@pattern-stack/codegen 0.17.1 → 0.17.2

package/CHANGELOG.md

@@ -4,6 +4,42 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.17.2] — 2026-06-04
+
+**Shutdown leak fix** (LISTEN-NOTIFY-2; swe-brain dogfood). With
+`listen_notify: true` (the LISTEN/NOTIFY wake extension shipped in 0.16.0), a
+Nest app that booted and then `app.close()`d — e.g. a boot-check / CI smoke step —
+never exited: at least one `LISTEN codegen_jobs_wake` client survived
+`app.close()`, holding an ESTABLISHED Postgres socket open forever (two swe-brain
+CI runs hung for hours). Backward-compatible; affects only consumers that opted
+into `listen_notify`.
+
+### Fixed
+
+- **`PgNotifyListener.stop()` is race-safe against an in-flight `connect()`**
+  (LISTEN-NOTIFY-2 RC1 — the defect that actually fired). `connect()` checked
+  `this.stopped` only at entry, then `await pool.connect()`, wired handlers,
+  issued `LISTEN`, and assigned `this.client` last. A `stop()` arriving during
+  the checkout await ran `releaseClient()` against a still-null `this.client`
+  (released nothing); the resuming `connect()` then assigned the client and
+  issued `LISTEN` — leaking a checked-out connection with no owner left to
+  release it. With 5–6 listeners (one per jobs pool + the events drainer) all
+  starting at bootstrap and a tight `app.close()`, the race fired on ~1 of 6
+  listeners — exactly the observed signature (one survivor, the rest clean).
+  Now `connect()` re-checks `stopped` after the checkout AND after `LISTEN`,
+  destroying the just-acquired client and bailing before assignment; `stop()`
+  tracks and awaits the in-flight connect promise before its own release, so
+  `app.close()` can't return while a checkout is still mid-flight. Releases use
+  `release(true)` (destroy) so a half-listening socket is never reused.
+- **`JobWorker.onModuleDestroy` stops the wake listener on EVERY destroy path**
+  (LISTEN-NOTIFY-2 RC2 — latent). The listener `stop()` lived only on the first
+  (non-`shuttingDown`) branch, so a SIGTERM-then-Nest double-destroy hit the
+  `if (this.shuttingDown) { …; return; }` early return and skipped it, leaking
+  the listener under the normal SIGTERM shutdown path. Teardown is now an
+  idempotent `stopNotifyListener()` called unconditionally at the top of every
+  destroy. `DrizzleEventBus` already stopped its listener unconditionally; it
+  shared `PgNotifyListener` and so benefits from the RC1 fix directly.
+
 ## [0.17.1] — 2026-06-04
 
 **Two dogfood fixes that bit the same swe-brain mutation drain** (ADR-0009

package/dist/{chunk-HPS554L4.js → chunk-235ZMMJR.js}

@@ -1,9 +1,9 @@
 import {
   JobWorker
-} from "./chunk-FWRL7BZ5.js";
+} from "./chunk-VDL5CJ5C.js";
 import {
   JobsDomainModule
-} from "./chunk-HOIRY5XP.js";
+} from "./chunk-AZLUWG5S.js";
 import {
   BootValidationError,
   ReservedPoolViolationError
@@ -18,14 +18,14 @@ import {
   allPoolNames,
   loadPoolConfig
 } from "./chunk-RHVN6NA7.js";
+import {
+  HandlerRegistry
+} from "./chunk-7P5ODGLA.js";
 import {
   JOB_ORCHESTRATOR,
   JOB_RUN_SERVICE,
   JOB_STEP_SERVICE
 } from "./chunk-ZPL74UQN.js";
-import {
-  HandlerRegistry
-} from "./chunk-7P5ODGLA.js";
 import {
   tokenKey
 } from "./chunk-GYGNEQSC.js";
@@ -290,4 +290,4 @@ export {
   JobWorkerOrchestrator,
   JobWorkerModule
 };
-//# sourceMappingURL=chunk-HPS554L4.js.map
+//# sourceMappingURL=chunk-235ZMMJR.js.map

package/dist/{chunk-BK5ICA2F.js → chunk-4MVGAMUA.js}

@@ -1,12 +1,12 @@
-import {
-  STORAGE
-} from "./chunk-NYBCQZC7.js";
 import {
   LocalStorageBackend
 } from "./chunk-JWNHNUYL.js";
 import {
   MemoryStorageBackend
 } from "./chunk-3SZFUTXE.js";
+import {
+  STORAGE
+} from "./chunk-NYBCQZC7.js";
 import {
   __decorateClass
 } from "./chunk-2E224ZSN.js";
@@ -37,4 +37,4 @@ StorageModule = __decorateClass([
 export {
   StorageModule
 };
-//# sourceMappingURL=chunk-BK5ICA2F.js.map
+//# sourceMappingURL=chunk-4MVGAMUA.js.map

