jinaga-server 3.7.1 → 3.7.4

package/.github/workflows/main.yml

@@ -23,7 +23,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       
       - name: Build and Test
         run: |

package/.github/workflows/publish.yml

@@ -11,13 +11,15 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
-          node-version: '20.x'
+          node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
-      - run: npm install -g npm@latest
-      - run: npm install
-      - run: npm publish
+      - run: npm ci
+      # Force NODE_AUTH_TOKEN empty so .npmrc has no static token and npm
+      # falls through to OIDC trusted publishing. setup-node defaults this
+      # to GITHUB_TOKEN, which the npm registry rejects (masked as 404).
+      - run: npm publish --provenance
         env:
           NODE_AUTH_TOKEN: ''

package/.github/workflows/upgrade-jinaga.yml

@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
-          node-version: '20.x'
+          node-version: '24.x'
 
       - name: Get versions
         id: versions

package/dist/postgres/postgres-keystore.js

@@ -119,8 +119,19 @@ class PostgresKeystore {
     generateKeyPair(connection, userIdentity) {
         return __awaiter(this, void 0, void 0, function* () {
             const keyPair = (0, jinaga_1.generateKeyPair)();
-            yield connection.query(`INSERT INTO ${this.schema}.user (provider, user_identifier, private_key, public_key) VALUES ($1, $2, $3, $4)`, [userIdentity.provider, userIdentity.id, keyPair.privatePem, keyPair.publicPem]);
-            return keyPair;
+            const { rows } = yield connection.query(`INSERT INTO ${this.schema}.user (provider, user_identifier, private_key, public_key)
+             VALUES ($1, $2, $3, $4)
+             ON CONFLICT (user_identifier, provider) DO NOTHING
+             RETURNING 1`, [userIdentity.provider, userIdentity.id, keyPair.privatePem, keyPair.publicPem]);
+            if (rows.length === 1) {
+                return keyPair;
+            }
+            // Lost the race: a concurrent request inserted this user's key pair
+            // between our SELECT and INSERT. The ON CONFLICT clause suppressed the
+            // unique-violation (23505) on ux_user, so read back the winner's key
+            // pair instead of surfacing a duplicate-key error. selectOrInsertKeyPair
+            // will now find exactly one row.
+            return this.selectOrInsertKeyPair(connection, userIdentity);
         });
     }
 }

