@steve31415/baselib 3.5.0 → 3.7.0

package/dist/db.d.ts

@@ -20,10 +20,27 @@ export interface PoolOptions {
      *  default is to wait forever, which turns pool starvation into a silent
      *  hang instead of an error). */
     connectionTimeoutMillis?: number;
+    /** Server-side cap on any single SQL statement, sent in each connection's
+     *  startup packet (default DEFAULT_STATEMENT_TIMEOUT_MS; 0 disables). */
+    statementTimeoutMillis?: number;
     /** Receives idle-client errors (see logPoolErrors). Without one they go to
      *  stderr — on the Cloud Logging backstop, but not in Axiom. */
     logger?: Logger;
 }
+/** Why a fleet-wide statement timeout (mirror, 2026-09-08): a transaction an
+ * app deliberately holds open across an application await (mirror's job
+ * claims) can sit in a lock cycle whose closing edge lives in Node —
+ * invisible to Postgres's deadlock detector, so it is never broken, and
+ * every statement queued behind it waits forever (mirror's twitter
+ * ingestion was silently down ~12 h). With the cap, blocked statements
+ * abort (SQLSTATE 57014), their transactions roll back, and the pile-up
+ * self-heals. 10 minutes is deliberately far above any healthy statement in
+ * the fleet (milliseconds to seconds): never cancel legitimate work, just
+ * bound the pathological case (Steve, 2026-09-08). A migration that
+ * legitimately needs longer (huge index build) should start with
+ * `set local statement_timeout = 0` — migrate() runs each file in its own
+ * transaction, so the override scopes to that migration. */
+export declare const DEFAULT_STATEMENT_TIMEOUT_MS: number;
 /** pg-pool re-emits an idle client's socket error as its own 'error' event —
  * in production "Connection terminated unexpectedly" when Cloud SQL closes an
  * idle connection. Unhandled, that event throws and takes the process down

package/dist/db.js

@@ -30,6 +30,20 @@ export async function cloudSqlClientOptions(instance, auth) {
     });
     return { options, connector };
 }
+/** Why a fleet-wide statement timeout (mirror, 2026-09-08): a transaction an
+ * app deliberately holds open across an application await (mirror's job
+ * claims) can sit in a lock cycle whose closing edge lives in Node —
+ * invisible to Postgres's deadlock detector, so it is never broken, and
+ * every statement queued behind it waits forever (mirror's twitter
+ * ingestion was silently down ~12 h). With the cap, blocked statements
+ * abort (SQLSTATE 57014), their transactions roll back, and the pile-up
+ * self-heals. 10 minutes is deliberately far above any healthy statement in
+ * the fleet (milliseconds to seconds): never cancel legitimate work, just
+ * bound the pathological case (Steve, 2026-09-08). A migration that
+ * legitimately needs longer (huge index build) should start with
+ * `set local statement_timeout = 0` — migrate() runs each file in its own
+ * transaction, so the override scopes to that migration. */
+export const DEFAULT_STATEMENT_TIMEOUT_MS = 10 * 60_000;
 /** pg-pool re-emits an idle client's socket error as its own 'error' event —
  * in production "Connection terminated unexpectedly" when Cloud SQL closes an
  * idle connection. Unhandled, that event throws and takes the process down
@@ -51,6 +65,10 @@ export async function createPool(opts = {}) {
     return pool;
 }
 async function newPool(opts) {
+    // pg sends statement_timeout in the startup packet of every connection —
+    // server-enforced, no per-connection SET. A 0 is falsy, so pg omits it and
+    // the server default (no timeout) applies.
+    const statement_timeout = opts.statementTimeoutMillis ?? DEFAULT_STATEMENT_TIMEOUT_MS;
     const instance = process.env.CLOUD_SQL_INSTANCE;
     if (instance) {
         const { options: clientOpts } = await cloudSqlClientOptions(instance);
@@ -60,12 +78,18 @@ async function newPool(opts) {
             database: opts.database ?? requireEnv('DB_NAME'),
             max: opts.max ?? 3, // shared instance: default max_connections is low
             connectionTimeoutMillis: opts.connectionTimeoutMillis,
+            statement_timeout,
         });
     }
     const url = new URL(requireEnv('DATABASE_URL'));
     if (opts.database)
         url.pathname = `/${opts.database}`;
-    return new pg.Pool({ connectionString: url.toString(), max: opts.max ?? 5, connectionTimeoutMillis: opts.connectionTimeoutMillis });
+    return new pg.Pool({
+        connectionString: url.toString(),
+        max: opts.max ?? 5,
+        connectionTimeoutMillis: opts.connectionTimeoutMillis,
+        statement_timeout,
+    });
 }
 /** End a pool and resolve only once every client's connection has actually
  * closed. pg-pool's own `end()` resolves as soon as it has *asked* its idle

package/dist/email.d.ts

@@ -1,5 +1,11 @@
 import { type Logger } from './log-core.js';
 export declare const RESEND_API_URL = "https://api.resend.com/emails";
+/** An attachment in Resend's raw-API shape. `content` is standard Base64. */
+export interface EmailAttachment {
+    filename: string;
+    content: string;
+    contentType?: string;
+}
 /** An email to send. At least one of `text` / `html` must be present. */
 export interface EmailMessage {
     /** RFC 5322 from address, e.g. `Watchdog <watchdog@snewman.net>`. */
@@ -8,6 +14,7 @@ export interface EmailMessage {
     subject: string;
     text?: string;
     html?: string;
+    attachments?: EmailAttachment[];
 }
 export interface SendEmailResult {
     ok: boolean;

package/dist/email.js

@@ -1,9 +1,9 @@
 // Transactional email through Resend — the fleet's one email path for
 // system-generated mail (Steve's ruling 2026-09-03, migration decision log):
-// named senders on the verified snewman.net domain (`Watchdog
-// <watchdog@snewman.net>`, `Lurch <steve@snewman.net>`, …), key from Secret
-// Manager `shared--resend-api-key`. Gmail via Mirror2's token broker stays
-// only for mail that is genuinely Steve-to-Steve (Digest2).
+// app-specific senders on the verified snewman.net domain (`Watchdog
+// <watchdog@snewman.net>`, `Lurch <lurch@snewman.net>`, …), key from Secret
+// Manager `shared--resend-api-key`. Gmail is reserved for messages initiated
+// directly by the user (for example, Radar's Reply action).
 //
 // Ported from the old-world package @steve31415/resend-mailer 1.0.0
 // (plasticine-apps/resend-mailer@5148649) minus its D1 outbox: the new-world
@@ -29,6 +29,7 @@ export async function sendEmail(msg, deps) {
         subject: truncate(msg.subject, 200),
         textLength: msg.text?.length ?? 0,
         htmlLength: msg.html?.length ?? 0,
+        attachmentCount: msg.attachments?.length ?? 0,
         ...deps.context,
     };
     const preview = { text: truncate(msg.text ?? '', 500), html: truncate(msg.html ?? '', 500) };
@@ -53,6 +54,15 @@ export async function sendEmail(msg, deps) {
                 subject: msg.subject,
                 ...(msg.text !== undefined ? { text: msg.text } : {}),
                 ...(msg.html !== undefined ? { html: msg.html } : {}),
+                ...(msg.attachments?.length
+                    ? {
+                        attachments: msg.attachments.map((attachment) => ({
+                            filename: attachment.filename,
+                            content: attachment.content,
+                            ...(attachment.contentType ? { content_type: attachment.contentType } : {}),
+                        })),
+                    }
+                    : {}),
             }),
         });
         const elapsedMs = Date.now() - start;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.5.0",
+  "version": "3.7.0",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",