@antelopejs/postgres 0.3.0 → 0.4.1

package/dist/test-external/probe-refusals.test.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const probe_fixture_1 = require("./probe-fixture");
+const relays_1 = require("./relays");
+function WithoutPassword(url) {
+    return (0, probe_fixture_1.Altered)(url, (target) => {
+        target.password = "";
+    });
+}
+const SSL_REQUEST = Buffer.from([0, 0, 0, 8, 0x04, 0xd2, 0x16, 0x2f]);
+function OnDatabase(url, database) {
+    return (0, probe_fixture_1.Altered)(url, (target) => {
+        target.pathname = `/${database}`;
+    });
+}
+describe("the connection probe's refusals", function () {
+    this.timeout(60_000);
+    (0, probe_fixture_1.WithProbeLogins)();
+    it("refuses a wrong password as credentials", async () => {
+        const answer = await (0, probe_fixture_1.Probe)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader, "not-the-password"));
+        (0, chai_1.expect)(answer).to.include({ outcome: "refused", refusal: "credentials" });
+    });
+    it("refuses a login the server does not let in as host", async () => {
+        (0, chai_1.expect)(await (0, probe_fixture_1.Probe)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.NO_LOGIN))).to.include({
+            outcome: "refused",
+            refusal: "host",
+        });
+    });
+    it("refuses a database the server does not have as database", async () => {
+        const url = OnDatabase((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), "antelopejs_missing");
+        (0, chai_1.expect)(await (0, probe_fixture_1.Probe)(url)).to.include({
+            outcome: "refused",
+            refusal: "database",
+        });
+    });
+    it("refuses a database the login may not connect to as database-denied", async () => {
+        const url = OnDatabase((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), probe_fixture_1.LOCKED_DATABASE);
+        (0, chai_1.expect)(await (0, probe_fixture_1.Probe)(url)).to.include({
+            outcome: "refused",
+            refusal: "database-denied",
+        });
+    });
+    it("refuses a URL without the password the server asks for as sign-in-required", async () => {
+        (0, chai_1.expect)(await (0, probe_fixture_1.Probe)(WithoutPassword((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader)))).to.include({
+            outcome: "refused",
+            refusal: "sign-in-required",
+        });
+    });
+    it("never fills a password the URL lacks from PGPASSWORD", async () => {
+        const reader = (0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader);
+        await (0, probe_fixture_1.WithEnvironment)({ PGPASSWORD: new URL(reader).password }, async () => {
+            (0, chai_1.expect)(await (0, probe_fixture_1.Probe)(WithoutPassword(reader))).to.include({
+                outcome: "refused",
+                refusal: "sign-in-required",
+            });
+        });
+    });
+    it("sends nothing to a server asking for a cleartext password the URL lacks", async () => {
+        const server = await (0, relays_1.StartRecordingServer)(relays_1.CLEARTEXT_PASSWORD_REQUEST);
+        try {
+            await (0, probe_fixture_1.WithEnvironment)({ PGPASSWORD: "the probing process's own secret" }, async () => {
+                const url = WithoutPassword((0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port));
+                (0, chai_1.expect)(await (0, probe_fixture_1.Probe)(url)).to.include({
+                    outcome: "refused",
+                    refusal: "sign-in-required",
+                });
+            });
+            (0, chai_1.expect)(server.received()).to.equal(0);
+        }
+        finally {
+            await server.close();
+        }
+    });
+    it("asks for TLS before anything else when the URL says ssl=no-verify", async () => {
+        const server = await (0, relays_1.StartRecordingServer)(relays_1.CLEARTEXT_PASSWORD_REQUEST);
+        try {
+            const url = (0, probe_fixture_1.Altered)((0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port), (target) => {
+                target.searchParams.set("ssl", "no-verify");
+            });
+            await (0, probe_fixture_1.Probe)(url);
+            (0, chai_1.expect)(server.first()).to.deep.equal(SSL_REQUEST);
+            (0, chai_1.expect)(server.received()).to.equal(0);
+        }
+        finally {
+            await server.close();
+        }
+    });
+    it("refuses any other server error during the sign-in as other, with its message", async () => {
+        const url = (0, probe_fixture_1.Altered)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), (target) => {
+            target.searchParams.set("options", "-c probe_bogus=1");
+        });
+        const answer = await (0, probe_fixture_1.Probe)(url);
+        (0, chai_1.expect)(answer).to.include({ outcome: "refused", refusal: "other" });
+        (0, chai_1.expect)(answer).to.have.property("message").that.contains("probe_bogus");
+    });
+    it("answers a port nothing listens on as unreachable, within the timeout", async () => {
+        const started = performance.now();
