@elench/testkit 0.1.145 → 0.1.147

package/lib/database/index.mjs

@@ -1,47 +1,27 @@
 import fs from "fs";
 import path from "path";
-import { execa } from "execa";
 import {
   computeTemplateFingerprint as computeTemplateFingerprintModel,
 } from "./fingerprint.mjs";
 import {
-  buildContainerName as buildContainerNameModel,
-  buildDatabaseUrl as buildDatabaseUrlModel,
-  buildRuntimeDatabaseName as buildRuntimeDatabaseNameModel,
-  buildTemplateDatabaseName as buildTemplateDatabaseNameModel,
-  escapeIdentifier as escapeIdentifierModel,
-  escapeSqlLiteral as escapeSqlLiteralModel,
-  hashString as hashStringModel,
-  limitIdentifier as limitIdentifierModel,
-  slugSegment as slugSegmentModel,
+  buildDatabaseUrl,
+  buildRuntimeDatabaseName,
+  buildTemplateDatabaseName,
+  hashString,
 } from "./naming.mjs";
 import {
-  getLocalInfraDir as getLocalInfraDirModel,
-  getLocalLocksDir as getLocalLocksDirModel,
-  getLocalServiceCacheDir as getLocalServiceCacheDirModel,
-  getResourceLocksDir as getResourceLocksDirModel,
-  hasRemainingLocalArtifacts as hasRemainingLocalArtifactsModel,
-  readStateValue as readStateValueModel,
-  visitDirs as visitDirsModel,
+  getLocalInfraDir,
+  getLocalLocksDir,
+  getLocalServiceCacheDir,
+  getResourceLocksDir,
+  hasRemainingLocalArtifacts,
+  readStateValue,
 } from "./state.mjs";
 import {
   runTemplateStage,
   runTemplateStep,
 } from "./template-steps.mjs";
 import { materializeDatabaseConfig } from "../config/database-materialization.mjs";
-import {
-  TESTKIT_PRODUCT_DIR_LABEL,
-  TESTKIT_PRODUCT_ID_LABEL,
-  TESTKIT_RESOURCE_KIND_LABEL,
-  TESTKIT_SCOPE_LABEL,
-  buildDockerResourceLabels,
-  buildProductIdentity,
-  dockerContainerSummary,
-  dockerLabelArgs,
-  listLegacyTestkitPostgresContainers,
-  listManagedDockerContainers,
-  removeDockerContainer,
-} from "../ownership/docker.mjs";
 import {
   applySourceSchemaCache,
   createSourceSchemaMismatchError,
@@ -50,17 +30,36 @@ import {
   verifyLocalSchemaMatchesSource,
 } from "./schema-source.mjs";
 import { collectStateDirLines } from "../runner/state-io.mjs";
+import {
+  cloneDatabaseFromTemplate,
+  createEmptyDatabase,
+  databaseExists,
+  dropDatabaseIfExists,
+  waitForResourcePostgresReady,
+} from "./admin.mjs";
+import {
+  ensureLocalContainer,
+  loadExistingLocalContainer,
+} from "./local-postgres.mjs";
+import {
+  resolveResourcePostgresInfra,
+  resolveResourcePostgresInfraFromState,
+} from "./resource-postgres.mjs";
+import {
+  writeCacheState,
+  writeResourceConnectionState,
+} from "./state-files.mjs";
+import { withLock } from "./locks.mjs";
+import {
+  cleanupLocalPostgresDockerResources,
+} from "./cleanup.mjs";
 
-const LOCAL_IMAGE = "pgvector/pgvector:pg16";
-const LOCAL_USER = "testkit";
-const LOCAL_PASSWORD = "testkit";
-const LOCAL_ADMIN_DB = "postgres";
-const LOCAL_READY_TIMEOUT_MS = 60_000;
-const LOCAL_POLL_INTERVAL_MS = 1_000;
-const LOCAL_ADMIN_QUERY_RETRY_MS = 15_000;
-const LOCAL_ADMIN_QUERY_RETRY_INTERVAL_MS = 250;
-const LOCAL_DROP_DATABASE_TIMEOUT_MS = 15_000;
-const LOCAL_DROP_DATABASE_POLL_INTERVAL_MS = 250;
+export {
+  dropDatabaseWithForceOrDrain,
+  isTransientAdminQueryConnectionError,
+  waitForDatabaseConnectionsToDrain,
+} from "./admin.mjs";
+export { formatDatabaseResourceCleanupLine } from "./cleanup.mjs";
 
 export async function prepareDatabaseRuntime(config, options = {}) {
   const db = materializeDatabaseConfig(
