@aidra/pmx-io 0.0.0-stage → 9.13.0

package/lib/itg/redis-common.js

@@ -0,0 +1,265 @@
+// Copyright (c) 2026 Mike Warriner. All rights reserved. Proprietary — see LICENSE.
+'use strict'
+
+// Shared by the ioredis and node-redis integrations (82 §6, §10): command statements (ITG-032),
+// error codes (ITG-123), the XADD field carrier and the parsing of XREAD/XREADGROUP replies for
+// Redis streams (ITG-210). Same results as pmx-io's _redis.py.
+
+const c = require('./common')
+
+const MAX_PLACEHOLDERS = 10
+const MAX_ARG = 100
+const MAX_STATEMENT = 2000
+const MAX_PIPELINE_LINES = 20
+const STREAM_COMMANDS = new Set(['XADD', 'XREAD', 'XREADGROUP'])
+
+function text (v) {
+  if (typeof v === 'string') return v
+  if (v instanceof Uint8Array) return Buffer.from(v.buffer, v.byteOffset, v.byteLength).toString('utf8')
+  return String(v)
+}
+
+function secretIndexes (name, args) {
+  const out = new Set()
+  if (name === 'AUTH') {
+    for (let i = 0; i < args.length; i++) out.add(i)
+    return out
+  }
+  const up = args.map((a) => (typeof a === 'string' || a instanceof Uint8Array ? text(a).toUpperCase() : ''))
+  if (name === 'HELLO') {
+    up.forEach((t, i) => { if (t === 'AUTH') { out.add(i + 1); out.add(i + 2) } })
+  } else if (name === 'MIGRATE') {
+    up.forEach((t, i) => {
+      if (t === 'AUTH') out.add(i + 1)
+      else if (t === 'AUTH2') { out.add(i + 1); out.add(i + 2) }
+    })
+  } else if (name === 'CONFIG' && up[0] === 'SET') {
+    for (let i = 2; i < args.length; i += 2) out.add(i)
+  } else if (name === 'ACL' && up[0] === 'SETUSER') {
+    // the rules carry passwords (`>pw`, `<pw`) and hashes (`#…`, `!…`)
+    for (let i = 2; i < args.length; i++) out.add(i)
+  }
+  return out
+}
+
+/** ITG-032: `SET ? ?` (sanitized), the arguments as text (raw, secrets as `?`), or undefined (off). */
+function statement (name, args, mode) {
+  if (mode === 'off') return undefined
+  args = args || []
+  if (mode !== 'raw') {
+    const n = args.length
+    return name + ' ?'.repeat(Math.min(n, MAX_PLACEHOLDERS)) + (n > MAX_PLACEHOLDERS ? ' …' : '')
+  }
+  const secret = secretIndexes(name, args)
+  const parts = [name]
+  for (let i = 0; i < args.length; i++) {
+    if (secret.has(i)) {
+      parts.push('?')
+      continue
+    }
+    let t = text(args[i])
+    if (t.length > MAX_ARG) t = t.slice(0, MAX_ARG) + '…'
+    parts.push(t)
+  }
+  let s = parts.join(' ')
+  if (s.length > MAX_STATEMENT) s = s.slice(0, MAX_STATEMENT) + '…'
+  return s
+}
+
+/** ITG-032 for a pipeline/transaction: commands = [[name, args]]. */
+function pipelineStatement (commands, mode) {
+  if (mode === 'off') return undefined
+  const lines = []
+  for (const [name, args] of commands.slice(0, MAX_PIPELINE_LINES)) lines.push(statement(name, args, mode) || '')
+  if (commands.length > MAX_PIPELINE_LINES) lines.push('… (' + (commands.length - MAX_PIPELINE_LINES) + ' more)')
+  let s = lines.join('\n')
+  if (s.length > MAX_STATEMENT) s = s.slice(0, MAX_STATEMENT) + '…'
+  return s
+}
+
+/** ITG-123: the first word of a Redis error reply (WRONGTYPE, ERR, …), or undefined. */
+function errorCode (err) {
+  if (!err || typeof err.message !== 'string') return undefined
+  // ioredis ReplyError; node-redis ErrorReply and its subclasses (SimpleError, BlobError)
+  let reply = /Reply/.test(String(err.name || ''))
+  for (let p = Object.getPrototypeOf(err); !reply && p && p !== Error.prototype; p = Object.getPrototypeOf(p)) {
+    if (p.constructor && /Reply/.test(p.constructor.name)) reply = true
+  }
+  if (!reply) return undefined
+  const first = err.message.split(/\s/)[0]
+  return /^[A-Z][A-Z0-9_]*$/.test(first) ? first : undefined
+}
+
+const XADD_FLAGS = { NOMKSTREAM: 0, KEEPREF: 0, DELREF: 0, ACKED: 0, IDMPAUTO: 1, IDMP: 2, LIMIT: 1 }
+
+/** Index in `args` (the arguments after XADD, key first) of the first field, or -1. */
+function xaddFieldsStart (args) {
+  let i = 1
+  const n = args.length
+  while (i < n) {
+    const t = text(args[i]).toUpperCase()