+        const answer = await (0, probe_fixture_1.Probe)((0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), await (0, relays_1.ClosedPort)()));
+        (0, chai_1.expect)(performance.now() - started).to.be.lessThan(probe_fixture_1.TIMEOUT_MS);
+        (0, chai_1.expect)(answer.outcome).to.equal("unreachable");
+    });
+    it("says why when every address of a host name refuses", async () => {
+        const port = await (0, relays_1.ClosedPort)();
+        const answer = await (0, probe_fixture_1.Probe)((0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), port, "localhost"));
+        (0, chai_1.expect)(answer.outcome).to.equal("unreachable");
+        (0, chai_1.expect)(answer).to.have.property("message").that.contains("ECONNREFUSED");
+    });
+});
+//# sourceMappingURL=probe-refusals.test.js.map

package/dist/test-external/probe-refusals.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-refusals.test.js","sourceRoot":"","sources":["../../src/test-external/probe-refusals.test.ts"],"names":[],"mappings":";;AAAA,+BAA8B;AAE9B,mDAWyB;AACzB,qCAIkB;AAElB,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,IAAA,uBAAO,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAGD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEtE,SAAS,UAAU,CAAC,GAAW,EAAE,QAAgB;IAC/C,OAAO,IAAA,uBAAO,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,CAAC,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,iCAAiC,EAAE;IAC1C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,IAAA,+BAAe,GAAE,CAAC;IAElB,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAK,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACvE,IAAA,aAAM,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,IAAA,aAAM,EAAC,MAAM,IAAA,qBAAK,EAAC,IAAA,wBAAQ,EAAC,wBAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;YACjD,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACrE,IAAA,aAAM,EAAC,MAAM,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;YAClC,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,+BAAe,CAAC,CAAC;QAChE,IAAA,aAAM,EAAC,MAAM,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;YAClC,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,iBAAiB;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,IAAA,aAAM,EAAC,MAAM,IAAA,qBAAK,EAAC,eAAe,CAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;YACtE,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,IAAA,+BAAe,EACnB,EAAE,UAAU,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EACxC,KAAK,IAAI,EAAE;YACT,IAAA,aAAM,EAAC,MAAM,IAAA,qBAAK,EAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;gBACtD,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAoB,EAAC,mCAA0B,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,IAAA,+BAAe,EACnB,EAAE,UAAU,EAAE,kCAAkC,EAAE,EAClD,KAAK,IAAI,EAAE;gBACT,MAAM,GAAG,GAAG,eAAe,CACzB,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAC5C,CAAC;gBACF,IAAA,aAAM,EAAC,MAAM,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;oBAClC,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,kBAAkB;iBAC5B,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YACF,IAAA,aAAM,EAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAoB,EAAC,mCAA0B,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,uBAAO,EACjB,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC,MAAM,EAAE,EAAE;gBACT,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC9C,CAAC,CACF,CAAC;YACF,MAAM,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC;YACjB,IAAA,aAAM,EAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,IAAA,aAAM,EAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,GAAG,GAAG,IAAA,uBAAO,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE;YACrD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC;QAChC,IAAA,aAAM,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,IAAA,aAAM,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAK,EACxB,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,IAAA,mBAAU,GAAE,CAAC,CACnD,CAAC;QACF,IAAA,aAAM,EAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,0BAAU,CAAC,CAAC;QAC/D,IAAA,aAAM,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,IAAI,GAAG,MAAM,IAAA,mBAAU,GAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAK,EACxB,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAClD,CAAC;QACF,IAAA,aAAM,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test-external/probe-url.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test-external/probe-url.test.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const probe_1 = require("../probe");
+const probe_fixture_1 = require("./probe-fixture");
+const relays_1 = require("./relays");
+const BOUND_MS = 300;
+const LIFTED_MS = 60_000;
+const NO_CONNECTION = { connections: 0, received: 0 };
+function WithParameter(url, name, value) {
+    return (0, probe_fixture_1.Altered)(url, (target) => {
+        target.searchParams.set(name, value);
+    });
+}
+function Bounded(url) {
+    return (0, probe_1.probe)({
+        url,
+        timeoutMs: BOUND_MS,
+        signal: new AbortController().signal,
+    });
+}
+function StartupParameters(packet) {
+    const fields = (packet ?? Buffer.alloc(0))