package/dist/postgres/postgres-keystore.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-keystore.js","sourceRoot":"","sources":["../../src/postgres/postgres-keystore.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,mCAAyI;AAIzI,6CAAiD;AAEjD,MAAa,gBAAgB;IAIzB,YAAa,IAAU,EAAU,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QAFvC,UAAK,GAAyB,IAAI,GAAG,EAAE,CAAC;QAG5C,IAAI,CAAC,iBAAiB,GAAG,IAAI,8BAAiB,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,mBAAmB,CAAC,YAA0B;QAC1C,OAAO,IAAI,CAAC,uBAAuB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACrE,CAAC;IAED,qBAAqB,CAAC,cAA4B;QAC9C,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACzE,CAAC;IAED,WAAW,CAAC,YAA0B;QAClC,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC7D,CAAC;IAED,aAAa,CAAC,cAA4B;QACtC,OAAO,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACjE,CAAC;IAEK,SAAS,CAAC,YAA0B,EAAE,KAAmB;;YAC3D,IAAI,CAAC,YAAY,EAAE;gBACf,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;aACxD;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACpD,OAAO,IAAA,kBAAS,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;KAAA;IAEa,uBAAuB,CAAC,IAAY,EAAE,QAAsB;;YACtE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAChE,MAAM,YAAY,GAA0B,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG;gBACX,SAAS,EAAE,SAAS;aACvB,CAAC;YACF,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAChD,CAAC;KAAA;IAEa,eAAe,CAAC,IAAY,EAAE,QAAsB;;YAC9D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtD,MAAM,YAAY,GAA0B,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG;gBACX,SAAS,EAAE,SAAS;aACvB,CAAC;YACF,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAChD,CAAC;KAAA;IAEa,UAAU,CAAC,YAA0B;;YAC/C,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;aAC/B;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAC3D,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC;QACnB,CAAC;KAAA;IAEa,aAAa,CAAC,UAAsB,EAAE,YAA0B;;YAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,uCAAuC,IAAI,CAAC,MAAM,oDAAoD,EAC1I,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;gBACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;aAC9D;iBACI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;gBACxB,MAAM,SAAS,GAAW,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC1C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;aACpC;iBACI;gBACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;aACrD;QACL,CAAC;KAAA;IAEa,oBAAoB,CAAC,YAA0B;;YACzD,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;aAC/B;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CACtE,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC;QACnB,CAAC;KAAA;IAEa,qBAAqB,CAAC,UAAsB,EAAE,YAA0B;;YAClF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,uCAAuC,IAAI,CAAC,MAAM,oDAAoD,EAC1I,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;gBACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;aAC9D;iBACI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;gBACxB,MAAM,SAAS,GAAW,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,UAAU,GAAW,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;aACpC;iBACI;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;gBACrE,OAAO,OAAO,CAAC;aAClB;QACL,CAAC;KAAA;IAEa,eAAe,CAAC,UAAsB,EAAE,YAA0B;;YAC5E,MAAM,OAAO,GAAG,IAAA,wBAAe,GAAE,CAAC;YAClC,MAAM,UAAU,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,MAAM,oFAAoF,EACjI,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACrF,OAAO,OAAO,CAAC;QACnB,CAAC;KAAA;CACJ;AAlHD,4CAkHC;AAED,SAAS,kBAAkB,CAAC,YAA0B;IAClD,OAAO,GAAG,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"postgres-keystore.js","sourceRoot":"","sources":["../../src/postgres/postgres-keystore.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,mCAAyI;AAIzI,6CAAiD;AAEjD,MAAa,gBAAgB;IAIzB,YAAa,IAAU,EAAU,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QAFvC,UAAK,GAAyB,IAAI,GAAG,EAAE,CAAC;QAG5C,IAAI,CAAC,iBAAiB,GAAG,IAAI,8BAAiB,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,mBAAmB,CAAC,YAA0B;QAC1C,OAAO,IAAI,CAAC,uBAAuB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACrE,CAAC;IAED,qBAAqB,CAAC,cAA4B;QAC9C,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACzE,CAAC;IAED,WAAW,CAAC,YAA0B;QAClC,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC7D,CAAC;IAED,aAAa,CAAC,cAA4B;QACtC,OAAO,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACjE,CAAC;IAEK,SAAS,CAAC,YAA0B,EAAE,KAAmB;;YAC3D,IAAI,CAAC,YAAY,EAAE;gBACf,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;aACxD;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACpD,OAAO,IAAA,kBAAS,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;KAAA;IAEa,uBAAuB,CAAC,IAAY,EAAE,QAAsB;;YACtE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAChE,MAAM,YAAY,GAA0B,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG;gBACX,SAAS,EAAE,SAAS;aACvB,CAAC;YACF,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAChD,CAAC;KAAA;IAEa,eAAe,CAAC,IAAY,EAAE,QAAsB;;YAC9D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtD,MAAM,YAAY,GAA0B,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG;gBACX,SAAS,EAAE,SAAS;aACvB,CAAC;YACF,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAChD,CAAC;KAAA;IAEa,UAAU,CAAC,YAA0B;;YAC/C,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;aAC/B;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAC3D,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC;QACnB,CAAC;KAAA;IAEa,aAAa,CAAC,UAAsB,EAAE,YAA0B;;YAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,uCAAuC,IAAI,CAAC,MAAM,oDAAoD,EAC1I,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;gBACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;aAC9D;iBACI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;gBACxB,MAAM,SAAS,GAAW,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC1C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;aACpC;iBACI;gBACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;aACrD;QACL,CAAC;KAAA;IAEa,oBAAoB,CAAC,YAA0B;;YACzD,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;aAC/B;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CACtE,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC;QACnB,CAAC;KAAA;IAEa,qBAAqB,CAAC,UAAsB,EAAE,YAA0B;;YAClF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,uCAAuC,IAAI,CAAC,MAAM,oDAAoD,EAC1I,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;gBACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;aAC9D;iBACI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;gBACxB,MAAM,SAAS,GAAW,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,UAAU,GAAW,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;aACpC;iBACI;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;gBACrE,OAAO,OAAO,CAAC;aAClB;QACL,CAAC;KAAA;IAEa,eAAe,CAAC,UAAsB,EAAE,YAA0B;;YAC5E,MAAM,OAAO,GAAG,IAAA,wBAAe,GAAE,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CACnC,eAAe,IAAI,CAAC,MAAM;;;yBAGb,EACb,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACrF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;gBACnB,OAAO,OAAO,CAAC;aAClB;YACD,oEAAoE;YACpE,uEAAuE;YACvE,qEAAqE;YACrE,yEAAyE;YACzE,iCAAiC;YACjC,OAAO,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChE,CAAC;KAAA;CACJ;AA9HD,4CA8HC;AAED,SAAS,kBAAkB,CAAC,YAA0B;IAClD,OAAO,GAAG,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;AACzD,CAAC"}

