spice-js 2.7.31 → 2.7.33

package/build/models/SpiceModel.js

@@ -32,7 +32,8 @@ var SDate = require("sonover-date"),
   _mapping_concurrency = Symbol(),
   _skip_mapped_serialization = Symbol(),
   _mapping_dept_exempt = Symbol(),
-  _current_path = Symbol();
+  _current_path = Symbol(),
+  _failed_json_fields = Symbol();
 var GLOBAL_MAPPING_CONCURRENCY = Math.max(1, Number(process.env.SPICE_MAPPING_GLOBAL_CONCURRENCY) || 32);
 var activeGlobalMappings = 0;
 var globalMappingWaiters = [];
@@ -71,7 +72,7 @@ function _acquireGlobalMappingSlot() {
 }
 function runWithConcurrency(_x, _x2, _x3) {
   return _runWithConcurrency.apply(this, arguments);
-} //const _type = Symbol("type");
+}
 function _runWithConcurrency() {
   _runWithConcurrency = _asyncToGenerator(function* (items, concurrency, worker) {
     var results = new Array(items.length);
@@ -97,6 +98,19 @@ function _runWithConcurrency() {
   });
   return _runWithConcurrency.apply(this, arguments);
 }
+var JSON_PARSE_FAILED = Symbol("json_parse_failed");
+function safeParseJsonField(value, fieldName, modelType) {
+  if (value == null || value === "") return undefined;
+  try {
+    return JSON.parse(value);
+  } catch (e) {
+    console.warn("SpiceModel(" + modelType + "): failed to parse field \"" + fieldName + "\" as JSON: " + e.message);
+    return JSON_PARSE_FAILED;
+  }
+}
+
+//const _type = Symbol("type");
+
 var that;
 if (!Promise.allSettled) {
   Promise.allSettled = promises => Promise.all(promises.map((promise, i) => promise.then(value => ({
@@ -135,6 +149,7 @@ class SpiceModel {
       this[_skip_cache] = ((_args4 = args) == null ? void 0 : (_args4$args = _args4.args) == null ? void 0 : _args4$args.skip_cache) || false;
       this[_level] = ((_args5 = args) == null ? void 0 : (_args5$args = _args5.args) == null ? void 0 : _args5$args._level) || 0;
       this[_current_path] = ((_args6 = args) == null ? void 0 : (_args6$args = _args6.args) == null ? void 0 : _args6$args._current_path) || "";
+      this[_failed_json_fields] = [];
       this[_columns] = ((_args7 = args) == null ? void 0 : (_args7$args = _args7.args) == null ? void 0 : _args7$args._columns) || "";
       this[_hooks] = {
         create: {
@@ -258,13 +273,33 @@ class SpiceModel {
               case Array:
               case "array":
                 {
-                  this[i] = _.isArray(args.args[i]) ? args.args[i] : JSON.parse(args.args[i]);
+                  if (_.isArray(args.args[i])) {
+                    this[i] = args.args[i];
+                  } else {
+                    var parsed = safeParseJsonField(args.args[i], i, args.collection || this.type);
+                    if (parsed === JSON_PARSE_FAILED) {
+                      this[_failed_json_fields].push(i);
+                      this[i] = [];
+                    } else if (parsed !== undefined) {
+                      this[i] = parsed;
+                    }
+                  }
                   break;
                 }
               case Object:
               case "object":
                 {
-                  this[i] = _.isObject(args.args[i]) ? args.args[i] : JSON.parse(args.args[i]);
+                  if (_.isObject(args.args[i])) {
+                    this[i] = args.args[i];
+                  } else {
+                    var _parsed = safeParseJsonField(args.args[i], i, args.collection || this.type);
+                    if (_parsed === JSON_PARSE_FAILED) {
+                      this[_failed_json_fields].push(i);
+                      this[i] = {};
+                    } else if (_parsed !== undefined) {
+                      this[i] = _parsed;
+                    }
+                  }
                   break;
                 }
               default:
@@ -712,17 +747,44 @@ class SpiceModel {
       }
     })();
   }
-  query(query, scope) {
+  query(query, scope, options) {
     var _this5 = this;
     return _asyncToGenerator(function* () {
       try {
-        var results = yield _this5.database.query(query, scope);
+        var results = yield _this5.database.query(query, scope, options);
         return results;
       } catch (error) {
         throw error;
       }
     })();
   }
+  getQueryOptions(args) {
+    if (args === void 0) {
+      args = {};
+    }
+    var scanConsistency = args.scan_consistency;
+
+    // Backward compatibility for callers that already use statement_consistent.
+    // The adapter accepts the SDK-style value as well as these snake_case keys.
+    if (scanConsistency === undefined && args.statement_consistent !== undefined) {
+      var legacyValue = args.statement_consistent;
+      var isRequestPlus = legacyValue === true || typeof legacyValue === "string" && ["true", "request_plus"].includes(legacyValue.toLowerCase());
+      scanConsistency = isRequestPlus ? "request_plus" : "not_bounded";
+    }
+    return {
+      scan_consistency: scanConsistency,
