@crowdsource.you/core 1.2.0

package/dist/esm/outbox/postgres/store/outbox.js

@@ -0,0 +1,207 @@
+import { and, asc, eq, gt, inArray, lte, or, sql } from 'drizzle-orm';
+import { PgTransaction } from 'drizzle-orm/pg-core';
+import { ModerationOutboxTransactionError } from '../../outbox/service.js';
+export function postgresOutboxStore(input) {
+    const { db } = input;
+    const outbox = input.tables.outbox;
+    /**
+     * Due work, as one predicate.
+     *
+     * Either `pending` and past its `available_at`, or `processing` with an EXPIRED
+     * lease — the second arm is what makes a dead worker's event reclaimable rather
+     * than stranded. The two arms have an index each
+     * (`moderation_outbox_due_idx`, `moderation_outbox_lease_idx`).
+     */
+    const dueOrExpired = (now) => or(and(eq(outbox.status, 'pending'), lte(outbox.availableAt, now)), and(eq(outbox.status, 'processing'), lte(outbox.leaseUntil, now)));
+    /** The lease this caller claims to hold, still live. Shared by all three transitions. */
+    const heldLease = (eventId, leaseOwner, now) => and(eq(outbox.id, eventId), eq(outbox.status, 'processing'), eq(outbox.leaseOwner, leaseOwner), gt(outbox.leaseUntil, now));
+    const toEvent = (row) => ({
+        id: row.id,
+        kind: row.kind,
+        payload: row.payload,
+        attempts: row.attempts,
+        availableAt: row.availableAt,
+        // `null` is how Postgres stores "no lease"; the event type says absent.
+        ...(row.leaseOwner === null ? {} : { leaseOwner: row.leaseOwner }),
+        ...(row.leaseUntil === null ? {} : { leaseUntil: row.leaseUntil }),
+        expiresAt: row.expiresAt,
+        createdAt: row.createdAt,
+    });
+    return {
+        async enqueue(event, tx) {
+            /**
+             * The guard, and it is not the same mistake Mongo's guards against.
+             *
+             * Both `db` and `tx` are a `ModerationPgHandle`, so handing this the POOL
+             * handle type-checks perfectly — and then the row commits on its own
+             * connection, independently of the domain write it was supposed to be
+             * atomic with. That is "the report was answered 201 and never delivered",
+             * reached by a different route than a session nobody opened a transaction
+             * on, with the same silence.
+             *
+             * `PgTransaction` is a real runtime class in `drizzle-orm/pg-core`, so this
+             * is a genuine check rather than a duck-typed guess.
+             */
+            if (!(tx instanceof PgTransaction)) {
+                throw new ModerationOutboxTransactionError(event.eventId);
+            }
+            /**
+             * `ON CONFLICT DO NOTHING`, never `DO UPDATE`.
+             *
+             * A repeated enqueue is ORDINARY — a transaction retry, two concurrent
+             * duplicate submissions, a reconciliation sweep re-deriving an event — and
+             * the dispatcher is concurrently taking, renewing and completing leases on
+             * these same rows. `DO UPDATE` would make each repeat a real write, which
+             * conflicts with a live lease update and aborts the enclosing transaction:
+             * the exact defect the Mongo store's `timestamps: false` exists to prevent,
+             * reintroduced in a dialect where nothing forces it on you.
+             *
+             * One behavioural difference from Mongo, and Postgres has the better end of
+             * it: if a CONCURRENT UNCOMMITTED transaction holds this same key, Postgres
+             * WAITS for it and then proceeds (finding the row committed, and doing
+             * nothing), where Mongo raises `WriteConflict` (code 112) and aborts the
+             * enclosing transaction. Waiting is the outcome a caller wants.
+             *
+             * `created_at` and `updated_at` are written explicitly from the caller's
+             * clock rather than left to their defaults, so both backends stamp a row
+             * from one instant — and so a test can assert that a repeat changed
+             * NOTHING, which is a stronger claim than "no duplicate row".
+             */
+            await tx
+                .insert(outbox)
+                .values({
+                id: event.eventId,
+                kind: event.kind,
+                payload: event.payload,
+                status: 'pending',
+                attempts: 0,
+                availableAt: event.availableAt,
+                expiresAt: event.expiresAt,
+                createdAt: event.now,
+                updatedAt: event.now,
+            })
+                .onConflictDoNothing({ target: outbox.id });
+        },
+        async claim({ leaseOwner, leaseUntil, now, eventId }) {
+            /**
+             * `SKIP LOCKED` is load-bearing, not tuning.
