@rubytech/create-maxy-code 0.1.478 → 0.1.480

package/payload/platform/plugins/cloudflare/bin/portal-index-push.mjs

@@ -0,0 +1,357 @@
+#!/usr/bin/env node
+// Publish a sub-account's deliverable file INDEX to its portal's D1.
+//
+// Metadata only. The bytes stay on the device and are fetched on demand through
+// a short-lived signed link, which is what lets the portal render the folder
+// tree while the device is offline.
+//
+// Full replace per account rather than a diff: a delete or a rename on the
+// device converges on the next cycle with no tombstone protocol to get wrong.
+//
+// Runnable standalone as well as from the heartbeat, because the heartbeat spawn
+// this copies has never been observed running on a device (Task 1828). If the
+// hourly run is silently dead, this script still works by hand.
+//
+//   node portal-index-push.mjs --account-dir <dir> --account <id> --db <name>
+//   node portal-index-push.mjs --all-accounts
+//
+// Credentials come from the house file, never a flag; PLATFORM_ROOT locates it.
+
+import { readFile, readdir, stat } from 'node:fs/promises'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { resolveExposedDirs } from './schema-exposed-dirs.mjs'
+import { createD1Client } from './d1-http.mjs'
+
+const TAG = '[portal-index]'
+
+/** Read `KEY=value` pairs from a secrets file without polluting process.env.
+ *  Values are trimmed, matching the readers in reconcile-bookings.ts and
+ *  house-scoped-token.ts — a CRLF file would otherwise leave a stray "\r" that
+ *  reaches Cloudflare as an opaque invalid-header error.
+ *  @param {string} path @returns {Record<string, string>} */
+function readEnvFile(path) {
+  /** @type {Record<string, string>} */ const out = {}
+  if (!existsSync(path)) return out
+  for (const line of readFileSync(path, 'utf8').split('\n')) {
+    const m = line.match(/^([A-Z0-9_]+)=(.*)$/)
+    if (m) out[m[1]] = m[2].trim()
+  }
+  return out
+}
+
+/**
+ * Files under `exposed` dirs, at any depth. Dot-prefixed entries are skipped at
+ * every level: `.uploads-tmp/` holds in-flight upload partials (files.ts:25) and
+ * must never be published as a deliverable.
+ * @param {string} accountDir @param {string[]} exposed
+ * @returns {Promise<{relPath: string, sizeBytes: number, modifiedAt: string}[]>}
+ */
+export async function walkExposed(accountDir, exposed) {
+  /** @type {{relPath: string, sizeBytes: number, modifiedAt: string}[]} */
+  const out = []
+
+  /** @param {string} rel */
+  async function walk(rel) {
+    /** @type {import('node:fs').Dirent[]} */ let entries
+    try {
+      entries = await readdir(join(accountDir, rel), { withFileTypes: true })
+    } catch {
+      return // absent or unreadable dir contributes nothing
+    }
+    for (const e of entries) {
+      if (e.name.startsWith('.')) continue
+      const childRel = `${rel}/${e.name}`
+      if (e.isDirectory()) {
+        await walk(childRel)
+      } else if (e.isFile()) {
+        try {
+          const st = await stat(join(accountDir, childRel))
+          out.push({ relPath: childRel, sizeBytes: st.size, modifiedAt: st.mtime.toISOString() })
+        } catch {
+          // vanished mid-walk; the next cycle settles it
+        }
+      }
+    }
+  }
+
+  for (const dir of exposed) await walk(dir)
+  return out
+}
+
+/**
+ * @param {{ accountDir: string, accountId: string, dbName: string,
+ *           client: { query: (sql: string, params?: unknown[]) => Promise<Record<string, unknown>[]> },
+ *           log: (line: string) => void, nowIso: string,
+ *           previousExposed?: string[] }} opts
+ * @returns {Promise<{ exposed: string[], rows: number, schemaPresent: boolean }>}
+ */
+export async function pushAccount(opts) {
+  const { accountDir, accountId, client, log, nowIso } = opts
+
+  /** @type {string | null} */ let schemaText = null
+  try {
+    schemaText = await readFile(join(accountDir, 'SCHEMA.md'), 'utf8')
+  } catch {
+    schemaText = null
+  }
+
+  const r = resolveExposedDirs(schemaText)
+  log(
+    `${TAG} op=resolve account=${accountId} schemaPresent=${r.schemaPresent} allowed=${r.allowed.length} ` +
+      `domainBuckets=${r.domainBuckets.join(',') || 'none'} exposed=${r.exposed.join(',') || 'none'}`,
+  )
+  // The generator gives a plugin-claimed dir to the plugin-owned region only
+  // (account-schema-owned-dirs.py:287), so this is normally silent. When it is
+  // not, a bucket has vanished from the client's view and nothing else says so.
