@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.51

package/server-managed/db-neon.ts

@@ -0,0 +1,468 @@
+import { DEPENDENCY_REVIEW_COLUMNS, DEPENDENCY_REVIEW_INDEXES, DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
+import { LINK_REPORT_SCHEMA } from './link-reports.ts'
+import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
+import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+import { GITHUB_LINK_SCHEMA, GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
+import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { WebSocket } from 'ws'
+import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
+import { revisionSchema } from './revisions.ts'
+import { MANAGED_SCHEMA, REPO_UPLOAD_INDEXES, VIEW_SESSION_INDEX } from './db-schema.ts'
+import { STORAGE_SCHEMA } from './storage-db.ts'
+import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
+import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
+import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
+import { UPSTREAM_CACHE_SCHEMA } from './upstream-cache.ts'
+import { COMMENT_SCHEMA } from './comments.ts'
+import { ACTIVITY_SCHEMA, uploadAction } from './activity.ts'
+import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
+import { countStatement, timed } from './request-timing.ts'
+import { postgresSchema, postgresSql } from './sql-postgres.ts'
+import { managedTableRenames } from './db-table-names.ts'
+import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
+import { allocateMissingSlugs } from './slugs.ts'
+
+export interface PgConnection {
+  query(sql: string, params?: unknown[]): Promise<{
+    rows: Record<string, unknown>[]; rowCount?: number | null
+    fields?: { name: string; dataTypeID: number }[]
+  }>
+  // After a failure the connection's state is unknown: discard it, never reuse it.
+  release(discard?: boolean): Promise<void>
+}
+export type PgConnect = () => Promise<PgConnection>
+// Content/access mutations cooperate on this transaction-scoped lock. Reads,
+// presence updates, and maintenance leases do not take it. Also fences migrations.
+const LOCK = 'SELECT pg_advisory_xact_lock(1937006964, 1835101793)'
+
+// Whether every version up to the latest is recorded, in one round trip at
+// a cold start: a database with no versions table yet (undefined_table) has
+// none. Outside a transaction, so the failed read aborts nothing.
+const SCHEMA_VERSIONS = 33
+async function currentSchema(db: PgConnection): Promise<boolean> {
+  try {
+    const { rows } = await db.query(`SELECT count(*) AS n FROM managed_schema_version WHERE version BETWEEN 1 AND ${SCHEMA_VERSIONS}`)
+    return Number(rows[0]?.['n']) === SCHEMA_VERSIONS
+  } catch (error) {
+    if ((error as { code?: unknown })?.code === '42P01') return false
+    throw error
+  }
+}
+
+async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 12')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_selected_repo ADD COLUMN IF NOT EXISTS cached_default_branch TEXT')
+  await db.query('INSERT INTO managed_schema_version VALUES (12)')
+}
+
+async function migrateBundleBuildLeases(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 13')).rows.length > 0) return
+  await db.query(postgresSchema(BUNDLE_BUILD_LEASE_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (13)')
+}
+
+async function migrateGithubMetadata(db: PgConnection): Promise<void> {
+  await db.query(postgresSchema(GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA))
+  await db.query(`ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS state_reason ${GITHUB_STATE_REASON_COLUMN}`)
+  await db.query('ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS attempted_at BIGINT')
+  await db.query('INSERT INTO managed_schema_version VALUES (14) ON CONFLICT DO NOTHING')
+}
+
+async function migrateBundleVisibility(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 15')).rows.length === 0) {
+    await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS visible INTEGER NOT NULL DEFAULT 1')
+    await db.query('INSERT INTO managed_schema_version VALUES (15)')
+  }
+}
+
+async function migrateLinkReports(db: PgConnection): Promise<void> {
+  await db.query(postgresSchema(revisionSchema(true)))
+  await db.query('INSERT INTO managed_schema_version VALUES (16) ON CONFLICT DO NOTHING')
+}
+
+async function migrateRepositoryAliases(db: PgConnection): Promise<void> {
+  await db.query(postgresSchema(REPOSITORY_ALIAS_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (17) ON CONFLICT DO NOTHING')
+}
+
+async function migrateHiddenTeams(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 18')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_team ADD COLUMN IF NOT EXISTS hidden INTEGER NOT NULL DEFAULT 0')
+  await db.query('INSERT INTO managed_schema_version VALUES (18)')
+}
+
+async function migrateIssueFixes(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 19')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_finding_issue ADD COLUMN IF NOT EXISTS auto_fix_url TEXT, ADD COLUMN IF NOT EXISTS auto_fix_checked_at BIGINT')
+  await db.query(postgresSchema(revisionSchema(true)))
+  await db.query('INSERT INTO managed_schema_version VALUES (19)')
+}
+
+// Existing rows stay NULL (unknown): some may have been built on the server.