@@ -112,7 +111,7 @@ export async function destroyServiceDatabaseCache(productDir, serviceName) {
     const resourceLockDir = getResourceLocksDir(productDir, resourceName || "unknown");
     fs.mkdirSync(resourceLockDir, { recursive: true });
     await withLock(path.join(resourceLockDir, `template-${serviceName}.lock`), async () => {
-      const infra = resolveResourcePostgresInfraFromState(cacheDir);
+      const infra = resolveResourcePostgresInfraFromState(cacheDir, readStateValue);
       const templateDbName = readStateValue(path.join(cacheDir, "template_database_name"));
       if (infra && templateDbName) {
         await dropDatabaseIfExists(infra, templateDbName);
@@ -144,17 +143,11 @@ export async function destroyServiceDatabaseCache(productDir, serviceName) {
 export async function cleanupOrphanedLocalInfrastructure(productDir) {
   const infraDir = getLocalInfraDir(productDir);
 
-  if (hasRemainingLocalArtifacts(productDir)) return;
-
-  if (fs.existsSync(infraDir)) {
-    const containerName = readStateValue(path.join(infraDir, "container_name"));
-    if (containerName) {
-      await stopAndRemoveContainer(containerName);
-    }
+  const resourceCleanup = await cleanupOwnedLocalDatabaseResources(productDir, { stopIdle: true });
+  if (!hasRemainingLocalArtifacts(productDir, readStateValue)) {
     fs.rmSync(infraDir, { recursive: true, force: true });
   }
-
-  await cleanupOwnedLocalDatabaseResources(productDir);
+  return resourceCleanup;
 }
 
 export async function destroyOwnedLocalDatabaseResources(productDir, options = {}) {
@@ -171,6 +164,7 @@ export async function cleanupOwnedLocalDatabaseResources(productDir, options = {
     force: Boolean(options.force),
     global: false,
     includeLegacy: Boolean(options.includeLegacy),
+    stopIdle: options.stopIdle !== false,
   });
 }
 
@@ -181,6 +175,7 @@ export async function cleanupGlobalLocalDatabaseResources(options = {}) {
     force: false,
     global: true,
     includeLegacy: Boolean(options.includeLegacy),
+    stopIdle: options.stopIdle !== false,
   });
 }
 
@@ -492,680 +487,11 @@ async function destroyResourceRuntimeDatabase(stateDir) {
   const dbName = readStateValue(path.join(stateDir, "resource_database_name"));
   if (!dbName) return;
 
-  const infra = resolveResourcePostgresInfraFromState(stateDir);
+  const infra = resolveResourcePostgresInfraFromState(stateDir, readStateValue);
   if (!infra) return;
   await dropDatabaseIfExists(infra, dbName);
 }
 
-async function ensureLocalContainer(productDir, database = {}) {
-  const infraDir = getLocalInfraDir(productDir);
-  fs.mkdirSync(infraDir, { recursive: true });
-
-  const containerName =
-    readStateValue(path.join(infraDir, "container_name")) || buildContainerName(productDir);
-  const image = database.image || readStateValue(path.join(infraDir, "image")) || LOCAL_IMAGE;
-  const user = database.user || readStateValue(path.join(infraDir, "user")) || LOCAL_USER;
-  const password =
-    database.password || readStateValue(path.join(infraDir, "password")) || LOCAL_PASSWORD;
-
-  let inspect = await inspectContainer(containerName);
-  if (inspect && inspect.Config?.Image !== image) {
-    await stopAndRemoveContainer(containerName);
-    inspect = null;
-  }
-
-  if (!inspect) {
-    const labels = buildLocalPostgresContainerLabels(productDir, containerName);
-    await execa("docker", [
-      "run",
-      "-d",
-      "--name",
