@tstdl/base 0.93.197 → 0.93.199

package/cryptography/cryptography.js

@@ -74,7 +74,15 @@ export function sign(algorithm, key, data) {
             length: algorithm.outputLength * 8,
         };
     }
-    const arrayBufferPromise = globalThis.crypto.subtle.sign(finalAlgorithm, key, bytes);
+    const arrayBufferPromise = (async () => {
+        let arrayBuffer = await globalThis.crypto.subtle.sign(finalAlgorithm, key, bytes);
+        // TODO: TEMPORARY because of bug in node 25.9
+        if (isNotString(algorithm) && algorithm.name.startsWith('KMAC') && ('outputLength' in algorithm) && (arrayBuffer.byteLength == algorithm.outputLength / 8)) {
+            const bitAlgorithm = { ...finalAlgorithm, outputLength: algorithm.outputLength * 8 };
+            arrayBuffer = await globalThis.crypto.subtle.sign(bitAlgorithm, key, bytes);
+        }
+        return arrayBuffer;
+    })();
     const result = {
         toBuffer: async () => await arrayBufferPromise,
         toUint8Array: async () => new Uint8Array(await arrayBufferPromise),
@@ -104,7 +112,13 @@ export async function verify(algorithm, key, signature, data) {
             length: algorithm.outputLength * 8,
         };
     }
-    return await globalThis.crypto.subtle.verify(finalAlgorithm, key, signatureBytes, dataBytes);
+    let verified = await globalThis.crypto.subtle.verify(finalAlgorithm, key, signatureBytes, dataBytes);
+    // TODO: TEMPORARY because of bug in node 25.9
+    if (!verified && isNotString(algorithm) && algorithm.name.startsWith('KMAC') && ('outputLength' in algorithm)) {
+        const bitAlgorithm = { ...finalAlgorithm, outputLength: algorithm.outputLength * 8 };
+        verified = await globalThis.crypto.subtle.verify(bitAlgorithm, key, signatureBytes, dataBytes);
+    }
+    return verified;
 }
 export async function importKey(format, keyData, algorithm, extractable, keyUsages) {
     return await globalThis.crypto.subtle.importKey(format, keyData, algorithm, extractable, keyUsages);

package/cryptography/module.js

@@ -72,10 +72,20 @@ export class DerivedKey {
         assertDefined(this.#keyUsages, 'This key was not configured to derive a CryptoKey. Use injectDerivedCryptoKey().');
         if (isUndefined(this.#derivedKey)) {
             this.#derivedKey = (async () => {
-                const rawBytes = await this.#computeRawBytes();
+                let rawBytes = await this.#computeRawBytes();
                 try {
                     return await importKey('raw-secret', rawBytes, this.#keyOptions, false, this.#keyUsages);
                 }
+                catch (error) {
+                    // TODO: TEMPORARY because of bug in node 25.9
+                    if (error instanceof Error && error.name == 'DataError' && error.message.includes('key length')) {
+                        const bitAlgorithm = { ...this.#kmacParams, outputLength: this.#kmacParams.outputLength * 8 };
+                        const baseKey = await this.#baseKey;
+                        rawBytes = await sign(bitAlgorithm, baseKey, this.#salt).toBuffer();
+                        return await importKey('raw-secret', rawBytes, this.#keyOptions, false, this.#keyUsages);
+                    }
+                    throw error;
+                }
                 finally {
                     crypto.getRandomValues(new Uint8Array(rawBytes));
                 }

package/examples/document-management/main.js

@@ -13,6 +13,7 @@ import { Application } from '../../application/application.js';
 import { provideInitializer, provideModule, provideSignalHandler } from '../../application/index.js';
 import { configureAudit } from '../../audit/module.js';
 import { configurePostgresCircuitBreaker } from '../../circuit-breaker/postgres/module.js';
+import { configureSecrets } from '../../cryptography/module.js';
 import { DocumentManagementAuthorizationService } from '../../document-management/index.js';
 import { configureDocumentManagement } from '../../document-management/server/configure.js';
 import { DocumentCategoryTypeService, DocumentCollectionService, DocumentManagementAncillaryService, DocumentManagementApiController, DocumentRequestService } from '../../document-management/server/index.js';
@@ -95,6 +96,9 @@ function bootstrap() {
     configurePostgresRateLimiter();
     configureLocalMessageBus();
     configureDefaultSignalsImplementation();
+    configureSecrets({
+        key: 'document-management-test',
+    });
     configureGenkit({
         gemini: {
             apiKey: config.ai.apiKey,