+async function migrateBundleProvenance(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 20')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS provenance TEXT')
+  await createUploadTrigger(db, 'bundle', false)
+  await db.query('INSERT INTO managed_schema_version VALUES (20)')
+}
+
+async function migrateUpstreamCache(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 21')).rows.length > 0) return
+  await db.query(postgresSchema(UPSTREAM_CACHE_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (21)')
+}
+
+// Existing builds stay NULL: their conditions were never recorded.
+async function migrateBundleBuildConditions(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 22')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS build_conditions TEXT')
+  await db.query('INSERT INTO managed_schema_version VALUES (22)')
+}
+
+// Existing sessions create their upload key on first use.
+async function migrateSessionUploadKeys(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 23')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_session ADD COLUMN IF NOT EXISTS upload_key TEXT')
+  await db.query('INSERT INTO managed_schema_version VALUES (23)')
+}
+
+async function migrateViewSessions(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 24')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_session ADD COLUMN IF NOT EXISTS viewer_session TEXT REFERENCES managed_session(id) ON DELETE CASCADE')
+  await db.query(VIEW_SESSION_INDEX)
+  await db.query('INSERT INTO managed_schema_version VALUES (24)')
+}
+
+async function migrateGithubCommits(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 25')).rows.length > 0) return
+  await db.query(postgresSchema(GITHUB_COMMIT_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (25)')
+}
+
+async function migrateTeamNpmScopes(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 26')).rows.length > 0) return
+  await db.query(postgresSchema(TEAM_NPM_SCOPE_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (26)')
+}
+
+async function migrateDependencyReviews(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 27')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_team ADD COLUMN IF NOT EXISTS dependency_review INTEGER NOT NULL DEFAULT 0')
+  await db.query(postgresSchema(DEPENDENCY_REVIEW_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (27)')
+}
+
+// Existing names are the sign-in accounts' own: none was chosen yet.
+async function migrateGithubLinks(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 28')).rows.length > 0) return
+  await db.query(postgresSchema(GITHUB_LINK_SCHEMA))
+  await db.query(`ALTER TABLE managed_user ${GITHUB_LINK_USER_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('UPDATE managed_user SET github_name = name')
+  await db.query('INSERT INTO managed_schema_version VALUES (28)')
+}
+
+async function migrateRepositoryDependencyReviews(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 29')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_selected_repo ${REPOSITORY_DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('INSERT INTO managed_schema_version VALUES (29)')
+}
+
+// The lockfiles a repository's dependency review holds to, its columns
+// added since 29 added there too; and a team's published reviews, listed by
+// it, indexed so.
+async function migrateRepositoryDependencyReviewLockfiles(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 30')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_selected_repo ${REPOSITORY_DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('CREATE INDEX IF NOT EXISTS managed_dependency_review_team_idx ON managed_dependency_review_team(team_id, review_id)')
+  await db.query('INSERT INTO managed_schema_version VALUES (30)')
+}
+
+async function migrateRepoUploadIndexes(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 31')).rows.length > 0) return
+  await db.query(REPO_UPLOAD_INDEXES)
+  await db.query('INSERT INTO managed_schema_version VALUES (31)')
+}
+
+// The shasums of the tarballs a dependency review reads, none known of
+// those written before.
+async function migrateDependencyReviewShasums(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 32')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_dependency_review ${DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('INSERT INTO managed_schema_version VALUES (32)')
+}
+
+// The patch a dependency review is of, and where it was read, none of
+// those written before; each author's one draft of a comparison held to its
+// patch too.
+async function migrateDependencyReviewPatches(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 33')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_dependency_review ${DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query(DEPENDENCY_REVIEW_INDEXES)
+  await db.query('INSERT INTO managed_schema_version VALUES (33)')
+}
+
+async function initialize(db: PgConnection): Promise<void> {
+  if (await currentSchema(db)) return
+  await db.query('BEGIN')
+  try {
+    await db.query(LOCK)
+    await db.query('CREATE TABLE IF NOT EXISTS managed_schema_version (version INTEGER PRIMARY KEY)')
+    const initialized = (await db.query('SELECT version FROM managed_schema_version WHERE version = 1')).rows.length > 0
+    const prefixed = (await db.query('SELECT version FROM managed_schema_version WHERE version = 3')).rows.length > 0
+    if (initialized && !prefixed) {
+      const { rows } = await db.query("SELECT relname AS name FROM pg_class WHERE relkind IN ('r', 'p') AND pg_table_is_visible(oid)")
+      for (const [from, to] of managedTableRenames(new Set(rows.map(row => String(row['name']))))) {
+        await db.query(`ALTER TABLE ${from} RENAME TO ${to}`)
+      }
+      // PL/pgSQL function bodies retain literal table names after ALTER TABLE.