package/dist/{chunk-SFQRETXJ.js → chunk-65MO75WM.js}

@@ -1,22 +1,22 @@
 import {
   BRIDGE_DELIVERY_JOB_TYPE
-} from "./chunk-SGSWVNNB.js";
+} from "./chunk-R6F6KFIL.js";
 import {
   bridgeDelivery
 } from "./chunk-2TVVBC53.js";
-import {
-  JOBS_LISTEN_NOTIFY
-} from "./chunk-ZPL74UQN.js";
-import {
-  jobRuns
-} from "./chunk-OKXZ63IA.js";
 import {
   JOBS_WAKE_CHANNEL,
   pgNotify
-} from "./chunk-MYQIQ27N.js";
+} from "./chunk-Q6LRJ4VI.js";
+import {
+  JOBS_LISTEN_NOTIFY
+} from "./chunk-ZPL74UQN.js";
 import {
   BRIDGE_REGISTRY
 } from "./chunk-4LH67P4U.js";
+import {
+  jobRuns
+} from "./chunk-OKXZ63IA.js";
 import {
   __decorateClass,
   __decorateParam
@@ -151,4 +151,4 @@ BridgeOutboxDrainHook = __decorateClass([
 export {
   BridgeOutboxDrainHook
 };
-//# sourceMappingURL=chunk-SFQRETXJ.js.map
+//# sourceMappingURL=chunk-65MO75WM.js.map

package/dist/{chunk-5RT7JGKT.js → chunk-7OVCARTQ.js}

@@ -4,14 +4,14 @@ import {
 import {
   JOB_ORCHESTRATOR
 } from "./chunk-ZPL74UQN.js";
+import {
+  EVENT_BUS
+} from "./chunk-H5NH7KPE.js";
 import {
   BRIDGE_DELIVERY_REPO,
   BRIDGE_MULTI_TENANT,
   BRIDGE_REGISTRY
 } from "./chunk-4LH67P4U.js";
-import {
-  EVENT_BUS
-} from "./chunk-H5NH7KPE.js";
 import {
   DRIZZLE
 } from "./chunk-U64T4YZE.js";
@@ -106,4 +106,4 @@ EventFlowService = __decorateClass([
 export {
   EventFlowService
 };
-//# sourceMappingURL=chunk-5RT7JGKT.js.map
+//# sourceMappingURL=chunk-7OVCARTQ.js.map

package/dist/{chunk-JA7GJDNI.js → chunk-ATVGYF3D.js}

@@ -1,6 +1,3 @@
-import {
-  MemoryCursorStore
-} from "./chunk-AHV4GDYM.js";
 import {
   DrizzleIntegrationRunRecorder
 } from "./chunk-YK5JEVLX.js";
@@ -10,6 +7,12 @@ import {
 import {
   PostgresCursorStore
 } from "./chunk-XWBK3XJK.js";
+import {
+  MemoryCursorStore
+} from "./chunk-AHV4GDYM.js";
+import {
+  DeepEqualDiffer
+} from "./chunk-JEINYUJH.js";
 import {
   INTEGRATION_CURSOR_STORE,
   INTEGRATION_FIELD_DIFFER,
@@ -17,9 +20,6 @@ import {
   INTEGRATION_MULTI_TENANT,
   INTEGRATION_RUN_RECORDER
 } from "./chunk-S7C6TIIF.js";
-import {
-  DeepEqualDiffer
-} from "./chunk-JEINYUJH.js";
 import {
   __decorateClass
 } from "./chunk-2E224ZSN.js";
@@ -84,4 +84,4 @@ IntegrationModule = __decorateClass([
 export {
   IntegrationModule
 };
-//# sourceMappingURL=chunk-JA7GJDNI.js.map
+//# sourceMappingURL=chunk-ATVGYF3D.js.map

package/dist/{chunk-HOIRY5XP.js → chunk-AZLUWG5S.js}

@@ -1,21 +1,21 @@
+import {
+  DrizzleJobRunService
+} from "./chunk-VNBC3VXM.js";
+import {
+  MemoryJobRunService
+} from "./chunk-BHZP6LOV.js";
 import {
   DrizzleJobStepService
 } from "./chunk-DV4RV2DC.js";
 import {
   DrizzleJobOrchestrator
-} from "./chunk-FVNAU7VO.js";
+} from "./chunk-E6PLM6QG.js";
 import {
   MemoryJobOrchestrator
-} from "./chunk-DUMI2J5M.js";
+} from "./chunk-VQOAATIG.js";
 import {
   MemoryJobStepService
 } from "./chunk-PNZSGAB2.js";
-import {
-  DrizzleJobRunService
-} from "./chunk-VNBC3VXM.js";
-import {
-  MemoryJobRunService
-} from "./chunk-BHZP6LOV.js";
 import {
   MemoryJobStore
 } from "./chunk-SNQ3TOWP.js";
@@ -114,4 +114,4 @@ JobsDomainModule = __decorateClass([
 export {
   JobsDomainModule
 };
-//# sourceMappingURL=chunk-HOIRY5XP.js.map
+//# sourceMappingURL=chunk-AZLUWG5S.js.map