-      containerName,
-      ...dockerLabelArgs(labels),
-      "-e",
-      `POSTGRES_USER=${user}`,
-      "-e",
-      `POSTGRES_PASSWORD=${password}`,
-      "-e",
-      `POSTGRES_DB=${LOCAL_ADMIN_DB}`,
-      "-p",
-      "127.0.0.1::5432",
-      image,
-    ]);
-    inspect = await inspectContainer(containerName);
-  } else if (!inspect.State?.Running) {
-    await execa("docker", ["start", containerName]);
-    inspect = await inspectContainer(containerName);
-  }
-
-  const hostPort = inspect?.NetworkSettings?.Ports?.["5432/tcp"]?.[0]?.HostPort;
-  if (!hostPort) {
-    throw new Error(`Could not determine published port for local database container ${containerName}`);
-  }
-
-  const infra = {
-    containerName,
-    containerId: inspect.Id,
-    image,
-    user,
-    password,
-    host: "127.0.0.1",
-    port: Number(hostPort),
-  };
-
-  await waitForLocalContainerReady(infra);
-  writeLocalInfraState(infraDir, infra);
-  return infra;
-}
-
-async function loadExistingLocalContainer(productDir) {
-  const infraDir = getLocalInfraDir(productDir);
-  const containerName = readStateValue(path.join(infraDir, "container_name"));
-  if (!containerName) return null;
-
-  const inspect = await inspectContainer(containerName);
-  if (!inspect) return null;
-
-  if (!inspect.State?.Running) {
-    await execa("docker", ["start", containerName]);
-  }
-
-  const nextInspect = await inspectContainer(containerName);
-  const hostPort = nextInspect?.NetworkSettings?.Ports?.["5432/tcp"]?.[0]?.HostPort;
-  if (!hostPort) return null;
-
-  const infra = {
-    containerName,
-    containerId: nextInspect.Id,
-    image: nextInspect.Config?.Image || readStateValue(path.join(infraDir, "image")) || LOCAL_IMAGE,
-    user: readStateValue(path.join(infraDir, "user")) || LOCAL_USER,
-    password: readStateValue(path.join(infraDir, "password")) || LOCAL_PASSWORD,
-    host: "127.0.0.1",
-    port: Number(hostPort),
-  };
-  await waitForLocalContainerReady(infra);
-  return infra;
-}
-
-async function waitForLocalContainerReady(infra) {
-  const startedAt = Date.now();
-  while (Date.now() - startedAt < LOCAL_READY_TIMEOUT_MS) {
-    try {
-      await execa("docker", [
-        "exec",
-        infra.containerName,
-        "pg_isready",
-        "-U",
-        infra.user,
-        "-d",
-        LOCAL_ADMIN_DB,
-      ]);
-      return;
-    } catch {
-      await sleep(LOCAL_POLL_INTERVAL_MS);
-    }
-  }
-
-  throw new Error(`Timed out waiting for local database container ${infra.containerName}`);
-}
-
-async function waitForResourcePostgresReady(infra) {
-  const startedAt = Date.now();
-  while (Date.now() - startedAt < LOCAL_READY_TIMEOUT_MS) {
-    try {
-      await runAdminQuery(infra, ["-tAc", "SELECT 1"]);
-      return;
-    } catch (error) {
-      if (!isTransientAdminQueryConnectionError(error)) throw error;
-      await sleep(LOCAL_POLL_INTERVAL_MS);
-    }
-  }
-
-  throw new Error(`Timed out waiting for Postgres resource "${infra.resourceName}" at ${infra.host}:${infra.port}`);
-}
-
-async function inspectContainer(containerName) {
-  try {
-    const { stdout } = await execa("docker", ["inspect", containerName]);
-    const parsed = JSON.parse(stdout);
-    return parsed[0] || null;
-  } catch {
-    return null;
-  }
-}
-
-async function stopAndRemoveContainer(containerName) {
-  try {
-    await execa("docker", ["rm", "-f", containerName]);
-  } catch {
-    // Already gone.