package/integration-test/jinaga-test/postgres-keystore-race.test.js

@@ -0,0 +1,68 @@
+const { Pool } = require('pg');
+const { PostgresKeystore } = require('jinaga-server');
+
+const host = "db";
+const connectionString = `postgresql://dev:devpw@${host}:5432/integrationtest`;
+
+const pool = new Pool({
+    connectionString
+});
+
+describe('PostgresKeystore concurrency race', () => {
+    afterAll(async () => {
+        await pool.end();
+    });
+
+    beforeEach(async () => {
+        // Ensure no row exists yet for the test identities so the
+        // select-then-insert path is exercised from a clean state.
+        await pool.query(`DELETE FROM public."user" WHERE provider = $1`, ['test-provider']);
+    });
+
+    it('should not fail when two concurrent requests create the same user key pair', async () => {
+        const userIdentity = { provider: 'test-provider', id: 'race-user-1' };
+
+        // Two separate keystore instances model two concurrent requests that
+        // each build a fresh runtime (empty in-process cache), as described in
+        // issue #177. Both SELECT zero rows and race to INSERT.
+        const keystoreA = new PostgresKeystore(pool, 'public');
+        const keystoreB = new PostgresKeystore(pool, 'public');
+
+        const [factA, factB] = await Promise.all([
+            keystoreA.getOrCreateUserFact(userIdentity),
+            keystoreB.getOrCreateUserFact(userIdentity)
+        ]);
+
+        // Both requests succeed and observe the same public key (the winner's).
+        expect(factA.type).toBe('Jinaga.User');
+        expect(factB.type).toBe('Jinaga.User');
+        expect(factA.fields.publicKey).toBe(factB.fields.publicKey);
+        expect(factA.hash).toBe(factB.hash);
+
+        // Exactly one row was persisted for the identity.
+        const { rows } = await pool.query(
+            `SELECT public_key FROM public."user" WHERE provider = $1 AND user_identifier = $2`,
+            [userIdentity.provider, userIdentity.id]);
+        expect(rows.length).toBe(1);
+        expect(rows[0].public_key).toBe(factA.fields.publicKey);
+    });
+
+    it('should tolerate many concurrent creations of the same identity', async () => {
+        const userIdentity = { provider: 'test-provider', id: 'race-user-2' };
+
+        // A larger fan-out of fresh runtimes all racing on the same identity.
+        const keystores = Array.from({ length: 8 }, () => new PostgresKeystore(pool, 'public'));
+
+        const facts = await Promise.all(
+            keystores.map(keystore => keystore.getOrCreateUserFact(userIdentity)));
+
+        // Every caller resolves to the same key pair.
+        const publicKeys = new Set(facts.map(fact => fact.fields.publicKey));
+        expect(publicKeys.size).toBe(1);
+
+        const { rows } = await pool.query(
+            `SELECT public_key FROM public."user" WHERE provider = $1 AND user_identifier = $2`,
+            [userIdentity.provider, userIdentity.id]);
+        expect(rows.length).toBe(1);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jinaga-server",
-  "version": "3.7.1",
+  "version": "3.7.4",
   "description": "Data management for web and mobile applications.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/postgres/postgres-keystore.ts

