feat(contrail): live-ingest entrypoint + fork pin

Dockerfile

@@ -8,10 +8,15 @@ COPY package*.json ./
 # Copy ts config
 COPY tsconfig.json ./
 
+# Vendored @atmo-dev/contrail* tarballs referenced by file: deps in package.json.
+# Required before npm ci; regenerated via scripts/prepare-contrail-deps.sh.
+# Drops out when upstream publishes to npm (PR #44 follow-up).
+COPY vendor/ ./vendor/
+
 
 # ---- Dependencies ----
 FROM base AS dependencies
-# Install production dependencies 
+# Install production dependencies
 RUN npm ci
 RUN npm install -g ts-node
 
@@ -54,3 +59,12 @@ EXPOSE 3000
 
 # CMD npm run migration:run:prod && npm run seed:run:prod && npm run start:prod
 CMD npm run start:prod
+
+
+# ---- Ingest ----
+# Same artifact as `release`, different default command. The contrail live-ingest
+# Deployment streams ATProto records from Jetstream into Postgres continuously;
+# no HTTP port. Process liveness is the sole health signal (kubelet restarts on
+# exit). See src/contrail/ingest.ts and the Phase D plan.
+FROM release AS ingest
+CMD ["npm", "run", "contrail:ingest"]

package.json

@@ -18,6 +18,7 @@
     "migration:run:prod": "ts-node -r tsconfig-paths/register  ./src/database/run-multi-tenant-migrations.ts",
     "backfill:activity-feeds": "env-cmd ts-node -r tsconfig-paths/register ./src/database/backfill-activity-feeds.ts",
     "contrail:sync": "node dist/contrail/sync.js",
+    "contrail:ingest": "node dist/contrail/ingest.js",
     "contrail:smoke": "ts-node -r tsconfig-paths/register ./src/contrail/smoke-server.ts",
     "seed:run:prod": "ts-node -r tsconfig-paths/register ./src/database/seeds/relational/run-seed.ts --tenant-config=./config/tenants.json",
     "schema:drop": "npm run typeorm -- --dataSource=src/database/data-source.ts schema:drop",
@@ -63,8 +64,15 @@
     "perf:compare": "mkdir -p k6-tests/results && MODE=comparison k6 run k6-tests/compare-index-impact.js --out json=k6-tests/results/latest.json",
     "perf:report": "node k6-tests/compare-results.js"
   },
+  "overrides": {
+    "@atmo-dev/contrail-base": "file:./vendor/atmo-dev-contrail-base.tgz",
+    "@atmo-dev/contrail-appview": "file:./vendor/atmo-dev-contrail-appview.tgz",
+    "@atmo-dev/contrail-authority": "file:./vendor/atmo-dev-contrail-authority.tgz",
+    "@atmo-dev/contrail-record-host": "file:./vendor/atmo-dev-contrail-record-host.tgz"
+  },
   "dependencies": {
-    "@atmo-dev/contrail": "0.6.0",
+    "@atcute/identity-resolver": "^1.2.3",
+    "@atmo-dev/contrail": "file:./vendor/atmo-dev-contrail.tgz",
     "@atproto/api": "^0.13.31",
     "@atproto/crypto": "^0.4.5",
     "@atproto/identity": "^0.4.7",
@@ -226,7 +234,8 @@
       "<rootDir>/../test/jest-setup.ts"
     ],
     "transformIgnorePatterns": [
-      "node_modules/(?!matrix-js-sdk)"
+      "node_modules/(?!matrix-js-sdk)",
+      "contrail-pr30/packages/.*/dist/"
     ],
     "maxWorkers": "75%",
     "workerIdleMemoryLimit": "512MB",

relational.e2e.Dockerfile

@@ -4,6 +4,9 @@ RUN apk add --no-cache bash curl jq
 RUN npm i -g @nestjs/cli typescript ts-node
 
 COPY package*.json /tmp/app/
+# Vendored @atmo-dev/contrail* tarballs referenced by file: deps; required for
+# npm install. Drops out when upstream publishes (PR #44 follow-up).
+COPY vendor/ /tmp/app/vendor/
 RUN cd /tmp/app && npm install
 
 COPY . /usr/src/app

relational.test.Dockerfile

@@ -4,6 +4,9 @@ RUN apk add --no-cache bash
 RUN npm i -g @nestjs/cli typescript ts-node
 
 COPY package*.json /tmp/app/
+# Vendored @atmo-dev/contrail* tarballs referenced by file: deps; required for
+# npm install. Drops out when upstream publishes (PR #44 follow-up).
+COPY vendor/ /tmp/app/vendor/
 RUN cd /tmp/app && npm install
 