package/dist/{chunk-4PFF3ED4.js → chunk-B34G6PHD.js}

@@ -1,22 +1,22 @@
+import {
+  clampEventLimit,
+  decodeEventCursor,
+  encodeEventCursor
+} from "./chunk-UQ5EHOH2.js";
 import {
   EVENTS_WAKE_CHANNEL,
   PgNotifyListener,
   pgNotify
-} from "./chunk-MYQIQ27N.js";
+} from "./chunk-Q6LRJ4VI.js";
+import {
+  EVENTS_MODULE_OPTIONS
+} from "./chunk-H5NH7KPE.js";
 import {
   BRIDGE_OUTBOX_DRAIN_HOOK
 } from "./chunk-4LH67P4U.js";
 import {
   domainEvents
 } from "./chunk-OFRRBC7M.js";
-import {
-  EVENTS_MODULE_OPTIONS
-} from "./chunk-H5NH7KPE.js";
-import {
-  clampEventLimit,
-  decodeEventCursor,
-  encodeEventCursor
-} from "./chunk-UQ5EHOH2.js";
 import {
   DRIZZLE
 } from "./chunk-U64T4YZE.js";
@@ -393,4 +393,4 @@ DrizzleEventBus = __decorateClass([
 export {
   DrizzleEventBus
 };
-//# sourceMappingURL=chunk-4PFF3ED4.js.map
+//# sourceMappingURL=chunk-B34G6PHD.js.map

package/dist/{chunk-W2UIDI3R.js → chunk-CLWBNXKF.js}

@@ -1,12 +1,12 @@
 import {
   JOB_RUN_SERVICE
 } from "./chunk-ZPL74UQN.js";
-import {
-  BRIDGE_DELIVERY_REPO
-} from "./chunk-4LH67P4U.js";
 import {
   EVENT_READ_PORT
 } from "./chunk-H5NH7KPE.js";
+import {
+  BRIDGE_DELIVERY_REPO
+} from "./chunk-4LH67P4U.js";
 import {
   INTEGRATION_CURSOR_STORE,
   INTEGRATION_RUN_RECORDER
@@ -181,4 +181,4 @@ ObservabilityService = __decorateClass([
 export {
   ObservabilityService
 };
-//# sourceMappingURL=chunk-W2UIDI3R.js.map
+//# sourceMappingURL=chunk-CLWBNXKF.js.map

package/dist/{chunk-FVNAU7VO.js → chunk-E6PLM6QG.js}

@@ -6,22 +6,22 @@ import {
   MissingTenantIdError
 } from "./chunk-T4BIIU5E.js";
 import {
-  JOBS_LISTEN_NOTIFY,
-  JOBS_MULTI_TENANT
-} from "./chunk-ZPL74UQN.js";
+  JOBS_WAKE_CHANNEL,
+  pgNotify
+} from "./chunk-Q6LRJ4VI.js";
 import {
   keySelectorToTemplate,
   resolveJobKey
 } from "./chunk-7P5ODGLA.js";
+import {
+  JOBS_LISTEN_NOTIFY,
+  JOBS_MULTI_TENANT
+} from "./chunk-ZPL74UQN.js";
 import {
   jobRuns,
   jobSteps,
   jobs
 } from "./chunk-OKXZ63IA.js";
-import {
-  JOBS_WAKE_CHANNEL,
-  pgNotify
-} from "./chunk-MYQIQ27N.js";
 import {
   DRIZZLE
 } from "./chunk-U64T4YZE.js";
@@ -393,4 +393,4 @@ export {
   evaluateKeyTemplate,
   DrizzleJobOrchestrator
 };
-//# sourceMappingURL=chunk-FVNAU7VO.js.map
+//# sourceMappingURL=chunk-E6PLM6QG.js.map

package/dist/{chunk-43SBT72G.js → chunk-I6UXRJ3Q.js}

@@ -1,9 +1,9 @@
-import {
-  PollChangeSource
-} from "./chunk-4MF3HKJA.js";
 import {
   WebhookChangeSource
 } from "./chunk-TIZXQU26.js";
+import {
+  PollChangeSource
+} from "./chunk-4MF3HKJA.js";
 
 // runtime/subsystems/integration/build-change-source.ts
 function buildChangeSource(cfg, fetch, middlewares = []) {
@@ -26,4 +26,4 @@ function buildChangeSource(cfg, fetch, middlewares = []) {
 export {
   buildChangeSource
 };
-//# sourceMappingURL=chunk-43SBT72G.js.map
+//# sourceMappingURL=chunk-I6UXRJ3Q.js.map

package/dist/{chunk-PSDVGPQR.js → chunk-KZDHMZ45.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-5A432NZJ.js";
 import {
   EventFlowService
-} from "./chunk-5RT7JGKT.js";
+} from "./chunk-7OVCARTQ.js";
 import {
   BRIDGE_RESERVED_POOLS
 } from "./chunk-EDKJU5BO.js";
@@ -15,16 +15,16 @@ import {
 } from "./chunk-4DOJBQTP.js";
 import {
   BridgeOutboxDrainHook
-} from "./chunk-SFQRETXJ.js";
+} from "./chunk-65MO75WM.js";
 import {
   BridgeDeliveryHandler
-} from "./chunk-SGSWVNNB.js";
+} from "./chunk-R6F6KFIL.js";
 import {
   BridgeReservedPoolsNotPolledError
 } from "./chunk-NXXDZ6ZF.js";
 import {
   JOB_WORKER_MODULE_OPTIONS
-} from "./chunk-HPS554L4.js";
+} from "./chunk-235ZMMJR.js";
 import {
   BRIDGE_DELIVERY_REPO,
   BRIDGE_MODULE_OPTIONS,
@@ -119,4 +119,4 @@ BridgeModule = __decorateClass([
 export {
   BridgeModule
 };
-//# sourceMappingURL=chunk-PSDVGPQR.js.map
+//# sourceMappingURL=chunk-KZDHMZ45.js.map