@@ -114,9 +114,21 @@ export class PostgresKeystore implements Keystore {
 
     private async generateKeyPair(connection: PoolClient, userIdentity: UserIdentity): Promise<KeyPair> {
         const keyPair = generateKeyPair();
-        await connection.query(`INSERT INTO ${this.schema}.user (provider, user_identifier, private_key, public_key) VALUES ($1, $2, $3, $4)`,
+        const { rows } = await connection.query(
+            `INSERT INTO ${this.schema}.user (provider, user_identifier, private_key, public_key)
+             VALUES ($1, $2, $3, $4)
+             ON CONFLICT (user_identifier, provider) DO NOTHING
+             RETURNING 1`,
             [userIdentity.provider, userIdentity.id, keyPair.privatePem, keyPair.publicPem]);
-        return keyPair;
+        if (rows.length === 1) {
+            return keyPair;
+        }
+        // Lost the race: a concurrent request inserted this user's key pair
+        // between our SELECT and INSERT. The ON CONFLICT clause suppressed the
+        // unique-violation (23505) on ux_user, so read back the winner's key
+        // pair instead of surfacing a duplicate-key error. selectOrInsertKeyPair
+        // will now find exactly one row.
+        return this.selectOrInsertKeyPair(connection, userIdentity);
     }
 }
 