package/orm/enums.d.ts

@@ -1,5 +1,7 @@
 import type { PgEnum } from 'drizzle-orm/pg-core';
 import type { Enumeration, EnumerationValue, UnionToTuple } from '../types/types.js';
-export declare function registerEnum(enumeration: Enumeration, name: string): void;
-export declare function getEnumName(enumeration: Enumeration): string | undefined;
+export declare function registerEnum<T extends Enumeration>(enumeration: T, instance: PgEnumFromEnumeration<T>): void;
+export declare function getRegisteredEnum<T extends Enumeration>(enumeration: T): PgEnumFromEnumeration<T> | undefined;
+export declare function tryGetEnumName(enumeration: Enumeration): string | undefined;
+export declare function getEnumName(enumeration: Enumeration): string;
 export type PgEnumFromEnumeration<T extends Enumeration> = PgEnum<Extract<UnionToTuple<`${EnumerationValue<T>}`>, [string, ...string[]]>>;

package/orm/enums.js

@@ -1,14 +1,25 @@
-import { tryGetEnumName } from '../enumeration/index.js';
+import { tryGetEnumName as tryGetBaseEnumName } from '../enumeration/index.js';
 import { toSnakeCase } from '../utils/string/casing.js';
 import { isUndefined } from '../utils/type-guards.js';
-const enumNames = new Map();
-export function registerEnum(enumeration, name) {
-    enumNames.set(enumeration, toSnakeCase(name));
+const enumInstances = new Map();
+export function registerEnum(enumeration, instance) {
+    enumInstances.set(enumeration, instance);
+}
+export function getRegisteredEnum(enumeration) {
+    return enumInstances.get(enumeration);
+}
+export function tryGetEnumName(enumeration) {
+    const instance = enumInstances.get(enumeration);
+    if (isUndefined(instance)) {
+        const baseName = tryGetBaseEnumName(enumeration);
+        return isUndefined(baseName) ? undefined : toSnakeCase(baseName);
+    }
+    return instance.enumName;
 }
 export function getEnumName(enumeration) {
-    const baseName = enumNames.get(enumeration) ?? tryGetEnumName(enumeration);
-    if (isUndefined(baseName)) {
-        return undefined;
+    const name = tryGetEnumName(enumeration);
+    if (isUndefined(name)) {
+        throw new Error('Unable to determine enum name. Make sure the enum is registered.');
     }
-    return toSnakeCase(baseName);
+    return name;
 }

package/orm/server/database-schema.js

@@ -1,4 +1,3 @@
-import { isDefined } from '../../utils/type-guards.js';
 import { registerEnum } from '../enums.js';
 import { getDrizzleTableFromType, getPgEnum } from './drizzle/schema-converter.js';
 /**
@@ -33,10 +32,9 @@ export class DatabaseSchema {
      * @returns The Drizzle enum object.
      */
     getEnum(enumeration, name) {
-        if (isDefined(name)) {
-            registerEnum(enumeration, name);
-        }
-        return getPgEnum(this.name, enumeration); // eslint-disable-line @typescript-eslint/no-unsafe-return
+        const pgEnum = getPgEnum(this.name, enumeration, name);
+        registerEnum(enumeration, pgEnum);
+        return pgEnum;
     }
 }
 /**

package/orm/server/drizzle/schema-converter.d.ts

@@ -12,7 +12,7 @@ export declare function getTableColumnDefinitions(table: PgTableWithColumns<any>
 export declare function getColumnDefinitionsMap(table: PgTableWithColumns<any>): ColumnDefinitionsMap;
 export declare function _getDrizzleTableFromType<T extends EntityType, S extends string>(type: T, fallbackSchemaName?: S): PgTableFromType<T, S>;
 export declare function isTableOwning(type: AbstractConstructor): boolean;
-export declare function getPgEnum(schema: string | PgSchema, enumeration: Enumeration, context?: ConverterContext): PgEnum<[string, ...string[]]>;
+export declare function getPgEnum(schema: string | PgSchema, enumeration: Enumeration, contextOrName?: ConverterContext | string): PgEnum<[string, ...string[]]>;
 export declare function getPrimaryKeyColumnDefinitions(type: EntityType, table: PgTableFromType, columnDefinitions?: ColumnDefinition[], columnDefinitionsMap?: ColumnDefinitionsMap): ColumnDefinition[];
 export declare function getPrimaryKeyColumns(type: EntityType, table: PgTableFromType, columnDefinitions?: ColumnDefinition[], columnDefinitionsMap?: ColumnDefinitionsMap): PgColumn[];
 export {};