+    if (Object.prototype.hasOwnProperty.call(XADD_FLAGS, t)) {
+      i += 1 + XADD_FLAGS[t]
+      continue
+    }
+    if (t === 'MAXLEN' || t === 'MINID') {
+      i++
+      if (i < n && (text(args[i]) === '=' || text(args[i]) === '~')) i++
+      i++
+      continue
+    }
+    const start = i + 1
+    if (start >= n || (n - start) % 2) return -1
+    return start
+  }
+  return -1
+}
+
+/** ITG-210 with `redisStreamFields`: the trace fields the entry lacks, as a flat [f, v, …]. */
+function xaddExtraFields (args, span) {
+  const start = xaddFieldsStart(args)
+  if (start < 0) return []
+  const present = new Set()
+  for (let j = start; j < args.length; j += 2) present.add(text(args[j]).toLowerCase())
+  const extra = []
+  for (const [k, v] of c.traceHeaders(span)) if (!present.has(k)) extra.push(k, v)
+  return extra
+}
+
+/** (stream names, group) of an XREAD / XREADGROUP argument list. */
+function streamNames (name, args) {
+  const up = args.map((a) => (typeof a === 'string' || a instanceof Uint8Array ? text(a).toUpperCase() : ''))
+  let group
+  if (name === 'XREADGROUP') {
+    const g = up.indexOf('GROUP')
+    if (g !== -1 && g + 1 < args.length) group = text(args[g + 1])
+  }
+  const s = up.indexOf('STREAMS')
+  if (s === -1) return { names: [], group }
+  const rest = args.slice(s + 1)
+  const half = Math.floor(rest.length / 2)
+  return { names: rest.slice(0, half).map(text), group }
+}
+
+/** Each entry's fields of an XREAD/XREADGROUP reply, as objects or flat arrays. */
+function * streamEntries (resp, depth) {
+  depth = depth || 0
+  if (depth > 5 || resp === null || resp === undefined) return
+  if (Array.isArray(resp)) {
+    // an entry: [id, [f, v, …]] or [id, {f: v}]
+    if (resp.length === 2 && (typeof resp[0] === 'string' || resp[0] instanceof Uint8Array) &&
+        (Array.isArray(resp[1]) || (resp[1] && typeof resp[1] === 'object' && !(resp[1] instanceof Uint8Array))) &&
+        isEntryId(resp[0])) {
+      yield resp[1]
+      return
+    }
+    for (const v of resp) if (v && typeof v === 'object') yield * streamEntries(v, depth + 1)
+    return
+  }
+  if (resp instanceof Map) {
+    for (const v of resp.values()) yield * streamEntries(v, depth + 1)
+    return
+  }
+  if (typeof resp === 'object') {
+    // node-redis: { name, messages: [{ id, message: {f: v} }] } or { id, message }
+    if (resp.message && typeof resp.message === 'object' && resp.id !== undefined) {
+      yield resp.message
+      return
+    }
+    if (Array.isArray(resp.messages)) {
+      yield * streamEntries(resp.messages, depth + 1)
+      return
+    }
+    for (const k of Object.keys(resp)) yield * streamEntries(resp[k], depth + 1)
+  }
+}
+
+function isEntryId (v) {
+  return /^\d+-\d+$/.test(text(v))
+}
+
+function field (fields, name) {
+  if (Array.isArray(fields)) {
+    for (let i = 0; i + 1 < fields.length; i += 2) if (text(fields[i]).toLowerCase() === name) return text(fields[i + 1])
+    return undefined
+  }
+  if (fields instanceof Map) {
+    for (const [k, v] of fields) if (text(k).toLowerCase() === name) return text(v)
+    return undefined
+  }
+  for (const k of Object.keys(fields)) if (k.toLowerCase() === name) return text(fields[k])
+  return undefined
+}
+
+/** { contexts, count } of the entries of an XREAD/XREADGROUP reply. */
+function streamContexts (resp) {
+  const contexts = []
+  let count = 0
+  for (const fields of streamEntries(resp)) {
+    count++
+    const tp = field(fields, 'traceparent')
+    if (tp === undefined) continue
+    const carrier = { traceparent: tp }
+    const ts = field(fields, 'tracestate')
+    if (ts) carrier.tracestate = ts
+    const bg = field(fields, 'baggage')
+    if (bg) carrier.baggage = bg
+    const ctx = c.extract(carrier)
+    if (ctx) contexts.push(ctx)
+  }
+  return { contexts, count }
+}
+
+/**
+ * The messaging span of a stream command (ITG-210), or null when messaging is off / no span:
+ * { span, extra (fields to append to XADD), done(result, err) }.