-  }
-}
-
-async function databaseExists(infra, dbName) {
-  const result = await runAdminQuery(infra, [
-    "-tAc",
-    `SELECT 1 FROM pg_database WHERE datname = '${escapeSqlLiteral(dbName)}'`,
-  ]);
-  return result.trim() === "1";
-}
-
-async function createEmptyDatabase(infra, dbName) {
-  await runAdminQuery(infra, ["-c", `CREATE DATABASE "${escapeIdentifier(dbName)}"`]);
-}
-
-async function cloneDatabaseFromTemplate(infra, dbName, templateDbName) {
-  await runAdminQuery(infra, [
-    "-c",
-    `CREATE DATABASE "${escapeIdentifier(dbName)}" TEMPLATE "${escapeIdentifier(templateDbName)}"`,
-  ]);
-}
-
-async function dropDatabaseIfExists(infra, dbName) {
-  await dropDatabaseWithForceOrDrain(infra, dbName);
-}
-
-export async function dropDatabaseWithForceOrDrain(infra, dbName, hooks = {}) {
-  const runAdminQueryFn = hooks.runAdminQuery || runAdminQuery;
-  const databaseExistsFn = hooks.databaseExists || databaseExists;
-  const sleepFn = hooks.sleep || sleep;
-
-  try {
-    await runAdminQueryFn(infra, [
-      "-c",
-      `DROP DATABASE IF EXISTS "${escapeIdentifier(dbName)}" WITH (FORCE)`,
-    ]);
-    return;
-  } catch (error) {
-    if (!isUnsupportedForceDropError(error)) {
-      throw error;
-    }
-  }
-
-  if (!(await databaseExistsFn(infra, dbName))) {
-    return;
-  }
-
-  let restoreConnections = false;
-  try {
-    await runAdminQueryFn(infra, [
-      "-c",
-      `ALTER DATABASE "${escapeIdentifier(dbName)}" WITH ALLOW_CONNECTIONS false`,
-    ]);
-    restoreConnections = true;
-    await waitForDatabaseConnectionsToDrain(infra, dbName, {
-      runAdminQuery: runAdminQueryFn,
-      sleep: sleepFn,
-    });
-    await runAdminQueryFn(infra, [
-      "-c",
-      `DROP DATABASE IF EXISTS "${escapeIdentifier(dbName)}"`,
-    ]);
-    restoreConnections = false;
-  } finally {
-    if (restoreConnections && (await databaseExistsFn(infra, dbName))) {
-      await runAdminQueryFn(infra, [
-        "-c",
-        `ALTER DATABASE "${escapeIdentifier(dbName)}" WITH ALLOW_CONNECTIONS true`,
-      ]).catch(() => {
-        // Best-effort restoration for failed fallback drops.