+             *
+             * Without it, under READ COMMITTED the sub-select is evaluated once: the
+             * loser blocks on the head row and then returns ZERO rows. `claim` answers
+             * `null`, `dispatch` breaks out of its batch, and a deployment running N
+             * tasks silently drains at 1/N the rate with nothing failing anywhere.
+             *
+             * The `FOR UPDATE` lives in the SUB-SELECT because that is what locks the
+             * one row this claim intends to take, before the UPDATE touches it — the
+             * documented Postgres idiom for a work queue.
+             */
+            const due = db
+                .select({ id: outbox.id })
+                .from(outbox)
+                .where(eventId === undefined
+                ? dueOrExpired(now)
+                : and(eq(outbox.id, eventId), dueOrExpired(now)))
+                // Oldest first, so a backlog drains in the order it was filed rather than
+                // in whatever order the storage engine finds convenient.
+                .orderBy(asc(outbox.createdAt))
+                .limit(1)
+                .for('update', { skipLocked: true });
+            const rows = await db
+                .update(outbox)
+                .set({
+                status: 'processing',
+                leaseOwner,
+                leaseUntil,
+                // The COLUMN is interpolated, not a value: `attempts` is incremented by
+                // the database so two claimers cannot both read 3 and both write 4.
+                attempts: sql `${outbox.attempts} + 1`,
+                // The previous attempt's error, cleared with the claim so a stale
+                // message can never be read as this attempt's. `null` CLEARS in
+                // drizzle; `undefined` would leave it alone.
+                lastError: null,
+                updatedAt: now,
+            })
+                .where(inArray(outbox.id, due))
+                .returning({
+                id: outbox.id,
+                kind: outbox.kind,
+                payload: outbox.payload,
+                attempts: outbox.attempts,
+                availableAt: outbox.availableAt,
+                leaseOwner: outbox.leaseOwner,
+                leaseUntil: outbox.leaseUntil,
+                expiresAt: outbox.expiresAt,
+                createdAt: outbox.createdAt,
+            });
+            const [row] = rows;
+            return row === undefined ? null : toEvent(row);
+        },
+        /**
+         * ## Why all three transitions read `RETURNING`, and what that collapses
+         *
+         * Mongo's `complete` and `fail` answer `modifiedCount === 1` while its
+         * `renew` answers `matchedCount === 1`. `RETURNING` counts MATCHED rows, so
+         * this store answers the `matchedCount` question in all three places.
+         *
+         * That is equivalent HERE, and the argument is worth writing down because it
+         * is an argument rather than a test: the WHERE clause requires
+         * `status = 'processing'`, and `complete` and `fail` both write a different
+         * status, so a matched row is always a modified row. `renew` writes only
+         * `lease_until`/`updated_at` and Mongo already used `matchedCount` for it —
+         * a renewal that lands on the values already stored is still a lease this
+         * caller holds, and reporting it as lost would make a dispatcher abandon an
+         * event it still owns.
+         *
+         * If a later transition ever stops changing `status`, this equivalence stops
+         * holding and the difference becomes silent.
