@blamejs/blamejs-shop 0.4.91 → 0.4.93

package/lib/vendor/blamejs/test/layer-0-primitives/sql.test.js

@@ -32,6 +32,8 @@ async function run() {
   check("b.sql.delete",      typeof b.sql.delete === "function");
   check("b.sql.upsert",      typeof b.sql.upsert === "function");
   check("b.sql.insertSelectWhere", typeof b.sql.insertSelectWhere === "function");
+  check("b.sql.guardedUpdate", typeof b.sql.guardedUpdate === "function");
+  check("b.sql.casWon",      typeof b.sql.casWon === "function");
   check("b.sql.table",       typeof b.sql.table === "function");
   check("b.sql.createTable", typeof b.sql.createTable === "function");
   check("b.sql.createIndex", typeof b.sql.createIndex === "function");
@@ -709,6 +711,100 @@ async function run() {
   check("insertSelectWhere toExternalSql postgres $N",
         ext.sql.indexOf("$1") !== -1 && ext.sql.indexOf("$2") !== -1 &&
           ext.sql.indexOf("$3") !== -1 && ext.sql.indexOf("?") === -1);
+
+  // ==== guardedUpdate (compare-and-swap UPDATE, #344) ====
+  // The conditional-UPDATE sibling of insertSelectWhere: advance a status /
+  // version ONLY when the row is still in the expected value, so two racing
+  // transitions on an autocommit-only substrate cannot both win.
+
+  // Canonical CAS: identity where() + a guardWhere() fence ANDed into one WHERE,
+  // params bound set -> identity -> guard in order.
+  var cas = sql.guardedUpdate("orders")
+    .set({ status: "shipped" }).where("id", 7).guardWhere("status", "paid").toSql();
+  check("guardedUpdate emits UPDATE...SET...WHERE id AND guard",
+        cas.sql === 'UPDATE orders SET "status" = ? WHERE "id" = ? AND "status" = ?' &&
+          cas.params.length === 3 && cas.params[0] === "shipped" &&
+          cas.params[1] === 7 && cas.params[2] === "paid");
+
+  // guardWhereOp for a non-equality fence (optimistic version / balance debit).
+  var casOp = sql.guardedUpdate("wallets")
+    .set({ balance: 90 }).where("id", 1).guardWhereOp("balance", ">=", 10).toSql();
+  check("guardedUpdate guardWhereOp renders a >= fence",
+        casOp.sql.indexOf('"balance" >= ?') !== -1 && casOp.params[casOp.params.length - 1] === 10);
+
+  // A null-valued fence becomes IS NULL (col = NULL never matches), no null param.
+  var casNull = sql.guardedUpdate("orders")
+    .set({ locked_by: "node-a" }).where("id", 1).guardWhere("locked_by", null).toSql();
+  check("guardedUpdate null fence renders IS NULL, binds no null",
+        casNull.sql.indexOf('"locked_by" IS NULL') !== -1 && casNull.params.indexOf(null) === -1);
+
+  // An UNDEFINED fence is refused (not silently collapsed to IS NULL) — an
+  // omitted/unset expected value would turn a CAS into "match NULL-state rows"
+  // and update the wrong rows. Only an EXPLICIT null means IS NULL.
+  rejects("guardedUpdate guardWhere(undefined) is refused", function () {
+    return sql.guardedUpdate("orders").set({ status: "x" }).where("id", 1)
+      .guardWhere("status", undefined).toSql();
+  }, "sql-builder/bad-guard-value");
+
+  // mysql backtick quoting + postgres $N positional carry through unchanged.
+  var casMy = sql.guardedUpdate("orders", { dialect: "mysql" })
+    .set({ status: "shipped" }).where("id", 7).guardWhere("status", "paid").toSql();
+  check("guardedUpdate mysql backtick quoting",
+        casMy.sql === "UPDATE orders SET `status` = ? WHERE `id` = ? AND `status` = ?");