package/orm/server/drizzle/schema-converter.js

@@ -20,7 +20,7 @@ import { assertDefined, assertDefinedPass, assertUint8ArrayPass, isArray, isDefi
 import { resolveValueOrProvider } from '../../../utils/value-or-provider.js';
 import { bytea, numericDate, timestamp, tsvector } from '../../data-types/index.js';
 import { TenantBaseEntity, TenantEntity } from '../../entity.js';
-import { getEnumName } from '../../enums.js';
+import { registerEnum, tryGetEnumName } from '../../enums.js';
 import { JsonSchema, NumericDateSchema, NumericSchema, TimestampSchema, TsVectorSchema, UuidSchema } from '../../schemas/index.js';
 import { getEntitySchema, getEntityTableName, getInheritanceMetadata, getTableReflectionDatas, isChildEntity } from '../../utils.js';
 import { decryptBytes, encryptBytes } from '../encryption.js';
@@ -474,21 +474,22 @@ function getPgColumnBuilder(columnName, dbSchema, schema, _reflectionData, conte
     });
 }
 const enums = new MultiKeyMap();
-export function getPgEnum(schema, enumeration, context) {
+export function getPgEnum(schema, enumeration, contextOrName) {
     const dbSchema = isString(schema) ? getDbSchema(schema) : schema;
-    const enumName = getEnumName(enumeration);
+    const enumName = isString(contextOrName) ? toSnakeCase(contextOrName) : tryGetEnumName(enumeration);
     if (isUndefined(enumName)) {
         const errorMessage = 'Enum is not registered. Please register it using `databaseSchema.getEnum(MyEnum)` before use.';
-        if (isDefined(context)) {
-            throw new Error(`${errorMessage} (type: ${context.type.name}, property: ${context.property})`);
+        if (isDefined(contextOrName) && !isString(contextOrName)) {
+            throw new Error(`${errorMessage} (type: ${contextOrName.type.name}, property: ${contextOrName.property})`);
         }
         throw new Error(errorMessage);
     }
     const values = (isArray(enumeration) ? enumeration : enumValues(enumeration))
         .map((value) => value.toString());
     const dbEnum = dbSchema.enum(enumName, values);
-    if (enums.has([dbSchema.schemaName, enumeration])) {
+    if (!enums.has([dbSchema.schemaName, enumeration])) {
         enums.set([dbSchema.schemaName, enumeration], dbEnum);
+        registerEnum(enumeration, dbEnum);
     }
     return dbEnum;
 }

package/orm/sqls/sqls.d.ts

@@ -66,7 +66,7 @@ export declare const RANDOM_UUID_V7: SQL<Uuid>;
 export declare const SQL_TRUE: SQL<boolean>;
 export declare const SQL_FALSE: SQL<boolean>;
 export declare const SQL_NULL: SQL<null>;
-export declare function enumValue<T extends EnumerationObject>(enumeration: T, dbEnum: PgEnumFromEnumeration<T> | string | null, value: EnumerationValue<T>): SQL<string>;
+export declare function enumValue<T extends EnumerationObject>(enumeration: T | PgEnumFromEnumeration<T> | string, value: EnumerationValue<T>, schema?: string): SQL<string>;
 /**
  * Generates a SQL `CASE` expression to enforce strict, mutually exclusive column usage based on a discriminator value.
  *