+ */
+function streamCall (name, args, peer) {
+  if (!c.msgTracer()) return null
+  if (name === 'XADD') {
+    const dest = args.length ? text(args[0]) : undefined
+    const span = c.producer('redis', dest, peer)
+    if (!span) return { span: null, extra: [], done () {} }
+    const t = c.msgTracer()
+    const extra = t && t.messaging.redisStreamFields ? xaddExtraFields(args, span) : []
+    return {
+      span,
+      extra,
+      done (result, err) {
+        if (!err && result !== null && result !== undefined) span.setAttribute('messaging.message.id', text(result))
+        c.end(span, err)
+      }
+    }
+  }
+  const { names, group } = streamNames(name, args)
+  const tags = Object.assign({}, peer)
+  if (group) tags['messaging.consumer.group.name'] = group
+  // created now (the span covers only the call), kept only when entries came back
+  const span = c.batchConsumer('redis', names.length === 1 ? names[0] : undefined, null, tags, 'receive')
+  return {
+    span,
+    extra: [],
+    done (result, err) {
+      if (!span) return
+      if (err) return c.end(span, err)
+      const { contexts, count } = streamContexts(result)
+      if (count === 0) return // nothing returned: no span (ITG-023)
+      if (count >= 2) span.setAttribute('messaging.batch.message_count', String(count))
+      for (const ctx of contexts) span.addLink(ctx)
+      c.end(span)
+    }
+  }
+}
+
+module.exports = {
+  statement,
+  pipelineStatement,
+  errorCode,
+  xaddFieldsStart,
+  xaddExtraFields,
+  streamNames,
+  streamContexts,
+  streamCall,
+  text,
+  STREAM_COMMANDS
+}

package/lib/itg/sql.js

@@ -0,0 +1,302 @@
+// Copyright (c) 2026 Mike Warriner. All rights reserved. Proprietary — see LICENSE.
+'use strict'
+
+// Statement helpers for database spans (80 PYI-122/PYI-123, 82 ITG-030/ITG-031; same results as
+// pmx-io's _sql.py): the operation keyword and the sanitised statement text (literals → `?`, bind
+// placeholders kept, comments removed, whitespace collapsed, 2000 characters). One pass over the
+// text; results cached per statement (bounded).