-      });
-    }
-  }
-}
-
-export async function waitForDatabaseConnectionsToDrain(infra, dbName, hooks = {}) {
-  const runAdminQueryFn = hooks.runAdminQuery || runAdminQuery;
-  const sleepFn = hooks.sleep || sleep;
-  const now = hooks.now || Date.now;
-  const timeoutMs = hooks.timeoutMs ?? LOCAL_DROP_DATABASE_TIMEOUT_MS;
-  const deadline = now() + timeoutMs;
-
-  while (true) {
-    await terminateDatabaseConnections(infra, dbName, runAdminQueryFn);
-    const remainingConnections = await countDatabaseConnections(infra, dbName, runAdminQueryFn);
-    if (remainingConnections === 0) {
-      return;
-    }
-    if (now() >= deadline) {
-      throw new Error(
-        `Timed out waiting for database "${dbName}" connections to close (${remainingConnections} remaining)`
-      );
-    }
-    await sleepFn(LOCAL_DROP_DATABASE_POLL_INTERVAL_MS);
-  }
-}
-
-async function runAdminQuery(infra, args) {
-  const command = infra.containerName ? "docker" : "psql";
-  const commandArgs = infra.containerName
-    ? [
-        "exec",
-        "-e",
-        `PGPASSWORD=${infra.password}`,
-        infra.containerName,
-        "psql",
-        "-v",
-        "ON_ERROR_STOP=1",
-        "-U",
-        infra.user,
-        "-d",
-        infra.adminDatabase || LOCAL_ADMIN_DB,
-        ...args,
-      ]
-    : [
-        "-v",
-        "ON_ERROR_STOP=1",
-        "-h",
-        infra.host,
-        "-p",
-        String(infra.port),
-        "-U",
-        infra.user,
-        "-d",
-        infra.adminDatabase || LOCAL_ADMIN_DB,
-        ...args,
-      ];
-  const commandOptions = infra.containerName
-    ? {}
-    : {
-        env: {
-          ...process.env,
-          PGPASSWORD: infra.password,
-          ...(infra.sslMode ? { PGSSLMODE: infra.sslMode } : {}),
-        },
-      };
-  const startedAt = Date.now();
-  while (true) {
-    try {
-      const { stdout } = await execa(command, commandArgs, commandOptions);
-      return stdout;
-    } catch (error) {
-      if (
-        Date.now() - startedAt >= LOCAL_ADMIN_QUERY_RETRY_MS ||
-        !isTransientAdminQueryConnectionError(error)
-      ) {
-        throw error;
-      }
-      await sleep(LOCAL_ADMIN_QUERY_RETRY_INTERVAL_MS);
-    }
-  }
-}
-
-export function isTransientAdminQueryConnectionError(error) {
-  const text = `${error?.shortMessage || ""}\n${error?.stderr || ""}\n${error?.stdout || ""}\n${error?.message || ""}`;
-  return (
-    text.includes('connection to server on socket "/var/run/postgresql/.s.PGSQL.5432" failed') ||
-    text.includes("No such file or directory") ||
-    text.includes("the database system is starting up") ||
-    text.includes("could not connect to server")
-  );
-}
-
-async function terminateDatabaseConnections(infra, dbName, runAdminQueryFn) {
-  await runAdminQueryFn(infra, [
-    "-c",
-    [
-      "SELECT pg_terminate_backend(pid)",
-      "FROM pg_stat_activity",
-      `WHERE datname = '${escapeSqlLiteral(dbName)}' AND pid <> pg_backend_pid();`,
-    ].join(" "),
-  ]);
-}
-
-async function countDatabaseConnections(infra, dbName, runAdminQueryFn) {
-  const result = await runAdminQueryFn(infra, [
-    "-tAc",
-    [
-      "SELECT COUNT(*)",
-      "FROM pg_stat_activity",
-      `WHERE datname = '${escapeSqlLiteral(dbName)}' AND pid <> pg_backend_pid();`,
-    ].join(" "),
-  ]);
-  return Number.parseInt(result.trim(), 10) || 0;
-}
-
-function isUnsupportedForceDropError(error) {
-  const text = `${error?.shortMessage || ""}\n${error?.stderr || ""}\n${error?.stdout || ""}\n${error?.message || ""}`;
-  return (
-    text.includes('syntax error at or near "WITH"') ||
-    text.includes('option "force"')
-  );
-}
-
 async function computeTemplateFingerprint(config, options = {}) {
   return computeTemplateFingerprintModel(config, options);
 }
-
-function buildDatabaseUrl(infra, dbName) {
-  return buildDatabaseUrlModel(infra, dbName);
-}
-
-function resolveResourcePostgresInfra(config, processEnv = process.env) {