+      consistent_with: args.consistent_with,
+      scan_wait: args.scan_wait
+    };
+  }
+  requiresFreshQuery(args) {
+    if (args === void 0) {
+      args = {};
+    }
+    var options = this.getQueryOptions(args);
+    var scanConsistency = options.scan_consistency;
+    return options.consistent_with !== undefined || scanConsistency === true || typeof scanConsistency === "string" && ["true", "request_plus"].includes(scanConsistency.toLowerCase());
+  }
   getMulti(args) {
     var _this6 = this;
     return _asyncToGenerator(function* () {
@@ -821,6 +883,21 @@ class SpiceModel {
       }
     })();
   }
+  get failedJsonFields() {
+    return this[_failed_json_fields] || [];
+  }
+
+  // Refuse writes when a schema-typed object/array field contained invalid
+  // JSON, so a parse fallback can never overwrite valid stored data.
+  assertNoFailedJsonFields(operation) {
+    var failed = this[_failed_json_fields] || [];
+    if (failed.length > 0) {
+      var err = new Error(this.type + ": cannot " + operation + " because field(s) [" + failed.join(", ") + "] contained invalid JSON. Stored data was left untouched.");
+      err.status = 400;
+      err.failed_json_fields = [...failed];
+      throw err;
+    }
+  }
   update(args) {
     var _this8 = this;
     return _asyncToGenerator(function* () {
@@ -829,6 +906,7 @@ class SpiceModel {
       var p = (_this8$_ctx = _this8[_ctx]) == null ? void 0 : _this8$_ctx.profiler;
       var doUpdate = /*#__PURE__*/function () {
         var _ref1 = _asyncToGenerator(function* () {
+          _this8.assertNoFailedJsonFields("update");
           _this8.updated_at = new SDate().now();
           var results = yield _this8.database.get(args.id);
           var item_exist = yield _this8.exist(results);
@@ -899,6 +977,7 @@ class SpiceModel {
       var p = (_this9$_ctx = _this9[_ctx]) == null ? void 0 : _this9$_ctx.profiler;
       var doCreate = /*#__PURE__*/function () {
         var _ref11 = _asyncToGenerator(function* () {
+          _this9.assertNoFailedJsonFields("create");
           var form;
           _this9.created_at = new SDate().now();
           args = _.defaults(args, {
@@ -1409,9 +1488,9 @@ class SpiceModel {
           if (args.skip_hooks !== true) {
             yield _this10.run_hook(_this10, "list", "before");
           }
-          var cacheKey = "list::" + _this10.type + "::" + args._join + "::" + query + "::" + args.limit + "::" + args.offset + "::" + args.sort + "::" + args.do_count + "::" + args.statement_consistent + "::" + args.columns + "::" + args.is_full_text + "::" + args.is_custom_query;
+          var cacheKey = "list::" + _this10.type + "::" + args._join + "::" + query + "::" + args.limit + "::" + args.offset + "::" + args.sort + "::" + args.do_count + "::" + args.query_scope + "::" + args.scan_consistency + "::" + args.statement_consistent + "::" + args.scan_wait + "::" + args.columns + "::" + args.is_full_text + "::" + args.is_custom_query;
           var results;
-          if (_this10.shouldUseCache(_this10.type)) {
+          if (_this10.shouldUseCache(_this10.type) && !_this10.requiresFreshQuery(args)) {
             var cached = yield _this10.getCacheProviderObject(_this10.type).get(cacheKey);
             results = cached == null ? void 0 : cached.value;
             var isEmpty = (cached == null ? void 0 : cached.value) === undefined;
@@ -1494,14 +1573,15 @@ class SpiceModel {
       var p = (_this11$_ctx = _this11[_ctx]) == null ? void 0 : _this11$_ctx.profiler;
       var doFetch = /*#__PURE__*/function () {
         var _ref17 = _asyncToGenerator(function* () {
+          var queryOptions = _this11.getQueryOptions(args);
           if (args.is_custom_query === "true" && args.ids.length > 0) {
             console.log("Fetching results from database", _this11.type, args, query, mappedNestings);
-            return yield _this11.database.query(query);
+            return yield _this11.database.query(query, args.query_scope, queryOptions);
           } else if (args.is_full_text === "true") {
             return yield _this11.database.full_text_search(_this11.type, query || "", args.limit, args.offset, args._join);
           } else {
             var correctedColumns = _this11.correctColumns(args.columns, mappedNestings);
-            var result = yield _this11.database.search(_this11.type, correctedColumns || args.columns || "", query || "", args.limit, args.offset, args.sort, args.do_count, args.statement_consistent, args._join);
+            var result = yield _this11.database.search(_this11.type, correctedColumns || args.columns || "", query || "", args.limit, args.offset, args.sort, args.do_count, args.query_scope, args._join, queryOptions);
             return result;
           }
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spice-js",
-  "version": "2.7.31",
+  "version": "2.7.33",
   "description": "spice",
   "main": "build/index.js",
   "repository": {