+
+const MAX_STATEMENT = 2000
+const CACHE_MAX = 512
+// statements longer than this are not cached: a cache of 512 multi-megabyte INSERT texts (bulk
+// loads with inline values, all distinct) would keep them all alive
+const CACHE_KEY_MAX = 8192
+
+const isWs = (c) => c === ' ' || c === '\t' || c === '\r' || c === '\n' || c === '\f' || c === '\v'
+const isIdentStart = (c) => (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || c === '_'
+const isDigit = (c) => c >= '0' && c <= '9'
+const isIdent = (c) => isIdentStart(c) || isDigit(c) || c === '$'
+const isHexD = (c) => isDigit(c) || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F') || c === '_'
+const isAlpha = (c) => /\p{L}/u.test(c)
+
+const opCache = new Map()
+const pgCache = new Map()
+const myCache = new Map()
+
+function cached (map, key, compute) {
+  if (key.length > CACHE_KEY_MAX) return compute(key)
+  let v = map.get(key)
+  if (v !== undefined) return v
+  v = compute(key)
+  if (map.size >= CACHE_MAX) map.clear()
+  map.set(key, v)
+  return v
+}
+
+function blockCommentEnd (s, i) {
+  // PostgreSQL block comments nest
+  let depth = 0
+  const n = s.length
+  while (i < n) {
+    if (s.startsWith('/*', i)) {
+      depth++
+      i += 2
+    } else if (s.startsWith('*/', i)) {
+      depth--
+      i += 2
+      if (depth === 0) return i
+    } else {
+      i++
+    }
+  }
+  return n
+}
+
+function skipWsComments (s, i) {
+  const n = s.length
+  while (i < n) {
+    const c = s[i]
+    if (isWs(c) || c === '(') i++
+    else if (c === '-' && s.startsWith('--', i)) {
+      const j = s.indexOf('\n', i)
+      i = j < 0 ? n : j + 1
+    } else if (c === '/' && s.startsWith('/*', i)) {
+      i = blockCommentEnd(s, i)
+    } else break
+  }
+  return i
+}
+
+/** PYI-122: the first keyword after leading whitespace and comments, uppercased, ≤ 16 chars. */
+function operation (statement) {
+  if (typeof statement !== 'string') return ''
+  return cached(opCache, statement, (s) => {
+    const i = skipWsComments(s, 0)
+    let j = i
+    while (j < s.length && isAlpha(s[j]) && j - i < 16) j++
+    return s.slice(i, j).toUpperCase()
+  })
+}
+
+function truncate (text) {
+  if (text.length > MAX_STATEMENT) return text.slice(0, MAX_STATEMENT - 1) + '…'
+  return text
+}
+
+function quotedEnd (s, i, quote, backslash) {
+  const n = s.length
+  i++
+  while (i < n) {
+    const c = s[i]
+    if (backslash && c === '\\') {
+      i += 2
+      continue
+    }
+    if (c === quote) {
+      if (i + 1 < n && s[i + 1] === quote) {
+        i += 2
+        continue
+      }
+      return i + 1
+    }
+    i++
+  }
+  return n
+}
+
+function dollarTag (s, i) {
+  const n = s.length
+  let j = i + 1
+  if (j < n && s[j] === '$') return '$$'
+  if (j < n && isIdentStart(s[j])) {
+    j++
+    while (j < n && isIdent(s[j]) && s[j] !== '$') j++
+    if (j < n && s[j] === '$') return s.slice(i, j + 1)
+  }
+  return ''
+}
+
+function numberEnd (s, i) {
+  const n = s.length
+  if (s[i] === '0' && i + 1 < n && 'xXoObB'.includes(s[i + 1])) {
+    let j = i + 2
+    while (j < n && isHexD(s[j])) j++
+    return j
+  }
+  let j = i
+  while (j < n && (isDigit(s[j]) || s[j] === '_')) j++
+  if (j < n && s[j] === '.') {
+    j++
+    while (j < n && (isDigit(s[j]) || s[j] === '_')) j++
+  }
+  if (j < n && (s[j] === 'e' || s[j] === 'E')) {
+    let k = j + 1
+    if (k < n && (s[k] === '+' || s[k] === '-')) k++
+    if (k < n && isDigit(s[k])) {
+      j = k
+      while (j < n && isDigit(s[j])) j++
+    }
+  }
+  return j
+}
+
+class Out {
+  constructor () {
+    this.parts = []
+    this.pending = false
+    this.len = 0
+  }
+
+  emit (text) {
+    if (this.pending && this.parts.length) {
+      this.parts.push(' ')
+      this.len++
+    }
+    this.pending = false
+    this.parts.push(text)
+    this.len += text.length
+  }
+
+  last () {
+    const p = this.parts[this.parts.length - 1]
+    return p ? p[p.length - 1] : ''
+  }
+
+  /** True once the text is past the statement limit (the rest of the input is not read). */
+  full () {
+    return this.len > MAX_STATEMENT
+  }
+
+  text () {
+    return truncate(this.parts.join(''))
+  }
+}
+
+const PG_PREFIXES = new Set(['e', 'E', 'b', 'B', 'x', 'X', 'n', 'N'])
+
+function sanitizePg (s) {
+  const out = new Out()
+  const n = s.length
+  let i = 0
+  while (i < n && !out.full()) {
+    const c = s[i]
+    if (isWs(c)) {
+      out.pending = true
+      i++
+    } else if (c === '-' && s.startsWith('--', i)) {
+      const j = s.indexOf('\n', i)
+      i = j < 0 ? n : j
+      out.pending = true
+    } else if (c === '/' && s.startsWith('/*', i)) {
+      i = blockCommentEnd(s, i)
+      out.pending = true
+    } else if (c === "'") {
+      i = quotedEnd(s, i, "'", false)
+      out.emit('?')
