fix(billing): retain older PostgreSQL timeout compatibility

Author: icecrasher321

.github/workflows/test-build.yml

@@ -30,6 +30,19 @@ jobs:
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
+      postgres-legacy:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: sim_billing_test
+        ports:
+          - 5433:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d sim_billing_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
     env:
       DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_auth_scim
       OAUTH_TOKEN_FAMILY_TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_auth_scim
@@ -89,6 +102,13 @@ jobs:
           BILLING_USAGE_TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_auth_scim
         run: bunx vitest run lib/billing/core/usage-log.postgres.test.ts
 
+      - name: Verify cumulative billing timeout recovery on PostgreSQL 16
+        if: matrix.provision == 'push'
+        working-directory: apps/sim
+        env:
+          BILLING_USAGE_TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5433/sim_billing_test
+        run: bunx vitest run lib/billing/core/usage-log.postgres.test.ts
+
       - name: Verify SCIM and administration over real HTTP
         working-directory: apps/sim
         env:

apps/sim/lib/billing/core/usage-log.postgres.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  *
- * Uses a disposable schema in local PostgreSQL 17+. The paused callback models
+ * Uses a disposable schema in local PostgreSQL 15+. The paused callback models
  * a client that stops progressing after writing usage but before COMMIT; the
  * database must release its locks without waiting for that client to resume.
  */
@@ -65,6 +65,7 @@ interface PausedTransaction {
 }
 
 let nextPause: PausedTransaction | undefined
+let holderTimeoutSetting = 'transaction_timeout'
 
 function pauseNextTransaction(lockOnly = false): PausedTransaction {
   const pause = { reached: deferred(), release: deferred(), lockOnly }
@@ -107,9 +108,14 @@ afterAll(async () => {
 describe.skipIf(!databaseUrl)('Cumulative billing with PostgreSQL', () => {
   beforeAll(async () => {
     if (!connection || !database) throw new Error('PostgreSQL fixture is unavailable')
-    const [version] =
-      await connection`select current_setting('server_version_num')::integer as version`
-    expect(version.version).toBeGreaterThanOrEqual(170000)
+    const [version] = await connection`
+        select current_setting('server_version_num')::integer as version,
+          current_setting('transaction_timeout', true) is not null as has_transaction_timeout
+      `
+    expect(version.version).toBeGreaterThanOrEqual(150000)
+    holderTimeoutSetting = version.has_transaction_timeout
+      ? 'transaction_timeout'
+      : 'idle_in_transaction_session_timeout'
     await connection.unsafe(`CREATE SCHEMA "${schemaName}"`)
     await connection.unsafe(`
       CREATE TABLE usage_log (
@@ -132,7 +138,7 @@ describe.skipIf(!databaseUrl)('Cumulative billing with PostgreSQL', () => {
         if (pause) {
           if (pause.lockOnly) {
             /** Reproduce the old policy: lock_timeout does not expire an idle holder. */
-            await tx.execute(sql`select set_config('transaction_timeout', '0', true)`)
+            await tx.execute(sql`select set_config(${holderTimeoutSetting}, '0', true)`)
           }
           pause.reached.resolve()
           await pause.release.promise
@@ -164,7 +170,7 @@ describe.skipIf(!databaseUrl)('Cumulative billing with PostgreSQL', () => {
       const resumed = deferred()
       let resumedError: unknown
       const holder = pool.begin(async (tx) => {
-        await tx`select set_config('transaction_timeout', '150ms', true)`
+        await tx`select set_config(${holderTimeoutSetting}, '150ms', true)`
         await tx`select 1`
         await release.promise
         try {

apps/sim/lib/billing/core/usage-log.test.ts

@@ -439,6 +439,7 @@ describe('recordCumulativeUsage', () => {
       eventKey: 'update-cost:msg-1-billing',
     })
     expect(executedSqlContaining(tx, 'transaction_timeout')).toBe(true)
+    expect(executedSqlContaining(tx, 'idle_in_transaction_session_timeout')).toBe(true)
     expect(executedSqlContaining(tx, 'statement_timeout')).toBe(true)
     expect(executedSqlContaining(tx, 'lock_timeout')).toBe(true)
     expect(tx.execute.mock.calls[0][0]).toMatchObject({ values: ['4000ms', '3500ms', '3000ms'] })

