feat(database): add an infrastructure-error classifier and read-retry helper

[anurag6569201]

Summary

Adds two shared primitives to @internal/database for surviving brief database connection blips: a classifier that recognises connectivity/infrastructure failures (as opposed to real query errors), and withInfraRetry, a helper that retries an operation on those failures.

Details

isInfrastructureError / looksLikeConnectivityError recognise connection-level failures (unreachable server, closed connection, connection reset, connect timeouts) and deliberately do not match query or validation errors, so retries never mask a real bug.

withInfraRetry(run, config) retries run on a classified infrastructure error with jittered backoff, gated by a shared token-bucket budget so a mass freeze cannot amplify into a retry storm. It has an enabled kill-switch (off by default) and reuses the existing retry-budget primitive.

It must only wrap operations that are safe to run more than once (reads, or writes made idempotent); it deliberately provides no path that silently retries a non-idempotent write.

Source merge-base: 43ecf15f80277c0eb931c08ddd89de55179cc795
Source head: d85831a9f122308f9faa74c383370afbfa883a29

[shipwright-agent]

✅ Shipwright · Approve

Recommendation: approve PR #5 · Tier T2
Checks: 0 total · 0 needing attention

Next step: ready to merge.

Findings (4)

• HIGH The exported 'InfraRetryOptions' requires 'enabled', 'maxAttempts', 'backoffMinMs', and 'backoffMaxMs', but 'withInfraRetry' accepts 'config?: InfraRetryConfig' and silently runs o · internal-packages/database/src/infraRetry.ts:5
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The retry loop consumes the shared budget only after a retryable error is detected, but the budget is checked before the final attempt as well. · internal-packages/database/src/infraRetry.ts:58
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The connectivity message regex includes 'timed out fetching a new connection', which is also the pool exhaustion signal. · internal-packages/database/src/infraError.ts:17
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• LOW The test 'clamps a swapped min/max backoff' expects a delay of 100 when backoffMinMs=300 and backoffMaxMs=100, but the implementation computes low=min(300,100)=100 and high=max(100 · internal-packages/database/src/infraRetry.ts:70
  • Fix: Fix the review finding before release.

Fireworks usage: 18,610 input · 673 output · 19,283 total tokens · $0.0045 · 16s · 0 fix iteration(s)

Open the Shipwright check for full evidence and the audit bundle. Use /shipwright rerun to verify again.