package/test/postgres/userGivenFeedSqlSpec.ts

@@ -0,0 +1,115 @@
+import { buildFeeds, dehydrateReference, getAllFactTypes, getAllRoles, Specification, SpecificationParser } from "jinaga";
+
+import { addFactType, addRole, emptyFactTypeMap, emptyRoleMap, FactTypeMap, getFactTypeId, RoleMap } from "../../src/postgres/maps";
+import { sqlFromFeed } from "../../src/postgres/specification-sql";
+
+// Regression coverage for jinaga-server#179.
+//
+// The issue named two candidate loci for a `Jinaga.User`-given feed returning
+// empty despite matching data: the distribution decision (jinaga.js) and the
+// Postgres feed SQL (this repo, `sqlFromFeed`). These tests pin down the
+// second: the feed SQL generated for a specification whose given is typed
+// `Jinaga.User` is structurally identical to the SQL for the same join shape
+// against any other given type. There is no `Jinaga.User` special-casing in
+// jinaga-server's query generation, so the empty-result trigger does not live
+// here.
+
+function parseSpecification(input: string): Specification {
+    const parser = new SpecificationParser(input);
+    parser.skipWhitespace();
+    return parser.parseSpecification();
+}
+
+function buildMaps(specification: Specification): { factTypes: FactTypeMap; roleMap: RoleMap } {
+    // Assign deterministic type ids in first-seen order so two specifications
+    // with the same shape but different type names produce identical parameter
+    // sequences. Filter the synthetic "Unknown" fact type and "unknown" role
+    // name (matching the other Postgres SQL generator specs) so they cannot
+    // shift the id assignment. Roles get ids offset well past the type ids.
+    const factTypes = getAllFactTypes(specification)
+        .filter(factType => factType !== 'Unknown')
+        .reduce((f, factType, i) => addFactType(f, factType, i + 1), emptyFactTypeMap());
+    const roleMap = getAllRoles(specification)
+        .filter(role => role.name !== 'unknown')
+        .reduce((r, role, i) => {
+            const factTypeId = getFactTypeId(factTypes, role.successorType);
+            if (!factTypeId) {
+                return r;
+            }
+            return addRole(r, factTypeId, role.name, i + 100);
+        }, emptyRoleMap());
+    return { factTypes, roleMap };
+}
+
+// Pure: generates the feed SQL for a single-feed specification. All assertions
+// live in the tests (or beforeAll) so a parse/build failure surfaces as a test
+// failure rather than a suite-collection error.
+function feedSqlFor(descriptiveString: string, startType: string) {
+    const specification = parseSpecification(descriptiveString);
+    const { factTypes, roleMap } = buildMaps(specification);
+    const feeds = buildFeeds(specification);
+    const start = [dehydrateReference({ type: startType, key: "value" })];
+    const query = sqlFromFeed(feeds[0], start, "public", "", 100, factTypes, roleMap);
+    return { query, feedCount: feeds.length, factTypes };
+}
+
+// The canonical "owned by me" shape: a successor edged to the given user
+// through a role named `owner`.
+const USER_GIVEN_SPEC = `
+    (user: Jinaga.User) {
+        activity: Networking.Activity [
+            activity->owner: Jinaga.User = user
+        ]
+    }`;
+
+// The identical join shape rooted at a non-user given.
+const ACTIVITY_GIVEN_SPEC = `
+    (activity: Networking.Activity) {
+        log: Networking.ActivityCrmLog [
+            log->activity: Networking.Activity = activity
+        ]
+    }`;
+
+describe("Jinaga.User-given feed SQL (issue #179)", () => {
+    let userGiven: ReturnType<typeof feedSqlFor>;
+    let activityGiven: ReturnType<typeof feedSqlFor>;
+
+    beforeAll(() => {
+        userGiven = feedSqlFor(USER_GIVEN_SPEC, "Jinaga.User");
+        activityGiven = feedSqlFor(ACTIVITY_GIVEN_SPEC, "Networking.Activity");
+        // Both shapes must reduce to a single feed for the comparison to be
+        // apples-to-apples.
+        expect(userGiven.feedCount).toBe(1);
+        expect(activityGiven.feedCount).toBe(1);
+    });
+
+    it("produces a satisfiable, single feed query for a Jinaga.User given", () => {
+        // A satisfiable query is the whole point: a null query here would be
+        // the silent-empty the issue describes. The given's type is loaded and
+        // the predecessor edge on `owner` is generated.
+        expect(userGiven.query).not.toBeNull();
+        expect(userGiven.query!.sql).toContain("f1.fact_type_id = $1 AND f1.hash = $2");
+        expect(userGiven.query!.sql).toContain("public.edge");
+        expect(userGiven.query!.labels.length).toBe(1);
+    });
+
+    it("generates SQL structurally identical to a non-user given of the same shape", () => {
+        // No Jinaga.User special-casing: the two SQL strings match exactly.
+        expect(userGiven.query).not.toBeNull();
+        expect(activityGiven.query).not.toBeNull();
+        expect(userGiven.query!.sql).toEqual(activityGiven.query!.sql);
+    });
+
+    it("binds the given type id (from the fact-type map) and hash as the leading parameters", () => {
+        // The given fact type participates in the WHERE clause like any other —
+        // it is not dropped or defaulted to a constant for Jinaga.User. Derive
+        // the expected id from the map built for this spec so the assertion is
+        // not coupled to getAllFactTypes ordering.
+        const userReference = dehydrateReference({ type: "Jinaga.User", key: "value" });
+        const expectedTypeId = getFactTypeId(userGiven.factTypes, "Jinaga.User");
+        expect(expectedTypeId).toBeDefined();
+        expect(userGiven.query).not.toBeNull();
+        expect(userGiven.query!.parameters[0]).toBe(expectedTypeId);
+        expect(userGiven.query!.parameters[1]).toBe(userReference.hash);
+    });
+});