+  for (const c of r.collisions) {
+    log(`${TAG} op=collision account=${accountId} dir=${c} claimedBy=plugin-owned`)
+  }
+
+  // Emitted only on a delta, so the line stays rare and is always worth
+  // reading. A schema regeneration — a vertical change, a plugin claiming a
+  // dir — silently changes what the client sees, with no deploy and nothing
+  // else to say so. `removed=` on a populated bucket is the client-visible
+  // regression. Reported from the push because the push is what applies the
+  // change; if it is not running, nothing changes and there is nothing to say.
+  if (opts.previousExposed) {
+    const added = r.exposed.filter((d) => !opts.previousExposed.includes(d))
+    const removed = opts.previousExposed.filter((d) => !r.exposed.includes(d))
+    if (added.length || removed.length) {
+      log(
+        `${TAG} op=exposed-changed account=${accountId} ` +
+          `added=${added.join(',') || 'none'} removed=${removed.join(',') || 'none'}`,
+      )
+    }
+  }
+
+  // Fail closed: no schema, or nothing exposed, means write NOTHING — not a
+  // delete. A delete would leave the table identical to a successful publish of
+  // an account that genuinely has no deliverables, which is the one state an
+  // operator must be able to tell apart.
+  if (!r.schemaPresent || r.exposed.length === 0) {
+    return { exposed: r.exposed, rows: 0, schemaPresent: r.schemaPresent }
+  }
+
+  const rows = await walkExposed(accountDir, r.exposed)
+
+  await client.query('DELETE FROM directory WHERE accountId = ?', [accountId])
+  for (const row of rows) {
+    await client.query(
+      'INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt) VALUES (?, ?, ?, ?, ?)',
+      [accountId, row.relPath, row.sizeBytes, row.modifiedAt, nowIso],
+    )
+  }
+  log(`${TAG} op=replace account=${accountId} deleted=all inserted=${rows.length}`)
+
+  // Read back rather than trusting the write: "issued the inserts" is not "the
+  // rows are there", and a half-applied batch is otherwise invisible.
+  const check = await client.query('SELECT COUNT(*) AS n FROM directory WHERE accountId = ?', [accountId])
+  const after = Number(check[0]?.n ?? -1)
+  log(`${TAG} op=verify account=${accountId} rowsAfter=${after} expected=${rows.length}`)
+
+  return { exposed: r.exposed, rows: rows.length, schemaPresent: true }
+}
+
+/**
+ * Where the push records what it last successfully wrote, per account.
+ *
+ * The heartbeat's audit reads this IN-PROCESS to answer "is this index still
+ * being refreshed?" — a question no event-driven line can answer, because the
+ * failure being detected is the absence of events. It lives under data/ rather
+ * than in an account dir so the audit needs nothing but PLATFORM_ROOT, and so
+ * it never trips the account write-path guard.
+ * @param {string} platformRoot
+ */
+export function stateFilePath(platformRoot) {
+  return resolve(platformRoot, '..', 'data', 'portal-index-state.json')
+}
+
+/** @param {string} platformRoot @returns {Record<string, {lastPushMs: number, rows: number, exposed: string[]}>} */
+export function readState(platformRoot) {
+  try {
+    return JSON.parse(readFileSync(stateFilePath(platformRoot), 'utf8'))
+  } catch {
+    return {}
+  }
+}
+
+/**
+ * Written ONLY after op=verify, so a stale entry means the push stopped
+ * succeeding rather than merely stopped logging. Read-modify-write per account
+ * so one account's failure does not erase another's record.
+ * @param {string} platformRoot @param {string} accountId
+ * @param {{lastPushMs: number, rows: number, exposed: string[]}} entry
+ */
+export function recordSuccess(platformRoot, accountId, entry) {
+  const path = stateFilePath(platformRoot)
+  const state = readState(platformRoot)
+  state[accountId] = entry
+  try {
+    writeFileSync(path, JSON.stringify(state, null, 1))
+  } catch (err) {
+    // Never fatal: the index IS published at this point. But never silent
+    // either — an unwritable state file makes every later audit report a
+    // healthy account as never-ran, which is a false alarm that would send an
+    // operator looking in the wrong place.