package/dist/{chunk-EJBK7I4F.js → chunk-OZEPJGMA.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-GM3RMJIJ.js";
 import {
   DrizzleEventBus
-} from "./chunk-4PFF3ED4.js";
+} from "./chunk-B34G6PHD.js";
 import {
   MemoryEventBus
-} from "./chunk-LQ6PYFU6.js";
+} from "./chunk-Z7PQCAVK.js";
 import {
   EVENTS_MODULE_OPTIONS,
   EVENTS_MULTI_TENANT,
@@ -152,4 +152,4 @@ EventsModule = __decorateClass([
 export {
   EventsModule
 };
-//# sourceMappingURL=chunk-EJBK7I4F.js.map
+//# sourceMappingURL=chunk-OZEPJGMA.js.map

package/dist/{chunk-MYQIQ27N.js → chunk-Q6LRJ4VI.js}

@@ -27,24 +27,60 @@ var PgNotifyListener = class {
   backoffMaxMs;
   /** WARN-once gate so a flapping listener doesn't spam the log. */
   warnedDown = false;
+  /**
+   * LISTEN-NOTIFY-2 — the in-flight `connect()` promise, set while a checkout is
+   * mid-`await`. `stop()` awaits it so a `stop()` that races a still-resolving
+   * `connect()` can't return before the connect either assigns `this.client`
+   * (then released by `releaseClient`) or self-releases the checked-out client.
+   * Without this, a `stop()` arriving during `pool.connect()`'s await saw
+   * `this.client === null` (nothing to release), then `connect()` resumed,
+   * assigned the client, and issued `LISTEN` — leaking an ESTABLISHED socket
+   * holding `LISTEN <channel>` forever past `app.close()`.
+   */
+  connecting = null;
   /** Begin listening. Idempotent-ish: a second call while connected is a no-op. */
   async start() {
     this.stopped = false;
     await this.connect();
   }
-  /** Stop listening + release the connection. Safe to call repeatedly. */
+  /**
+   * Stop listening + release the connection. Safe to call repeatedly and
+   * race-safe against an in-flight `connect()` (LISTEN-NOTIFY-2): it sets
+   * `stopped` first (so a resuming `connect()` self-releases its checkout),
+   * then awaits any in-flight connect, then releases whatever client landed.
+   */
   async stop() {
     this.stopped = true;
     if (this.reconnectTimer) {
       clearTimeout(this.reconnectTimer);
       this.reconnectTimer = null;
     }
+    const inflight = this.connecting;
+    if (inflight) {
+      try {
+        await inflight;
+      } catch {
+      }
+    }
     await this.releaseClient();
   }
   async connect() {
     if (this.stopped) return;
+    const attempt = this.doConnect();
+    this.connecting = attempt;
+    try {
+      await attempt;
+    } finally {
+      if (this.connecting === attempt) this.connecting = null;
+    }
+  }
+  async doConnect() {
     try {
       const client = await this.opts.pool.connect();
+      if (this.stopped) {
+        await this.releaseRawClient(client);
+        return;
+      }
       client.on("notification", (msg) => {
         if (msg.channel !== this.opts.channel) return;
         try {
@@ -58,6 +94,10 @@ var PgNotifyListener = class {
         this.handleDrop();
       });
       await client.query(`LISTEN ${this.opts.channel}`);
+      if (this.stopped) {
+        await this.releaseRawClient(client);
+        return;
+      }
       this.client = client;
       if (this.warnedDown) {
         this.logger.log(
@@ -99,6 +139,15 @@ var PgNotifyListener = class {
     const client = this.client;
     this.client = null;
     if (!client) return;
+    await this.releaseRawClient(client);
+  }
+  /**
+   * Tear down a raw checked-out client (LISTEN-NOTIFY-2). Used both by the
+   * normal `releaseClient()` path and by the connect-vs-stop race bail-outs,
+   * where the client was checked out but never assigned to `this.client`.
+   * Destroys (`release(true)`) so a half-listening socket is never reused.
+   */
+  async releaseRawClient(client) {
     try {
       client.removeAllListeners?.("notification");
       client.removeAllListeners?.("error");
@@ -115,4 +164,4 @@ export {
   pgNotify,
   PgNotifyListener
 };
-//# sourceMappingURL=chunk-MYQIQ27N.js.map
+//# sourceMappingURL=chunk-Q6LRJ4VI.js.map