+        .subarray(8, -1)
+        .toString("utf8")
+        .split("\0")
+        .slice(0, -1);
+    const parameters = new Map();
+    for (let index = 0; index + 1 < fields.length; index += 2) {
+        parameters.set(fields[index], fields[index + 1]);
+    }
+    return parameters;
+}
+async function WithServer(server, check) {
+    try {
+        await check(server);
+    }
+    finally {
+        await server.close();
+    }
+}
+function Seen(server) {
+    return { connections: server.connections(), received: server.received() };
+}
+const STARTUP_ROWS = [
+    { name: "statement_timeout", value: "0", sent: String(BOUND_MS) },
+    { name: "lock_timeout", value: "0", sent: String(BOUND_MS) },
+    {
+        name: "idle_in_transaction_session_timeout",
+        value: "0",
+        sent: String(BOUND_MS),
+    },
+    { name: "replication", value: "database", sent: undefined },
+    { name: "application_name", value: "probe-app", sent: "probe-app" },
+    { name: "options", value: "-c search_path=x", sent: "-c search_path=x" },
+];
+const TLS_ACCEPTED = Buffer.from("S");
+const HOSTILE_LENGTH = 1_000_000;
+function HostileUrls(port) {
+    const base = `postgres://${probe_fixture_1.LOGIN.reader}:secret@127.0.0.1:${port}/shop`;
+    const repeat = (text) => text.repeat(Math.ceil(HOSTILE_LENGTH / text.length));
+    return new Map([
+        ["host", `postgres://${probe_fixture_1.LOGIN.reader}:secret@${repeat("a")}:${port}/shop`],
+        ["user", `postgres://${repeat("%2")}:secret@127.0.0.1:${port}/shop`],
+        [
+            "database",
+            `postgres://${probe_fixture_1.LOGIN.reader}:secret@127.0.0.1:${port}/${repeat("%41")}`,
+        ],
+        ["options", `${base}?options=${repeat("-c%20a%3Db%20")}`],
+        ["application_name", `${base}?application_name=${repeat("a")}`],
+        ["bad escapes", `${base}?x=${repeat("%zz %")}`],
+        ["parameter count", `${base}?${repeat("k=v&")}`],
+        ["sslmode", `${base}?sslmode=${repeat("verify-")}`],
+    ]);
+}
+function CredentialCases() {
+    it("refuses a URL with no user before connecting, whatever PGUSER says", async () => {
+        await WithServer(await (0, relays_1.StartRecordingServer)(), async (server) => {
+            const url = (0, probe_fixture_1.Altered)((0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port), (target) => {
+                target.username = "";
+            });
+            await (0, probe_fixture_1.WithEnvironment)({ PGUSER: probe_fixture_1.LOGIN.reader }, async () => {
+                (0, chai_1.expect)(await (0, probe_fixture_1.Probe)(url)).to.include({
+                    outcome: "refused",
+                    refusal: "other",
+                });
+            });
+            (0, chai_1.expect)(Seen(server)).to.deep.equal(NO_CONNECTION);
+        });
+    });
+    it("refuses a URL with no host before connecting, whatever PGHOST says", async () => {
+        await (0, probe_fixture_1.WithEnvironment)({ PGHOST: "127.0.0.1" }, async () => {
+            const answer = await (0, probe_fixture_1.Probe)(`postgres://${probe_fixture_1.LOGIN.reader}:secret@/shop`);
+            (0, chai_1.expect)(answer).to.include({ outcome: "refused", refusal: "other" });
+            (0, chai_1.expect)(answer).to.have.property("message").that.contains("no host");
+        });
+    });
+    it("refuses a client certificate of the probing host before connecting", async () => {
+        await WithServer(await (0, relays_1.StartRecordingServer)(), async (server) => {
+            for (const name of ["sslcert", "sslkey"]) {
+                const url = WithParameter((0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port), name, __filename);
+                (0, chai_1.expect)(await (0, probe_fixture_1.Probe)(url), name).to.include({
+                    outcome: "refused",
+                    refusal: "other",
+                });
+            }
+            (0, chai_1.expect)(Seen(server)).to.deep.equal(NO_CONNECTION);
+        });
+    });
+}
+function WorkCases() {
+    const ROOT_CERTIFICATES = [
+        "/dev/zero",
+        __dirname,
+        "/proc/self/pagemap",
+        __filename,
+    ];
+    for (const path of ROOT_CERTIFICATES) {
+        it(`refuses sslrootcert=${path} without reading it`, async () => {
+            await WithServer(await (0, relays_1.StartRecordingServer)(), async (server) => {
+                const url = WithParameter((0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port), "sslrootcert", path);
+                const started = performance.now();
+                (0, chai_1.expect)(await Bounded(url)).to.include({
+                    outcome: "refused",
+                    refusal: "other",
+                });
+                (0, chai_1.expect)(performance.now() - started).to.be.lessThan(BOUND_MS);
+                (0, chai_1.expect)(Seen(server)).to.deep.equal(NO_CONNECTION);
+            });
+        });
+    }
+    for (const query of [
+        "ssl=false",
+        "ssl=require",
+        "ssl=abc",
+        "ssl=false&sslmode=",
+    ]) {
