@everystack/server 0.4.14 → 0.4.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.14",
+  "version": "0.4.15",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -73,6 +73,10 @@
       "types": "./src/cdn/index.ts",
       "default": "./src/cdn/index.ts"
     },
+    "./cdn/transforms": {
+      "types": "./src/cdn/transforms.ts",
+      "default": "./src/cdn/transforms.ts"
+    },
     "./kvs": {
       "types": "./src/kvs.ts",
       "default": "./src/kvs.ts"
@@ -160,7 +164,7 @@
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
     "@everystack/auth": "0.4.0",
-    "@everystack/cli": "0.4.31"
+    "@everystack/cli": "0.4.35"
   },
   "scripts": {
     "test": "jest",

package/src/backup.ts

@@ -274,13 +274,59 @@ export function dbNameFromUrl(url: string): string {
   return decodeURIComponent(new URL(url).pathname.replace(/^\//, ''));
 }
 
+// --- TCP keepalives: why every long-running pg binary needs them -------------------------------
+//
+// Verified failure, 2026-07-27 (db:swap, but the same shape applies to every command here). A
+// restore's COPY phase saturates the connection; the index/constraint phase that FOLLOWS it sends
+// one statement and then goes quiet for minutes. During that quiet period a stateful middlebox on
+// the path (NAT gateway, firewall) drops the flow's state. The server's own keepalive then finds a
+// dead peer and terminates the backend. The CLIENT, on the far side of the break, never receives a
+// FIN or RST: its socket stays ESTABLISHED and it blocks on a read that will never return.
+//
+// Measured: psql alive at 8m54s with 0.05s CPU, socket ESTABLISHED, Send-Q 0 — while a SECOND
+// connection to the same database confirmed via pg_stat_activity that no psql backend existed.
+//
+// Client keepalives fix both halves. Probing every 30s of quiet keeps the middlebox's state alive
+// so the flow is never dropped, and if the peer does die the client declares it dead in ~80s
+// (30 + 5 x 10) instead of hanging forever.
+//
+// These MUST travel as libpq connection parameters — there is no PG* environment variable for
+// keepalives. Passing them via `-d` keyword/value form still leaves host/user/password/sslmode to
+// the PG* env, because libpq resolves each parameter from the conninfo first and the environment
+// second. So the credential stays off argv.
+
+export const PG_KEEPALIVE_IDLE_S = 30;
+export const PG_KEEPALIVE_INTERVAL_S = 10;
+export const PG_KEEPALIVE_COUNT = 5;
+
+/** Escape a value for libpq keyword/value conninfo (single-quoted, backslash-escaped). */
+function conninfoValue(v: string): string {
+  return `'${v.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+}
+
+/**
+ * A libpq keyword/value conninfo carrying ONLY keepalives (plus `dbname` when given). Everything
+ * else still resolves from the PG* env — see the note above. Safe to log: it holds no credential.
+ */
+export function pgKeepaliveConninfo(dbName?: string): string {
+  const parts = [
+    'keepalives=1',
+    `keepalives_idle=${PG_KEEPALIVE_IDLE_S}`,
+    `keepalives_interval=${PG_KEEPALIVE_INTERVAL_S}`,
+    `keepalives_count=${PG_KEEPALIVE_COUNT}`,
+  ];
+  if (dbName) parts.unshift(`dbname=${conninfoValue(dbName)}`);
+  return parts.join(' ');
+}
+
 /**
  * Args for `pg_dump` — custom format (portable, restorable under a different role/stage). The
  * connection comes from PG* env, so no host/db on argv. --no-owner/--no-privileges/--no-comments
  * make the dump restore cleanly into a different stage (and dodge the RDS plpgsql-comment error).
  */
 export function pgDumpArgs(opts: { schema?: string } = {}): string[] {
-  const args = ['-Fc', '--no-owner', '--no-privileges', '--no-comments'];
+  // -d carries keepalives only; host/user/password/db still come from the PG* env (see above).
+  const args = ['-d', pgKeepaliveConninfo(), '-Fc', '--no-owner', '--no-privileges', '--no-comments'];
   if (opts.schema) {
     // A schema-scoped artifact dumps ONE schema (the canonical-sync export). pg_dump's --schema
     // takes a pattern; a plain identifier scopes to exactly that schema and its objects.
@@ -301,5 +347,7 @@ export function pgDumpArgs(opts: { schema?: string } = {}): string[] {
  * With no archive-file argument pg_restore reads the dump from stdin.
  */
 export function pgRestoreArgs(dbName: string): string[] {
-  return ['--clean', '--if-exists', '--no-owner', '--no-privileges', '--no-comments', '-d', dbName];
+  // The database name rides the same conninfo as the keepalives. libpq treats a `-d` string
+  // containing `=` as keyword/value form, so dbname must be a keyword here rather than bare.
+  return ['--clean', '--if-exists', '--no-owner', '--no-privileges', '--no-comments', '-d', pgKeepaliveConninfo(dbName)];
 }