-  const resourceName = String(config.testkit?.database?.resource || "").trim();
-  if (!resourceName) {
-    throw new Error("Resource-backed Postgres database requires database.resource");
-  }
-  const connections = parseResourceConnections(processEnv.TESTKIT_RESOURCE_CONNECTIONS_JSON);
-  const connection = connections[resourceName];
-  if (!connection) {
-    const available = Object.keys(connections).sort().join(", ") || "none";
-    throw new Error(`Postgres resource "${resourceName}" is not available. Available resources: ${available}`);
-  }
-  return normalizeResourcePostgresConnection(resourceName, connection);
-}
-
-function resolveResourcePostgresInfraFromState(stateDir, processEnv = process.env) {
-  const resourceName = readStateValue(path.join(stateDir, "resource_name"));
-  if (!resourceName) return null;
-  const connections = parseResourceConnections(processEnv.TESTKIT_RESOURCE_CONNECTIONS_JSON);
-  const connection = connections[resourceName] || readResourceConnectionState(stateDir);
-  return connection ? normalizeResourcePostgresConnection(resourceName, connection) : null;
-}
-
-function parseResourceConnections(raw) {
-  if (!raw) return {};
-  try {
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch (error) {
-    throw new Error(`Invalid TESTKIT_RESOURCE_CONNECTIONS_JSON: ${error.message}`);
-  }
-}
-
-function normalizeResourcePostgresConnection(resourceName, connection) {
-  const fromUrl = connection.url ? parsePostgresConnectionUrl(connection.url) : {};
-  const host = connection.host || fromUrl.host;
-  const port = Number(connection.port || fromUrl.port || 5432);
-  const user = connection.user || fromUrl.user;
-  const password = connection.password || fromUrl.password || "";
-  const adminDatabase = connection.adminDatabase || connection.admin_database || fromUrl.database || LOCAL_ADMIN_DB;
-  const sslMode = connection.sslMode || connection.sslmode || fromUrl.sslMode || "disable";
-  if (!host) throw new Error(`Postgres resource "${resourceName}" connection is missing host`);
-  if (!Number.isInteger(port) || port <= 0) {
-    throw new Error(`Postgres resource "${resourceName}" connection has invalid port`);
-  }
-  if (!user) throw new Error(`Postgres resource "${resourceName}" connection is missing user`);
-  return {
-    backend: "resource",
-    resourceName,
-    host,
-    port,
-    user,
-    password,
-    adminDatabase,
-    sslMode,
-  };
-}
-
-function parsePostgresConnectionUrl(rawUrl) {
-  const parsed = new URL(rawUrl);
-  return {
-    host: parsed.hostname,
-    port: parsed.port ? Number(parsed.port) : 5432,
-    database: decodeURIComponent(parsed.pathname.replace(/^\//, "")) || LOCAL_ADMIN_DB,
-    user: decodeURIComponent(parsed.username || ""),
-    password: decodeURIComponent(parsed.password || ""),
-    sslMode: parsed.searchParams.get("sslmode") || undefined,
-  };
-}
-
-async function cleanupLocalPostgresDockerResources(options = {}) {
-  const product = buildProductIdentity(options.productDir || process.cwd());
-  const managed = await listManagedDockerContainers();
-  const targets = [];
-  const kept = [];
-
-  for (const container of managed) {
-    if (!isManagedLocalPostgresContainer(container)) continue;
-    const classification = classifyManagedLocalPostgresContainer(container, product, options);
-    if (classification.remove) {
-      targets.push({ ...container, reason: classification.reason, legacy: false });
-    } else if (classification.reason) {
-      kept.push({ ...container, reason: classification.reason, legacy: false });
-    }
-  }
-
-  if (options.includeLegacy) {
-    const currentLegacyName = buildContainerName(product.dir);
-    for (const container of await listLegacyTestkitPostgresContainers()) {
-      if (!options.global && container.name !== currentLegacyName) continue;
-      targets.push({ ...container, reason: "legacy-unlabelled", legacy: true });
-    }
-  }
-
-  if (!options.dryRun) {