+         */
+        async complete({ eventId, leaseOwner, now }) {
+            const rows = await db
+                .update(outbox)
+                .set({
+                status: 'processed',
+                processedAt: now,
+                updatedAt: now,
+                leaseOwner: null,
+                leaseUntil: null,
+                lastError: null,
+            })
+                .where(heldLease(eventId, leaseOwner, now))
+                .returning({ id: outbox.id });
+            return rows.length === 1;
+        },
+        async renew({ eventId, leaseOwner, leaseUntil, now }) {
+            const rows = await db
+                .update(outbox)
+                .set({ leaseUntil, updatedAt: now })
+                .where(heldLease(eventId, leaseOwner, now))
+                .returning({ id: outbox.id });
+            return rows.length === 1;
+        },
+        async fail({ eventId, leaseOwner, status, availableAt, lastError, now }) {
+            const rows = await db
+                .update(outbox)
+                .set({
+                status,
+                availableAt,
+                lastError,
+                updatedAt: now,
+                leaseOwner: null,
+                leaseUntil: null,
+            })
+                .where(heldLease(eventId, leaseOwner, now))
+                .returning({ id: outbox.id });
+            return rows.length === 1;
+        },
+        async statusOf(eventId) {
+            const rows = await db
+                .select({ status: outbox.status })
+                .from(outbox)
+                .where(eq(outbox.id, eventId))
+                .limit(1);
+            const [row] = rows;
+            return row === undefined ? null : row.status;
+        },
+    };
+}
+//# sourceMappingURL=outbox.js.map

package/dist/esm/outbox/postgres/store/outbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.js","sourceRoot":"","sources":["../../../../../src/outbox/postgres/store/outbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAyC3E,MAAM,UAAU,mBAAmB,CAAC,KAGnC;IACC,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAEnC;;;;;;;OAOG;IACH,MAAM,YAAY,GAAG,CAAC,GAAS,EAAE,EAAE,CACjC,EAAE,CACA,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,EAC/D,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAClE,CAAC;IAEJ,yFAAyF;IACzF,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,UAAkB,EAAE,GAAS,EAAE,EAAE,CACnE,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EACtB,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EAC/B,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,EACjC,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAC3B,CAAC;IAEJ,MAAM,OAAO,GAAG,CAAC,GAAe,EAAyB,EAAE,CAAC,CAAC;QAC3D,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,wEAAwE;QACxE,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;QAClE,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;YACrB;;;;;;;;;;;;eAYG;YACH,IAAI,CAAC,CAAC,EAAE,YAAY,aAAa,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5D,CAAC;YAED;;;;;;;;;;;;;;;;;;;;;eAqBG;YACH,MAAM,EAAE;iBACL,MAAM,CAAC,MAAM,CAAC;iBACd,MAAM,CAAC;gBACN,EAAE,EAAE,KAAK,CAAC,OAAO;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,CAAC;gBACX,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,GAAG;gBACpB,SAAS,EAAE,KAAK,CAAC,GAAG;aACrB,CAAC;iBACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE;YAClD;;;;;;;;;;;eAWG;YACH,MAAM,GAAG,GAAG,EAAE;iBACX,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;iBACzB,IAAI,CAAC,MAAM,CAAC;iBACZ,KAAK,CACJ,OAAO,KAAK,SAAS;gBACnB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC;gBACnB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CACnD;gBACD,0EAA0E;gBAC1E,yDAAyD;iBACxD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC;iBACR,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAEvC,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,MAAM,CAAC;iBACd,GAAG,CAAC;gBACH,MAAM,EAAE,YAAY;gBACpB,UAAU;gBACV,UAAU;gBACV,wEAAwE;gBACxE,oEAAoE;gBACpE,QAAQ,EAAE,GAAG,CAAA,GAAG,MAAM,CAAC,QAAQ,MAAM;gBACrC,kEAAkE;gBAClE,gEAAgE;gBAChE,6CAA6C;gBAC7C,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;iBAC9B,SAAS,CAAC;gBACT,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;YAEL,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;QAED;;;;;;;;;;;;;;;;;;WAkBG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE;YACzC,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,MAAM,CAAC;iBACd,GAAG,CAAC;gBACH,MAAM,EAAE,WAAW;gBACnB,WAAW,EAAE,GAAG;gBAChB,SAAS,EAAE,GAAG;gBACd,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;aAChB,CAAC;iBACD,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;iBAC1C,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE;YAClD,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,MAAM,CAAC;iBACd,GAAG,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACnC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;iBAC1C,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE;YACrE,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,MAAM,CAAC;iBACd,GAAG,CAAC;gBACH,MAAM;gBACN,WAAW;gBACX,SAAS;gBACT,SAAS,EAAE,GAAG;gBACd,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC;iBACD,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;iBAC1C,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;iBACjC,IAAI,CAAC,MAAM,CAAC;iBACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;iBAC7B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/outbox/postgres/store/reports.js

@@ -0,0 +1,231 @@
+import { and, asc, eq, inArray, isNull, lt, lte, or, sql } from 'drizzle-orm';
+const OPTIONAL_REPORT_FIELDS = [
+    'details',
+    'localStatusReason',
+    'crowdSourceReportId',
+    'crowdSourceCaseId',
+    'crowdSourceMerged',
+    'contentSnapshotHash',
+    'submittedAt',
+    'lastDeliveryError',
+    'decisionId',
+    'decisionRevision',
+    'decisionOutcome',
+    'decisionStatus',
+    'decidedAt',
+    'enforcedAction',
+    'enforcedAt',
+];
+/** Drop the package's own optional fields when the column is NULL. */
+function absentWhereNull(row) {
+    const normalised = { ...row };
+    for (const field of OPTIONAL_REPORT_FIELDS) {
+        if (normalised[field] === null)
+            delete normalised[field];
+    }
+    return normalised;
+}
+/**
+ * The row, as the port declares it.