package/dist/chunk-Q6LRJ4VI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/subsystems/jobs/pg-notify.ts"],"sourcesContent":["/**\n * PgNotifyListener + pgNotify — Postgres LISTEN/NOTIFY wakeups\n * (LISTEN-NOTIFY-1, dogfood gap #7).\n *\n * The drizzle jobs worker and events outbox drainer poll on an interval today\n * (default 1 s/hop). With `listen_notify` enabled, a row write that makes work\n * claimable emits an in-transaction `pg_notify(...)`; a dedicated listener\n * connection wakes the polling loop the moment the writing transaction commits.\n *\n * Two halves:\n *   - `pgNotify(tx, channel, payload)` — fire an in-tx `pg_notify`. MUST be\n *     called with the SAME transaction handle as the row write it announces, so\n *     Postgres delivers it only on commit (the transactional-outbox guarantee).\n *   - `PgNotifyListener` — owns a single long-lived `pg.PoolClient`, issues\n *     `LISTEN <channel>`, forwards each notification's payload to an owner\n *     callback, debounces bursts, and reconnects with capped backoff on drop.\n *\n * **Polling never stops.** This is a wake-early optimisation layered ON TOP of\n * interval polling. A lost notification (listener down, pooler eats the LISTEN,\n * etc.) degrades to today's poll latency, never to lost work — the claim/drain\n * query remains the source of truth.\n *\n * **PgBouncer caveat:** session-scoped `LISTEN` does not survive a\n * transaction-mode pooler. `listen_notify` requires a direct (or session-mode)\n * connection; behind a transaction pooler notifies are simply never received and\n * the system degrades to polling. See the jobs config block / skill.\n */\n// TODO(logging-subsystem): swap to ILogger once ADR-028 lands\nimport { Logger } from '@nestjs/common';\nimport { sql } from 'drizzle-orm';\nimport type { DrizzleClient } from '../../types/drizzle';\nimport type { DrizzleTransaction } from '../events/event-bus.protocol';\n\n/** Channel the jobs worker LISTENs on; payload = pool name. */\nexport const JOBS_WAKE_CHANNEL = 'codegen_jobs_wake';\n/** Channel the events drainer LISTENs on; payload = event pool (or ''). */\nexport const EVENTS_WAKE_CHANNEL = 'codegen_events_wake';\n\n/**\n * Emit an in-transaction `pg_notify`. Call with the SAME `tx`/client handle as\n * the row write being announced so delivery is gated on commit. `payload` is a\n * short plain string (a pool name); it is NOT JSON — the wake is a hint and the\n * subsequent claim/drain query is authoritative. Channel names are framework\n * constants (never user input), so the `set_config`-free literal-channel form is\n * safe; the payload is bound as a parameter.\n */\nexport async function pgNotify(\n  tx: DrizzleClient | DrizzleTransaction,\n  channel: string,\n  payload: string,\n): Promise<void> {\n  const client = tx as DrizzleClient;\n  // `pg_notify(channel, payload)` is the function form (vs the `NOTIFY chan,\n  // 'payload'` statement form) precisely because it accepts bound parameters —\n  // the payload is parameterised, never string-concatenated.\n  await client.execute(sql`select pg_notify(${channel}, ${payload})`);\n}\n\n/** Minimal structural view of the `pg` Client/PoolClient surface we touch. */\ninterface PgListenClient {\n  query(text: string): Promise<unknown>;\n  on(event: 'notification', cb: (msg: { channel: string; payload?: string }) => void): void;\n  on(event: 'error', cb: (err: Error) => void): void;\n  removeAllListeners?: (event?: string) => void;\n  release?: (err?: boolean) => void;\n  end?: () => Promise<void>;\n}\n\n/** Minimal structural view of the `pg` Pool's `connect()`. */\ninterface PgPoolish {\n  connect(): Promise<PgListenClient>;\n}\n\nconst DEFAULT_BACKOFF_MIN_MS = 100;\nconst DEFAULT_BACKOFF_MAX_MS = 5_000;\n\nexport interface PgNotifyListenerOptions {\n  /** Channel to LISTEN on. */\n  channel: string;\n  /**\n   * The underlying `pg.Pool` — obtained from `drizzleClient.$client`. A\n   * dedicated `PoolClient` is checked out and held for the listener's lifetime\n   * (separate from the query pool so a slow query never delays a wake).\n   */\n  pool: PgPoolish;\n  /**\n   * Called for every notification on `channel`, with the raw payload string\n   * (`''` when Postgres delivers an empty payload). The owner decides whether\n   * the payload is relevant (e.g. \"is this one of my pools?\") and debounces its\n   * own claim cycle.\n   */\n  onNotify: (payload: string) => void;\n  /** Label used in log lines (e.g. 'jobs:interactive', 'events'). */\n  label: string;\n  backoffMinMs?: number;\n  backoffMaxMs?: number;\n}\n\n/**\n * Holds a dedicated listener connection and forwards notifications to `onNotify`.\n * Reconnects with capped exponential backoff on drop; logs the first failure +\n * the recovery exactly once each so a flapping connection doesn't flood logs.