package/orm/sqls/sqls.js

@@ -8,8 +8,8 @@ import { and, Column, eq, isSQLWrapper, sql, isNotNull as sqlIsNotNull, isNull a
 import { match, P } from 'ts-pattern';
 import { distinct, toArray } from '../../utils/array/array.js';
 import { objectEntries, objectValues } from '../../utils/object/object.js';
-import { assertDefined, isArray, isBoolean, isDefined, isInstanceOf, isLiteralObject, isNotNull, isNull, isNullOrUndefined, isNumber, isString } from '../../utils/type-guards.js';
-import { getEnumName } from '../enums.js';
+import { assertString, isArray, isBoolean, isDefined, isFunction, isInstanceOf, isLiteralObject, isNotNull, isNotString, isNull, isNullOrUndefined, isNumber, isString } from '../../utils/type-guards.js';
+import { getEnumName, getRegisteredEnum } from '../enums.js';
 import { caseWhen } from './case-when.js';
 const isJsonbSymbol = Symbol('isJsonb');
 function markAsJsonb(value) {
@@ -36,13 +36,20 @@ export const RANDOM_UUID_V7 = sql `uuidv7()`;
 export const SQL_TRUE = sql `TRUE`;
 export const SQL_FALSE = sql `FALSE`;
 export const SQL_NULL = sql `NULL`;
-export function enumValue(enumeration, dbEnum, value) {
-    if (isNull(dbEnum)) {
+export function enumValue(enumeration, value, schema) {
+    if (isFunction(enumeration)) {
+        return sql `'${sql.raw(String(value))}'::${enumeration}`;
+    }
+    if (isNotString(enumeration)) {
+        const instance = getRegisteredEnum(enumeration);
+        if (isDefined(instance)) {
+            return enumValue(instance, value, schema);
+        }
         const enumName = getEnumName(enumeration);
-        assertDefined(enumName, 'Enumeration is not registered.');
-        return enumValue(enumeration, enumName, value);
+        return enumValue(enumName, value, schema);
     }
-    const enumType = isString(dbEnum) ? sql `"${sql.raw(dbEnum)}"` : dbEnum;
+    assertString(enumeration, 'Invalid enumeration provided. Expected a string, a registered enum object, or a Drizzle PgEnum instance.');
+    const enumType = isDefined(schema) ? sql `${sql.identifier(schema)}.${sql.identifier(enumeration)}` : sql.identifier(enumeration);
     return sql `'${sql.raw(String(value))}'::${enumType}`;
 }
 /**
@@ -80,7 +87,7 @@ export function exclusiveColumn(enumeration, discriminator, conditionMapping) {
     // 2. Iterate and build conditions safely
     for (const [key, value] of objectEntries(conditionMapping)) {
         if (isNull(value)) {
-            kaseWhen.when(enumValue(enumeration, null, key), SQL_FALSE);
+            kaseWhen.when(enumValue(enumeration, key), SQL_FALSE);
             continue;
         }
         const conditions = [];
@@ -109,7 +116,7 @@ export function exclusiveColumn(enumeration, discriminator, conditionMapping) {
             }
         }
         const finalCondition = and(...conditions) ?? SQL_TRUE;
-        kaseWhen.when(enumValue(enumeration, null, key), finalCondition);
+        kaseWhen.when(enumValue(enumeration, key), finalCondition);
     }
     return kaseWhen.else(SQL_FALSE);
 }
@@ -146,7 +153,7 @@ export function enumerationCaseWhen(enumeration, discriminator, conditionMapping
             // Check for both a single Column OR an Array of Columns
             .when((val) => isInstanceOf(val, Column) || (isArray(val) && val.every((v) => isInstanceOf(v, Column))), (cols) => defaultColumnCondition(cols))
             .otherwise((rawSql) => rawSql);
-        kaseWhen.when(enumValue(enumeration, null, key), condition);
+        kaseWhen.when(enumValue(enumeration, key), condition);
     }
     return kaseWhen.else(SQL_FALSE);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tstdl/base",
-  "version": "0.93.197",
+  "version": "0.93.199",
   "author": "Patrick Hein",
   "publishConfig": {
     "access": "public"
@@ -153,8 +153,8 @@
     "type-fest": "^5.5"
   },
   "peerDependencies": {
-    "@aws-sdk/client-s3": "^3.1025",
-    "@aws-sdk/s3-request-presigner": "^3.1025",
+    "@aws-sdk/client-s3": "^3.1026",
+    "@aws-sdk/s3-request-presigner": "^3.1026",
     "@genkit-ai/google-genai": "^1.31",
     "@google-cloud/storage": "^7.19",
     "@toon-format/toon": "^2.1.0",