+    console.error(
+      `${TAG} op=state-write-failed account=${accountId} path="${path}" err="${err instanceof Error ? err.message : String(err)}"`,
+    )
+  }
+}
+
+/** @param {string} flag */
+function arg(flag) {
+  const i = process.argv.indexOf(flag)
+  return i === -1 ? undefined : process.argv[i + 1]
+}
+
+/**
+ * Every account carrying a data-portal.json has a portal. The file's presence is
+ * the enrolment signal — there is no separate flag to keep in sync with it.
+ * @param {string} accountsRoot
+ * @returns {Promise<{accountDir: string, accountId: string, dbName: string}[]>}
+ */
+async function portalAccounts(accountsRoot) {
+  /** @type {{accountDir: string, accountId: string, dbName: string}[]} */ const out = []
+  /** @type {string[]} */ let names
+  try {
+    names = await readdir(accountsRoot)
+  } catch {
+    return out
+  }
+  for (const accountId of names) {
+    const accountDir = join(accountsRoot, accountId)
+    try {
+      const cfg = JSON.parse(await readFile(join(accountDir, 'data-portal.json'), 'utf8'))
+      if (typeof cfg?.portalDbName === 'string' && cfg.portalDbName) {
+        out.push({ accountDir, accountId, dbName: cfg.portalDbName })
+      } else {
+        console.error(`${TAG} op=skip account=${accountId} reason=no-portalDbName`)
+      }
+    } catch {
+      // No data-portal.json: this account has no portal. Not an error.
+    }
+  }
+  return out
+}
+
+/**
+ * Resolve the Cloudflare credentials the D1 API needs.
+ *
+ * Two things this must not conflate. `cfAccountId` is the CLOUDFLARE account
+ * (the `/accounts/<id>/d1/...` path segment) and comes from the house
+ * credential; the Maxy sub-account id is a different value entirely and is what
+ * scopes the `directory` rows. Passing one where the other belongs makes every
+ * database lookup fail.
+ *
+ * And the house token is a MINTER — using it directly against D1 returns 10000.
+ * `cf-token.sh` mints (or reuses) a D1-scoped token from it and prints the
+ * secrets KEY holding the value, never the value itself.
+ *
+ * @param {string} platformRoot
+ * @returns {{ cfAccountId: string, token: string } | { error: string }}
+ */
+function resolveCloudflareCredentials(platformRoot) {
+  const houseEnvPath = join(platformRoot, 'config', 'cloudflare-house.env')
+  const house = readEnvFile(houseEnvPath)
+  if (!house.CLOUDFLARE_API_TOKEN) return { error: 'no-house-cloudflare-credential' }
+  // Required rather than inferred: the D1 endpoint is addressed per Cloudflare
+  // account, and guessing it would run these statements against the wrong one.
+  if (!house.CLOUDFLARE_ACCOUNT_ID) return { error: 'no-house-cloudflare-account-id' }
+
+  const cfTokenSh = join(platformRoot, 'plugins', 'cloudflare', 'bin', 'cf-token.sh')
+  if (!existsSync(cfTokenSh)) return { error: 'cf-token-sh-missing' }
+
+  /** @type {string} */ let keyName
+  try {
+    keyName = execFileSync(cfTokenSh, ['d1', houseEnvPath], { encoding: 'utf8' }).trim()
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err)
+    return { error: `scoped-token-mint-failed: ${detail}` }
+  }
+  // Re-read: cf-token.sh persists the minted token into the same file.
+  const token = readEnvFile(houseEnvPath)[keyName]
+  if (!token) return { error: `scoped-token-absent-after-mint key=${keyName}` }
+
+  return { cfAccountId: house.CLOUDFLARE_ACCOUNT_ID, token }
+}
+
+async function main() {
+  const platformRoot = process.env.PLATFORM_ROOT
+  if (!platformRoot) {
+    console.error(`${TAG} op=usage reason=no-platform-root PLATFORM_ROOT is required`)
+    process.exit(1)
+  }
+
+  const cred = resolveCloudflareCredentials(platformRoot)
+  if ('error' in cred) {
+    console.error(`${TAG} op=skip reason=${cred.error}`)
+    process.exit(1)
+  }
+
+  /** @type {{accountDir: string, accountId: string, dbName: string}[]} */ let targets
+  if (process.argv.includes('--all-accounts')) {
+    // Same derivation as the platform's own DATA_ROOT (data-path.ts:19), from
+    // the PLATFORM_ROOT the heartbeat already passes.