\n */\nexport class PgNotifyListener {\n  private readonly logger: Logger;\n  private client: PgListenClient | null = null;\n  private stopped = false;\n  private reconnectTimer: ReturnType<typeof setTimeout> | null = null;\n  private backoffMs: number;\n  private readonly backoffMinMs: number;\n  private readonly backoffMaxMs: number;\n  /** WARN-once gate so a flapping listener doesn't spam the log. */\n  private warnedDown = false;\n  /**\n   * LISTEN-NOTIFY-2 — the in-flight `connect()` promise, set while a checkout is\n   * mid-`await`. `stop()` awaits it so a `stop()` that races a still-resolving\n   * `connect()` can't return before the connect either assigns `this.client`\n   * (then released by `releaseClient`) or self-releases the checked-out client.\n   * Without this, a `stop()` arriving during `pool.connect()`'s await saw\n   * `this.client === null` (nothing to release), then `connect()` resumed,\n   * assigned the client, and issued `LISTEN` — leaking an ESTABLISHED socket\n   * holding `LISTEN <channel>` forever past `app.close()`.\n   */\n  private connecting: Promise<void> | null = null;\n\n  constructor(private readonly opts: PgNotifyListenerOptions) {\n    this.logger = new Logger(`PgNotifyListener(${opts.label})`);\n    this.backoffMinMs = opts.backoffMinMs ?? DEFAULT_BACKOFF_MIN_MS;\n    this.backoffMaxMs = opts.backoffMaxMs ?? DEFAULT_BACKOFF_MAX_MS;\n    this.backoffMs = this.backoffMinMs;\n  }\n\n  /** Begin listening. Idempotent-ish: a second call while connected is a no-op. */\n  async start(): Promise<void> {\n    this.stopped = false;\n    await this.connect();\n  }\n\n  /**\n   * Stop listening + release the connection. Safe to call repeatedly and\n   * race-safe against an in-flight `connect()` (LISTEN-NOTIFY-2): it sets\n   * `stopped` first (so a resuming `connect()` self-releases its checkout),\n   * then awaits any in-flight connect, then releases whatever client landed.\n   */\n  async stop(): Promise<void> {\n    this.stopped = true;\n    if (this.reconnectTimer) {\n      clearTimeout(this.reconnectTimer);\n      this.reconnectTimer = null;\n    }\n    // Await an in-flight checkout so we don't return while a client is still\n    // mid-`pool.connect()`. The resuming `connect()` sees `stopped` and either\n    // self-releases its checkout or assigns `this.client`; either way the\n    // `releaseClient()` below mops up.\n    const inflight = this.connecting;\n    if (inflight) {\n      try {\n        await inflight;\n      } catch {\n        // connect failures are handled inside connect(); ignore here.\n      }\n    }\n    await this.releaseClient();\n  }\n\n  private async connect(): Promise<void> {\n    if (this.stopped) return;\n    // Track this checkout so a racing stop() can await it (LISTEN-NOTIFY-2).\n    const attempt = this.doConnect();\n    this.connecting = attempt;\n    try {\n      await attempt;\n    } finally {\n      if (this.connecting === attempt) this.connecting = null;\n    }\n  }\n\n  private async doConnect(): Promise<void> {\n    try {\n      const client = await this.opts.pool.connect();\n      // Re-check AFTER the await resolves: a stop() may have fired while this\n      // checkout was in flight. If so, release the just-checked-out client\n      // right here and bail BEFORE wiring handlers / issuing LISTEN — otherwise\n      // we'd leak an ESTABLISHED listener socket past shutdown (LISTEN-NOTIFY-2).\n      if (this.stopped) {\n        await this.releaseRawClient(client);\n        return;\n      }\n      client.on('notification', (msg) => {\n        if (msg.channel !== this.opts.channel) return;\n        try {\n          this.opts.onNotify(msg.payload ?? '');\n        } catch (err) {\n          this.logger.error(`onNotify threw: ${(err as Error).message}`);\n        }\n      });\n      client.on('error', (err) => {\n        // A connection-level error is the signal to reconnect. Don't double-log\n        // here — scheduleReconnect owns the WARN-once.\n        this.logger.debug?.(`listener connection error: ${err.message}`);\n        this.handleDrop();\n      });\n      await client.query(`LISTEN ${this.opts.channel}`);\n      // A stop() could have fired during the LISTEN round-trip too — same guard.\n      if (this.stopped) {\n        await this.releaseRawClient(client);\n        return;\n      }\n      this.client = client;\n      // Recovery: only announce if we had previously warned about being down.