+        it(`refuses ${query}, which pg fails on once TLS starts, before connecting`, async () => {
+            await WithServer(await (0, relays_1.StartRecordingServer)(TLS_ACCEPTED), async (server) => {
+                const url = `${(0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port)}?${query}`;
+                (0, chai_1.expect)(await Bounded(url)).to.include({
+                    outcome: "refused",
+                    refusal: "other",
+                });
+                (0, chai_1.expect)(Seen(server)).to.deep.equal(NO_CONNECTION);
+            });
+        });
+    }
+    for (const query of ["ssl=", "ssl=0"]) {
+        it(`keeps ${query}, which pg reads as no TLS`, async () => {
+            await WithServer(await (0, relays_1.StartRecordingServer)(), async (server) => {
+                await Bounded(`${(0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port)}?${query}`);
+                (0, chai_1.expect)(StartupParameters(server.first()).get("user")).to.equal(probe_fixture_1.LOGIN.reader);
+            });
+        });
+    }
+    it("keeps ssl=no-verify and asks for TLS", async () => {
+        await WithServer(await (0, relays_1.StartRecordingServer)(), async (server) => {
+            await Bounded(WithParameter((0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port), "ssl", "no-verify"));
+            (0, chai_1.expect)(server.connections()).to.equal(1);
+        });
+    });
+    it("refuses many sslrootcert keys within its bound", async () => {
+        const url = `${(0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), await (0, relays_1.ClosedPort)())}?${`sslrootcert=${__filename}&`.repeat(10_000)}`;
+        const started = performance.now();
+        (0, chai_1.expect)(await Bounded(url)).to.include({
+            outcome: "refused",
+            refusal: "other",
+        });
+        (0, chai_1.expect)(performance.now() - started).to.be.lessThan(BOUND_MS);
+    });
+    for (const [key, character] of [
+        ["sslkey", "\t"],
+        ["sslcert", "\n"],
+        ["sslrootcert", "\r"],
+    ]) {
+        it(`refuses ${key} with ${JSON.stringify(character)} inside its name before reading it`, async () => {
+            await WithServer(await (0, relays_1.StartRecordingServer)(), async (server) => {
+                const name = `${key.slice(0, 3)}${character}${key.slice(3)}`;
+                const path = key === "sslrootcert" ? "/dev/zero" : __filename;
+                const url = `${(0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port)}?${name}=${path}`;
+                const started = performance.now();
+                (0, chai_1.expect)(await Bounded(url)).to.include({
+                    outcome: "refused",
+                    refusal: "other",
+                });
+                (0, chai_1.expect)(performance.now() - started).to.be.lessThan(BOUND_MS);
+                (0, chai_1.expect)(Seen(server)).to.deep.equal(NO_CONNECTION);
+            });
+        });
+    }
+    it("answers within its bound however long and awkward each URL value is", async () => {
+        for (const [name, url] of HostileUrls(await (0, relays_1.ClosedPort)())) {
+            const started = performance.now();
+            const answer = await Bounded(url);
+            (0, chai_1.expect)(performance.now() - started, name).to.be.lessThan(BOUND_MS * 4);
+            (0, chai_1.expect)(answer.outcome, name).to.not.equal("signed-in");
+        }
+    });
+}
+function ParameterCases() {
+    for (const { name, value, sent } of STARTUP_ROWS) {
+        it(`sends ${name} as ${sent ?? "nothing"} when the URL says ${value}`, async () => {
+            await WithServer(await (0, relays_1.StartRecordingServer)(), async (server) => {
+                const url = WithParameter((0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port), name, value);
+                await Bounded(url);
+                const parameters = StartupParameters(server.first());
+                (0, chai_1.expect)(parameters.get("user")).to.equal(probe_fixture_1.LOGIN.reader);
+                (0, chai_1.expect)(parameters.get(name)).to.equal(sent);
+            });
+        });
+    }
+    it("answers within its bound when the URL lifts query_timeout", async () => {
+        await WithServer(await (0, relays_1.StartRecordingServer)(relays_1.SIGNED_IN), async (server) => {
+            const url = WithParameter((0, probe_fixture_1.OnPort)((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.reader), server.port), "query_timeout", String(LIFTED_MS));
+            const started = performance.now();
+            const answer = await Bounded(url);
+            (0, chai_1.expect)(performance.now() - started).to.be.lessThan(BOUND_MS * 4);
+            (0, chai_1.expect)(answer.outcome).to.equal("unreachable");
+        });
+    });
+    it("changes no row when the URL's options put a writing function on the path", async () => {
+        const url = WithParameter((0, probe_fixture_1.LoginUrl)(probe_fixture_1.LOGIN.writer), "options", `-c search_path=${probe_fixture_1.SCRIBBLE_SCHEMA},pg_catalog`);