+  var casPg = sql.guardedUpdate("orders", { dialect: "postgres" })
+    .set({ status: "shipped" }).where("id", 7).guardWhere("status", "paid").toExternalSql("postgres");
+  check("guardedUpdate toExternalSql postgres $N",
+        casPg.sql.indexOf("$1") !== -1 && casPg.sql.indexOf("$3") !== -1 && casPg.sql.indexOf("?") === -1);
+
+  // Refuses to render without a fence — an unguarded guardedUpdate is just a
+  // plain update and almost always a CAS-forgotten bug.
+  rejects("guardedUpdate without a guardWhere throws", function () {
+    return sql.guardedUpdate("orders").set({ status: "x" }).where("id", 1).toSql();
+  }, "sql-builder/no-guard");
+  // set() is still required.
+  rejects("guardedUpdate without set throws", function () {
+    return sql.guardedUpdate("orders").where("id", 1).guardWhere("status", "paid").toSql();
+  }, "sql-builder/empty-set");
+
+  // casWon: own the rowCount -> won/lost mapping + cross-adapter field names.
+  check("casWon: rowCount=1 -> won",            sql.casWon({ rowCount: 1 }).won === true);
+  check("casWon: rowCount=0 -> lost",           sql.casWon({ rowCount: 0 }).won === false);
+  check("casWon: rowCount=2 -> lost, count kept",
+        sql.casWon({ rowCount: 2 }).won === false && sql.casWon({ rowCount: 2 }).rowCount === 2);
+  check("casWon: raw sqlite changes field",     sql.casWon({ changes: 1 }).won === true);
+  check("casWon: raw mysql affectedRows field", sql.casWon({ affectedRows: 1 }).won === true);
+  rejects("casWon: indeterminate result throws (no phantom win)", function () {
+    return sql.casWon({ foo: 1 });
+  }, "sql-builder/no-row-count");
+  rejects("casWon: non-object throws", function () {
+    return sql.casWon(null);
+  }, "sql-builder/bad-cas-result");
+
+  // Real-engine execution: build the CAS with b.sql, run it against an actual
+  // SQLite engine (node:sqlite), and prove the race contract end to end — the
+  // first transition wins (rowCount 1, casWon true), a second racer on the now-
+  // advanced row loses (rowCount 0, casWon false). This is the consumer path the
+  // issue is about (cross-instance-safe transition on a single-statement
+  // substrate); the same standard SQL runs identically on Postgres / MySQL.
+  var nodeSqlite = null;
+  try { nodeSqlite = require("node:sqlite"); } catch (_e) { nodeSqlite = null; }
+  if (nodeSqlite && typeof nodeSqlite.DatabaseSync === "function") {
+    var edb = new nodeSqlite.DatabaseSync(":memory:");
+    edb.exec("CREATE TABLE orders (id INTEGER PRIMARY KEY, status TEXT)");
+    edb.prepare("INSERT INTO orders (id, status) VALUES (?, ?)").run(7, "paid");
+    var casQ = sql.guardedUpdate("orders")
+      .set({ status: "shipped" }).where("id", 7).guardWhere("status", "paid").toSql();
+    var wonStmt = edb.prepare(casQ.sql);
+    var won = wonStmt.run.apply(wonStmt, casQ.params);
+    check("guardedUpdate live: winner casWon true (rowCount 1)", sql.casWon(won).won === true);
+    var lostStmt = edb.prepare(casQ.sql);
+    var lost = lostStmt.run.apply(lostStmt, casQ.params);
+    check("guardedUpdate live: loser casWon false (rowCount 0)",
+          sql.casWon(lost).won === false && sql.casWon(lost).rowCount === 0);
+    check("guardedUpdate live: row advanced exactly once",
+          edb.prepare("SELECT status FROM orders WHERE id = 7").get().status === "shipped");
+    edb.close();
+  }
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/ws-client.test.js