package/task-queue/postgres/task-queue.js

@@ -112,7 +112,7 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
     #takeNewUpdate = {
         namespace: this.#namespace,
         type: sql `excluded.type`,
-        status: caseWhen(gt(sql `excluded.unresolved_schedule_dependencies`, 0), enumValue(TaskStatus, taskStatus, TaskStatus.Waiting)).else(enumValue(TaskStatus, taskStatus, TaskStatus.Pending)),
+        status: caseWhen(gt(sql `excluded.unresolved_schedule_dependencies`, 0), enumValue(taskStatus, TaskStatus.Waiting)).else(enumValue(taskStatus, TaskStatus.Pending)),
         token: null,
         priority: sql `excluded.priority`,
         idempotencyKey: sql `excluded.idempotency_key`,
@@ -187,6 +187,7 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
                 },
             }));
             const itemsWithIdempotency = entitiesWithIndex.filter((e) => isNotNull(e.entity.idempotencyKey));
+            itemsWithIdempotency.sort((a, b) => a.entity.idempotencyKey.localeCompare(b.entity.idempotencyKey));
             const itemsWithoutIdempotency = entitiesWithIndex.filter((e) => isNull(e.entity.idempotencyKey));
             const hasDependencies = itemsWithDistinctDependencies.some((item) => ((item.scheduleAfter?.length ?? 0) > 0) || ((item.completeAfter?.length ?? 0) > 0) || (isDefined(item.parentId) && (item.parentRequires != false) && !(isArray(item.parentRequires) && (item.parentRequires.length == 0))));
             const mustUseTransaction = (entitiesWithIndex.length > 1) || hasDependencies;
@@ -330,7 +331,7 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
                             .from(taskTable)
                             .where(inArray(taskTable.id, distinctDependencyIds))
                             .unionAll(session
-                            .select({ id: taskArchiveTable.id, status: sql `${enumValue(TaskStatus, taskStatus, TaskStatus.Completed)}` })
+                            .select({ id: taskArchiveTable.id, status: sql `${enumValue(taskStatus, TaskStatus.Completed)}` })
                             .from(taskArchiveTable)
                             .where(inArray(taskArchiveTable.id, distinctDependencyIds)));
                         if (dependencyStatuses.length > 0) {
@@ -382,7 +383,6 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
             decrementsToApply.set(dep.taskId, current);
         }
         const values = [...decrementsToApply]
-            .toSorted(([idA], [idB]) => idA.localeCompare(idB))
             .map(([taskId, d]) => sql `(${taskId}::uuid, ${d.schedule}::int, ${d.complete}::int)`);
         const updates = session.$with('updates').as((qb) => qb
             .select({
@@ -391,8 +391,14 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
             completeIncrement: sql `(complete)::int`.as('complete_increment'),
         })
             .from(sql `(VALUES ${sql.join(values, sql `, `)}) AS t(id, schedule, complete)`));
+        const locked = session.$with('locked').as((qb) => qb
+            .select({ id: taskTable.id })
+            .from(taskTable)
+            .innerJoin(updates, eq(taskTable.id, updates.taskId))
+            .orderBy(asc(taskTable.id))
+            .for('update'));
         const updatedRows = await session
-            .with(updates)
+            .with(updates, locked)
             .update(taskTable)
             .set({
             unresolvedScheduleDependencies: sql `${taskTable.unresolvedScheduleDependencies} + ${updates.scheduleIncrement}`,
@@ -400,7 +406,7 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
             status: caseWhen(and(eq(taskTable.status, TaskStatus.Pending), gt(sql `${taskTable.unresolvedScheduleDependencies} + ${updates.scheduleIncrement}`, 0)), TaskStatus.Waiting).else(taskTable.status),
         })
             .from(updates)
-            .where(eq(taskTable.id, updates.taskId))
+            .where(and(eq(taskTable.id, updates.taskId), inArray(taskTable.id, session.select({ id: locked.id }).from(locked))))
             .returning({ id: taskTable.id, status: taskTable.status, namespace: taskTable.namespace });
         const notifiedNamespaces = new Set();
         for (const row of updatedRows) {
@@ -549,13 +555,13 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
         )
         UPDATE ${taskTable}
         SET
-          status = ${enumValue(TaskStatus, taskStatus, TaskStatus.Cancelled)},
+          status = ${enumValue(taskStatus, TaskStatus.Cancelled)},
           token = NULL,
           complete_timestamp = ${TRANSACTION_TIMESTAMP}
         FROM task_tree
         WHERE
           ${taskTable.id} = task_tree.id