+ *
+ * An unchecked declaration, not a conversion — the same escape the Mongoose store
+ * takes with `.lean<TReport>()`, and for the same reason: a driver cannot know an
+ * adopter's row type, and `ModerationReportTable` deliberately erases column types
+ * so that any adopter's table is accepted.
+ *
+ * What bounds it is that both halves are checked elsewhere. Column PRESENCE is a
+ * compile error, gated by `scripts/test-report-table-type.mjs`. Column VALUES are
+ * asserted by round-trips against a real database in
+ * `postgresReportStore.test.ts`. What remains unchecked is a column declared with
+ * the wrong TYPE, which the migration and the schema test cover instead.
+ */
+function asReport(row) {
+    return absentWhereNull(row);
+}
+export function postgresReportStore(input) {
+    const { db } = input;
+    const reports = input.reportTable;
+    /**
+     * `count(*)::int`, and the cast is load-bearing.
+     *
+     * `count(*)` is `bigint`, which postgres.js hands back as a STRING to avoid
+     * losing precision — so `sql<number>` without the cast is an assertion that
+     * quietly lies, and the caller's `number` is `'3'`. The `::int` makes the
+     * database do the conversion.
+     */
+    const total = sql `count(*)::int`;
+    return {
+        async findDuplicate({ reporter, reportedId, reportedType }, tx) {
+            const rows = await tx
+                .select()
+                .from(reports)
+                .where(and(eq(reports.reporter, reporter), eq(reports.reportedId, reportedId), eq(reports.reportedType, reportedType)))
+                .limit(1);
+            const [row] = rows;
+            return row === undefined ? null : asReport(row);
+        },
+        async insert(report, tx) {
+            const rows = await tx
+                .insert(reports)
+                .values({
+                /**
+                 * The application's own columns FIRST, so a field this package owns can
+                 * never be overwritten by one it knows nothing about. A report whose
+                 * `localStatus` came from `extra` would be queued with nothing to
+                 * deliver it, or received with a delivery event that tries anyway.
+                 *
+                 * A key that is not a column raises here — Postgres has no silent
+                 * discard. Mongoose strict mode drops an undeclared path with no throw
+                 * and no warning, which is why the Mongo half needs a standing test
+                 * that every DTO field resolves to a schema path.
+                 */
+                ...report.extra,
+                reportedType: report.reportedType,
+                reportedId: report.reportedId,
+                reporter: report.reporter,
+                categories: [...report.categories],
+                ...(report.details === undefined ? {} : { details: report.details }),
+                localStatus: report.localStatus,
+                ...(report.localStatusReason === undefined
+                    ? {}
+                    : { localStatusReason: report.localStatusReason }),
+            })
+                .returning();
+            const [row] = rows;
+            if (row === undefined) {
+                throw new Error('The moderation report insert returned no row.');
+            }
+            return asReport(row);
+        },
+        async findById(reportId) {
+            const rows = await db.select().from(reports).where(eq(reports.id, reportId)).limit(1);
+            const [row] = rows;
+            return row === undefined ? null : asReport(row);
+        },
+        async findByCaseId(caseId) {
+            const rows = await db
+                .select({
+                id: reports.id,
+                reportedType: reports.reportedType,
+                reportedId: reports.reportedId,
+            })
+                .from(reports)
+                .where(eq(reports.crowdSourceCaseId, caseId));
+            return rows.map((row) => ({
+                id: String(row.id),
+                reportedType: String(row.reportedType),
+                reportedId: String(row.reportedId),
+            }));
+        },
+        async applyDecision(reportId, update, maxRevision) {
+            const rows = await db
+                .update(reports)
+                .set(decisionSet(update))
+                .where(and(eq(reports.id, reportId), 
+            /**
+             * The revision guard, in the WHERE clause. It is the DATABASE that
+             * refuses a stale write rather than a read-then-write in this
+             * process: deliveries overlap — CrowdSource retries for 24 hours, and
+             * a correction can arrive while the decision it supersedes is still
+             * being applied — and an older revision landing last would otherwise
+             * overwrite the current answer.