@@ -105,6 +105,23 @@ async function run() {
   check("OPCODE_TEXT exposed",                    b.wsClient.OPCODE_TEXT === 0x01);
   check("CLOSE_NORMAL exposed",                   b.wsClient.CLOSE_NORMAL === 1000);
 
+  // #368 — WsClientError carries a per-code terminal/transient flag so a
+  // consumer's reconnect loop can read err.permanent directly instead of
+  // re-deriving the framework's error taxonomy. Terminal: config / 4xx /
+  // accept-mismatch / protocol-violation. Transient: 5xx / handshake- &
+  // pong-timeout / a dropped socket. A new/unknown code fails CLOSED (terminal).
+  var WCE = b.wsClient.WsClientError;
+  check("err: bad-url is terminal",               new WCE("ws-client/bad-url", "x").permanent === true);
+  check("err: accept-mismatch is terminal",       new WCE("ws-client/accept-mismatch", "x").permanent === true);
+  check("err: protocol-error is terminal",        new WCE("ws-client/protocol-error", "x").permanent === true);
+  check("err: handshake-timeout is transient",    new WCE("ws-client/handshake-timeout", "x").permanent === false);
+  check("err: pong-timeout is transient",         new WCE("ws-client/pong-timeout", "x").permanent === false);
+  check("err: bad-status 403 terminal + statusCode",
+        new WCE("ws-client/bad-status", "x", 403).permanent === true && new WCE("ws-client/bad-status", "x", 403).statusCode === 403);
+  check("err: bad-status 503 transient + statusCode",
+        new WCE("ws-client/bad-status", "x", 503).permanent === false && new WCE("ws-client/bad-status", "x", 503).statusCode === 503);
+  check("err: unknown code fails closed (terminal)", new WCE("ws-client/some-future-code", "x").permanent === true);
+
   // ---- bad URL ----
   rejects("connect: bad URL scheme",
     function () { b.wsClient.connect("http://example.com"); }, /must start with ws/);
@@ -201,8 +218,28 @@ async function run() {
   c4.on("error", function (e) { c4Err = e; });
   await _sleep(300);
   check("non-101: error emitted",                 c4Err && c4Err.code === "ws-client/bad-status");
+  // #368 — a 4xx handshake rejection is TERMINAL (permanent), carries the status.
+  check("non-101 4xx: err.permanent === true",    c4Err && c4Err.permanent === true);
+  check("non-101 4xx: err.statusCode === 403",    c4Err && c4Err.statusCode === 403);
+  check("non-101 4xx: err.status alias preserved", c4Err && c4Err.status === 403);
   server4.close();
 
+  // #368 — a 5xx handshake rejection is TRANSIENT: err.permanent === false so a
+  // consumer (and the client's own auto-reconnect) can retry. The single
+  // bad-status code is split by the carried status, not re-derived by the caller.
+  var server4b = await _makeServer({ rejectStatus: 503 });
+  var port4b = server4b.address().port;
+  var c4b = b.wsClient.connect("ws://127.0.0.1:" + port4b, {
+    reconnect: false, audit: false, allowInternal: true,
+  });
+  var c4bErr = null;
+  c4b.on("error", function (e) { c4bErr = e; });
+  await _sleep(300);
+  check("non-101 5xx: err.code is bad-status",    c4bErr && c4bErr.code === "ws-client/bad-status");
+  check("non-101 5xx: err.permanent === false (transient)", c4bErr && c4bErr.permanent === false);
+  check("non-101 5xx: err.statusCode === 503",    c4bErr && c4bErr.statusCode === 503);
+  server4b.close();
+
   // ---- subprotocol negotiation ----
   var server5 = await _makeServer({ subprotocol: "json-stream-v1" });
   var port5 = server5.address().port;
@@ -343,6 +380,24 @@ async function run() {
   check("permanent: error fired once",            c11ErrCount === 1);
   server4xx.close();
 
+  // #368 — a 5xx handshake rejection is TRANSIENT, so the client's own
+  // auto-reconnect now fires (it was silently dead while every WsClientError was
+  // alwaysPermanent → _isPermanentError always true → willReconnect always false).
+  var server5xx = await _makeServer({ rejectStatus: 503 });
+  var port5xx = server5xx.address().port;
+  var c12 = b.wsClient.connect("ws://127.0.0.1:" + port5xx, {
+    reconnect: { maxAttempts: 1, baseMs: 50, maxMs: 100 },
+    audit: false,
+    allowInternal: true,
+  });
+  var c12Reconnecting = 0;
+  c12.on("error", function () {});
+  c12.on("reconnecting", function () { c12Reconnecting += 1; });
+  await _sleep(500);
+  check("transient: 503 → schedules a reconnect", c12Reconnecting >= 1);
+  c12.close();
+  server5xx.close();
+
   // ---- close() reason length cap (>123 bytes truncated) ----
   var serverCl = await _makeServer({});
   var portCl = serverCl.address().port;