+        const answer = (0, probe_fixture_1.SignedIn)(await (0, probe_fixture_1.Probe)(url));
+        (0, chai_1.expect)(answer).to.include({ unreadable: "cannot-list" });
+        (0, chai_1.expect)(await (0, probe_fixture_1.CountAsOwner)(`${probe_fixture_1.SCRIBBLE_SCHEMA}.marks`)).to.equal(0);
+    });
+}
+describe("the connection probe's URL", function () {
+    this.timeout(60_000);
+    (0, probe_fixture_1.WithProbeLogins)();
+    describe("credentials", () => {
+        CredentialCases();
+    });
+    describe("work before the probe can refuse", () => {
+        WorkCases();
+    });
+    describe("parameters", () => {
+        ParameterCases();
+    });
+});
+//# sourceMappingURL=probe-url.test.js.map

package/dist/test-external/probe-url.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-url.test.js","sourceRoot":"","sources":["../../src/test-external/probe-url.test.ts"],"names":[],"mappings":";;AAAA,+BAA8B;AAE9B,oCAAiC;AACjC,mDAWyB;AACzB,qCAKkB;AAGlB,MAAM,QAAQ,GAAG,GAAG,CAAC;AAGrB,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB,MAAM,aAAa,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAEtD,SAAS,aAAa,CAAC,GAAW,EAAE,IAAY,EAAE,KAAa;IAC7D,OAAO,IAAA,uBAAO,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,IAAA,aAAK,EAAC;QACX,GAAG;QACH,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;KACrC,CAAC,CAAC;AACL,CAAC;AAGD,SAAS,iBAAiB,CAAC,MAA0B;IACnD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACvC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACf,QAAQ,CAAC,MAAM,CAAC;SAChB,KAAK,CAAC,IAAI,CAAC;SACX,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAuB,EACvB,KAAiD;IAEjD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,MAAuB;IACnC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC5E,CAAC;AAMD,MAAM,YAAY,GAAG;IACnB,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;IACjE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;IAC5D;QACE,IAAI,EAAE,qCAAqC;QAC3C,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC;KACvB;IACD,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3D,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE;IACnE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAAE;CACzE,CAAC;AAGF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAGtC,MAAM,cAAc,GAAG,SAAS,CAAC;AAGjC,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,IAAI,GAAG,cAAc,qBAAK,CAAC,MAAM,qBAAqB,IAAI,OAAO,CAAC;IACxE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,GAAG,CAAC;QACb,CAAC,MAAM,EAAE,cAAc,qBAAK,CAAC,MAAM,WAAW,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC;QACzE,CAAC,MAAM,EAAE,cAAc,MAAM,CAAC,IAAI,CAAC,qBAAqB,IAAI,OAAO,CAAC;QACpE;YACE,UAAU;YACV,cAAc,qBAAK,CAAC,MAAM,qBAAqB,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE;SACvE;QACD,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,CAAC,kBAAkB,EAAE,GAAG,IAAI,qBAAqB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,CAAC,aAAa,EAAE,GAAG,IAAI,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,CAAC,iBAAiB,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe;IACtB,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,UAAU,CAAC,MAAM,IAAA,6BAAoB,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9D,MAAM,GAAG,GAAG,IAAA,uBAAO,EACjB,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC,MAAM,EAAE,EAAE;gBACT,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;YACvB,CAAC,CACF,CAAC;YACF,MAAM,IAAA,+BAAe,EAAC,EAAE,MAAM,EAAE,qBAAK,CAAC,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE;gBACzD,IAAA,aAAM,EAAC,MAAM,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;oBAClC,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,IAAA,aAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAA,+BAAe,EAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAK,EAAC,cAAc,qBAAK,CAAC,MAAM,eAAe,CAAC,CAAC;YACtE,IAAA,aAAM,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACpE,IAAA,aAAM,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,UAAU,CAAC,MAAM,IAAA,6BAAoB,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9D,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzC,MAAM,GAAG,GAAG,aAAa,CACvB,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAC3C,IAAI,EACJ,UAAU,CACX,CAAC;gBACF,IAAA,aAAM,EAAC,MAAM,IAAA,qBAAK,EAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;oBACxC,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,IAAA,aAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,iBAAiB,GAAG;QACxB,WAAW;QACX,SAAS;QACT,oBAAoB;QACpB,UAAU;KACX,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,EAAE,CAAC,uBAAuB,IAAI,qBAAqB,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,UAAU,CAAC,MAAM,IAAA,6BAAoB,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBAC9D,MAAM,GAAG,GAAG,aAAa,CACvB,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAC3C,aAAa,EACb,IAAI,CACL,CAAC;gBACF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;gBAClC,IAAA,aAAM,EAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;oBACpC,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;gBACH,IAAA,aAAM,EAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC7D,IAAA,aAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,KAAK,IAAI;QAClB,WAAW;QACX,aAAa;QACb,SAAS;QACT,oBAAoB;KACrB,EAAE,CAAC;QACF,EAAE,CAAC,WAAW,KAAK,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtF,MAAM,UAAU,CACd,MAAM,IAAA,6BAAoB,EAAC,YAAY,CAAC,EACxC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACf,MAAM,GAAG,GAAG,GAAG,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtE,IAAA,aAAM,EAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;oBACpC,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;gBACH,IAAA,aAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACpD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACtC,EAAE,CAAC,SAAS,KAAK,4BAA4B,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,UAAU,CAAC,MAAM,IAAA,6BAAoB,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBAC9D,MAAM,OAAO,CACX,GAAG,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAC1D,CAAC;gBACF,IAAA,aAAM,EAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAC5D,qBAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,UAAU,CAAC,MAAM,IAAA,6BAAoB,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9D,MAAM,OAAO,CACX,aAAa,CACX,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAC3C,KAAK,EACL,WAAW,CACZ,CACF,CAAC;YACF,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,GAAG,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,IAAA,mBAAU,GAAE,CAAC,IAAI,eAAe,UAAU,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACnH,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,IAAA,aAAM,EAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;YACpC,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,IAAA,aAAM,EAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI;QAC7B,CAAC,QAAQ,EAAE,IAAI,CAAC;QAChB,CAAC,SAAS,EAAE,IAAI,CAAC;QACjB,CAAC,aAAa,EAAE,IAAI,CAAC;KACtB,EAAE,CAAC;QACF,EAAE,CAAC,WAAW,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClG,MAAM,UAAU,CAAC,MAAM,IAAA,6BAAoB,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBAC9D,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,GAAG,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC9D,MAAM,GAAG,GAAG,GAAG,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;gBAClC,IAAA,aAAM,EAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;oBACpC,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;gBACH,IAAA,aAAM,EAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC7D,IAAA,aAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,IAAA,mBAAU,GAAE,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAA,aAAM,EAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YACvE,IAAA,aAAM,EAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;QACjD,EAAE,CAAC,SAAS,IAAI,OAAO,IAAI,IAAI,SAAS,sBAAsB,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE;YAChF,MAAM,UAAU,CAAC,MAAM,IAAA,6BAAoB,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBAC9D,MAAM,GAAG,GAAG,aAAa,CACvB,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAC3C,IAAI,EACJ,KAAK,CACN,CAAC;gBACF,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACrD,IAAA,aAAM,EAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAK,CAAC,MAAM,CAAC,CAAC;gBACtD,IAAA,aAAM,EAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,UAAU,CAAC,MAAM,IAAA,6BAAoB,EAAC,kBAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvE,MAAM,GAAG,GAAG,aAAa,CACvB,IAAA,sBAAM,EAAC,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAC3C,eAAe,EACf,MAAM,CAAC,SAAS,CAAC,CAClB,CAAC;YACF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAA,aAAM,EAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YACjE,IAAA,aAAM,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,GAAG,GAAG,aAAa,CACvB,IAAA,wBAAQ,EAAC,qBAAK,CAAC,MAAM,CAAC,EACtB,SAAS,EACT,kBAAkB,+BAAe,aAAa,CAC/C,CAAC;QACF,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,MAAM,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,IAAA,aAAM,EAAC,MAAM,IAAA,4BAAY,EAAC,GAAG,+BAAe,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,4BAA4B,EAAE;IACrC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,IAAA,+BAAe,GAAE,CAAC;IAElB,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,SAAS,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,cAAc,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test-external/reads.test.js

@@ -18,7 +18,8 @@ function NextDay(iso) {
     return new Date(Day(iso).getTime() + 86_400_000);
 }
 describe("listing an external relation as a TableView does", () => {
-    before(async () => {
+    before(async function () {
+        this.timeout(sales_1.REGISTRATION_TIMEOUT_MS);
         sales = await (0, sales_1.RegisterSales)();
     });
     it("lists with an enum filter, a (?i) search, a sort and a page, as a TableView does", async () => {
@@ -27,7 +28,8 @@ describe("listing an external relation as a TableView does", () => {
             .filter((row) => row.key("status").eq("active"))
             .filter((row) => row.key("name").match("(?i)acct 1"))
             .slice(0, 5)
-            .pluck("_internal", "_id", "name", "status");
+            .pluck("_internal", "_id", "name", "status")
+            .run();
         const expected = await (0, sales_1.Native)(`SELECT id::text AS "_id", name, status::text AS status FROM sales.accounts
        WHERE status = 'active' AND name ~* 'acct 1' ORDER BY name DESC LIMIT 5`);