-    for (const container of targets) {
-      await removeDockerContainer(container.name || container.id);
-    }
-  }
-
-  return {
-    removed: options.dryRun ? [] : targets,
-    targets,
-    kept,
-  };
-}
-
-function classifyManagedLocalPostgresContainer(container, product, options) {
-  const labels = container.labels || {};
-  const containerProductId = labels[TESTKIT_PRODUCT_ID_LABEL] || "";
-  const containerProductDir = labels[TESTKIT_PRODUCT_DIR_LABEL] || "";
-  const currentProduct = containerProductId === product.id;
-
-  if (options.force && currentProduct) {
-    return { remove: true, reason: "destroy-current-product" };
-  }
-
-  if (!options.global && !currentProduct) {
-    return { remove: false, reason: "different-product" };
-  }
-
-  if (currentProduct) {
-    if (!hasRemainingLocalArtifacts(product.dir)) {
-      return { remove: true, reason: "current-product-no-local-artifacts" };
-    }
-    if (!localArtifactsReferenceContainer(product.dir, container.name)) {
-      return { remove: true, reason: "current-product-unreferenced" };
-    }
-    return { remove: false, reason: "current-product-referenced" };
-  }
-
-  if (options.global && containerProductDir && !fs.existsSync(containerProductDir)) {
-    return { remove: true, reason: "product-dir-missing" };
-  }
-
-  if (options.global && containerProductDir && !hasRemainingLocalArtifacts(containerProductDir)) {
-    return { remove: true, reason: "product-has-no-local-artifacts" };
-  }
-
-  return { remove: false, reason: options.global ? "other-product-retained" : "different-product" };
-}
-
-function isManagedLocalPostgresContainer(container) {
-  const labels = container.labels || {};
-  return (
-    labels[TESTKIT_RESOURCE_KIND_LABEL] === "postgres-container" &&
-    labels[TESTKIT_SCOPE_LABEL] === "local-postgres"
-  );
-}
-
-function buildLocalPostgresContainerLabels(productDir, containerName) {
-  return buildDockerResourceLabels(productDir, {
-    kind: "postgres-container",
-    name: containerName,
-    scope: "local-postgres",
-    cachePolicy: "product-cache",
-  });
-}
-
-function localArtifactsReferenceContainer(productDir, containerName) {
-  if (!containerName) return false;
-  const root = path.join(productDir, ".testkit");
-  let referenced = false;
-  visitDirs(root, (dir) => {
-    if (referenced) return;
-    for (const fileName of ["container_name", "local_container_name"]) {
-      if (readStateValue(path.join(dir, fileName)) === containerName) {
-        referenced = true;
-        return;
-      }
-    }
-  });
-  return referenced;
-}
-
-export function formatDatabaseResourceCleanupLine(entry, dryRun = false) {
-  const action = dryRun ? "Would remove" : "Removed";
-  const legacy = entry.legacy ? " legacy" : "";
-  return `${action}${legacy} database resource ${dockerContainerSummary(entry)} reason=${entry.reason}`;
-}
-
-function buildContainerName(productDir) {
-  return buildContainerNameModel(productDir);
-}
-
-function buildTemplateDatabaseName(serviceName, fingerprint) {
-  return buildTemplateDatabaseNameModel(serviceName, fingerprint);
-}
-
-function buildRuntimeDatabaseName(serviceName, bindingKey, fingerprint) {
-  return buildRuntimeDatabaseNameModel(serviceName, bindingKey, fingerprint);
-}
-
-function writeLocalInfraState(infraDir, infra) {
-  const product = buildProductIdentity(path.resolve(infraDir, "..", "..", ".."));
-  fs.writeFileSync(path.join(infraDir, "database_backend"), "local");
-  fs.writeFileSync(path.join(infraDir, "container_name"), infra.containerName);
-  fs.writeFileSync(path.join(infraDir, "container_id"), infra.containerId);
-  fs.writeFileSync(path.join(infraDir, "ownership_product_id"), product.id);
-  fs.writeFileSync(path.join(infraDir, "image"), infra.image);
-  fs.writeFileSync(path.join(infraDir, "user"), infra.user);
-  fs.writeFileSync(path.join(infraDir, "password"), infra.password);
-  fs.writeFileSync(path.join(infraDir, "host"), infra.host);
