@blamejs/core 0.6.35 → 0.6.36

package/CHANGELOG.md

@@ -8,6 +8,7 @@ upgrading across more than a few patches at a time.
 
 ## v0.6.x
 
+- **0.6.36** (2026-05-02) — `b.db.from("schema.table")` cross-schema chain. **`b.db.from("audit.events")`** — the chainable Query builder now accepts a two-part `schema.table` identifier. Both halves validated separately as SQL identifiers (rejects three-part names, empty parts, identifiers with embedded quotes / SQL keywords); both halves wrapped in `"..."` when interpolated so the generated SQL is `SELECT * FROM "audit"."events" WHERE ...` etc. The bare `b.db.from("users")` form still works unchanged. Sealed-field registry lookup tries the qualified name (`audit.users`) first when schema is set, falls back to the bare table — operators registering `cryptoField.registerTable("audit.users", { sealedFields: ... })` get per-schema sealed columns; existing table-name-only registrations keep working. Use cases: cross-schema joins on Postgres external-db (`public.users` vs `audit.events` from one app), SQLite `ATTACH DATABASE` (per-classification audit / archive databases mounted on the side and queried through the same Query API). **Tests**: 14 layer-0 SQL-shape assertions against a fake DB (verify schema-qualified SELECT / INSERT / UPDATE / DELETE / count / sub-select-on-rowid all emit `"schema"."table"`; reject three-part / empty / invalid identifiers; bare table name preserved unqualified) + 7 layer-2 end-to-end assertions against a real `ATTACH DATABASE` schema (insert / select / count / update / delete round-trip via `b.db.from("audit.events")`). Smoke 6854 / wiki e2e 178 / per-primitive integration 16 files / wiki integration 32 / shellcheck clean / eslint clean.
 - **0.6.35** (2026-05-02) — `cluster-provider-db` MySQL dialect. **`b.cluster.create({ provider: clusterProviderDb.create({ dialect: "mysql", ... }) })`** — operators on MySQL no longer have to supply their own provider; the framework's default DB-row leader-election provider now speaks all three of postgres / sqlite / mysql. The MySQL acquireLease shape uses `INSERT INTO _blamejs_leader (...) VALUES (...) ON DUPLICATE KEY UPDATE col = IF(expiresAt < ?, VALUES(col), col), ..., expiresAt = IF(expiresAt < ?, VALUES(expiresAt), expiresAt)` so a still-valid lease is preserved untouched and an expired one is overwritten — atomic at the row level — followed by a `SELECT FROM _blamejs_leader WHERE scope='leader'` to read who holds (MySQL has no `RETURNING`). The expiresAt assignment runs LAST so per-column IF() predicates evaluate against pre-update row state. Renew uses `UPDATE ... SET expiresAt=?, endpoint=? WHERE scope='leader' AND nodeId=? AND leaseId=?` followed by a check-SELECT to surface takeover races as `LEASE_LOST`. Schema generation: `BIGINT` int columns (was `INTEGER` for SQLite), `VARCHAR(64)` for primary-key text columns and `VARCHAR(255)` for body text (MySQL needs explicit lengths on PRIMARY KEY columns), `CHECK (scope = 'leader' / 'state')` constraint dropped on MySQL because some MariaDB / MySQL 5.x versions parse-then-silently-drop CHECK clauses (would surface as version drift); the constant-scope invariant is enforced by application code anyway. Placeholder style auto-flips to `?` for MySQL (Postgres / SQLite continue to use `$1..$N`). **Tests**: 16 layer-1 assertions exercising the MySQL dialect path against a fake mysql-shaped driver (`_makeFakeMysqlDriver` in `test/helpers/drivers.js`) that emulates `INSERT ... ON DUPLICATE KEY UPDATE` with the per-column `IF()` semantics; covers acquire-empty, blocked-while-held, renew-no-fencing-bump, takeover-with-fencing-bump, old-leader-renew-throws-LEASE_LOST, currentLeader, releaseLease — plus a SQL-shape audit (validates VARCHAR primary keys, ON DUPLICATE KEY syntax, ?-placeholders, IF() gating). 14 live integration assertions against the docker MySQL 8.4 container via a docker-exec-based external-db driver shim (no npm mysql client; the framework already requires operator-supplied driver wiring, the shim demonstrates one path) covering ensureSchema, acquireLease, blocked-second-node, currentLeader, renewLease, release, takeover-after-expiry, fencingToken bump, old-leader LEASE_LOST. Smoke 6833 / wiki e2e 178 / per-primitive integration 16 files / wiki integration 32 / shellcheck clean / eslint clean.
 - **0.6.34** (2026-05-02) — distributed pub/sub primitive. **`b.pubsub`** — single API for cross-node fan-out across the framework, with three backends. `local` dispatches in-process to registered handlers (zero coordination overhead for single-node deploys); `cluster` polls a shared `_blamejs_pubsub_messages` table at `pollIntervalMs` (default 100ms) and dispatches new rows past `lastSeenId` from other nodes (publishedBy=self filter prevents loopback); `redis` opens a SUBSCRIBE-mode connection on `lib/redis-client.js` (now with new push-message demultiplexing — server-pushed `["message", channel, payload]` and `["pmessage", pattern, channel, payload]` arrays route through `setOnPushMessage` instead of consuming a pending request slot, while SUBSCRIBE / UNSUBSCRIBE acks still flow through the normal command pipeline). Per-instance nonce stamped on outgoing redis payloads so the SUBSCRIBE socket recognizes its own publishes and skips the loopback (without it every same-instance publish would fire local handlers twice). Operator API: `ps.subscribe(channel, handler) → token`, `ps.subscribePattern(pattern, handler) → token` (glob-style on local + cluster, native PSUBSCRIBE on redis), `ps.unsubscribe(token)`, `await ps.publish(channel, payload) → { local, remote }`, `await ps.close()`. `topicPrefix` opt scopes channel names so independent pubsub instances sharing a backend (cache invalidation + websocket channels + custom) don't collide. Handler errors are caught + logged via the framework's boot logger; they never abort dispatch to other handlers on the same channel. **`lib/websocket-channels.js`** — replaces the inline cluster-poll-and-fan-out logic with `b.pubsub` consumption. The hub now owns one pubsub instance per primitive; cross-node delivery is `pubsub.subscribe` per channel the hub joins, with the hub's `_localDispatch` as the handler. Per-channel pubsub subscription is refcounted by local conn count (subscribe on first conn, unsubscribe on last). The `_blamejs_ws_messages` table is renamed to `_blamejs_pubsub_messages` (column `channel` → `topic`) reflecting the generalization; pre-v1, no compat shim — operators upgrading wipe the previous table (which carried only ephemeral fan-out rows with default 60s retention). **`b.cache.create({ invalidationPubsub })`** — passing a `b.pubsub.create()` instance auto-publishes on every successful `del` / `clear` / `invalidateTag`, and subscribes for the same events so other cache instances on other nodes (or processes sharing the pubsub backend) react locally — primarily useful for the memory backend so stale per-node entries don't survive a global tag wipe. Re-entrancy guard prevents inbound invalidation events from re-publishing (no fan-out loops). Tests: 29 layer-0 assertions covering local + cluster behavior, topicPrefix isolation, pattern subscribe, handler error isolation, post-close error path, end-to-end cache invalidationPubsub fan-out via local pubsub. 10 live integration assertions against the docker redis container covering single-instance round-trip, PSUBSCRIBE pattern, cross-instance fan-out, and cache invalidation through redis PUB/SUB. Smoke 6817 / wiki e2e 178 / per-primitive integration 15 files / wiki integration 32 / shellcheck clean / eslint clean.
 - **0.6.33** (2026-05-02) — log-stream sinks parity sweep. **`b.logStream` syslog sink (RFC 5424)** — first-class `protocol: "syslog"` for `b.logStream.init({ sinks: { ... } })`; new module `lib/log-stream-syslog.js`. URL-driven transport selection: `udp://host:514` / `tcp://host:514` / `tls://host:6514`. UDP is best-effort one-datagram-per-record; TCP / TLS use RFC 6587 octet-counting framing (`<length> <message>`) so collectors that prefer it over the older non-transparent newline framing parse cleanly. TLS is TLS 1.3 minimum; operators with private CAs pass `ca` (PEM string or array) for trust pinning, `servername` for SNI override (auto-suppressed on IP literals per the v0.6.28 redis-client convention). Outgoing records are formatted with PRI = `(facility << 3) | severity`, default facility `local0` (16), severity mapped from the framework's level field (debug=7 / info=6 / warn=4 / error=3); operators override via `facility`, `appName` (default `blamejs`), `procId` (default `process.pid`), `hostname` (default `os.hostname()`), `structuredData` (default `-`). Meta is JSON-encoded into the MSG body so the structured payload survives the wire as a single token. TCP / TLS reconnect with exponential backoff (default 250ms→30s); records buffer during the down window with `bufferLimit`-bounded oldest-drop semantics, replay on reconnect. `close()` waits up to 3s for an in-flight (re)connect to drain the buffer before tearing down — without this the slower TLS handshake raced fire-and-forget shutdown emits and silently dropped records. Operator-supplied `onDrop({reason, batch, error})` surfaces every drop class (`overflow` / `udp-send-error` / `write-error` / `sink-closed`). Removed `syslog` from `DEFERRED_PROTOCOLS`. **`b.logStream` cloudwatch sink: `autoCreate`** — pass `{ autoCreate: true }` to have the framework issue `CreateLogGroup` + `CreateLogStream` on first emit so operators provisioning collectors via env vars / runbooks don't need a separate aws-cli step. Idempotent: AWS's `ResourceAlreadyExistsException` is treated as success on both calls. Hard failures (5xx, AccessDenied, etc.) drop the batch with `onDrop` reason `autocreate-failed`. Default remains `autoCreate: false` so the AWS posture (operator pre-creates via aws / CDK / Terraform) stays the recommended path; `autoCreate` exists for ephemeral / dynamic-stream deployments where pre-provisioning is impractical. **Test suite**: 19 new framework-level cloudwatch assertions cover autoCreate fires both Create calls in order before PutLogEvents, ResourceAlreadyExists doesn't abort the post-create PutLogEvents, hard 5xx during CreateLogGroup drops the batch via `onDrop`, autoCreate=false skips Create calls entirely. Live syslog integration covers UDP / TCP wire delivery against the docker syslog-ng container (`/var/log/blamejs-test.log`) plus an in-process `tls.createServer` receiver that asserts the on-the-wire RFC 6587 octet-counting framing + RFC 5424 PRI / timestamp / structured-data slot the framework emits over TLS. **Test infrastructure fix**: `docker/init/generate-certs.sh` was overwriting an existing CA when re-run with `.complete` removed, invalidating every previously-issued leaf cert; now reuses an existing `(ca.crt, ca.key)` pair across `.complete`-only resets and only generates a fresh CA when neither file is present. Smoke 6790 / wiki e2e 178 / per-primitive integration 14 files (log-stream up from 16→18 checks, cloudwatch suite up from 39→58 assertions) / wiki integration 32 / shellcheck clean / eslint clean.

package/lib/db-query.js

@@ -39,31 +39,46 @@ class Query {
     // (parameter placeholders only bind values, not names). Validate at
     // construction so an attacker-controlled name with embedded `"` or
     // SQL keywords can't break out of the wrapping quotes downstream.
-    // Cross-schema queries (e.g., Postgres `public.users`) need the
-    // schema-qualified API, not a dotted single-identifier — reject `.`
-    // here so the failure mode is explicit.
     if (typeof tableName !== "string") {
       throw new TypeError("Query: tableName must be a string, got " + typeof tableName);
     }
+    // Cross-schema syntax: "schema.table". Two-part identifier only —
+    // three-part (catalog.schema.table) is rejected. Both parts must
+    // be valid SQL identifiers and contain no further dots.
+    var schema = null;
+    var table  = tableName;
     if (tableName.indexOf(".") !== -1) {
-      throw new Error("Query: tableName '" + tableName + "' contains '.' — use a single " +
-        "identifier; cross-schema queries are not supported by db.from(). " +
-        "For Postgres-style schema.table access, use b.externalDb.query directly.");
+      var parts = tableName.split(".");
+      if (parts.length !== 2 || parts[0].length === 0 || parts[1].length === 0) {
+        throw new Error("Query: schema-qualified tableName must be exactly " +
+          "'schema.table' (got '" + tableName + "'). Three-part identifiers " +
+          "(catalog.schema.table) and empty parts are not supported.");
+      }
+      schema = parts[0];
+      table  = parts[1];
+      // Validate the schema identifier separately. allowReserved:true
+      // because we always wrap in `"..."`.
+      safeSql.validateIdentifier(schema, { allowReserved: true });
     }
-    // allowReserved: true — db-query always wraps the identifier in
-    // `"..."` so a table named `order` resolves correctly via the SQL
-    // standard quoting rule. The reserved-word block in safeSql is for
-    // call sites that interpolate unquoted.
-    safeSql.validateIdentifier(tableName, { allowReserved: true });
-
-    this._db          = database;
-    this._table       = tableName;
-    this._where       = [];
-    this._whereParams = [];
-    this._select      = null;
-    this._orderBy     = null;
-    this._limit       = null;
-    this._offset      = null;
+    safeSql.validateIdentifier(table, { allowReserved: true });
+
+    this._db            = database;
+    this._schema        = schema;
+    this._table         = table;
+    this._qualifiedKey  = schema ? schema + "." + table : table;
+    this._where         = [];
+    this._whereParams   = [];
+    this._select        = null;
+    this._orderBy       = null;
+    this._limit         = null;
+    this._offset        = null;
+  }
+
+  // Quoted SQL form: `"schema"."table"` if schema-qualified, else `"table"`.
+  _quotedTable() {
+    return this._schema
+      ? '"' + this._schema + '"."' + this._table + '"'
+      : '"' + this._table + '"';
   }
 
   // ---- Chainable filters ----
@@ -89,10 +104,10 @@ class Query {
     }
     // Sealed-field translation: rewrite predicate to use derived hash if available
     if (this._isSealedField(field)) {
-      var lookup = cryptoField.lookupHash(this._table, field, value);
+      var lookup = cryptoField.lookupHash(this._cryptoFieldKey(), field, value);
       if (!lookup) {
         throw new Error(
-          "cannot query sealed column '" + this._table + "." + field +
+          "cannot query sealed column '" + this._cryptoFieldKey() + "." + field +
           "' without a derived hash. Declare derivedHashes: { <name>: { from: '" + field + "' } } " +
           "in the table's schema config."
         );
@@ -107,10 +122,23 @@ class Query {
   }
 
   _isSealedField(field) {
-    var sealed = cryptoField.getSealedFields(this._table);
+    var sealed = cryptoField.getSealedFields(this._cryptoFieldKey());
     return sealed.indexOf(field) !== -1;
   }
 
+  // Sealed-field registry lookup key. Schema-qualified queries first
+  // try the qualified name (`audit.users`) so an operator can register
+  // per-schema sealed columns; falls back to the bare table when no
+  // qualified registration exists. The fall-back lets the existing
+  // table-name-only registrations keep working unchanged.
+  _cryptoFieldKey() {
+    if (!this._schema) return this._table;
+    if (cryptoField.getSealedFields(this._qualifiedKey).length > 0) {
+      return this._qualifiedKey;
+    }
+    return this._table;
+  }
+
   // whereRaw — append a parenthesized raw SQL fragment with positional
   // placeholders and the parameter values that fill them. Composes with
   // .where() (AND-joined via the same `_where` array). The fragment
@@ -207,21 +235,22 @@ class Query {
   // ---- Terminal methods (sync) ----
 
   first() {
-    var sql = "SELECT " + this._projection() + ' FROM "' + this._table + '"' +
+    var sql = "SELECT " + this._projection() + " FROM " + this._quotedTable() +
               this._whereClause() + this._orderLimitOffset() + " LIMIT 1";
     var stmt = this._db.prepare(sql);
     var row = stmt.get.apply(stmt, this._whereParams);
-    return row ? cryptoField.unsealRow(this._table, row) : null;
+    return row ? cryptoField.unsealRow(this._cryptoFieldKey(), row) : null;
   }
 
   all() {
-    var sql = "SELECT " + this._projection() + ' FROM "' + this._table + '"' +
+    var sql = "SELECT " + this._projection() + " FROM " + this._quotedTable() +
               this._whereClause() + this._orderLimitOffset();
     var stmt = this._db.prepare(sql);
     var rows = stmt.all.apply(stmt, this._whereParams);
     var out = new Array(rows.length);
+    var key = this._cryptoFieldKey();
     for (var i = 0; i < rows.length; i++) {
-      out[i] = cryptoField.unsealRow(this._table, rows[i]);
+      out[i] = cryptoField.unsealRow(key, rows[i]);
     }
     return out;
   }
@@ -231,10 +260,10 @@ class Query {
   // operator's pipeline. For large result sets (audit exports, backup
   // table dumps) this avoids materializing the full rowset in memory.
   stream() {
-    var sql = "SELECT " + this._projection() + ' FROM "' + this._table + '"' +
+    var sql = "SELECT " + this._projection() + " FROM " + this._quotedTable() +
               this._whereClause() + this._orderLimitOffset();
     var stmt = this._db.prepare(sql);
-    var table = this._table;
+    var key = this._cryptoFieldKey();
     var iter;
     try { iter = stmt.iterate.apply(stmt, this._whereParams); }
     catch (e) {
@@ -248,7 +277,7 @@ class Query {
         try {
           var step = iter.next();
           if (step.done) { this.push(null); return; }
-          this.push(cryptoField.unsealRow(table, step.value));
+          this.push(cryptoField.unsealRow(key, step.value));
         } catch (e) {
           this.destroy(e);
         }
@@ -257,7 +286,7 @@ class Query {
   }
 
   count() {
-    var sql = 'SELECT COUNT(*) AS n FROM "' + this._table + '"' + this._whereClause();
+    var sql = "SELECT COUNT(*) AS n FROM " + this._quotedTable() + this._whereClause();
     var stmt = this._db.prepare(sql);
     var row = stmt.get.apply(stmt, this._whereParams);
     return row ? row.n : 0;
@@ -271,12 +300,12 @@ class Query {
     if (withId._id === undefined || withId._id === null) {
       withId._id = generateToken(16);
     }
-    var sealed = cryptoField.sealRow(this._table, withId);
+    var sealed = cryptoField.sealRow(this._cryptoFieldKey(), withId);
     var cols = Object.keys(sealed);
     var placeholders = cols.map(function () { return "?"; }).join(", ");
     var quotedCols = cols.map(function (c) { return '"' + c + '"'; }).join(", ");
     var values = cols.map(function (c) { return sealed[c]; });
-    var sql = 'INSERT INTO "' + this._table + '" (' + quotedCols + ") VALUES (" + placeholders + ")";
+    var sql = "INSERT INTO " + this._quotedTable() + " (" + quotedCols + ") VALUES (" + placeholders + ")";
     var insertStmt = this._db.prepare(sql);
     insertStmt.run.apply(insertStmt, values);
     // Return the original row with _id filled in (plaintext, never sealed)
@@ -308,7 +337,7 @@ class Query {
     if (this._where.length === 0) {
       throw new Error("refusing unconditional update — call where(...) first");
     }
-    var sealed = cryptoField.sealRow(this._table, changes);
+    var sealed = cryptoField.sealRow(this._cryptoFieldKey(), changes);
     var setKeys = Object.keys(sealed);
     if (setKeys.length === 0) {
       throw new Error("update changes object is empty");
@@ -322,11 +351,12 @@ class Query {
     // SQLite supports LIMIT on UPDATE only when compiled with SQLITE_ENABLE_UPDATE_DELETE_LIMIT.
     // node:sqlite ships without that flag — emulate single-row with a sub-select on rowid.
     var sql;
+    var qt = this._quotedTable();
     if (single) {
-      sql = 'UPDATE "' + this._table + '" SET ' + setClause +
-            ' WHERE rowid = (SELECT rowid FROM "' + this._table + '" WHERE ' + whereSql + " LIMIT 1)";
+      sql = "UPDATE " + qt + " SET " + setClause +
+            " WHERE rowid = (SELECT rowid FROM " + qt + " WHERE " + whereSql + " LIMIT 1)";
     } else {
-      sql = 'UPDATE "' + this._table + '" SET ' + setClause + " WHERE " + whereSql + limit;
+      sql = "UPDATE " + qt + " SET " + setClause + " WHERE " + whereSql + limit;
     }
     var allParams = setValues.concat(this._whereParams);
     var updStmt = this._db.prepare(sql);
@@ -348,11 +378,12 @@ class Query {
     }
     var whereSql = this._where.join(" AND ");
     var sql;
+    var qt = this._quotedTable();
     if (single) {
-      sql = 'DELETE FROM "' + this._table +
-            '" WHERE rowid = (SELECT rowid FROM "' + this._table + '" WHERE ' + whereSql + " LIMIT 1)";
+      sql = "DELETE FROM " + qt +
+            " WHERE rowid = (SELECT rowid FROM " + qt + " WHERE " + whereSql + " LIMIT 1)";
     } else {
-      sql = 'DELETE FROM "' + this._table + '" WHERE ' + whereSql;
+      sql = "DELETE FROM " + qt + " WHERE " + whereSql;
     }
     var delStmt = this._db.prepare(sql);
     var info = delStmt.run.apply(delStmt, this._whereParams);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.35",
+  "version": "0.6.36",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e7b125dc-2b9c-460b-8b32-6ae1b9da3dac",
+  "serialNumber": "urn:uuid:7c9d3ad1-2719-437a-80c6-0d18fefad8b9",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-02T20:25:21.814Z",
+    "timestamp": "2026-05-02T20:34:17.304Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.35",
+      "bom-ref": "@blamejs/core@0.6.36",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.35",
+      "version": "0.6.36",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.35",
+      "purl": "pkg:npm/%40blamejs/core@0.6.36",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.35",
+      "ref": "@blamejs/core@0.6.36",
       "dependsOn": []
     }
   ]