package/src/models/SpiceModel.js

@@ -27,7 +27,8 @@ var SDate = require("sonover-date"),
   _mapping_concurrency = Symbol(),
   _skip_mapped_serialization = Symbol(),
   _mapping_dept_exempt = Symbol(),
-  _current_path = Symbol();
+  _current_path = Symbol(),
+  _failed_json_fields = Symbol();
 
 const GLOBAL_MAPPING_CONCURRENCY = Math.max(
   1,
@@ -82,6 +83,20 @@ async function runWithConcurrency(items, concurrency, worker) {
   return results;
 }
 
+const JSON_PARSE_FAILED = Symbol("json_parse_failed");
+
+function safeParseJsonField(value, fieldName, modelType) {
+  if (value == null || value === "") return undefined;
+  try {
+    return JSON.parse(value);
+  } catch (e) {
+    console.warn(
+      `SpiceModel(${modelType}): failed to parse field "${fieldName}" as JSON: ${e.message}`,
+    );
+    return JSON_PARSE_FAILED;
+  }
+}
+
 //const _type = Symbol("type");
 
 let that;
@@ -144,6 +159,7 @@ export default class SpiceModel {
       this[_skip_cache] = args?.args?.skip_cache || false;
       this[_level] = args?.args?._level || 0;
       this[_current_path] = args?.args?._current_path || "";
+      this[_failed_json_fields] = [];
       this[_columns] = args?.args?._columns || "";
       this[_hooks] = {
         create: {
@@ -289,18 +305,40 @@ export default class SpiceModel {
               }
               case Array:
               case "array": {
-                this[i] =
-                  _.isArray(args.args[i]) ?
-                    args.args[i]
-                  : JSON.parse(args.args[i]);
+                if (_.isArray(args.args[i])) {
+                  this[i] = args.args[i];
+                } else {
+                  const parsed = safeParseJsonField(
+                    args.args[i],
+                    i,
+                    args.collection || this.type,
+                  );
+                  if (parsed === JSON_PARSE_FAILED) {
+                    this[_failed_json_fields].push(i);
+                    this[i] = [];
+                  } else if (parsed !== undefined) {
+                    this[i] = parsed;
+                  }
+                }
                 break;
               }
               case Object:
               case "object": {
-                this[i] =
-                  _.isObject(args.args[i]) ?
-                    args.args[i]
-                  : JSON.parse(args.args[i]);
+                if (_.isObject(args.args[i])) {
+                  this[i] = args.args[i];
+                } else {
+                  const parsed = safeParseJsonField(
+                    args.args[i],
+                    i,
+                    args.collection || this.type,
+                  );
+                  if (parsed === JSON_PARSE_FAILED) {
+                    this[_failed_json_fields].push(i);
+                    this[i] = {};
+                  } else if (parsed !== undefined) {
+                    this[i] = parsed;
+                  }
+                }
                 break;
               }
               default: {
@@ -783,15 +821,47 @@ export default class SpiceModel {
     }
   }
 
-  async query(query, scope) {
+  async query(query, scope, options) {
     try {
-      let results = await this.database.query(query, scope);
+      let results = await this.database.query(query, scope, options);
       return results;
     } catch (error) {
       throw error;
     }
   }
 