         (0, chai_1.expect)(rows).to.deep.equal(expected);
@@ -36,14 +38,16 @@ describe("listing an external relation as a TableView does", () => {
         const total = await Accounts()
             .filter((row) => row.key("status").eq("active"))
             .filter((row) => row.key("name").match("(?i)acct 1"))
-            .count();
+            .count()
+            .run();
         (0, chai_1.expect)(total).to.equal(await (0, sales_1.NativeCount)("SELECT count(*) FROM sales.accounts WHERE status = 'active' AND name ~* 'acct 1'"));
     });
     it("filters an integer and a numeric column by the numbers the DMS parses", async () => {
         const total = await Accounts()
             .filter((row) => row.key("score").gt(97))
             .filter((row) => row.key("revenue").ge(267000))
-            .count();
+            .count()
+            .run();
         (0, chai_1.expect)(total).to.equal(await (0, sales_1.NativeCount)("SELECT count(*) FROM sales.accounts WHERE score > 97 AND revenue >= 267000"));
     });
     for (const [table, column] of [
@@ -60,7 +64,8 @@ describe("listing an external relation as a TableView does", () => {
                 .key(column)
                 .ge(Day(day))
                 .and(row.key(column).lt(NextDay(day))))
-                .count();
+                .count()
+                .run();
             (0, chai_1.expect)(total).to.equal(await (0, sales_1.NativeCount)(`SELECT count(*) FROM sales.${table}
            WHERE (${column})::timestamp >= $1::timestamp AND (${column})::timestamp < $1::timestamp + interval '1 day'`, [day]));
             (0, chai_1.expect)(total).to.be.greaterThan(0);
@@ -69,7 +74,8 @@ describe("listing an external relation as a TableView does", () => {
     it("searches a date column through its ISO rendering, as a TableView search does", async () => {
         const total = await Accounts()
             .filter((row) => row.key("created_at").match("(?i)2026-01-02T0"))
-            .count();
+            .count()
+            .run();
         (0, chai_1.expect)(total).to.equal(10);
     });
     it("searches enum and uuid columns through their text", async () => {
@@ -78,18 +84,21 @@ describe("listing an external relation as a TableView does", () => {
             .key("status")
             .match("(?i)CHURN")
             .or(row.key("external_ref").match("(?i)^0")))
-            .count();
+            .count()
+            .run();
         (0, chai_1.expect)(total).to.equal(await (0, sales_1.NativeCount)("SELECT count(*) FROM sales.accounts WHERE status::text ~* 'churn' OR external_ref::text ~* '^0'"));
     });
 });
 describe("reading an external row by key", () => {
-    before(async () => {
+    before(async function () {
+        this.timeout(sales_1.REGISTRATION_TIMEOUT_MS);
         sales = await (0, sales_1.RegisterSales)();
     });
     it("gets a row by its bigint key as a string _id, with exact bigints and true instants", async () => {
         const row = await Accounts()
             .get("42")
-            .pluck("_id", "id", "big_counter", "signed_on", "last_seen");
+            .pluck("_id", "id", "big_counter", "signed_on", "last_seen")
+            .run();
         (0, chai_1.expect)(row).to.deep.equal({
             _id: "42",
             id: "42",
@@ -102,7 +111,10 @@ describe("reading an external row by key", () => {
         const original = process.env.TZ;
         process.env.TZ = "America/New_York";
         try {
-            const row = await Accounts().get("42").pluck("signed_on", "last_seen");
+            const row = await Accounts()
+                .get("42")
+                .pluck("signed_on", "last_seen")
+                .run();
             (0, chai_1.expect)(row).to.deep.equal({
                 signed_on: new Date("2026-02-12T00:00:00.000Z"),
                 last_seen: new Date("2026-01-01T00:42:00.000Z"),
@@ -113,7 +125,7 @@ describe("reading an external row by key", () => {
         }
     });
     it("reads a whole row in row mode with _id first and every declared field", async () => {
-        const row = await Accounts().get("7");
+        const row = await Accounts().get("7").run();
         (0, chai_1.expect)(Object.keys(row)[0]).to.equal("_id");
         (0, chai_1.expect)(row).to.include({
             _id: "7",
@@ -126,12 +138,13 @@ describe("reading an external row by key", () => {
     });
     it("answers getAll by _id with the rows whose key matches, and nothing for a key that cannot", async () => {
         const [known] = await (0, sales_1.Native)("SELECT contact_id::text AS id FROM sales.contacts ORDER BY first_name LIMIT 1");
-        const rows = await Contacts().getAll([known.id, "not-a-uuid"], "_id");
+        const rows = await Contacts().getAll([known.id, "not-a-uuid"], "_id").run();
         (0, chai_1.expect)(rows.map((row) => row._id)).to.deep.equal([known.id]);
     });
 });
 describe("reading across external relations", () => {
-    before(async () => {
+    before(async function () {
+        this.timeout(sales_1.REGISTRATION_TIMEOUT_MS);