+      for (const type of ['report', 'bundle']) await createUploadTrigger(db, type, false)
+    }
+    if (!initialized) {
+      await db.query(postgresSchema(MANAGED_SCHEMA + COMMENT_SCHEMA + ACTIVITY_SCHEMA))
+      await db.query(`ALTER TABLE managed_finding_triage_event ADD COLUMN report_id TEXT, ADD COLUMN report TEXT, ADD COLUMN repo TEXT;
+        CREATE UNIQUE INDEX managed_team_slug_idx ON managed_team(slug);
+        CREATE UNIQUE INDEX managed_report_slug_idx ON managed_report(slug);
+        CREATE INDEX managed_activity_actor_at_idx ON managed_activity(actor_id, at);`)
+      for (const type of ['report', 'bundle']) await createUploadTrigger(db, type)
+      await db.query('INSERT INTO managed_schema_version VALUES (1)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 2')).rows.length === 0) {
+      await db.query('CREATE INDEX IF NOT EXISTS managed_report_bundle_hash_idx ON managed_report(bundle_id, sha256)')
+      await db.query('INSERT INTO managed_schema_version VALUES (2)')
+    }
+    if (!prefixed) await db.query('INSERT INTO managed_schema_version VALUES (3)')
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 4')).rows.length === 0) {
+      await db.query(postgresSchema(WORKSPACE_SHARE_SCHEMA))
+      await db.query('INSERT INTO managed_schema_version VALUES (4)')
+    }
+    await migrateGithubMetadata(db)
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 5')).rows.length === 0) {
+      await db.query(`ALTER TABLE managed_workspace_share ADD COLUMN IF NOT EXISTS dependencies INTEGER NOT NULL DEFAULT 0,
+        ADD COLUMN IF NOT EXISTS security INTEGER NOT NULL DEFAULT 0`)
+      await db.query('INSERT INTO managed_schema_version VALUES (5)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 6')).rows.length === 0) {
+      await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS slug TEXT')
+      const { rows } = await db.query('SELECT id, slug FROM managed_bundle ORDER BY id')
+      for (const row of allocateMissingSlugs(rows as { id: string; slug: string | null }[])) {
+        await db.query('UPDATE managed_bundle SET slug = $1 WHERE id = $2', [row.slug, row.id])
+      }
+      await db.query(`ALTER TABLE managed_bundle ALTER COLUMN slug SET NOT NULL;
+        CREATE UNIQUE INDEX IF NOT EXISTS managed_bundle_slug_idx ON managed_bundle(slug);
+        INSERT INTO managed_schema_version VALUES (6)`)
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 7')).rows.length === 0) {
+      await db.query("ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS repo_directory TEXT NOT NULL DEFAULT ''")
+      await db.query('INSERT INTO managed_schema_version VALUES (7)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 8')).rows.length === 0) {
+      await db.query('CREATE INDEX IF NOT EXISTS managed_report_hash_idx ON managed_report(sha256, uploaded_at, id)')
+      await db.query('INSERT INTO managed_schema_version VALUES (8)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 9')).rows.length === 0) {
+      await db.query(postgresSchema(STORAGE_SCHEMA))
+      for (const table of ['managed_report', 'managed_bundle']) {
+        await db.query(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS data_key TEXT, ADD COLUMN IF NOT EXISTS storage_encrypted INTEGER NOT NULL DEFAULT 0`)
+      }
+      await db.query('ALTER TABLE managed_user ADD COLUMN IF NOT EXISTS gh_tokens_encrypted INTEGER NOT NULL DEFAULT 0')
+      await db.query('INSERT INTO managed_schema_version VALUES (9)')
+    }
+    await db.query(postgresSchema(LINK_REPORT_SCHEMA))
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 10')).rows.length === 0) {
+      await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (10)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 11')).rows.length === 0) {
+      await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
+    }
+    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews, migrateGithubLinks, migrateRepositoryDependencyReviews,
+      migrateRepositoryDependencyReviewLockfiles, migrateRepoUploadIndexes, migrateDependencyReviewShasums, migrateDependencyReviewPatches]) await migrate(db)
+    await db.query('COMMIT')
+  } catch (err) {
+    await db.query('ROLLBACK')
+    throw err
+  }
+}
+