+  getQueryOptions(args = {}) {
+    let scanConsistency = args.scan_consistency;
+
+    // Backward compatibility for callers that already use statement_consistent.
+    // The adapter accepts the SDK-style value as well as these snake_case keys.
+    if (scanConsistency === undefined && args.statement_consistent !== undefined) {
+      const legacyValue = args.statement_consistent;
+      const isRequestPlus =
+        legacyValue === true ||
+        (typeof legacyValue === "string" &&
+          ["true", "request_plus"].includes(legacyValue.toLowerCase()));
+      scanConsistency = isRequestPlus ? "request_plus" : "not_bounded";
+    }
+
+    return {
+      scan_consistency: scanConsistency,
+      consistent_with: args.consistent_with,
+      scan_wait: args.scan_wait,
+    };
+  }
+
+  requiresFreshQuery(args = {}) {
+    const options = this.getQueryOptions(args);
+    const scanConsistency = options.scan_consistency;
+    return (
+      options.consistent_with !== undefined ||
+      scanConsistency === true ||
+      (typeof scanConsistency === "string" &&
+        ["true", "request_plus"].includes(scanConsistency.toLowerCase()))
+    );
+  }
+
   async getMulti(args) {
     // ⚡ Profiling: use track() for proper async context forking
     const p = this[_ctx]?.profiler;
@@ -909,11 +979,32 @@ export default class SpiceModel {
     }
   }
 
+  get failedJsonFields() {
+    return this[_failed_json_fields] || [];
+  }
+
+  // Refuse writes when a schema-typed object/array field contained invalid
+  // JSON, so a parse fallback can never overwrite valid stored data.
+  assertNoFailedJsonFields(operation) {
+    const failed = this[_failed_json_fields] || [];
+    if (failed.length > 0) {
+      const err = new Error(
+        `${this.type}: cannot ${operation} because field(s) [${failed.join(
+          ", ",
+        )}] contained invalid JSON. Stored data was left untouched.`,
+      );
+      err.status = 400;
+      err.failed_json_fields = [...failed];
+      throw err;
+    }
+  }
+
   async update(args) {
     // Profiling: use track() for proper async context forking
     const p = this[_ctx]?.profiler;
 
     const doUpdate = async () => {
+      this.assertNoFailedJsonFields("update");
       this.updated_at = new SDate().now();
       let results = await this.database.get(args.id);
       let item_exist = await this.exist(results);
@@ -993,6 +1084,7 @@ export default class SpiceModel {
     const p = this[_ctx]?.profiler;
 
     const doCreate = async () => {
+      this.assertNoFailedJsonFields("create");
       let form;
       this.created_at = new SDate().now();
       args = _.defaults(args, { id_prefix: this.type });
@@ -1569,10 +1661,10 @@ export default class SpiceModel {
         await this.run_hook(this, "list", "before");
       }
 
-      const cacheKey = `list::${this.type}::${args._join}::${query}::${args.limit}::${args.offset}::${args.sort}::${args.do_count}::${args.statement_consistent}::${args.columns}::${args.is_full_text}::${args.is_custom_query}`;
+      const cacheKey = `list::${this.type}::${args._join}::${query}::${args.limit}::${args.offset}::${args.sort}::${args.do_count}::${args.query_scope}::${args.scan_consistency}::${args.statement_consistent}::${args.scan_wait}::${args.columns}::${args.is_full_text}::${args.is_custom_query}`;
       let results;
 
-      if (this.shouldUseCache(this.type)) {
+      if (this.shouldUseCache(this.type) && !this.requiresFreshQuery(args)) {
         const cached = await this.getCacheProviderObject(this.type).get(
           cacheKey,
         );
@@ -1671,6 +1763,7 @@ export default class SpiceModel {
     const p = this[_ctx]?.profiler;
 
     const doFetch = async () => {
+      const queryOptions = this.getQueryOptions(args);
       if (args.is_custom_query === "true" && args.ids.length > 0) {
         console.log(
           "Fetching results from database",
@@ -1679,7 +1772,7 @@ export default class SpiceModel {
           query,
           mappedNestings,
         );
-        return await this.database.query(query);
+        return await this.database.query(query, args.query_scope, queryOptions);
       } else if (args.is_full_text === "true") {
         return await this.database.full_text_search(
           this.type,
@@ -1701,8 +1794,9 @@ export default class SpiceModel {
           args.offset,
           args.sort,
           args.do_count,
-          args.statement_consistent,
+          args.query_scope,
           args._join,
+          queryOptions,
         );
         return result;
       }