\n      if (this.warnedDown) {\n        this.logger.log(\n          `listener reconnected; LISTEN ${this.opts.channel} re-established`,\n        );\n        this.warnedDown = false;\n      }\n      this.backoffMs = this.backoffMinMs;\n    } catch (err) {\n      this.handleConnectFailure(err);\n    }\n  }\n\n  /** Connection dropped after being established → reconnect. */\n  private handleDrop(): void {\n    if (this.stopped) return;\n    void this.releaseClient().finally(() => this.scheduleReconnect());\n  }\n\n  /** Initial / reconnect `connect()` threw. */\n  private handleConnectFailure(err: unknown): void {\n    this.scheduleReconnect(err);\n  }\n\n  private scheduleReconnect(err?: unknown): void {\n    if (this.stopped) return;\n    if (!this.warnedDown) {\n      this.warnedDown = true;\n      this.logger.warn(\n        `listener down — falling back to interval polling until reconnect. ` +\n          `Cause: ${err instanceof Error ? err.message : 'connection lost'}. ` +\n          `(This degrades latency, not durability — polling still drives all work.)`,\n      );\n    }\n    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);\n    const delay = this.backoffMs;\n    this.backoffMs = Math.min(this.backoffMs * 2, this.backoffMaxMs);\n    this.reconnectTimer = setTimeout(() => {\n      this.reconnectTimer = null;\n      void this.connect();\n    }, delay);\n  }\n\n  private async releaseClient(): Promise<void> {\n    const client = this.client;\n    this.client = null;\n    if (!client) return;\n    await this.releaseRawClient(client);\n  }\n\n  /**\n   * Tear down a raw checked-out client (LISTEN-NOTIFY-2). Used both by the\n   * normal `releaseClient()` path and by the connect-vs-stop race bail-outs,\n   * where the client was checked out but never assigned to `this.client`.\n   * Destroys (`release(true)`) so a half-listening socket is never reused.\n   */\n  private async releaseRawClient(client: PgListenClient): Promise<void> {\n    try {\n      client.removeAllListeners?.('notification');\n      client.removeAllListeners?.('error');\n      if (client.release) client.release(true);\n      else if (client.end) await client.end();\n    } catch {\n      // best-effort teardown\n    }\n  }\n}\n"],"mappings":";AA4BA,SAAS,cAAc;AACvB,SAAS,WAAW;AAKb,IAAM,oBAAoB;AAE1B,IAAM,sBAAsB;AAUnC,eAAsB,SACpB,IACA,SACA,SACe;AACf,QAAM,SAAS;AAIf,QAAM,OAAO,QAAQ,uBAAuB,OAAO,KAAK,OAAO,GAAG;AACpE;AAiBA,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AA6BxB,IAAM,mBAAN,MAAuB;AAAA,EAsB5B,YAA6B,MAA+B;AAA/B;AAC3B,SAAK,SAAS,IAAI,OAAO,oBAAoB,KAAK,KAAK,GAAG;AAC1D,SAAK,eAAe,KAAK,gBAAgB;AACzC,SAAK,eAAe,KAAK,gBAAgB;AACzC,SAAK,YAAY,KAAK;AAAA,EACxB;AAAA,EAL6B;AAAA,EArBZ;AAAA,EACT,SAAgC;AAAA,EAChC,UAAU;AAAA,EACV,iBAAuD;AAAA,EACvD;AAAA,EACS;AAAA,EACA;AAAA;AAAA,EAET,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWb,aAAmC;AAAA;AAAA,EAU3C,MAAM,QAAuB;AAC3B,SAAK,UAAU;AACf,UAAM,KAAK,QAAQ;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAsB;AAC1B,SAAK,UAAU;AACf,QAAI,KAAK,gBAAgB;AACvB,mBAAa,KAAK,cAAc;AAChC,WAAK,iBAAiB;AAAA,IACxB;AAKA,UAAM,WAAW,KAAK;AACtB,QAAI,UAAU;AACZ,UAAI;AACF,cAAM;AAAA,MACR,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,KAAK,cAAc;AAAA,EAC3B;AAAA,EAEA,MAAc,UAAyB;AACrC,QAAI,KAAK,QAAS;AAElB,UAAM,UAAU,KAAK,UAAU;AAC/B,SAAK,aAAa;AAClB,QAAI;AACF,YAAM;AAAA,IACR,UAAE;AACA,UAAI,KAAK,eAAe,QAAS,MAAK,aAAa;AAAA,IACrD;AAAA,EACF;AAAA,EAEA,MAAc,YAA2B;AACvC,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,KAAK,KAAK,QAAQ;AAK5C,UAAI,KAAK,SAAS;AAChB,cAAM,KAAK,iBAAiB,MAAM;AAClC;AAAA,MACF;AACA,aAAO,GAAG,gBAAgB,CAAC,QAAQ;AACjC,YAAI,IAAI,YAAY,KAAK,KAAK,QAAS;AACvC,YAAI;AACF,eAAK,KAAK,SAAS,IAAI,WAAW,EAAE;AAAA,QACtC,SAAS,KAAK;AACZ,eAAK,OAAO,MAAM,mBAAoB,IAAc,OAAO,EAAE;AAAA,QAC/D;AAAA,MACF,CAAC;AACD,aAAO,GAAG,SAAS,CAAC,QAAQ;AAG1B,aAAK,OAAO,QAAQ,8BAA8B,IAAI,OAAO,EAAE;AAC/D,aAAK,WAAW;AAAA,MAClB,CAAC;AACD,YAAM,OAAO,MAAM,UAAU,KAAK,KAAK,OAAO,EAAE;AAEhD,UAAI,KAAK,SAAS;AAChB,cAAM,KAAK,iBAAiB,MAAM;AAClC;AAAA,MACF;AACA,WAAK,SAAS;AAEd,UAAI,KAAK,YAAY;AACnB,aAAK,OAAO;AAAA,UACV,gCAAgC,KAAK,KAAK,OAAO;AAAA,QACnD;AACA,aAAK,aAAa;AAAA,MACpB;AACA,WAAK,YAAY,KAAK;AAAA,IACxB,SAAS,KAAK;AACZ,WAAK,qBAAqB,GAAG;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA,EAGQ,aAAmB;AACzB,QAAI,KAAK,QAAS;AAClB,SAAK,KAAK,cAAc,EAAE,QAAQ,MAAM,KAAK,kBAAkB,CAAC;AAAA,EAClE;AAAA;AAAA,EAGQ,qBAAqB,KAAoB;AAC/C,SAAK,kBAAkB,GAAG;AAAA,EAC5B;AAAA,EAEQ,kBAAkB,KAAqB;AAC7C,QAAI,KAAK,QAAS;AAClB,QAAI,CAAC,KAAK,YAAY;AACpB,WAAK,aAAa;AAClB,WAAK,OAAO;AAAA,QACV,iFACY,eAAe,QAAQ,IAAI,UAAU,iBAAiB;AAAA,MAEpE;AAAA,IACF;AACA,QAAI,KAAK,eAAgB,cAAa,KAAK,cAAc;AACzD,UAAM,QAAQ,KAAK;AACnB,SAAK,YAAY,KAAK,IAAI,KAAK,YAAY,GAAG,KAAK,YAAY;AAC/D,SAAK,iBAAiB,WAAW,MAAM;AACrC,WAAK,iBAAiB;AACtB,WAAK,KAAK,QAAQ;AAAA,IACpB,GAAG,KAAK;AAAA,EACV;AAAA,EAEA,MAAc,gBAA+B;AAC3C,UAAM,SAAS,KAAK;AACpB,SAAK,SAAS;AACd,QAAI,CAAC,OAAQ;AACb,UAAM,KAAK,iBAAiB,MAAM;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,iBAAiB,QAAuC;AACpE,QAAI;AACF,aAAO,qBAAqB,cAAc;AAC1C,aAAO,qBAAqB,OAAO;AACnC,UAAI,OAAO,QAAS,QAAO,QAAQ,IAAI;AAAA,eAC9B,OAAO,IAAK,OAAM,OAAO,IAAI;AAAA,IACxC,QAAQ;AAAA,IAER;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-SGSWVNNB.js → chunk-R6F6KFIL.js}