-          AND ${taskTable.status} NOT IN (${sql.join(terminalStatuses.map((s) => enumValue(TaskStatus, taskStatus, s)), sql `, `)})
+          AND ${taskTable.status} NOT IN (${sql.join(terminalStatuses.map((s) => enumValue(taskStatus, s)), sql `, `)})
         RETURNING ${taskTable.id} as id, ${taskTable.namespace} as namespace
       `);
             if (cancelledRows.rows.length > 0) {
@@ -688,11 +694,11 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
         await session
             .update(taskTable)
             .set({
-            status: caseWhen(gt(taskTable.unresolvedScheduleDependencies, 0), enumValue(TaskStatus, taskStatus, TaskStatus.Waiting)).else(enumValue(TaskStatus, taskStatus, TaskStatus.Pending)),
+            status: caseWhen(gt(taskTable.unresolvedScheduleDependencies, 0), enumValue(taskStatus, TaskStatus.Waiting)).else(enumValue(taskStatus, TaskStatus.Pending)),
             token: null,
             scheduleTimestamp: timestamp,
             visibilityDeadline: null,
-            tries: caseWhen(eq(taskTable.status, enumValue(TaskStatus, taskStatus, TaskStatus.Running)), greatest(0, sql `${taskTable.tries} - 1`)).else(taskTable.tries),
+            tries: caseWhen(eq(taskTable.status, enumValue(taskStatus, TaskStatus.Running)), greatest(0, sql `${taskTable.tries} - 1`)).else(taskTable.tries),
         })
             .where(and(inArray(taskTable.id, ids), notInArray(taskTable.status, terminalStatuses)));
     }
@@ -701,11 +707,11 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
         await session
             .update(taskTable)
             .set({
-            status: caseWhen(gt(taskTable.unresolvedScheduleDependencies, 0), enumValue(TaskStatus, taskStatus, TaskStatus.Waiting)).else(enumValue(TaskStatus, taskStatus, TaskStatus.Pending)),
+            status: caseWhen(gt(taskTable.unresolvedScheduleDependencies, 0), enumValue(taskStatus, TaskStatus.Waiting)).else(enumValue(taskStatus, TaskStatus.Pending)),
             token: null,
             scheduleTimestamp: timestamp,
             visibilityDeadline: null,
-            tries: caseWhen(eq(taskTable.status, enumValue(TaskStatus, taskStatus, TaskStatus.Running)), greatest(0, sql `${taskTable.tries} - 1`)).else(taskTable.tries),
+            tries: caseWhen(eq(taskTable.status, enumValue(taskStatus, TaskStatus.Running)), greatest(0, sql `${taskTable.tries} - 1`)).else(taskTable.tries),
         })
             .where(and(eq(taskTable.namespace, this.#namespace), arrayOverlaps(taskTable.tags, toArray(tags)), notInArray(taskTable.status, terminalStatuses)));
     }
@@ -718,7 +724,7 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
         const [updatedRow] = await session
             .update(taskTable)
             .set({
-            status: caseWhen(exceededMaxExecutionTime, enumValue(TaskStatus, taskStatus, TaskStatus.TimedOut)).else(taskTable.status),
+            status: caseWhen(exceededMaxExecutionTime, enumValue(taskStatus, TaskStatus.TimedOut)).else(taskTable.status),
             visibilityDeadline: caseWhen(exceededMaxExecutionTime, null).else(sql `${TRANSACTION_TIMESTAMP} + ${interval(this.visibilityTimeout, 'milliseconds')}`),
             completeTimestamp: caseWhen(exceededMaxExecutionTime, TRANSACTION_TIMESTAMP).else(taskTable.completeTimestamp),
             errors: caseWhen(exceededMaxExecutionTime, sql `${taskTable.errors} || ${buildJsonb([{ code: 'MaxTimeExceeded', message: 'Hard Execution Timeout' }])}`).else(taskTable.errors),
@@ -755,6 +761,12 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
             updateState: sql `(state)::jsonb`.as('update_state'),
         })
             .from(sql `(VALUES ${sql.join(rows, sql `, `)}) AS t(id, token, progress, state)`));
+        const locked = session.$with('locked').as((qb) => qb
+            .select({ id: taskTable.id })
+            .from(taskTable)
+            .innerJoin(updates, eq(taskTable.id, updates.updateId))
+            .orderBy(asc(taskTable.id))
+            .for('update'));
         const updated = session.$with('updated').as(() => session
             .update(taskTable)
             .set({
@@ -763,10 +775,10 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
             state: coalesce(updates.updateState, taskTable.state),
         })
             .from(updates)
-            .where(and(eq(taskTable.id, updates.updateId), sql `${taskTable.token} IS NOT DISTINCT FROM ${updates.updateToken}`, eq(taskTable.status, TaskStatus.Running), gt(taskTable.startTimestamp, sql `${TRANSACTION_TIMESTAMP} - ${interval(this.maxExecutionTime, 'milliseconds')}`)))