         sales = await (0, sales_1.RegisterSales)();
     });
     it("resolves a foreign field: lookup from a bigint foreign key to the account's _id", async () => {
@@ -139,7 +152,8 @@ describe("reading across external relations", () => {
             .orderBy("first_name", "asc")
             .slice(0, 3)
             .lookup(Accounts().pluck("_internal", "_id", "name"), "account_id", "_id")
-            .pluck("first_name", "account_id");
+            .pluck("first_name", "account_id")
+            .run();
         const expected = await (0, sales_1.Native)(`SELECT c.first_name, jsonb_build_object('_id', a.id::text, 'name', a.name) AS account_id
        FROM sales.contacts c JOIN sales.accounts a ON a.id = c.account_id
        ORDER BY c.first_name LIMIT 3`);
@@ -159,22 +173,25 @@ describe("reading across external relations", () => {
         }))
             .group("bucket", (rows, group) => ({ x: group, y: rows.count() }))
             .orderBy("x", "asc")
-            .slice(0, 3);
+            .slice(0, 3)
+            .run();
         const expected = await (0, sales_1.Native)(`SELECT to_char(created_at AT TIME ZONE 'UTC' AT TIME ZONE '${PARIS}', 'YYYYMMDD') AS x, count(*) AS y
        FROM sales.contacts GROUP BY 1 ORDER BY 1 LIMIT 3`);
         (0, chai_1.expect)(series).to.deep.equal(expected.map((bucket) => ({ x: Number(bucket.x), y: Number(bucket.y) })));
     });
     it("reads an undeclared key, such as the _internal data-api plucks, as absent", async () => {
-        const row = await Accounts().get("1").pluck("_internal", "name");
+        const row = await Accounts().get("1").pluck("_internal", "name").run();
         (0, chai_1.expect)(row).to.deep.equal({ name: "Acct 1" });
         const total = await Accounts()
             .filter((row) => row.key("nickname").eq("x"))
-            .count();
+            .count()
+            .run();
         (0, chai_1.expect)(total).to.equal(0);
     });
 });
 describe("the _id of relations without a single-column primary key", () => {
-    before(async () => {
+    before(async function () {
+        this.timeout(sales_1.REGISTRATION_TIMEOUT_MS);
         sales = await (0, sales_1.RegisterSales)();
     });
     it("answers a composite key's _id as its parts, and gets the row back by it", async () => {
@@ -182,16 +199,23 @@ describe("the _id of relations without a single-column primary key", () => {
             .instance()
             .table("order_lines")
             .orderBy("_id")
-            .slice(0, 1);
+            .slice(0, 1)
+            .run();
         (0, chai_1.expect)(first._id).to.equal('["0", "1"]');
         const again = await sales
             .instance()
             .table("order_lines")
-            .get(String(first._id));
+            .get(String(first._id))
+            .run();
         (0, chai_1.expect)(again).to.deep.equal(first);
     });
     it("answers _id from the unique index of a table without a primary key", async () => {
-        const row = await sales.instance().table("events").orderBy("at").nth(0);
+        const row = await sales
+            .instance()
+            .table("events")
+            .orderBy("at")
+            .nth(0)
+            .run();
         if (row === null)
             throw new Error("the relation answered no row");
         (0, chai_1.expect)(row._id).to.equal(row.event_ref);
@@ -199,23 +223,24 @@ describe("the _id of relations without a single-column primary key", () => {
     for (const relation of ["raw_log", "big_accounts", "daily_signups"]) {
         it(`counts ${relation}, which has no key, and its rows answer no _id`, async () => {
             const table = sales.instance().table(relation);
-            (0, chai_1.expect)(await table.count()).to.equal(await (0, sales_1.NativeCount)(`SELECT count(*) FROM sales.${relation}`));
-            const [row] = await table.slice(0, 1);
+            (0, chai_1.expect)(await table.count().run()).to.equal(await (0, sales_1.NativeCount)(`SELECT count(*) FROM sales.${relation}`));
+            const [row] = await table.slice(0, 1).run();
             (0, chai_1.expect)(row).to.not.have.property("_id");
         });
     }
 });
 describe("instances over an external relation", () => {
-    before(async () => {
+    before(async function () {
+        this.timeout(sales_1.REGISTRATION_TIMEOUT_MS);
         sales = await (0, sales_1.RegisterSales)();
     });
     it("reads every row through CROSS_INSTANCE, since an external relation has no instances", async () => {
-        (0, chai_1.expect)(await sales.instance(schema_1.CROSS_INSTANCE).table("accounts").count()).to.equal(20000);
+        (0, chai_1.expect)(await sales.instance(schema_1.CROSS_INSTANCE).table("accounts").count().run()).to.equal(20000);
     });
     it("refuses a named instance rather than answer rows nobody scoped to it", async () => {
         let refusal;
         try {
-            await sales.instance("tenant-1").table("accounts").count();
+            await sales.instance("tenant-1").table("accounts").count().run();
         }
         catch (err) {
             if (!(err instanceof Error))