-  fs.writeFileSync(path.join(infraDir, "port"), String(infra.port));
-}
-
-function writeCacheState(cacheDir, config, infra, templateDbName, fingerprint) {
-  const backend = config.testkit.database.provider;
-  fs.writeFileSync(path.join(cacheDir, "database_backend"), backend);
-  fs.writeFileSync(path.join(cacheDir, "template_database_name"), templateDbName);
-  fs.writeFileSync(path.join(cacheDir, "template_fingerprint"), fingerprint);
-  if (backend === "local") {
-    fs.writeFileSync(path.join(cacheDir, "container_name"), infra.containerName);
-  } else {
-    fs.writeFileSync(path.join(cacheDir, "resource_name"), infra.resourceName);
-    writeResourceConnectionState(cacheDir, infra);
-  }
-}
-
-function writeResourceConnectionState(stateDir, infra) {
-  fs.writeFileSync(path.join(stateDir, "resource_host"), infra.host);
-  fs.writeFileSync(path.join(stateDir, "resource_port"), String(infra.port));
-  fs.writeFileSync(path.join(stateDir, "resource_user"), infra.user);
-  fs.writeFileSync(path.join(stateDir, "resource_password"), infra.password);
-  fs.writeFileSync(path.join(stateDir, "resource_admin_database"), infra.adminDatabase || LOCAL_ADMIN_DB);
-  fs.writeFileSync(path.join(stateDir, "resource_sslmode"), infra.sslMode || "disable");
-}
-
-function readResourceConnectionState(stateDir) {
-  const host = readStateValue(path.join(stateDir, "resource_host"));
-  const user = readStateValue(path.join(stateDir, "resource_user"));
-  if (!host || !user) return null;
-  return {
-    host,
-    port: Number(readStateValue(path.join(stateDir, "resource_port")) || 5432),
-    user,
-    password: readStateValue(path.join(stateDir, "resource_password")) || "",
-    adminDatabase: readStateValue(path.join(stateDir, "resource_admin_database")) || LOCAL_ADMIN_DB,
-    sslMode: readStateValue(path.join(stateDir, "resource_sslmode")) || "disable",
-  };
-}
-
-function getLocalInfraDir(productDir) {
-  return getLocalInfraDirModel(productDir);
-}
-
-function getLocalLocksDir(productDir) {
-  return getLocalLocksDirModel(productDir);
-}
-
-function getLocalServiceCacheDir(productDir, serviceName) {
-  return getLocalServiceCacheDirModel(productDir, serviceName);
-}
-
-function getResourceLocksDir(productDir, resourceName) {
-  return getResourceLocksDirModel(productDir, resourceName);
-}
-
-function hasRemainingLocalArtifacts(productDir) {
-  return hasRemainingLocalArtifactsModel(productDir, readStateValue);
-}
-
-function visitDirs(root, visitor) {
-  return visitDirsModel(root, visitor);
-}
-
-async function withLock(lockPath, fn) {
-  const lockDir = `${lockPath}.dir`;
-  const timeoutMs = 60_000;
-  const startedAt = Date.now();
-
-  while (true) {
-    try {
-      fs.mkdirSync(lockDir, { recursive: false });
-      break;
-    } catch (error) {
-      if (error.code !== "EEXIST") throw error;
-      if (Date.now() - startedAt > timeoutMs) {
-        throw new Error(`Timed out waiting for lock ${path.basename(lockPath)}`);
-      }
-      await sleep(200);
-    }
-  }
-
-  try {
-    return await fn();
-  } finally {
-    fs.rmSync(lockDir, { recursive: true, force: true });
-  }
-}
-
-function hashString(value, length = 12) {
-  return hashStringModel(value, length);
-}
-
-function slugSegment(value) {
-  return slugSegmentModel(value);
-}
-
-function limitIdentifier(value, maxLength) {
-  return limitIdentifierModel(value, maxLength);
-}
-
-function escapeIdentifier(value) {
-  return escapeIdentifierModel(value);
-}
-
-function escapeSqlLiteral(value) {
-  return escapeSqlLiteralModel(value);
-}
-
-function readStateValue(filePath) {
-  return readStateValueModel(filePath);
-}
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-function removeLocalRuntimeState(stateDir) {
-  for (const file of [
-    "local_database_name",
-    "local_template_fingerprint",
-    "local_template_database_name",
-    "local_container_name",
-  ]) {
-    fs.rmSync(path.join(stateDir, file), { force: true });
-  }
-}