+            .where(and(eq(taskTable.id, updates.updateId), inArray(taskTable.id, session.select({ id: locked.id }).from(locked)), sql `${taskTable.token} IS NOT DISTINCT FROM ${updates.updateToken}`, eq(taskTable.status, TaskStatus.Running), gt(taskTable.startTimestamp, sql `${TRANSACTION_TIMESTAMP} - ${interval(this.maxExecutionTime, 'milliseconds')}`)))
             .returning({ id: taskTable.id }));
         const result = await session
-            .with(updates, updated)
+            .with(updates, locked, updated)
             .select({ id: updated.id })
             .from(updated);
         return result.map((r) => r.id);
@@ -775,7 +787,7 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
         await this.#repository.useTransaction(options?.transaction, async (tx) => {
             const [updatedTask] = await tx.pgTransaction.update(taskTable)
                 .set({
-                status: caseWhen(gt(taskTable.unresolvedCompleteDependencies, 0), enumValue(TaskStatus, taskStatus, TaskStatus.WaitingChildren)).else(enumValue(TaskStatus, taskStatus, TaskStatus.Completed)),
+                status: caseWhen(gt(taskTable.unresolvedCompleteDependencies, 0), enumValue(taskStatus, TaskStatus.WaitingChildren)).else(enumValue(taskStatus, TaskStatus.Completed)),
                 token: null,
                 result: options?.result,
                 progress: caseWhen(gt(taskTable.unresolvedCompleteDependencies, 0), task.progress).else(sql.raw('1')),
@@ -810,10 +822,16 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
                 updateProgress: sql `(progress)::numeric`.as('update_progress'),
             })
                 .from(sql `(VALUES ${sql.join(rows, sql `, `)}) AS t(id, token, result, progress)`));
+            const locked = tx.pgTransaction.$with('locked').as((qb) => qb
+                .select({ id: taskTable.id })
+                .from(taskTable)
+                .innerJoin(updates, eq(taskTable.id, updates.updateId))
+                .orderBy(asc(taskTable.id))
+                .for('update'));
             const updated = tx.pgTransaction.$with('updated').as(() => tx.pgTransaction
                 .update(taskTable)
                 .set({
-                status: caseWhen(gt(taskTable.unresolvedCompleteDependencies, 0), enumValue(TaskStatus, taskStatus, TaskStatus.WaitingChildren)).else(enumValue(TaskStatus, taskStatus, TaskStatus.Completed)),
+                status: caseWhen(gt(taskTable.unresolvedCompleteDependencies, 0), enumValue(taskStatus, TaskStatus.WaitingChildren)).else(enumValue(taskStatus, TaskStatus.Completed)),
                 token: null,
                 result: updates.updateResult,
                 progress: caseWhen(gt(taskTable.unresolvedCompleteDependencies, 0), updates.updateProgress).else(1),
@@ -821,10 +839,10 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
                 visibilityDeadline: null,
             })
                 .from(updates)
-                .where(and(eq(taskTable.id, updates.updateId), sql `${taskTable.token} IS NOT DISTINCT FROM ${updates.updateToken}`))
+                .where(and(eq(taskTable.id, updates.updateId), inArray(taskTable.id, tx.pgTransaction.select({ id: locked.id }).from(locked)), sql `${taskTable.token} IS NOT DISTINCT FROM ${updates.updateToken}`))
                 .returning({ id: taskTable.id, status: taskTable.status }));
             const updatedRows = await tx.pgTransaction
-                .with(updates, updated)
+                .with(updates, locked, updated)
                 .select({ id: updated.id, status: updated.status })
                 .from(updated);
             if (updatedRows.length > 0) {
@@ -879,6 +897,12 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
                 updateComplete: sql `(complete_timestamp)`.as('update_complete'),
             })
                 .from(sql `(VALUES ${sql.join(rows, sql `, `)}) AS t(id, token, tries, status, error, schedule_timestamp, complete_timestamp)`));
+            const locked = tx.pgTransaction.$with('locked').as((qb) => qb
+                .select({ id: taskTable.id })
+                .from(taskTable)
+                .innerJoin(updates, eq(taskTable.id, updates.updateId))
+                .orderBy(asc(taskTable.id))
+                .for('update'));
             const updated = tx.pgTransaction.$with('updated').as(() => tx.pgTransaction
                 .update(taskTable)
                 .set({
@@ -890,10 +914,10 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
                 completeTimestamp: sql `${updates.updateComplete}`,
             })
                 .from(updates)