package/lib/vendor/blamejs/test/smoke.js

@@ -203,6 +203,35 @@ void os;
 var FILE_TIMEOUT_MS = parseInt(process.env.SMOKE_FILE_TIMEOUT_MS || "300000", 10);
 if (!Number.isFinite(FILE_TIMEOUT_MS) || FILE_TIMEOUT_MS < 1000) FILE_TIMEOUT_MS = 300000;
 
+// Solo files (SMOKE_RUN_SOLO — CPU-bound scans that fan out across the whole
+// box, e.g. the duplicate-block pattern catalog) get a MULTIPLIED budget. They
+// run ALONE, so a generous timeout can't mask a parallel-contention hang, and
+// their cost scales with the lib/ + test/ corpus, which grows every release —
+// a single fixed budget needs bumping each time the corpus crosses it on a
+// low-core runner (macos-latest = 3 cores), the recurring release friction
+// this removes. Multiplying the base budget decouples solo headroom from the
+// pool budget so the treadmill stops. A genuine solo-file hang is still caught.
+var SOLO_TIMEOUT_MULT = parseInt(process.env.SMOKE_SOLO_TIMEOUT_MULT || "4", 10);
+if (!Number.isFinite(SOLO_TIMEOUT_MULT) || SOLO_TIMEOUT_MULT < 1) SOLO_TIMEOUT_MULT = 4;
+var SOLO_TIMEOUT_MS = FILE_TIMEOUT_MS * SOLO_TIMEOUT_MULT;
+
+// A forked file that fails at the PROCESS level — a spawn error (EAGAIN /
+// EMFILE under load) or a non-zero exit AFTER its assertions already passed (a
+// leaked-handle teardown, far more common on a resource-starved macos runner)
+// — is retried ONCE. A CLEAN assertion failure (the test ran and reported
+// ok:false) and a watchdog timeout are NOT retried: those are deterministic /
+// already-budgeted, so retrying would only mask a real failure or burn another
+// full budget. The retry recovers the transient-runner case without hiding a
+// real one (a deterministic failure fails again).
+var FORK_RETRIES = parseInt(process.env.SMOKE_FORK_RETRIES || "1", 10);
+if (!Number.isFinite(FORK_RETRIES) || FORK_RETRIES < 0) FORK_RETRIES = 1;
+
+// Opt-in leaked-handle audit (SMOKE_AUDIT_HANDLES=1). The worker always
+// computes the per-file leak set (cheap); this gate only controls REPORTING,
+// because the snapshot-diff over-reports async-closing handles as false
+// positives. Turn it on to triage the real-leak population for a cleanup pass.
+var AUDIT_HANDLES = !!process.env.SMOKE_AUDIT_HANDLES;
+
 // _readTimings / _writeTimings — persist per-test durations under
 // .test-output/smoke-timings.json so the next run's LPT scheduler can
 // place long-tail tests on the first worker. Median of last 5 runs to
@@ -264,7 +293,8 @@ function _writeTimings(latest) {
 // The child writes a JSON result line to stdout and exits 0/1. Output
 // from the test (helpers.check FAIL messages, etc.) goes to the
 // child's stdout/stderr which we pipe to the parent.
-function _runFileForked(modulePath, displayName) {
+function _runFileForked(modulePath, displayName, timeoutMs) {
+  var budget = (typeof timeoutMs === "number" && timeoutMs > 0) ? timeoutMs : FILE_TIMEOUT_MS;
   return new Promise(function (resolve) {
     var fileStart = Date.now();
     var workerScript = path.join(__dirname, "_smoke-worker.js");
@@ -287,25 +317,29 @@ function _runFileForked(modulePath, displayName) {
     }
     var watchdog = setTimeout(function () {
       // Child overran the budget with no exit — reap it and report a
-      // failure that names the file + the most likely cause.
+      // failure that names the file + the most likely cause. NOT retriable:
+      // a timeout is already-budgeted, so a retry would just burn another
+      // full budget.
       try { child.kill("SIGKILL"); } catch (_e) { /* already gone */ }
       settle({
         ok:     false,
         ms:     Date.now() - fileStart,
         checks: 0,
-        error:  "watchdog: '" + displayName + "' exceeded " + FILE_TIMEOUT_MS +
+        error:  "watchdog: '" + displayName + "' exceeded " + budget +
                 "ms with no exit — likely a leaked handle (timer / socket / fs.watch). " +
                 "Last stderr: " + (stderrBuf.slice(-500) || "(none)"),
         stderr: stderrBuf,
         displayName: displayName,
+        retriable: false,
       });
-    }, FILE_TIMEOUT_MS);
+    }, budget);
     if (typeof watchdog.unref === "function") watchdog.unref();
     child.stdout.on("data", function (d) { stdoutBuf += d.toString("utf8"); });
     child.stderr.on("data", function (d) { stderrBuf += d.toString("utf8"); });
     child.on("error", function (e) {
       // fork() itself failed (ENOENT / EMFILE / spawn error) — without
-      // this handler the Promise would never resolve and hang the run.
+      // this handler the Promise would never resolve and hang the run. A
+      // spawn failure under load (EAGAIN / EMFILE) is transient → retriable.
       settle({
         ok:     false,
         ms:     Date.now() - fileStart,
@@ -313,6 +347,7 @@ function _runFileForked(modulePath, displayName) {
         error:  displayName + ": fork error: " + ((e && e.message) || String(e)),
         stderr: stderrBuf,
         displayName: displayName,
+        retriable: true,
       });
     });
     child.on("close", function (code) {
@@ -323,18 +358,50 @@ function _runFileForked(modulePath, displayName) {
       var parsed;
       try { parsed = JSON.parse(resultLine); }
       catch (_e) { parsed = { ok: false, error: "no result line; stderr: " + stderrBuf.slice(0, 500) }; }
+      // A non-zero exit AFTER the assertions passed (parsed.ok === true) is a
+      // process-level teardown failure — a leaked handle that delays / faults
+      // exit, common on a resource-starved runner — and is retriable. A clean
+      // assertion failure (parsed.ok === false) is deterministic, NOT retriable.
+      // Retriable process-level transients: a non-zero exit after the
+      // assertions passed (a leaked handle faulting exit) OR a late async error
+      // the worker attributed (parsed.lateError). Both differ from a clean
+      // assertion failure (parsed.ok === false WITHOUT lateError), which is
+      // deterministic and NOT retried.
+      var processFailedAfterPass = code !== 0 && parsed.ok === true;
+      var lateError = parsed.lateError === true;
       settle({
         ok:     code === 0 && parsed.ok,
         ms:     ms,
         checks: parsed.checks || 0,
-        error:  parsed.error,
+        error:  parsed.error || (processFailedAfterPass
+          ? (displayName + ": process exited non-zero (" + code + ") after assertions passed " +
+             "— likely a leaked handle on a slow runner. Last stderr: " + (stderrBuf.slice(-300) || "(none)"))
+          : undefined),
         stderr: stderrBuf,
         displayName: displayName,
+        retriable: processFailedAfterPass || lateError,
+        leaks:  Array.isArray(parsed.leaks) ? parsed.leaks : [],
       });
     });
   });
 }
 