@@ -1,21 +1,21 @@
 import {
   assertTenantId
 } from "./chunk-6DWFJNIK.js";
-import {
-  JOB_ORCHESTRATOR
-} from "./chunk-ZPL74UQN.js";
 import {
   JobHandler,
   JobHandlerBase
 } from "./chunk-7P5ODGLA.js";
+import {
+  JOB_ORCHESTRATOR
+} from "./chunk-ZPL74UQN.js";
+import {
+  EVENT_BUS
+} from "./chunk-H5NH7KPE.js";
 import {
   BRIDGE_DELIVERY_REPO,
   BRIDGE_MULTI_TENANT,
   BRIDGE_REGISTRY
 } from "./chunk-4LH67P4U.js";
-import {
-  EVENT_BUS
-} from "./chunk-H5NH7KPE.js";
 import {
   __decorateClass,
   __decorateParam
@@ -118,4 +118,4 @@ export {
   BRIDGE_DELIVERY_JOB_TYPE,
   BridgeDeliveryHandler
 };
-//# sourceMappingURL=chunk-SGSWVNNB.js.map
+//# sourceMappingURL=chunk-R6F6KFIL.js.map

package/dist/{chunk-FWRL7BZ5.js → chunk-VDL5CJ5C.js}

@@ -1,18 +1,18 @@
+import {
+  JOBS_WAKE_CHANNEL,
+  PgNotifyListener
+} from "./chunk-Q6LRJ4VI.js";
+import {
+  JOB_HANDLER_REGISTRY
+} from "./chunk-7P5ODGLA.js";
 import {
   JOB_ORCHESTRATOR,
   JOB_RUN_SERVICE,
   JOB_STEP_SERVICE
 } from "./chunk-ZPL74UQN.js";
-import {
-  JOB_HANDLER_REGISTRY
-} from "./chunk-7P5ODGLA.js";
 import {
   jobRuns
 } from "./chunk-OKXZ63IA.js";
-import {
-  JOBS_WAKE_CHANNEL,
-  PgNotifyListener
-} from "./chunk-MYQIQ27N.js";
 import {
   tokenKey
 } from "./chunk-GYGNEQSC.js";
@@ -199,6 +199,7 @@ var JobWorker = class {
     }
   }
   async onModuleDestroy() {
+    await this.stopNotifyListener();
     if (this.shuttingDown) {
       await this.drainInFlight();
       return;
@@ -213,14 +214,6 @@ var JobWorker = class {
       this.sweeperTimer = null;
     }
     process.removeListener("SIGTERM", this.sigtermHandler);
-    if (this.notifyListener) {
-      try {
-        await this.notifyListener.stop();
-      } catch (err) {
-        this.logger.error(`notify listener stop failed: ${err.message}`);
-      }
-      this.notifyListener = null;
-    }
     await this.drainInFlight();
     try {
       await this.db.update(jobRuns).set({ status: "pending", claimedAt: null, startedAt: null }).where(
@@ -240,6 +233,23 @@ var JobWorker = class {
       timeout
     ]);
   }
+  /**
+   * LISTEN-NOTIFY-2 — stop + drop the wake listener. Idempotent: a second call
+   * (SIGTERM + Nest destroy) finds `notifyListener` already null and no-ops.
+   * `PgNotifyListener.stop()` is itself race-safe against an in-flight
+   * `connect()`, so even a destroy that arrives microseconds after `start()`
+   * releases the listener socket rather than leaking it.
+   */
+  async stopNotifyListener() {
+    const listener = this.notifyListener;
+    if (!listener) return;
+    this.notifyListener = null;
+    try {
+      await listener.stop();
+    } catch (err) {
+      this.logger.error(`notify listener stop failed: ${err.message}`);
+    }
+  }
   // ============================================================================
   // Poll loop
   // ============================================================================
@@ -518,4 +528,4 @@ export {
   buildStaleSweepQuery,
   JobWorker
 };
-//# sourceMappingURL=chunk-FWRL7BZ5.js.map
+//# sourceMappingURL=chunk-VDL5CJ5C.js.map