+    const accountsRoot = resolve(platformRoot, '..', 'data', 'accounts')
+    targets = await portalAccounts(accountsRoot)
+    console.error(`${TAG} op=enumerate accountsRoot="${accountsRoot}" accounts=${targets.length}`)
+  } else {
+    const accountDir = arg('--account-dir')
+    const accountId = arg('--account')
+    const dbName = arg('--db')
+    if (!accountDir || !accountId || !dbName) {
+      console.error(`${TAG} op=usage --account-dir <dir> --account <id> --db <name>`)
+      process.exit(1)
+    }
+    targets = [{ accountDir, accountId, dbName }]
+  }
+
+  const state = readState(platformRoot)
+  let failed = 0
+  for (const t of targets) {
+    try {
+      // cfAccountId addresses the D1 endpoint; t.accountId scopes the rows.
+      // Two different identifiers — see resolveCloudflareCredentials.
+      const client = createD1Client({
+        accountId: cred.cfAccountId,
+        token: cred.token,
+        dbName: t.dbName,
+      })
+      const r = await pushAccount({
+        ...t,
+        client,
+        log: (l) => console.error(l),
+        nowIso: new Date().toISOString(),
+        previousExposed: state[t.accountId]?.exposed,
+      })
+      // Only a schema-present run records success. A fail-closed run published
+      // nothing, so recording it would let a broken schema masquerade as a
+      // healthy hourly cycle for as long as it stayed broken.
+      if (r.schemaPresent) {
+        recordSuccess(platformRoot, t.accountId, {
+          lastPushMs: Date.now(),
+          rows: r.rows,
+          exposed: r.exposed,
+        })
+      }
+      console.error(`${TAG} op=done account=${t.accountId} rows=${r.rows}`)
+    } catch (err) {
+      // One account's failure must not stop the rest, and it must never be
+      // swallowed — the message is the only thing that says which account.
+      failed++
+      console.error(
+        `${TAG} op=failed account=${t.accountId} err="${err instanceof Error ? err.message : String(err)}"`,
+      )
+    }
+  }
+  if (failed > 0) process.exit(1)
+}
+
+// Only when invoked directly, so the module stays importable by tests.
+if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))) {
+  void main()
+}

package/payload/platform/plugins/cloudflare/bin/schema-exposed-dirs.mjs

@@ -0,0 +1,103 @@
+// Which folders of an account may a portal client see?
+//
+// Not a list in this file. The answer is derived per account from that
+// account's own SCHEMA.md, which is generated by
+// platform/scripts/lib/account-schema-owned-dirs.py: one bucket per top-level
+// entity of the brand's vertical ontology, plus whatever plugins claim, inside
+// a closed allowed-top-level set.
+//
+// Exposed = ontology buckets + `output`, intersected with the allowed set.
+// Ontology buckets hold per-entity artifacts ("File a job's artifacts under its
+// entity folder", the region's own prose); `output` is the delivery convention
+// (doc-source-resolve.ts:14 calls it agent-authored). Operator-data buckets,
+// uploads, plugin workspaces and platform-internal dirs are in neither source
+// and so are never exposed.
+
+const ONT_START = '<!-- ontology-buckets:start -->'
+const ONT_END = '<!-- ontology-buckets:end -->'
+const OWNED_START = '<!-- plugin-owned-dirs:start -->'
+const OWNED_END = '<!-- plugin-owned-dirs:end -->'
+
+/** The delivery convention, always exposed when the account allows it. */
+export const ALWAYS_EXPOSED = 'output'
+
+/**
+ * The generator writes the ontology region with an ASCII hyphen and the
+ * plugin-owned region with an em dash (account-schema-owned-dirs.py:294 vs
+ * :281). Matching the wrong one yields zero buckets and reads as "this account
+ * has no deliverables", which is why each region has its own pattern.