+async function createUploadTrigger(db: PgConnection, type: string, createTrigger = true): Promise<void> {
+  await db.query(`CREATE OR REPLACE FUNCTION managed_${type}_activity_insert() RETURNS trigger LANGUAGE plpgsql AS $$
+    BEGIN
+      INSERT INTO managed_activity (id, kind, actor, action, repo, report_id, report, at, bundle_id, actor_id)
+      VALUES ('${type}-upload:' || NEW.id, 'upload',
+        COALESCE(NEW.uploaded_by_login, (SELECT login FROM managed_user WHERE id = NEW.uploaded_by)),
+        ${uploadAction(type, 'NEW')}, (SELECT full_name FROM managed_selected_repo WHERE repo_id = NEW.repo_id),
+        ${type === 'report' ? 'NEW.id' : 'NULL'}, NEW.filename, NEW.uploaded_at,
+        ${type === 'bundle' ? 'NEW.id' : 'NULL'}, NEW.uploaded_by);
+      RETURN NEW;
+    END $$;`)
+  if (createTrigger) {
+    await db.query(`CREATE TRIGGER managed_${type}_activity AFTER INSERT ON managed_${type}
+      FOR EACH ROW EXECUTE FUNCTION managed_${type}_activity_insert();`)
+  }
+}
+
+function requestConnections(connect: PgConnect) {
+  const requests = new AsyncLocalStorage<{ connection?: PgConnection; queue: Promise<unknown>; ended: boolean }>()
+  async function withConnection<T>(work: (db: PgConnection) => Promise<T>): Promise<T> {
+    const request = requests.getStore()
+    if (!request || request.ended) {
+      const connection = await connect()
+      let result: T
+      try { result = await work(connection) }
+      catch (error) { await connection.release(true).catch(() => {}); throw error }
+      await connection.release()
+      return result
+    }
+    // Serialize transactions on the leased connection, never interleave BEGINs
+    // from concurrent Blob/catalog tasks. Remote Blob reads remain concurrent.
+    const result = request.queue.then(async () => {
+      const connection = request.connection ??= await connect()
+      try { return await work(connection) }
+      catch (error) {
+        delete request.connection
+        await connection.release(true).catch(() => {})
+        throw error
+      }
+    })
+    request.queue = result.catch(() => {})
+    return result
+  }
+  async function withRequest<T>(work: () => Promise<T>): Promise<T> {
+    if (requests.getStore()) return work()
+    const request: { connection?: PgConnection; queue: Promise<unknown>; ended: boolean } = { queue: Promise.resolve(), ended: false }
+    let failed = false
+    try { return await requests.run(request, work) }
+    catch (error) { failed = true; throw error }
+    finally {
+      request.ended = true
+      await request.queue
+      if (failed) await request.connection?.release(true).catch(() => {})
+      else await request.connection?.release()
+    }
+  }
+  return { withConnection, withRequest }
+}
+
+// Exposed for parity tests against real PostgreSQL semantics via PGlite.
+export async function openPostgresManagedDb(leased: PgConnect, options: ManagedDbOptions = {}, reuseConnections = false): Promise<ManagedDb> {
+  // Each statement told in its request's Server-Timing (request-timing.ts).
+  const connect: PgConnect = async () => {
+    const connection = await leased()
+    return { query: (sql, params) => { countStatement(); return connection.query(sql, params) }, release: discard => connection.release(discard) }
+  }
+  const initial = await connect()
+  try { await initialize(initial) } catch (err) { await initial.release(true).catch(() => {}); throw err }
+  await initial.release()
+  const { withConnection, withRequest } = requestConnections(connect)
+  const context = new AsyncLocalStorage<PgConnection>()
+  let closed = false
+  const driver: ManagedSqlDriver = {
+    prepare(source) {
+      const { sql, names } = postgresSql(source)
+      async function query(args: unknown[]) {
+        const db = context.getStore()
+        if (!db) throw new Error('Managed query outside transaction')
+        const values = names.length > 0 ? names.map(name => (args[0] as Record<string, unknown>)[name])
+          : args.length === 1 && typeof args[0] === 'object' && args[0] !== null ? [] : args
+        const result = await db.query(sql, values)
+        // Postgres int8 is returned as text by node-postgres/Neon. All store
+        // numbers are JS safe integers (timestamps, IDs, sizes and sequences).