+             *
+             * `IS NULL` is the port of Mongo's `$exists: false`, because a report
+             * with no decision yet stores NULL rather than omitting the column.
+             * `<=` rather than `<` is deliberate: a redelivery of the SAME
+             * revision rewrites, which is harmless and keeps a partially-applied
+             * decision converging.
+             */
+            or(isNull(reports.decisionRevision), lte(reports.decisionRevision, maxRevision))))
+                .returning({ id: reports.id });
+            return rows.length === 1;
+        },
+        async markSubmitted(reportId, submission) {
+            await db
+                .update(reports)
+                .set({
+                localStatus: 'submitted',
+                crowdSourceReportId: submission.crowdSourceReportId,
+                crowdSourceCaseId: submission.crowdSourceCaseId,
+                crowdSourceMerged: submission.crowdSourceMerged,
+                contentSnapshotHash: submission.contentSnapshotHash,
+                submittedAt: submission.submittedAt,
+                // A report that has landed carries no failure and no reason it was
+                // going nowhere. `null` CLEARS in drizzle; `undefined` would leave the
+                // stale value in place, which is the port of Mongo's `$unset`.
+                lastDeliveryError: null,
+                localStatusReason: null,
+            })
+                .where(eq(reports.id, reportId));
+        },
+        async markDeliveryFailed(reportId, lastDeliveryError) {
+            await db
+                .update(reports)
+                .set({ localStatus: 'delivery_failed', lastDeliveryError })
+                .where(eq(reports.id, reportId));
+        },
+        async close(reportId, localStatusReason) {
+            await db
+                .update(reports)
+                .set({ localStatus: 'closed', localStatusReason })
+                .where(eq(reports.id, reportId));
+        },
+        async findPendingOldestFirst(limit) {
+            /**
+             * `queued` and `delivery_failed` only. `received` is excluded deliberately
+             * and the omission is the safety property, not an oversight: those reports
+             * have no subject provider, so an event re-derived for one would fail on
+             * its first attempt and dead-letter.
+             *
+             * Oldest first, and ASC needs no explicit NULLS placement: both drizzle and
+             * Postgres default ascending to NULLS LAST, so this matches the
+             * `(local_status, created_at)` index. A DESCENDING order would need the
+             * placement spelled out — see the enforcement store's reversal lookup for
+             * what that costs when it is not.
+             */
+            const rows = await db
+                .select({ id: reports.id })
+                .from(reports)
+                .where(inArray(reports.localStatus, ['queued', 'delivery_failed']))
+                .orderBy(asc(reports.createdAt))
+                .limit(limit);
+            return rows.map((row) => String(row.id));
+        },
+        async countAwaitingDecision(submittedBefore) {
+            const rows = await db
+                .select({ total })
+                .from(reports)
+                .where(and(eq(reports.localStatus, 'submitted'), lt(reports.submittedAt, submittedBefore)));
+            return rows[0]?.total ?? 0;
+        },
+        async countLocalOnly() {
+            const rows = await db
+                .select({ total })
+                .from(reports)
+                .where(eq(reports.localStatus, 'received'));
+            return rows[0]?.total ?? 0;
+        },
+    };
+}
+/**
+ * The `$set` a decision writes, as one object.
+ *
+ * `extra` FIRST, for the same reason it is first on insert: it is the adopter's
+ * legacy verdict field, and this package's own fields must win.