+ */
+const DOMAIN_LINE = /^- `([^`/]+)\/` - one folder per /
+const OWNED_LINE = /^- `([^`/]+)\/` — /
+
+/** @param {string} text @param {string} start @param {string} end */
+function region(text, start, end) {
+  const i = text.indexOf(start)
+  if (i === -1) return null
+  const j = text.indexOf(end, i)
+  return text.slice(i, j === -1 ? text.length : j)
+}
+
+/** @param {string} text @returns {string[] | null} */
+function allowedBlockOrNull(text) {
+  const lines = text.split('\n')
+  const start = lines.findIndex((l) => l.trim() === '```allowed-top-level')
+  if (start === -1) return null
+  for (let j = start + 1; j < lines.length; j++) {
+    if (lines[j].trim() === '```') {
+      return lines.slice(start + 1, j).map((l) => l.trim()).filter(Boolean)
+    }
+  }
+  return null
+}
+
+/**
+ * @param {string | null} schemaText Contents of accounts/<id>/SCHEMA.md, or null when absent.
+ * @returns {{ schemaPresent: boolean, allowed: string[], domainBuckets: string[],
+ *            pluginOwned: string[], collisions: string[], exposed: string[] }}
+ */
+export function resolveExposedDirs(schemaText) {
+  const empty = {
+    schemaPresent: false,
+    allowed: /** @type {string[]} */ ([]),
+    domainBuckets: /** @type {string[]} */ ([]),
+    pluginOwned: /** @type {string[]} */ ([]),
+    collisions: /** @type {string[]} */ ([]),
+    exposed: /** @type {string[]} */ ([]),
+  }
+  // Fail CLOSED. fs-schema-guard.sh:76-78 fails open on a missing schema so an
+  // unseeded legacy account is not write-blocked; a read surface facing a
+  // client must do the opposite. Do not "fix" this to match the guard.
+  if (typeof schemaText !== 'string' || schemaText.length === 0) return empty
+
+  const allowed = allowedBlockOrNull(schemaText)
+  if (allowed === null) return { ...empty, schemaPresent: true }
+
+  const ont = region(schemaText, ONT_START, ONT_END)
+  const owned = region(schemaText, OWNED_START, OWNED_END)
+
+  /** @param {string | null} text @param {RegExp} re */
+  const dirsIn = (text, re) => {
+    if (!text) return []
+    /** @type {string[]} */ const out = []
+    for (const line of text.split('\n')) {
+      const m = re.exec(line.trim())
+      if (m && !out.includes(m[1])) out.push(m[1])
+    }
+    return out
+  }
+
+  const domainBuckets = dirsIn(ont, DOMAIN_LINE)
+  const pluginOwned = dirsIn(owned, OWNED_LINE)
+
+  // The generator omits a plugin-claimed dir from the ontology region
+  // (account-schema-owned-dirs.py:287), so this should be empty in practice.
+  // When it is not, the bucket silently vanishes from the client's view — the
+  // caller logs it rather than guessing which side should win.
+  const collisions = domainBuckets.filter((d) => pluginOwned.includes(d))
+
+  const candidates = [ALWAYS_EXPOSED, ...domainBuckets.filter((d) => !collisions.includes(d))]
+  const exposed = [...new Set(candidates)].filter((d) => allowed.includes(d)).sort()
+
+  return { schemaPresent: true, allowed, domainBuckets, pluginOwned, collisions, exposed }
+}

package/payload/platform/plugins/cloudflare/mcp/__tests__/authorize.test.ts

@@ -67,7 +67,7 @@ describe('sessions', () => {
   it('mints a session resolvable to its owner', async () => {
     const { db } = fakeDb()
     await mintSession(db, 'alice', 'sess-1', 1_000_000, PC)
-    expect(await resolveSession(db, 'sess-1', 1_000_000)).toEqual({ ownerId: 'alice' })
+    expect(await resolveSession(db, 'sess-1', 1_000_000)).toEqual({ ownerId: 'alice', accountId: '' })
   })
 
   it('does not resolve an expired session', async () => {
@@ -97,7 +97,7 @@ describe('session revocation — the property the design claims', () => {
     // by construction, not by remembering to delete anything.