+        for (const field of result.fields ?? []) {
+          if (field.dataTypeID !== 20) continue
+          for (const row of result.rows) {
+            if (row[field.name] == null) continue
+            const value = Number(row[field.name])
+            if (!Number.isSafeInteger(value)) throw new Error('Managed integer exceeds safe range')
+            row[field.name] = value
+          }
+        }
+        return result
+      }
+      return {
+        get: async (...args) => (await query(args)).rows[0],
+        all: async (...args) => (await query(args)).rows,
+        run: async (...args) => ({ changes: (await query(args)).rowCount ?? 0 }),
+      }
+    },
+    async scope(write, work, { lock = write, statement = false } = {}) {
+      if (closed) throw new Error('Managed database is closed')
+      let committed = false
+      try { return await withConnection(async db => {
+        if (statement) return context.run(db, work)
+        let commitAttempted = false
+        try {
+          await db.query(write ? 'BEGIN' : 'BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY')
+          if (lock) await db.query(LOCK)
+          const result = await context.run(db, work)
+          commitAttempted = true
+          await db.query('COMMIT')
+          committed = true
+          return result
+        } catch (err) {
+          await db.query('ROLLBACK').catch(() => {})
+          if (write && commitAttempted) throw new Error('Managed commit outcome is uncertain', { cause: err })
+          throw err
+        }
+      }) } catch (error) {
+        if (write && committed) throw new Error('Managed commit outcome is uncertain', { cause: error })
+        throw error
+      }
+    },
+    close() { closed = true },
+  }
+  const methods = scopeManagedMethods(createManagedMethods(driver, options), driver)
+  if (reuseConnections) methods.withRequest = withRequest
+  return methods
+}
+
+// Idle connections stay open this long between leases, so a warm instance's
+// requests and feed polls (three seconds apart) skip the TLS, WebSocket and
+// Postgres handshake a new connection repeats.
+const NEON_POOL_IDLE_MS = 5_000
+
+type NeonPoolClient = {
+  query: PgConnection['query']
+  release(discard?: boolean): void
+  on(event: string, listener: (...args: unknown[]) => void): void
+}
+export type NeonPool = {
+  connect(): Promise<NeonPoolClient>
+  end(): Promise<void>
+  on(event: string, listener: (...args: unknown[]) => void): void
+}
+
+// `attachPool` is Vercel's attachDatabasePool on serverless instances: each
+// release keeps the invocation alive until idle connections have closed, so
+// no socket survives a frozen instance.
+export async function openNeonManagedDb(url: string, options: ManagedDbOptions = {}, attachPool?: (pool: NeonPool) => void): Promise<ManagedDb> {
+  // Reuse the e2e optional-driver boundary.
+  const { Pool, neonConfig } = await import('../server-e2e/neon-driver.ts') as unknown as {
+    Pool: new (config: { connectionString: string; max: number; idleTimeoutMillis: number }) => NeonPool
+    neonConfig: { webSocketConstructor: typeof WebSocket }
+  }
+  neonConfig.webSocketConstructor = WebSocket
+  // Leases stay unbounded, one per request or operation as before: a cap would
+  // stall a request that holds one while it awaits work needing another.
+  const pool = new Pool({ connectionString: url, max: Infinity, idleTimeoutMillis: NEON_POOL_IDLE_MS })
+  // The pool evicts an idle connection the server closed. Neither that nor a
+  // remote disconnect while leased may become an unhandled EventEmitter error;
+  // a leased one must instead reject its next query, and is then discarded.
+  pool.on('error', () => {})
+  attachPool?.(pool)
+  const failed = new WeakSet<NeonPoolClient>(), watched = new WeakSet<NeonPoolClient>()
+  let ending: Promise<void> | undefined
+  const end = () => ending ??= pool.end()
+  let db: ManagedDb
+  try {
+    db = await openPostgresManagedDb(async () => {
+      // A lease's wait told in its request's Server-Timing: a new connection's
+      // TLS, WebSocket and Postgres handshake, where the pool had none idle.
+      const client = await timed('conn', () => pool.connect())
+      if (!watched.has(client)) { watched.add(client); client.on('error', () => { failed.add(client) }) }
+      return { query: (sql, params) => client.query(sql, params),
+        release: discard => Promise.try(() => client.release(discard === true || failed.has(client))) }
+    }, options, true)
+  } catch (err) { await end().catch(() => {}); throw err }
+  const close = db.close
+  return { ...db, async close() { try { await close() } finally { await end() } } }
+}