@rotorsoft/act-pg 1.13.16 → 1.13.18

package/dist/index.js

@@ -6,7 +6,8 @@ import {
   log,
   SNAP_EVENT,
   StoreError,
-  TOMBSTONE_EVENT
+  TOMBSTONE_EVENT,
+  ValidationError
 } from "@rotorsoft/act";
 import {
   decrypt,
@@ -26,6 +27,7 @@ var scopedTypes = {
 };
 var SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 var PG_UNIQUE_VIOLATION = "23505";
+var PG_NUL_BYTE = /* @__PURE__ */ new Set(["22P05", "22021"]);
 var NOTIFY_CHANNEL_PREFIX = "act_commit";
 var NOTIFY_MAX_PAYLOAD_BYTES = 8e3;
 var NOTIFY_RECONNECT_BASE_MS = 250;
@@ -239,6 +241,9 @@ var PostgresStore = class {
     const client = await this._client("seed");
     try {
       await client.query("BEGIN");
+      await client.query(`SELECT pg_advisory_xact_lock(hashtext($1))`, [
+        this.config.schema
+      ]);
       await client.query(`SELECT pg_advisory_xact_lock(hashtext($1))`, [
         `${this.config.schema}.${this.config.table}`
       ]);
@@ -281,6 +286,11 @@ var PostgresStore = class {
         ON ${this._fqt} (stream COLLATE pg_catalog."default", id)
         WHERE name = '${SNAP_EVENT}';`
       );
+      await client.query(
+        `CREATE INDEX IF NOT EXISTS "${this.config.table}_stream_id_ix"
+        ON ${this._fqt} (stream COLLATE pg_catalog."default", id)
+        WHERE name <> '${SNAP_EVENT}';`
+      );
       await client.query(
         `CREATE TABLE IF NOT EXISTS ${this._fqs} (
           stream text COLLATE pg_catalog."default" PRIMARY KEY,
@@ -573,6 +583,13 @@ var PostgresStore = class {
             expectedVersion ?? -1
           );
         }
+        if (PG_NUL_BYTE.has(error?.code ?? "")) {
+          throw new ValidationError(
+            stream,
+            msgs,
+            `Postgres cannot store a NUL byte (\\u0000). One of the ${msgs.length} event(s) committed to "${stream}" (${msgs.map((m) => String(m.name)).join(", ")}) carries one in its name, data, meta or pii. InMemory and SQLite accept it, so this commit would have succeeded there \u2014 strip NUL bytes at the edge where the data enters. Driver: ${error.message}`
+          );
+        }
         throw error;
       }
     } finally {
@@ -608,29 +625,66 @@ var PostgresStore = class {
         -- and lock EVERY claimable stream for this transaction, starving
         -- overlapping competing consumers. We only lock the small
         -- lagging+leading candidate slice, down in the "locked" CTE.
-        available AS (
+        -- Eligibility, split by SOURCE CLASS rather than expressed as one
+        -- disjunction (#1448). The three classes are mutually exclusive, so
+        -- the UNION ALL returns exactly what the old OR-chain did \u2014 but each
+        -- arm now carries a single, planner-legible predicate.
+        --
+        -- That matters for one arm in particular. Written as
+        -- "s.source IS NULL OR (... AND e.stream = s.source) OR (... ~ ...)",
+        -- the equality is buried inside a disjunction and is NOT sargable:
+        -- no index on (stream, id) can serve it, so every probe degenerated
+        -- into a forward scan of the pk from the stream's watermark. With
+        -- the classes separated, the literal arm \u2014 every per-aggregate
+        -- .to(e => ({target: e.stream})) reaction, i.e. the overwhelming
+        -- majority \u2014 becomes an index seek on (stream, id).
+        --
+        -- Measured at 10k subscribed streams with 10 pending: 5,792 ms
+        -- before, 10.3 ms after. See libs/act-pg/PERFORMANCE.md for #1448.
+        eligible AS (
           SELECT stream, source, at, priority, lane
           FROM ${this._fqs} s
           WHERE blocked = false
             ${lane_clause}
             AND (leased_by IS NULL OR leased_until <= NOW())
             AND (deferred_at IS NULL OR deferred_at <= NOW())
-            AND (s.at < 0 OR EXISTS (
+        ),
+        available AS (
+          -- Never processed: claimable without probing the log at all.
+          SELECT stream, source, at, priority, lane FROM eligible WHERE at < 0
+          UNION ALL
+          -- Source-less subscription: any non-snapshot event past the
+          -- watermark counts, so the id index alone answers it.
+          SELECT stream, source, at, priority, lane FROM eligible s
+          WHERE s.at >= 0 AND s.source IS NULL
+            AND EXISTS (
               SELECT 1 FROM ${this._fqt} e
-              WHERE e.id > s.at
-                AND e.name <> '${SNAP_EVENT}'
-                -- Literal source (no regex metacharacter) matches by
-                -- equality \u2014 index-friendly, and exact so "s1" never
-                -- claims "s12". A pattern source (e.g. '^(A|B)$') matches
-                -- with the POSIX regex operator so the calculator's static
-                -- regex reaction is claimed for every stream it anchors.
-                AND (
-                  s.source IS NULL
-                  OR (s.source !~ '${SOURCE_METACHARACTER_CLASS}' AND e.stream = s.source)
-                  OR (s.source ~ '${SOURCE_METACHARACTER_CLASS}' AND e.stream ~ s.source)
-                )
-              LIMIT 1
-            ))
+              WHERE e.id > s.at AND e.name <> '${SNAP_EVENT}' LIMIT 1
+            )
+          UNION ALL
+          -- Literal source (no regex metacharacter): exact equality, so
+          -- "s1" never claims "s12", and (stream, id) is usable.
+          SELECT stream, source, at, priority, lane FROM eligible s
+          WHERE s.at >= 0 AND s.source IS NOT NULL
+            AND s.source !~ '${SOURCE_METACHARACTER_CLASS}'
+            AND EXISTS (
+              SELECT 1 FROM ${this._fqt} e
+              WHERE e.stream = s.source AND e.id > s.at
+                AND e.name <> '${SNAP_EVENT}' LIMIT 1
+            )
+          UNION ALL
+          -- Pattern source (e.g. '^(A|B)$'): POSIX match, so the
+          -- calculator's static regex reaction is claimed for every stream
+          -- it anchors. Unavoidably a scan \u2014 but only for the subscriptions
+          -- that actually declare a pattern.
+          SELECT stream, source, at, priority, lane FROM eligible s
+          WHERE s.at >= 0 AND s.source IS NOT NULL
+            AND s.source ~ '${SOURCE_METACHARACTER_CLASS}'
+            AND EXISTS (
+              SELECT 1 FROM ${this._fqt} e
+              WHERE e.id > s.at AND e.name <> '${SNAP_EVENT}'
+                AND e.stream ~ s.source LIMIT 1
+            )
         ),
         -- Priority lanes (ACT-102): higher priority first, then
         -- lagging-watermark order. With everyone at priority=0 the