     const { db, peopleRows } = fakeDb()
     await mintSession(db, 'alice', 'sess-1', 1_000_000, PC)
-    expect(await resolveSession(db, 'sess-1', 1_000_000)).toEqual({ ownerId: 'alice' })
+    expect(await resolveSession(db, 'sess-1', 1_000_000)).toEqual({ ownerId: 'alice', accountId: '' })
 
     peopleRows[0].hash = 'HASH-v2-rotated0' // operator re-runs enrolment
 

package/payload/platform/plugins/cloudflare/mcp/__tests__/d1-http.test.ts

@@ -0,0 +1,96 @@
+import { describe, it, expect } from 'vitest'
+import { createD1Client } from '../../bin/d1-http.mjs'
+
+type Init = { method?: string; body?: string; headers?: Record<string, string> }
+type Call = { url: string; init: Init }
+
+function fakeFetch(calls: Call[], rows: unknown[] = []) {
+  return async (url: string, init: Init) => {
+    calls.push({ url, init })
+    if (url.includes('?name=')) {
+      return { ok: true, status: 200, json: async () => ({ result: [{ name: 'portal-db', uuid: 'db-uuid' }] }) }
+    }
+    return { ok: true, status: 200, json: async () => ({ result: [{ results: rows }] }) }
+  }
+}
+
+const opts = (fetchFn: unknown) => ({
+  accountId: 'acc',
+  token: 't',
+  dbName: 'portal-db',
+  fetchFn: fetchFn as never,
+})
+
+describe('createD1Client', () => {
+  it('resolves the database by exact name then queries by uuid', async () => {
+    const calls: Call[] = []
+    const c = createD1Client(opts(fakeFetch(calls)))
+    await c.query('SELECT 1')
+    expect(calls[0].url).toContain('/accounts/acc/d1/database?name=portal-db')
+    expect(calls[1].url).toContain('/d1/database/db-uuid/query')
+    expect(calls[1].init.headers?.Authorization).toBe('Bearer t')
+  })
+
+  it('sends values as params, never interpolated into sql', async () => {
+    const calls: Call[] = []
+    const c = createD1Client(opts(fakeFetch(calls)))
+    await c.query('INSERT INTO directory (relPath) VALUES (?)', ["o'brien.pdf"])
+    const body = JSON.parse(calls[1].init.body ?? '{}')
+    expect(body.sql).toBe('INSERT INTO directory (relPath) VALUES (?)')
+    expect(body.params).toEqual(["o'brien.pdf"])
+  })
+
+  it('returns the rows of the first result', async () => {
+    const c = createD1Client(opts(fakeFetch([], [{ n: 3 }])))
+    expect(await c.query('SELECT COUNT(*) AS n FROM directory')).toEqual([{ n: 3 }])
+  })
+
+  it('caches the name lookup across statements', async () => {
+    const calls: Call[] = []
+    const c = createD1Client(opts(fakeFetch(calls)))
+    await c.query('SELECT 1')
+    await c.query('SELECT 2')
+    expect(calls.filter((x) => x.url.includes('?name=')).length).toBe(1)
+    expect(c.statements).toBe(2)
+  })
+
+  it('throws carrying the response body when the api fails', async () => {
+    // Never discard an error body: a bare status turns every failure into the
+    // same unactionable line.
+    const fetchFn = async () => ({
+      ok: false,
+      status: 403,
+      json: async () => ({ errors: [{ message: 'insufficient permissions' }] }),
+    })
+    const c = createD1Client(opts(fetchFn))
+    await expect(c.query('SELECT 1')).rejects.toThrow(/403.*insufficient permissions/)
+  })
+
+  it('refuses a database whose name only nearly matches', async () => {
+    // `?name=` is a filter whose matching rule is not documented, so taking the
+    // first result on trust could run this account's statements against a
+    // near-named database.
+    const fetchFn = async (url: string) => ({
+      ok: true,
+      status: 200,
+      json: async () =>
+        url.includes('?name=') ? { result: [{ name: 'portal-db-old', uuid: 'x' }] } : { result: [] },
+    })
+    const c = createD1Client(opts(fetchFn))
+    await expect(c.query('SELECT 1')).rejects.toThrow(/no D1 database named/)
+  })
+
+  it('counts a statement that was issued and then errored', async () => {
+    let n = 0
+    const fetchFn = async (url: string) => {
+      n++
+      if (url.includes('?name=')) {
+        return { ok: true, status: 200, json: async () => ({ result: [{ name: 'portal-db', uuid: 'u' }] }) }
+      }
+      return { ok: false, status: 500, json: async () => ({ errors: [{ message: 'boom' }] }) }
+    }
+    const c = createD1Client(opts(fetchFn))
+    await expect(c.query('SELECT 1')).rejects.toThrow()
+    expect(c.statements).toBe(1)
+  })
+})