 COPY . /usr/src/app

scripts/prepare-contrail-deps.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Build the five @atmo-dev/contrail* packages from a sibling fork worktree
+# and place the resulting tarballs under vendor/ with stable filenames.
+#
+# Local: assumes ../contrail-pr30 exists (override with CONTRAIL_DIR).
+# Stable names (atmo-dev-contrail.tgz, etc.) let package.json pin paths
+# without churn across fork bumps.
+#
+# vendor/*.tgz are TRACKED in git so CI (deploy-to-dev.yml: npm ci +
+# docker build) can resolve the file: deps without a fork checkout.
+#
+# Regeneration workflow on a fork bump:
+#   scripts/prepare-contrail-deps.sh
+#   npm install                                     # only touches lockfile entries for the tarballs
+#   git add vendor/*.tgz package-lock.json
+#   git commit -m "chore(contrail): bump fork pin to <new-sha>"
+#
+# Drop this script + vendor/ entirely once @atmo-dev/contrail* publish
+# to npm (post PR #44 merge).
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+CONTRAIL_DIR="${CONTRAIL_DIR:-$REPO_ROOT/../contrail-pr30}"
+
+if [[ ! -d "$CONTRAIL_DIR" ]]; then
+  echo "error: CONTRAIL_DIR not found: $CONTRAIL_DIR" >&2
+  echo "       set CONTRAIL_DIR or check out the fork next to openmeet-api-contrail-live-ingest" >&2
+  exit 1
+fi
+
+echo "building @atmo-dev/contrail* from $CONTRAIL_DIR ($(git -C "$CONTRAIL_DIR" rev-parse --short HEAD))"
+cd "$CONTRAIL_DIR"
+pnpm install --frozen-lockfile
+pnpm -r --filter "@atmo-dev/contrail" --filter "@atmo-dev/contrail-base" --filter "@atmo-dev/contrail-appview" --filter "@atmo-dev/contrail-authority" --filter "@atmo-dev/contrail-record-host" build
+
+mkdir -p "$REPO_ROOT/vendor"
+
+for pkg in contrail contrail-base contrail-appview contrail-authority contrail-record-host; do
+  cd "$CONTRAIL_DIR/packages/$pkg"
+  packed=$(pnpm pack --silent | tail -1)
+  dest="$REPO_ROOT/vendor/atmo-dev-${pkg}.tgz"
+  mv "$packed" "$dest"
+  echo "wrote $dest"
+done

src/contrail/contrail-init-idempotency.spec.ts

@@ -0,0 +1,51 @@
+/**
+ * Asserts that contrail.init() is safe to call concurrently against the same
+ * database. Replaces the previous contrail-init-lock.spec which exercised the
+ * consumer-side advisory lock; idempotency is now the library's responsibility
+ * (see fork PR #44 / commit L3).
+ *
+ * Gated on CONTRAIL_TEST_DATABASE_URL — local-only by default.
+ */
+import pg from 'pg';
+import { loadContrail } from './contrail-loader';
+import { buildContrailConfig } from './contrail.config';
+
+const databaseUrl = process.env.CONTRAIL_TEST_DATABASE_URL;
+
+const maybe = databaseUrl ? describe : describe.skip;
+
+maybe('contrail.init() idempotency', () => {
+  let pool: pg.Pool;
+
+  beforeEach(async () => {
+    pool = new pg.Pool({ connectionString: databaseUrl });
+    await pool.query('DROP SCHEMA IF EXISTS contrail_idempotency_test CASCADE');
+    await pool.query('CREATE SCHEMA contrail_idempotency_test');
+  });
+
+  afterEach(async () => {
+    await pool.query('DROP SCHEMA contrail_idempotency_test CASCADE');
+    await pool.end();
+  });
+
+  it('should not throw when called twice sequentially', async () => {
+    const { pkg, postgres } = await loadContrail();
+    const config = await buildContrailConfig();
+    const db = postgres.createPostgresDatabase(pool);
+    const contrail = new pkg.Contrail({ ...config, db });
+
+    await contrail.init(db);
+    await expect(contrail.init(db)).resolves.not.toThrow();
+  });
+
+  it('should be safe under concurrent invocation', async () => {
+    const { pkg, postgres } = await loadContrail();
+    const config = await buildContrailConfig();
+    const db = postgres.createPostgresDatabase(pool);
+    const contrail = new pkg.Contrail({ ...config, db });
+
+    await expect(
+      Promise.all([contrail.init(db), contrail.init(db), contrail.init(db)]),
+    ).resolves.not.toThrow();
+  });
+});