apps/sim/lib/billing/core/usage-log.ts

@@ -635,10 +635,11 @@ function assertCumulativeUsageLedgerBinding(
 }
 
 /**
- * PostgreSQL 17 bounds the holder's entire transaction, including time spent
- * waiting for the application between statements. A lock timeout alone only
- * bounds other callers waiting behind that holder. Keep the transaction below
- * the billing callback's five-second client deadline so retries can recover.
+ * PostgreSQL 17+ bounds the entire transaction below the callback's five-second
+ * deadline. Older supported servers instead bound each idle interval between
+ * statements, alongside the per-statement budget. Both policies release an idle
+ * lock holder without waiting for its application process to resume; only the
+ * newer policy also limits total elapsed transaction time.
  */
 const CUMULATIVE_FLUSH_TRANSACTION_TIMEOUT_MS = 4_000
 const CUMULATIVE_FLUSH_STATEMENT_TIMEOUT_MS = 3_500
@@ -658,8 +659,8 @@ type CumulativeUsageStage = 'pool' | 'configure' | 'lock' | 'read' | 'write' | '
  * An existing row must match the incoming actor, workspace, payer, and billing
  * period before either a duplicate no-op or a top-up is accepted.
  * The billing context is resolved BEFORE the transaction and the lock wait is
- * bounded by `lock_timeout`. A server-enforced `transaction_timeout` releases
- * the holder even when its application process stops making progress. The
+ * bounded by `lock_timeout`. A server-enforced transaction deadline, or idle
+ * transaction deadline on older PostgreSQL, releases a stalled holder. The
  * critical section uses one SELECT plus one INSERT/UPDATE on a single connection.
  *
  * Because every leg flushes its cumulative and this converges to the max,
@@ -706,7 +707,14 @@ export async function recordCumulativeUsage(
       enterStage('configure')
       await tx.execute(sql`
         select
-          set_config('transaction_timeout', ${`${CUMULATIVE_FLUSH_TRANSACTION_TIMEOUT_MS}ms`}, true),
+          set_config(
+            case when current_setting('transaction_timeout', true) is null
+              then 'idle_in_transaction_session_timeout'
+              else 'transaction_timeout'
+            end,
+            ${`${CUMULATIVE_FLUSH_TRANSACTION_TIMEOUT_MS}ms`},
+            true
+          ),
           set_config('statement_timeout', ${`${CUMULATIVE_FLUSH_STATEMENT_TIMEOUT_MS}ms`}, true),
           set_config('lock_timeout', ${`${CUMULATIVE_FLUSH_LOCK_TIMEOUT_MS}ms`}, true)
       `)

patches/README.md

@@ -32,12 +32,16 @@ including its implicit COMMIT/ROLLBACK, before they reach the connection or pool
 The guard is applied to all published ESM, CommonJS, and Cloudflare entry points.
 It does not change connection establishment, retries, or healthy transactions.
 
-This is required for cumulative billing's PostgreSQL 17 `transaction_timeout`:
-the database can release an idle lock holder without waiting for the application.
+This is required for cumulative billing's server-enforced holder deadline:
+PostgreSQL 17+ uses `transaction_timeout`; older supported servers use
+`idle_in_transaction_session_timeout` alongside the statement timeout. Both release
+a stalled idle holder; the older fallback limits each idle interval and statement,
+not the total elapsed transaction time.
 `apps/sim/lib/billing/core/usage-log.postgres.test.ts` tests real ESM/CommonJS driver
 closure and reconnection, rollback after billing INSERT/UPDATE, and exact retry
-accounting. CI runs it against PostgreSQL 17. Set `BILLING_USAGE_TEST_DATABASE_URL`
-to a disposable local PostgreSQL 17+ database to run it manually.
+accounting. CI runs it against PostgreSQL 17 and 16. Set
+`BILLING_USAGE_TEST_DATABASE_URL` to a disposable local PostgreSQL 15+ database to
+run it manually.
 
 Remove this patch when the pinned driver includes equivalent transaction-scope
 closure handling. Keep the reconnect regression tests when upgrading.