+// Run a forked file, retrying ONCE (FORK_RETRIES) on a PROCESS-level transient
+// (spawn error / non-zero-exit-after-pass) but never on a clean assertion
+// failure or a watchdog timeout — recovers a starved-runner flake without
+// masking a real failure (a deterministic failure fails again on the retry).
+async function _runFileForkedRetrying(modulePath, displayName, timeoutMs) {
+  var rv = await _runFileForked(modulePath, displayName, timeoutMs);
+  var attempts = 0;
+  while (!rv.ok && rv.retriable && attempts < FORK_RETRIES) {
+    attempts += 1;
+    console.log("  [retry " + attempts + "/" + FORK_RETRIES + "] " + displayName +
+      " — process-level transient (" + (rv.error || "fork failed").slice(0, 120) + ")");
+    rv = await _runFileForked(modulePath, displayName, timeoutMs);
+  }
+  return rv;
+}
+
 async function _runLayer(layerNum, legacyPath, layerName) {
   // Legacy single-layer file (run only when HS_ONLY isn't set).
   if (ONLY.length === 0 && fs.existsSync(legacyPath)) {
@@ -401,10 +468,11 @@ async function _runLayer(layerNum, legacyPath, layerName) {
       (solo ? soloFiles : poolFiles).push(files[pf]);
     }
 
-    // Solo phase — heavy files one at a time, each with the full box.
+    // Solo phase — heavy files one at a time, each with the full box and the
+    // multiplied solo budget (their cost scales with the growing corpus).
     for (var si = 0; si < soloFiles.length && !firstFailure; si += 1) {
       var sName = soloFiles[si];
-      var srv = await _runFileForked(path.join(dir, sName), layerName + " / " + sName);
+      var srv = await _runFileForkedRetrying(path.join(dir, sName), layerName + " / " + sName, SOLO_TIMEOUT_MS);
       resultsByFile[sName] = srv;
       newTimings[sName] = srv.ms;
       if (!srv.ok && !firstFailure) firstFailure = srv;
@@ -428,7 +496,7 @@ async function _runLayer(layerNum, legacyPath, layerName) {
         var myIdx = cursor++;
         if (myIdx >= ordered.length) return;
         var fname = ordered[myIdx];
-        var rv = await _runFileForked(path.join(dir, fname), layerName + " / " + fname);
+        var rv = await _runFileForkedRetrying(path.join(dir, fname), layerName + " / " + fname);
         resultsByFile[fname] = rv;
         newTimings[fname] = rv.ms;
         if (!rv.ok && !firstFailure) firstFailure = rv;
@@ -442,6 +510,7 @@ async function _runLayer(layerNum, legacyPath, layerName) {
 
     // Print in original sort() order so the per-run output is stable
     // for diff-based comparison (the solo/LPT order is internal scheduling).
+    var leakReport = [];
     for (var p = 0; p < files.length; p += 1) {
       var rf = resultsByFile[files[p]];
       if (!rf) continue;                                                         // pool aborted before this file ran
@@ -450,7 +519,21 @@ async function _runLayer(layerNum, legacyPath, layerName) {
         if (rf.stderr) process.stderr.write(rf.stderr);
         throw new Error(rf.displayName + ": " + (rf.error || "fork failed"));
       }
-      console.log("  " + _padRight(files[p], 40) + " (" + rf.ms + "ms)");
+      console.log("  " + _padRight(files[p], 40) + " (" + rf.ms + "ms)" +
+        (AUDIT_HANDLES && rf.leaks && rf.leaks.length ? "  [leaked: " + rf.leaks.join(", ") + "]" : ""));
+      if (rf.leaks && rf.leaks.length) leakReport.push(files[p] + " :: " + rf.leaks.join(", "));
+    }
+    // Handle-leak population — opt-in diagnostic (SMOKE_AUDIT_HANDLES=1). A
+    // test that leaks a timer / socket / server / worker is the same root that
+    // flakes a slow runner (delay) or throws after pass (fork-fail). Off by
+    // default because the snapshot-diff over-reports async-CLOSING handles (a
+    // server whose close() callback fired but whose handle lingers a tick past
+    // the grace window) as false positives; turn it on to triage real leaks.
+    if (AUDIT_HANDLES && leakReport.length) {
+      console.log("");
+      console.log("  ⚠ " + leakReport.length + " layer-0 file(s) held a handle past run() " +
+        "(SMOKE_AUDIT_HANDLES — triage: real leak vs async-close-in-flight):");
+      for (var lr = 0; lr < leakReport.length; lr += 1) console.log("      " + leakReport[lr]);
     }
     helpers.addExternalChecks(totalChecks);
     _writeTimings(newTimings);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.91",
+  "version": "0.4.93",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {