@nxtedition/rocksdb 16.0.2 → 16.0.6

package/binding.cc

@@ -54,7 +54,7 @@ class NullLogger : public rocksdb::Logger {
 
 struct Database;
 class Iterator;
-class Updates;
+struct Updates;
 
 struct ColumnFamily {
   rocksdb::ColumnFamilyHandle* handle;
@@ -440,6 +440,15 @@ struct BaseIterator : public Closable {
     return iterator_->status();
   }
 
+  virtual rocksdb::Status Refresh() {
+    assert(iterator_);
+    // Refresh restarts iteration, so the user `limit` budget must restart too;
+    // otherwise an iterator that already yielded `limit` rows returns nothing
+    // after a refresh even though every other piece of state was reset.
+    count_ = 0;
+    return iterator_->Refresh();
+  }
+
   Database* database_;
   rocksdb::ColumnFamilyHandle* column_;
 
@@ -508,6 +517,11 @@ class Iterator final : public BaseIterator {
     return BaseIterator::Seek(target);
   }
 
+  rocksdb::Status Refresh() override {
+    first_ = true;
+    return BaseIterator::Refresh();
+  }
+
   static std::unique_ptr<Iterator> create(napi_env env, napi_value db, napi_value options) {
     Database* database;
     NAPI_STATUS_THROWS(napi_get_value_external(env, db, reinterpret_cast<void**>(&database)));
@@ -527,7 +541,9 @@ class Iterator final : public BaseIterator {
     int32_t limit = -1;
     NAPI_STATUS_THROWS(GetProperty(env, options, "limit", limit));
 
-    int32_t highWaterMarkBytes = std::numeric_limits<int32_t>::max();
+    // 64-bit: the value flows into a size_t cap, so parsing as int32 would wrap
+    // any value > 2 GiB to a garbage cap. Default stays ~2 GiB (effectively no cap).
+    int64_t highWaterMarkBytes = std::numeric_limits<int32_t>::max();
     NAPI_STATUS_THROWS(GetProperty(env, options, "highWaterMarkBytes", highWaterMarkBytes));
 
     std::optional<std::string> lt;
@@ -644,14 +660,11 @@ class Iterator final : public BaseIterator {
               break;
             }
 
-            if (!Increment()) {
-              // Hit the user's `limit` option: terminal, and flag that it was a
-              // limit rather than natural exhaustion.
-              state.finished = true;
-              state.limited = true;
-              break;
-            }
-
+            // Apply the key/value filters BEFORE charging the user `limit`, so
+            // `limit` counts matched (emitted) rows, not rows merely scanned and
+            // then discarded. Otherwise a `{ limit, keyFilter }` query could
+            // exhaust its budget on non-matching rows and return fewer (or zero)
+            // matches than exist.
             if (keyFilter_ && !re2::RE2::PartialMatch(CurrentKey().ToStringView(), *keyFilter_)) {
               continue;
             }
@@ -660,6 +673,14 @@ class Iterator final : public BaseIterator {
               continue;
             }
 
+            if (!Increment()) {
+              // Hit the user's `limit` option: terminal, and flag that it was a
+              // limit rather than natural exhaustion.
+              state.finished = true;
+              state.limited = true;
+              break;
+            }
+
             if (keys_ && values_) {
               rocksdb::PinnableSlice k;
               k.PinSelf(CurrentKey());
@@ -772,14 +793,8 @@ class Iterator final : public BaseIterator {
         break;
       }
 
-      if (!Increment()) {
-        // Hit the user's `limit` option: terminal, and flag that it was a limit
-        // rather than natural exhaustion.
-        NAPI_STATUS_THROWS(napi_get_boolean(env, true, &finished));
-        NAPI_STATUS_THROWS(napi_get_boolean(env, true, &limited));
-        break;
-      }
-
+      // Apply the key/value filters BEFORE charging the user `limit`, so `limit`
+      // counts matched (emitted) rows, not rows merely scanned and discarded.
       if (keyFilter_ && !re2::RE2::PartialMatch(CurrentKey().ToStringView(), *keyFilter_)) {
         continue;
       }
@@ -788,6 +803,14 @@ class Iterator final : public BaseIterator {
         continue;
       }
 
+      if (!Increment()) {
+        // Hit the user's `limit` option: terminal, and flag that it was a limit
+        // rather than natural exhaustion.
+        NAPI_STATUS_THROWS(napi_get_boolean(env, true, &finished));
+        NAPI_STATUS_THROWS(napi_get_boolean(env, true, &limited));
+        break;
+      }
+
       napi_value key;
       napi_value val;
 
@@ -848,6 +871,11 @@ static void FinalizeDatabase(napi_env env, void* data, void* hint) {
       database->resourceNamesRef = nullptr;
     }
     database->Close();
+    // This external owns the Database (the bigint-handle external in db_init is
+    // created with no finalizer, so it never reaches here). Close() already
+    // released the rocksdb::DB; free the heap object itself or it leaks for the
+    // lifetime of the process.
+    delete database;
   }
 }
 
@@ -880,7 +908,19 @@ NAPI_METHOD(db_init) {
     database = reinterpret_cast<Database*>(value);
     NAPI_STATUS_THROWS(napi_create_external(env, database, nullptr, nullptr, &result));
 
-    // We should have an env_cleanup_hook for closing iterators...
+    // TODO (critical, lifetime): sharing a Database* across V8 environments (e.g.
+    // worker_threads) via db_get_handle is unsafe. There is no cross-env
+    // reference count on the rocksdb::DB, so one env's db_close() runs
+    // Database::Close() (freeing the DB + column handles on a worker thread)
+    // while another env may still be running MultiGet / iterator / updates
+    // against it -> use-after-free / double-free. This branch also installs no
+    // env_cleanup_hook or finalizer, so a tearing-down secondary env never
+    // detaches its iterators, and GetResourceName() dereferences a napi_ref
+    // (resourceNamesRef) that belongs to the originating env (cross-env ref use
+    // is undefined behaviour). Fix: refcount the Database lifetime across all
+    // wrapping envs (run the real Close()/db.reset() only when the last
+    // reference drops), install a cleanup hook here, and make resource names
+    // per-env. Until then, close() on a shared handle must be app-coordinated.
   } else {
     NAPI_STATUS_THROWS(napi_invalid_arg);
   }
@@ -916,7 +956,15 @@ NAPI_METHOD(db_query) {
   NAPI_ARGV(2);
 
   try {
-    return Iterator::create(env, argv[0], argv[1])->nextv(env, std::numeric_limits<uint32_t>::max());
+    auto iterator = Iterator::create(env, argv[0], argv[1]);
+    // Iterator::create uses NAPI_STATUS_THROWS internally, which on a N-API
+    // failure schedules a pending JS exception and `return NULL` — i.e. an empty
+    // unique_ptr. Dereferencing it (->nextv) would be a null deref / crash, so
+    // bail out and let the pending exception surface.
+    if (!iterator) {
+      return nullptr;
+    }
+    return iterator->nextv(env, std::numeric_limits<uint32_t>::max());
   } catch (const std::exception& e) {
     napi_throw_error(env, nullptr, e.what());
     return nullptr;
@@ -983,6 +1031,10 @@ napi_status InitOptions(napi_env env, T& columnOptions, const U& options) {
     columnOptions.compression = rocksdb::kZSTD;
     columnOptions.compression_opts.max_dict_bytes = 16 * 1024;
     columnOptions.compression_opts.zstd_max_train_bytes = 16 * 1024 * 100;
+    NAPI_STATUS_RETURN(GetProperty(env, options, "compressionLevel", columnOptions.compression_opts.level));
+    NAPI_STATUS_RETURN(GetProperty(env, options, "maxDictBytes", columnOptions.compression_opts.max_dict_bytes));
+    NAPI_STATUS_RETURN(
+        GetProperty(env, options, "zstdMaxTrainBytes", columnOptions.compression_opts.zstd_max_train_bytes));
     // TODO (perf): compression_opts.parallel_threads
   } else {
     columnOptions.compression = rocksdb::kNoCompression;
@@ -1093,7 +1145,9 @@ napi_status InitOptions(napi_env env, T& columnOptions, const U& options) {
   }
 
   if (!cache) {
-    uint32_t cacheSize = 8 << 20;
+    // size_t: RocksDB cache capacity is size_t; a 32-bit type silently wraps
+    // requests >= 4 GiB (and 4 GiB exactly wraps to 0 -> cache disabled).
+    uint64_t cacheSize = 8 << 20;
     double compressedRatio = 0.0;
 
     NAPI_STATUS_RETURN(GetProperty(env, options, "cacheSize", cacheSize));
@@ -1113,7 +1167,10 @@ napi_status InitOptions(napi_env env, T& columnOptions, const U& options) {
   }
 
   {
-    uint32_t cacheSize = -1;
+    // int64: -1 means "unset" (inherit the shared cache); a 32-bit type both
+    // wraps requests >= 4 GiB and collides the unset sentinel with a real
+    // 4294967295-byte request.
+    int64_t cacheSize = -1;
     double compressedRatio = 0.0;
 
     NAPI_STATUS_RETURN(GetProperty(env, options, "cachePrepopulate", tableOptions.prepopulate_block_cache));
@@ -1141,7 +1198,9 @@ napi_status InitOptions(napi_env env, T& columnOptions, const U& options) {
   }
 
   {
-    uint32_t cacheSize = -1;
+    // int64: see the block-cache block above — -1 = unset, avoids 32-bit wrap
+    // and the unset/4-GiB sentinel collision.
+    int64_t cacheSize = -1;
     double compressedRatio = 0.0;
 
     NAPI_STATUS_RETURN(GetProperty(env, options, "cachePrepopulate", columnOptions.prepopulate_blob_cache));
@@ -1157,6 +1216,9 @@ napi_status InitOptions(napi_env env, T& columnOptions, const U& options) {
       columnOptions.blob_cache = nullptr;
     } else if (compressedRatio > 0.0) {
       rocksdb::TieredCacheOptions options;
+      // Match the block/main cache tiers: pin the primary tier to HyperClockCache
+      // explicitly rather than letting it default to LRU.
+      options.cache_type = rocksdb::PrimaryCacheType::kCacheTypeHCC;
       options.total_capacity = cacheSize;
       options.compressed_secondary_ratio = compressedRatio;
       options.comp_cache_opts.compression_type = rocksdb::CompressionType::kZSTD;
@@ -1301,13 +1363,15 @@ NAPI_METHOD(db_open) {
 
     NAPI_STATUS_THROWS(GetProperty(env, options, "walDir", dbOptions.wal_dir));
 
-    uint32_t walTTL = 0;
+    // 64-bit inputs: walTTL is in ms and walSizeLimit in bytes, so a 32-bit type
+    // wraps a >= ~4.3 GB size limit (or a ~49-day TTL) before the unit conversion.
+    uint64_t walTTL = 0;
     NAPI_STATUS_THROWS(GetProperty(env, options, "walTTL", walTTL));
-    dbOptions.WAL_ttl_seconds = static_cast<uint32_t>(std::ceil(walTTL / 1e3));
+    dbOptions.WAL_ttl_seconds = static_cast<uint64_t>(std::ceil(walTTL / 1e3));
 
-    uint32_t walSizeLimit = 0;
+    uint64_t walSizeLimit = 0;
     NAPI_STATUS_THROWS(GetProperty(env, options, "walSizeLimit", walSizeLimit));
-    dbOptions.WAL_size_limit_MB = static_cast<uint32_t>(std::ceil(walSizeLimit / 1e6));
+    dbOptions.WAL_size_limit_MB = static_cast<uint64_t>(std::ceil(walSizeLimit / 1e6));
 
     NAPI_STATUS_THROWS(GetProperty(env, options, "maxTotalWalSize", dbOptions.max_total_wal_size));
 
@@ -1624,7 +1688,7 @@ NAPI_METHOD(db_get_many) {
       [=](auto& state, napi_env env, napi_value* result) {
         NAPI_STATUS_RETURN(napi_create_array_with_length(env, count, result));
 
-        for (auto n = 0; n < count; n++) {
+        for (uint32_t n = 0; n < count; n++) {
           napi_value row;
           if (state.statuses[n].IsNotFound()) {
             NAPI_STATUS_RETURN(napi_get_undefined(env, &row));
@@ -1688,6 +1752,10 @@ NAPI_METHOD(db_clear) {
       *end.GetSelf() = std::move(*lt);
     } else {
       // HACK: Assume no key that starts with 0xFF is larger than 1MiB.
+      // TODO (correctness): this synthetic upper bound silently leaves any key
+      // >= a 1 MiB run of 0xFF bytes uncleared. Prefer DeleteRange over the full
+      // keyspace (null end) or RangeBound::kInclusive on the max key instead of
+      // assuming a bound.
       end.GetSelf()->resize(1e6);
       memset(end.GetSelf()->data(), 255, end.GetSelf()->size());
     }
@@ -1743,16 +1811,26 @@ NAPI_METHOD(db_clear) {
 }
 
 NAPI_METHOD(db_get_property) {
-  NAPI_ARGV(2);
+  NAPI_ARGV(3);
 
   Database* database;
   NAPI_STATUS_THROWS(napi_get_value_external(env, argv[0], reinterpret_cast<void**>(&database)));
 
+  if (!database->db) {
+    napi_throw_error(env, "LEVEL_DATABASE_NOT_OPEN", "Database is not open");
+    return NULL;
+  }
+
   rocksdb::PinnableSlice property;
   NAPI_STATUS_THROWS(GetValue(env, argv[1], property));
 
+  // Most rocksdb properties are column-family scoped; without an explicit
+  // column they answer for the default CF only.
+  rocksdb::ColumnFamilyHandle* column = database->db->DefaultColumnFamily();
+  NAPI_STATUS_THROWS(GetProperty(env, argv[2], "column", column));
+
   std::string value;
-  database->db->GetProperty(property, &value);
+  database->db->GetProperty(column, property, &value);
 
   napi_value result;
   NAPI_STATUS_THROWS(napi_create_string_utf8(env, value.data(), value.size(), &result));
@@ -1804,6 +1882,11 @@ NAPI_METHOD(iterator_init_sync) {
   napi_value result;
   try {
     auto iterator = Iterator::create(env, argv[0], argv[1]);
+    // create() returns an empty unique_ptr (and a pending JS exception) on a
+    // N-API failure; surface that instead of wrapping a null pointer.
+    if (!iterator) {
+      return nullptr;
+    }
 
     NAPI_STATUS_THROWS(napi_create_external(env, iterator.get(), Finalize<Iterator>, iterator.get(), &result));
     iterator.release();
@@ -1815,6 +1898,22 @@ NAPI_METHOD(iterator_init_sync) {
   return result;
 }
 
+NAPI_METHOD(iterator_refresh_sync) {
+  NAPI_ARGV(1);
+
+  try {
+    Iterator* iterator;
+    NAPI_STATUS_THROWS(napi_get_value_external(env, argv[0], reinterpret_cast<void**>(&iterator)));
+
+    ROCKS_STATUS_THROWS_NAPI(iterator->Refresh());
+  } catch (const std::exception& e) {
+    napi_throw_error(env, nullptr, e.what());
+    return nullptr;
+  }
+
+  return 0;
+}
+
 NAPI_METHOD(iterator_seek) {
   NAPI_ARGV(3);
 
@@ -2363,6 +2462,7 @@ NAPI_INIT() {
   NAPI_EXPORT_FUNCTION(db_flush_wal);
 
   NAPI_EXPORT_FUNCTION(iterator_init_sync);
+  NAPI_EXPORT_FUNCTION(iterator_refresh_sync);
   NAPI_EXPORT_FUNCTION(iterator_seek);
   NAPI_EXPORT_FUNCTION(iterator_seek_sync);
   NAPI_EXPORT_FUNCTION(iterator_close_sync);

package/build.sh

@@ -1,15 +1,29 @@
 #!/bin/bash
 set -e
 
+# The Dockerfile targets x86-64 explicitly (znver3 march flags, prebuildify
+# --arch x64), so the image must be built for linux/amd64 even on arm64 hosts
+# (e.g. Apple Silicon), where it runs under emulation. Without this the native
+# arm64 gcc rejects -march=znver3 ("unknown value 'znver3'") and the build fails.
+PLATFORM=linux/amd64
+
+# Build on the remote x86-64 docker host by default (avoids emulation on
+# Apple Silicon). Override with DOCKER_HOST=... ./build.sh, or
+# DOCKER_HOST= ./build.sh to use the local docker daemon.
+export DOCKER_HOST="${DOCKER_HOST-ssh://nxtop@hq-test-srv1.nxt.io}"
+
 echo "Initializing submodules..."
 git submodule update --init
 
 echo "Building image..."
-docker build --iidfile prebuilds.iid .
+# JOBS caps build parallelism for the memory-heavy rocksdb compile (default 8,
+# see Dockerfile). Lower it (e.g. JOBS=4 ./build.sh) if the build still OOMs on
+# a memory-constrained Docker, or raise it on a large host.
+docker build --platform "$PLATFORM" ${JOBS:+--build-arg JOBS="$JOBS"} --iidfile prebuilds.iid .
 
 echo "Extracting prebuilds from image..."
 IMG=$(cat prebuilds.iid)
-ID=$(docker create $IMG)
+ID=$(docker create --platform "$PLATFORM" $IMG)
 docker cp "$ID:/rocks-level/prebuilds" ./
 
 echo "Cleaning up..."

package/index.js

@@ -224,7 +224,11 @@ class RocksLevel extends AbstractLevel {
     callback = fromCallback(callback, kPromise)
 
     try {
-      // TODO (fix): Use batch + DeleteRange...
+      // TODO (perf): db_clear is a synchronous native call that blocks the event
+      // loop. The whole-range (limit === -1) path is a single DeleteRange (cheap),
+      // but the limited path iterates + writes WriteBatches on the JS thread, and
+      // neither is ref-counted against close(). Move to an async binding
+      // (runAsync) that takes a kRef like the other ops.
       binding.db_clear(this[kContext], options ?? kEmpty)
       process.nextTick(callback, null)
     } catch (err) {
@@ -290,7 +294,7 @@ class RocksLevel extends AbstractLevel {
     return binding.db_get_identity(this[kContext])
   }
 
-  getProperty (property) {
+  getProperty (property, options) {
     if (typeof property !== 'string') {
       throw new TypeError("The first argument 'property' must be a string")
     }
@@ -302,7 +306,7 @@ class RocksLevel extends AbstractLevel {
       })
     }
 
-    return binding.db_get_property(this[kContext], property)
+    return binding.db_get_property(this[kContext], property, options ?? kEmpty)
   }
 
   query (options, callback) {

package/iterator.js

@@ -126,6 +126,18 @@ class Iterator extends AbstractIterator {
 
   // nxt API
 
+  _refreshSync () {
+    assert(this[kContext])
+    assert(!this[kBusy])
+
+    this[kFirst] = true
+    this[kCache] = kEmpty
+    this[kFinished] = false
+    this[kPosition] = 0
+
+    binding.iterator_refresh_sync(this[kContext])
+  }
+
   _seekSync (target) {
     assert(this[kContext])
     assert(!this[kBusy])

package/max_rev_operator.h

@@ -6,6 +6,21 @@
 
 #include <iostream>
 
+// Compares two length-prefixed revision operands and returns <0, 0, >0.
+//
+// This MUST stay byte-for-byte order-compatible with the in-memory JS comparator
+// (@nxtedition/util compareRev, lib/packages/util/src/compare-rev.ts), because
+// RocksDB selects the durable winner with this operator while the application
+// compares the same revisions in memory with the JS one — if they disagree, the
+// stored "max revision" diverges from what the app believes is the max. A 500k
+// randomized fuzz (leading zeros, INF, length ties, missing dashes) confirms
+// parity. Revisions are `<number>-<id>` (e.g. `12-7a00`, `INF-…`) compared as:
+//   1. INF sentinel: a number beginning with 'I' is +infinity (largest).
+//   2. leading zeros are skipped so `01-x` == `1-x` in magnitude.
+//   3. the number is compared digit-by-digit, terminated by '-'; the side whose
+//      number ends first (fewer significant digits) is smaller.
+//   4. then the id is compared bytewise; finally the zero-stripped length breaks
+//      ties (a longer number = larger revision).
 int compareRev(const rocksdb::Slice& a, const rocksdb::Slice& b) {
   if (a.empty()) {
     return b.empty() ? 0 : -1;
@@ -22,14 +37,35 @@ int compareRev(const rocksdb::Slice& a, const rocksdb::Slice& b) {
   const std::size_t endA = 1 + std::min<std::size_t>(static_cast<unsigned char>(a[0]), a.size() - 1);
   const std::size_t endB = 1 + std::min<std::size_t>(static_cast<unsigned char>(b[0]), b.size() - 1);
 
+  // INF-XXXX sorts above every numeric revision. Mirror the JS comparator's
+  // explicit sentinel rather than relying on 'I' (0x49) happening to exceed the
+  // digit bytes.
+  const bool infA = indexA < endA && a[indexA] == 'I';
+  const bool infB = indexB < endB && b[indexB] == 'I';
+  if (infA != infB) {
+    return infA ? 1 : -1;
+  }
+
+  // Skip leading zeroes, tracking the zero-stripped content length for the final
+  // tiebreak, so `01-x` and `1-x` compare as the same magnitude.
+  std::size_t lenA = endA - indexA;
+  std::size_t lenB = endB - indexB;
+  while (indexA < endA && a[indexA] == '0') {
+    ++indexA;
+    --lenA;
+  }
+  while (indexB < endB && b[indexB] == '0') {
+    ++indexB;
+    --lenB;
+  }
+
   // Compare the revision number. Compare bytes as unsigned char: rocksdb::Slice
   // operator[] returns (signed-on-most-platforms) char, so a byte >= 0x80 would
   // otherwise sort as negative and order opposite to the JS comparator, which
   // reads bytes as unsigned (Buffer[i] in 0..255). Keeping both sides unsigned
   // ensures the in-memory ordering and this durable maxRev merge agree.
   auto result = 0;
-  const auto end = std::min(endA, endB);
-  while (indexA < end && indexB < end) {
+  while (indexA < endA && indexB < endB) {
     const unsigned char ac = static_cast<unsigned char>(a[indexA++]);
     const unsigned char bc = static_cast<unsigned char>(b[indexB++]);
 
@@ -52,7 +88,7 @@ int compareRev(const rocksdb::Slice& a, const rocksdb::Slice& b) {
   }
 
   // Compare the rest (unsigned, for the same reason as the loop above).
-  while (indexA < end && indexB < end) {
+  while (indexA < endA && indexB < endB) {
     const unsigned char ac = static_cast<unsigned char>(a[indexA++]);
     const unsigned char bc = static_cast<unsigned char>(b[indexB++]);
     if (ac != bc) {
@@ -60,7 +96,7 @@ int compareRev(const rocksdb::Slice& a, const rocksdb::Slice& b) {
     }
   }
 
-  return static_cast<int>(endA) - static_cast<int>(endB);
+  return static_cast<int>(lenA) - static_cast<int>(lenB);
 }
 
 class MaxRevOperator : public rocksdb::MergeOperator {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nxtedition/rocksdb",
-  "version": "16.0.2",
+  "version": "16.0.6",
   "description": "A low-level Node.js RocksDB binding",
   "license": "MIT",
   "main": "index.js",
@@ -9,7 +9,8 @@
     "test": "standard && (nyc -s tape test/*-test.js | faucet) && nyc report",
     "test-prebuild": "cross-env PREBUILDS_ONLY=1 npm t",
     "prebuildify": "JOBS=8 prebuildify --napi --strip",
-    "rebuild": "JOBS=8 npm run install --build-from-source"
+    "rebuild": "JOBS=8 npm run install --build-from-source",
+    "release": "./release.sh"
   },
   "dependencies": {
     "abstract-level": "^1.0.2",

package/release.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+set -e
+
+cd "$(dirname "$0")"
+
+# Fail fast: npm version refuses a dirty tree, so check before the slow builds.
+if [ -n "$(git status --porcelain)" ]; then
+  echo "Working tree is not clean, commit or stash changes first." >&2
+  exit 1
+fi
+
+# Keep the local arm64 build targeting the same node version as the Docker image.
+NODE_TARGET=$(sed -n 's/^FROM node:\([0-9.]*\).*/\1/p' Dockerfile)
+if [ -z "$NODE_TARGET" ]; then
+  echo "Could not determine node version from Dockerfile." >&2
+  exit 1
+fi
+
+echo "Building linux prebuilds (docker)..."
+./build.sh
+
+echo "Building darwin-arm64 prebuilds (node $NODE_TARGET)..."
+JOBS=16 npx prebuildify -t "$NODE_TARGET" --napi --strip --arch arm64
+
+read -r -p "Version bump (patch/minor/major): " BUMP
+case "$BUMP" in
+  patch | minor | major) ;;
+  *)
+    echo "Invalid bump: '$BUMP' (expected patch, minor or major)" >&2
+    exit 1
+    ;;
+esac
+
+npm version "$BUMP"
+npm publish
+
+git push
+git push --tags
+
+echo "Published $(node -p "require('./package.json').version")."

package/util.h

@@ -9,6 +9,7 @@
 #include <rocksdb/status.h>
 
 #include <array>
+#include <memory>
 #include <optional>
 #include <string>
 
@@ -439,9 +440,18 @@ napi_status Convert(napi_env env,
                     bool unsafe = false) {
   if (encoding == Encoding::Buffer) {
     if (unsafe) {
-      auto s2 = new rocksdb::PinnableSlice(std::move(s));
-      return napi_create_external_buffer(env, s2->size(), const_cast<char*>(s2->data()),
-                                         Finalize<rocksdb::PinnableSlice>, s2, &result);
+      // The heap PinnableSlice is owned by the finalizer, which N-API only
+      // registers when the external buffer is created successfully. Hold it in a
+      // unique_ptr and release ownership only on success, so a failed
+      // napi_create_external_buffer does not leak it (and the block/memtable
+      // region it pinned).
+      auto s2 = std::make_unique<rocksdb::PinnableSlice>(std::move(s));
+      const auto status = napi_create_external_buffer(env, s2->size(), const_cast<char*>(s2->data()),
+                                                      Finalize<rocksdb::PinnableSlice>, s2.get(), &result);
+      if (status == napi_ok) {
+        s2.release();
+      }
+      return status;
     } else {
       return napi_create_buffer_copy(env, s.size(), s.data(), nullptr, &result);
     }

package/util.js

@@ -2,73 +2,3 @@
 
 exports.kRef = Symbol('ref')
 exports.kUnref = Symbol('unref')
-
-function handleMany (sizes, data, options) {
-  const { valueEncoding } = options ?? {}
-
-  data ??= Buffer.alloc(0)
-  sizes ??= Buffer.alloc(0)
-
-  const rows = []
-  let offset = 0
-  const sizes32 = new Int32Array(sizes.buffer, sizes.byteOffset, sizes.byteLength / 4)
-  for (let n = 0; n < sizes32.length; n++) {
-    const size = sizes32[n]
-    const encoding = valueEncoding
-    if (size < 0) {
-      rows.push(undefined)
-    } else {
-      if (!encoding || encoding === 'buffer') {
-        rows.push(data.subarray(offset, offset + size))
-      } else if (encoding === 'slice') {
-        rows.push({ buffer: data, byteOffset: offset, byteLength: size })
-      } else {
-        rows.push(data.toString(encoding, offset, offset + size))
-      }
-      offset += size
-      if (offset & 0x7) {
-        offset = (offset | 0x7) + 1
-      }
-    }
-  }
-
-  return rows
-}
-function handleNextv (err, sizes, buffer, finished, options, callback) {
-  const { keyEncoding, valueEncoding } = options ?? {}
-
-  if (err) {
-    callback(err)
-  } else {
-    buffer ??= Buffer.alloc(0)
-    sizes ??= Buffer.alloc(0)
-
-    const rows = []
-    let offset = 0
-    const sizes32 = new Int32Array(sizes.buffer, sizes.byteOffset, sizes.byteLength / 4)
-    for (let n = 0; n < sizes32.length; n++) {
-      const size = sizes32[n]
-      const encoding = n & 1 ? valueEncoding : keyEncoding
-      if (size < 0) {
-        rows.push(undefined)
-      } else {
-        if (!encoding || encoding === 'buffer') {
-          rows.push(buffer.subarray(offset, offset + size))
-        } else if (encoding === 'slice') {
-          rows.push({ buffer, byteOffset: offset, byteLength: size })
-        } else {
-          rows.push(buffer.toString(encoding, offset, offset + size))
-        }
-        offset += size
-        if (offset & 0x7) {
-          offset = (offset | 0x7) + 1
-        }
-      }
-    }
-
-    callback(null, rows, finished)
-  }
-}
-
-exports.handleMany = handleMany
-exports.handleNextv = handleNextv

package/.claude/settings.local.json

@@ -1,35 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(npm pack:*)",
-      "Bash(node:*)",
-      "Bash(npm view:*)",
-      "Bash(npm info:*)",
-      "Bash(nm:*)",
-      "Bash(grep:*)",
-      "Bash(while read f)",
-      "Bash(do basename \"$f\")",
-      "Bash(done)",
-      "Bash(ls:*)",
-      "Bash(git submodule update:*)",
-      "Bash(git submodule:*)",
-      "Bash(yarn build:*)",
-      "Bash(yarn rebuild:*)",
-      "Bash(npx tape:*)",
-      "Bash(echo \"=== In binding.gyp ===\" grep \"absl/base/internal\" binding.gyp echo \"\" echo \"=== Available \\(non-test\\) files ===\" ls deps/abseil-cpp/absl/base/internal/*.cc)",
-      "Bash(echo \"=== Checking for abseil source requirements ===\" echo \"\" echo \"profiling sources:\" ls /Users/ronagy/GitHub/nxtedition/rocks-level/deps/abseil-cpp/absl/profiling/internal/*.cc)",
-      "Bash(echo \"none found\" echo \"\" echo \"crc sources:\" ls /Users/ronagy/GitHub/nxtedition/rocks-level/deps/abseil-cpp/absl/crc/internal/*.cc)",
-      "Bash(echo \"NONE INCLUDED!\" echo \"\" echo \"=== Available log sources ===\" ls /Users/ronagy/GitHub/nxtedition/rocks-level/deps/abseil-cpp/absl/log/*.cc)",
-      "Bash(head -20 echo \"\" echo \"=== Log internal sources ===\" ls /Users/ronagy/GitHub/nxtedition/rocks-level/deps/abseil-cpp/absl/log/internal/*.cc)",
-      "Bash(echo \"=== Required log sources \\(non-test\\) ===\" ls /Users/ronagy/GitHub/nxtedition/rocks-level/deps/abseil-cpp/absl/log/*.cc)",
-      "Bash(CFLAGS=\"-g -O0\" CXXFLAGS=\"-g -O0\" npm run rebuild)",
-      "Bash(node-gyp rebuild:*)",
-      "Bash(npx node-gyp rebuild:*)",
-      "Bash(git rm:*)",
-      "WebFetch(domain:raw.githubusercontent.com)",
-      "Bash(git log:*)",
-      "WebFetch(domain:github.com)",
-      "Bash(npm run rebuild:*)"
-    ]
-  }
-}