-                .where(and(eq(taskTable.id, updates.updateId), sql `${taskTable.token} IS NOT DISTINCT FROM ${updates.updateToken}`, eq(taskTable.tries, updates.updateTries)))
+                .where(and(eq(taskTable.id, updates.updateId), inArray(taskTable.id, tx.pgTransaction.select({ id: locked.id }).from(locked)), sql `${taskTable.token} IS NOT DISTINCT FROM ${updates.updateToken}`, eq(taskTable.tries, updates.updateTries)))
                 .returning({ id: taskTable.id, status: taskTable.status }));
             const result = await tx.pgTransaction
-                .with(updates, updated)
+                .with(updates, locked, updated)
                 .select({ id: updated.id, status: updated.status })
                 .from(updated);
             if (result.length > 0) {
@@ -916,7 +940,9 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
         await this.resolveDependenciesMany([{ id, status, namespace: options?.namespace }], options);
     }
     async resolveDependenciesMany(tasks, options) {
-        const tasksToResolve = tasks.filter((t) => terminalStatuses.includes(t.status));
+        const tasksToResolve = tasks
+            .filter((t) => terminalStatuses.includes(t.status))
+            .toSorted((a, b) => a.id.localeCompare(b.id));
         if (tasksToResolve.length == 0) {
             return;
         }
@@ -1013,7 +1039,6 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
             }
             if (decrementsToApply.size > 0) {
                 const decrementValues = [...decrementsToApply]
-                    .toSorted(([idA], [idB]) => idA.localeCompare(idB))
                     .map(([taskId, d]) => sql `(${taskId}::uuid, ${d.schedule}::int, ${d.complete}::int)`);
                 const updates = tx.pgTransaction.$with('updates').as((qb) => qb
                     .select({
@@ -1022,8 +1047,14 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
                     completeDecrement: sql `(complete)::int`.as('complete_decrement'),
                 })
                     .from(sql `(VALUES ${sql.join(decrementValues, sql `, `)}) AS t(id, schedule, complete)`));
+                const locked = tx.pgTransaction.$with('locked').as((qb) => qb
+                    .select({ id: taskTable.id })
+                    .from(taskTable)
+                    .innerJoin(updates, eq(taskTable.id, updates.taskId))
+                    .orderBy(asc(taskTable.id))
+                    .for('update'));
                 const updatedRows = await tx.pgTransaction
-                    .with(updates)
+                    .with(updates, locked)
                     .update(taskTable)
                     .set({
                     unresolvedScheduleDependencies: greatest(0, sql `${taskTable.unresolvedScheduleDependencies} - ${updates.scheduleDecrement}`),
@@ -1034,7 +1065,7 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
                     token: caseWhen(and(eq(taskTable.status, TaskStatus.WaitingChildren), eq(greatest(0, sql `${taskTable.unresolvedCompleteDependencies} - ${updates.completeDecrement}`), 0)), null).else(taskTable.token),
                 })
                     .from(updates)
-                    .where(eq(taskTable.id, updates.taskId))
+                    .where(and(eq(taskTable.id, updates.taskId), inArray(taskTable.id, tx.pgTransaction.select({ id: locked.id }).from(locked))))
                     .returning({
                     id: taskTable.id,
                     namespace: taskTable.namespace,
@@ -1161,7 +1192,7 @@ let PostgresTaskQueue = class PostgresTaskQueue extends TaskQueue {
                     .with(selection)
                     .update(taskTable)
                     .set({
-                    status: caseWhen(lt(taskTable.startTimestamp, sql `${TRANSACTION_TIMESTAMP} - ${interval(this.maxExecutionTime, 'milliseconds')}`), enumValue(TaskStatus, taskStatus, TaskStatus.TimedOut)).else(caseWhen(lt(taskTable.tries, this.maxTries), enumValue(TaskStatus, taskStatus, TaskStatus.Retrying)).else(enumValue(TaskStatus, taskStatus, TaskStatus.Orphaned))),
+                    status: caseWhen(lt(taskTable.startTimestamp, sql `${TRANSACTION_TIMESTAMP} - ${interval(this.maxExecutionTime, 'milliseconds')}`), enumValue(taskStatus, TaskStatus.TimedOut)).else(caseWhen(lt(taskTable.tries, this.maxTries), enumValue(taskStatus, TaskStatus.Retrying)).else(enumValue(taskStatus, TaskStatus.Orphaned))),
                     token: null,
                     visibilityDeadline: null,
                     completeTimestamp: caseWhen(or(lt(taskTable.startTimestamp, sql `${TRANSACTION_TIMESTAMP} - ${interval(this.maxExecutionTime, 'milliseconds')}`), gte(taskTable.tries, this.maxTries)), TRANSACTION_TIMESTAMP).else(null),