+    } else if (c === '"') {
+      const j = quotedEnd(s, i, '"', false)
+      out.emit(s.slice(i, j))
+      i = j
+    } else if (c === '$') {
+      const tag = dollarTag(s, i)
+      if (tag && !(isIdent(out.last()) && !out.pending)) {
+        const end = s.indexOf(tag, i + tag.length)
+        i = end < 0 ? n : end + tag.length
+        out.emit('?')
+      } else {
+        let j = i + 1
+        while (j < n && isDigit(s[j])) j++
+        out.emit(s.slice(i, j)) // bind placeholder $1 (or a lone '$')
+        i = j
+      }
+    } else if (isIdentStart(c)) {
+      let j = i + 1
+      while (j < n && isIdent(s[j])) j++
+      const word = s.slice(i, j)
+      if (j < n && s[j] === "'" && PG_PREFIXES.has(word)) {
+        i = quotedEnd(s, j, "'", word === 'e' || word === 'E')
+        out.emit('?')
+      } else if (j + 1 < n && s[j] === '&' && s[j + 1] === "'" && (word === 'u' || word === 'U')) {
+        i = quotedEnd(s, j + 1, "'", false)
+        out.emit('?')
+      } else {
+        out.emit(word)
+        i = j
+      }
+    } else if (isDigit(c) || (c === '.' && i + 1 < n && isDigit(s[i + 1]))) {
+      i = numberEnd(s, i)
+      out.emit('?')
+    } else {
+      out.emit(c)
+      i++
+    }
+  }
+  return out.text()
+}
+
+const MY_PREFIXES = new Set(['x', 'X', 'b', 'B', 'n', 'N'])
+
+function sanitizeMysql (s) {
+  const out = new Out()
+  const n = s.length
+  let i = 0
+  while (i < n && !out.full()) {
+    const c = s[i]
+    if (isWs(c)) {
+      out.pending = true
+      i++
+    } else if (c === '#' || (c === '-' && s.startsWith('--', i) && (i + 2 >= n || isWs(s[i + 2])))) {
+      const j = s.indexOf('\n', i)
+      i = j < 0 ? n : j
+      out.pending = true
+    } else if (c === '/' && s.startsWith('/*', i)) {
+      const j = s.indexOf('*/', i + 2) // MySQL comments do not nest
+      i = j < 0 ? n : j + 2
+      out.pending = true
+    } else if (c === "'" || c === '"') {
+      i = quotedEnd(s, i, c, true)
+      out.emit('?')
+    } else if (c === '`') {
+      const j = quotedEnd(s, i, '`', false)
+      out.emit(s.slice(i, j))
+      i = j
+    } else if (isIdentStart(c)) {
+      let j = i + 1
+      while (j < n && isIdent(s[j])) j++
+      const word = s.slice(i, j)
+      if (j < n && s[j] === "'" && (MY_PREFIXES.has(word) || word.startsWith('_'))) {
+        i = quotedEnd(s, j, "'", !['x', 'X', 'b', 'B'].includes(word))
+        out.emit('?')
+      } else {
+        out.emit(word)
+        i = j
+      }
+    } else if (isDigit(c) || (c === '.' && i + 1 < n && isDigit(s[i + 1]))) {
+      i = numberEnd(s, i)
+      out.emit('?')
+    } else {
+      out.emit(c)
+      i++
+    }
+  }
+  return out.text()
+}
+
+/** PYI-123 `sanitized` mode for PostgreSQL (cached). */
+function sanitize (statement) {
+  return cached(pgCache, statement, sanitizePg)
+}
+
+/** 82 ITG-031 `sanitized` mode for MySQL (cached). */
+function sanitizeMySQL (statement) {
+  return cached(myCache, statement, sanitizeMysql)
+}
+
+/** The `db.statement` tag for `mode` (`sanitized` | `raw` | `off`), or undefined. */
+function statementTag (statement, mode, mysql) {
+  if (mode === 'off' || typeof statement !== 'string') return undefined
+  if (mode === 'raw') return truncate(statement)
+  return mysql ? sanitizeMySQL(statement) : sanitize(statement)
+}
+
+module.exports = { operation, sanitize, sanitizeMySQL, statementTag, truncate, MAX_STATEMENT }