+ */
+function decisionSet(update) {
+    return {
+        ...update.extra,
+        localStatus: update.localStatus,
+        decisionId: update.decisionId,
+        decisionRevision: update.decisionRevision,
+        decisionOutcome: update.decisionOutcome,
+        decisionStatus: update.decisionStatus,
+        decidedAt: update.decidedAt,
+        ...(update.enforcedAction === undefined
+            ? {}
+            : { enforcedAction: update.enforcedAction }),
+        ...(update.enforcedAt === undefined ? {} : { enforcedAt: update.enforcedAt }),
+    };
+}
+//# sourceMappingURL=reports.js.map

package/dist/esm/outbox/postgres/store/reports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reports.js","sourceRoot":"","sources":["../../../../../src/outbox/postgres/store/reports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAgE9E,MAAM,sBAAsB,GAAG;IAC7B,SAAS;IACT,mBAAmB;IACnB,qBAAqB;IACrB,mBAAmB;IACnB,mBAAmB;IACnB,qBAAqB;IACrB,aAAa;IACb,mBAAmB;IACnB,YAAY;IACZ,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,YAAY;CACqC,CAAC;AAcpD,sEAAsE;AACtE,SAAS,eAAe,CAAC,GAA4B;IACnD,MAAM,UAAU,GAA4B,EAAE,GAAG,GAAG,EAAE,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;QAC3C,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,QAAQ,CACf,GAA4B;IAE5B,OAAO,eAAe,CAAC,GAAG,CAAY,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAyC,KAG3E;IACC,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrB,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC;IAElC;;;;;;;OAOG;IACH,MAAM,KAAK,GAAG,GAAG,CAAQ,eAAe,CAAC;IAEzC,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,EAAE;YAC5D,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,EAAE;iBACR,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC9B,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,EAClC,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CACvC,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAU,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE;YACrB,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,CAAC;gBACN;;;;;;;;;;mBAUG;gBACH,GAAG,MAAM,CAAC,KAAK;gBACf,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpE,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;aACrD,CAAC;iBACD,SAAS,EAAE,CAAC;YAEf,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,QAAQ,CAAU,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACrB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtF,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAU,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC;gBACN,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC;iBACD,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;YAEhD,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,GAAG,EAAuB,EAAE,CAAC,CAAC;gBAC7B,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;gBACtC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;aACnC,CAAC,CACH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW;YAC/C,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;iBACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC;YACxB;;;;;;;;;;;;;eAaG;YACH,EAAE,CACA,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAChC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAC3C,CACF,CACF;iBACA,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAEjC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU;YACtC,MAAM,EAAE;iBACL,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC;gBACH,WAAW,EAAE,WAAW;gBACxB,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;gBAC/C,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;gBAC/C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,mEAAmE;gBACnE,uEAAuE;gBACvE,+DAA+D;gBAC/D,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB,EAAE,IAAI;aACxB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB;YAClD,MAAM,EAAE;iBACL,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;iBAC1D,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,iBAAiB;YACrC,MAAM,EAAE;iBACL,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;iBACjD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,KAAK;YAChC;;;;;;;;;;;eAWG;YACH,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;iBAC1B,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;iBAClE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;iBAC/B,KAAK,CAAC,KAAK,CAAC,CAAC;YAEhB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,eAAe;YACzC,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;iBACjB,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EACpC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,CACzC,CACF,CAAC;YACJ,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,cAAc;YAClB,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;iBACjB,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAsC;IACzD,OAAO;QACL,GAAG,MAAM,CAAC,KAAK;QACf,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/dist/esm/outbox/postgres/store/transaction.js

@@ -0,0 +1,29 @@
+/**
+ * The transaction runner, in Postgres.
+ *
+ * READ COMMITTED, explicitly, and not `repeatable read`. Neither multi-statement
+ * transaction this package runs — a report insert plus an outbox upsert, an event
+ * update plus an outbox upsert — reads-then-decides in a way snapshot isolation
+ * protects, so `repeatable read` would import `40001` serialization failures and
+ * a retry loop for no benefit.
+ *
+ * What it deliberately does NOT promise: intake's duplicate-check-then-insert is
+ * not serialized at READ COMMITTED, and the "one report per reporter per object"
+ * unique index is explicitly the application's responsibility.
+ *
+ * The failure this runner exists to make impossible is subtler than Mongo's. A
+ * store call given `db` instead of `tx` inside the callback runs on a DIFFERENT
+ * pooled connection and commits on its own — no error, no warning, and the
+ * atomicity the outbox exists for is simply gone. `postgresOutboxStore.enqueue`
+ * refuses a handle that is not a transaction for exactly that reason.
+ */
+export function postgresTransactionRunner(db) {
+    return {
+        async run(operation) {
+            return await db.transaction(async (tx) => await operation(tx), {
+                isolationLevel: 'read committed',
+            });
+        },
+    };
+}
+//# sourceMappingURL=transaction.js.map

package/dist/esm/outbox/postgres/store/transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction.js","sourceRoot":"","sources":["../../../../../src/outbox/postgres/store/transaction.ts"],"names":[],"mappings":"AAkCA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACvC,EAAsB;IAEtB,OAAO;QACL,KAAK,CAAC,GAAG,CAAI,SAAiD;YAC5D,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,EAAE,CAAC,EAAE;gBAC7D,cAAc,EAAE,gBAAgB;aACjC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}