package/tests/__mocks__/spice-couchbase.js

@@ -44,6 +44,18 @@ class MockDatabase {
     return updated;
   }
 
+  /**
+   * Mock insert operation
+   * @param {string} id - Document ID
+   * @param {Object} data - Document data
+   * @returns {Promise<Object>} Inserted document
+   */
+  async insert(id, data, ttl) {
+    const inserted = { ...data, id };
+    this.mockData.set(id, inserted);
+    return inserted;
+  }
+
   /**
    * Seed mock database with test data
    * @param {string} id - Document ID

package/tests/models/SpiceModel.query-consistency.test.js

@@ -0,0 +1,114 @@
+const { createTestModel } = require("../helpers/modelFactory");
+
+describe("SpiceModel query consistency", () => {
+  test("keeps query scope separate from query consistency", async () => {
+    const model = createTestModel({ type: "application" });
+    model.database.search = jest.fn(async () => ({ data: [], total: null }));
+
+    await model.fetchResults(
+      {
+        ids: [],
+        query_scope: "cluster",
+        scan_consistency: "request_plus",
+        scan_wait: 2500,
+        _join: "",
+      },
+      "",
+      [],
+    );
+
+    expect(model.database.search).toHaveBeenCalledWith(
+      "application",
+      "",
+      "",
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      "cluster",
+      "",
+      {
+        scan_consistency: "request_plus",
+        consistent_with: undefined,
+        scan_wait: 2500,
+      },
+    );
+  });
+
+  test.each([true, "true", "request_plus"])(
+    "maps legacy statement_consistent=%s to request_plus",
+    (legacyValue) => {
+      const model = createTestModel({ type: "application" });
+
+      expect(
+        model.getQueryOptions({ statement_consistent: legacyValue }),
+      ).toEqual(
+        expect.objectContaining({ scan_consistency: "request_plus" }),
+      );
+    },
+  );
+
+  test.each([false, "false"])(
+    "maps legacy statement_consistent=%s to not_bounded",
+    (legacyValue) => {
+      const model = createTestModel({ type: "application" });
+
+      expect(
+        model.getQueryOptions({ statement_consistent: legacyValue }),
+      ).toEqual(
+        expect.objectContaining({ scan_consistency: "not_bounded" }),
+      );
+    },
+  );
+
+  test("explicit scan_consistency takes precedence over the legacy flag", () => {
+    const model = createTestModel({ type: "application" });
+
+    expect(
+      model.getQueryOptions({
+        scan_consistency: "not_bounded",
+        statement_consistent: true,
+      }),
+    ).toEqual(expect.objectContaining({ scan_consistency: "not_bounded" }));
+  });
+
+  test("strongly consistent reads bypass the model query cache", () => {
+    const model = createTestModel({ type: "application" });
+
+    expect(model.requiresFreshQuery({ scan_consistency: "request_plus" })).toBe(
+      true,
+    );
+    expect(model.requiresFreshQuery({ statement_consistent: true })).toBe(true);
+    expect(model.requiresFreshQuery({ consistent_with: {} })).toBe(true);
+    expect(model.requiresFreshQuery({ scan_consistency: "not_bounded" })).toBe(
+      false,
+    );
+  });
+
+  test("custom queries receive the same query options", async () => {
+    const model = createTestModel({ type: "application" });
+    model.database.query = jest.fn(async () => ({ rows: [] }));
+    const mutationState = { token: "test-token" };
+
+    await model.fetchResults(
+      {
+        ids: ["application-1"],
+        is_custom_query: "true",
+        query_scope: "scope",
+        consistent_with: mutationState,
+      },
+      "SELECT 1",
+      [],
+    );
+
+    expect(model.database.query).toHaveBeenCalledWith(
+      "SELECT 1",
+      "scope",
+      {
+        scan_consistency: undefined,
+        consistent_with: mutationState,
+        scan_wait: undefined,
+      },
+    );
+  });
+});

package/tests/models/SpiceModel.test.js

@@ -631,3 +631,255 @@ describe('SpiceModel - Critical Fixes for Empty/Null Values', () => {
     });
   });
 });
+
+describe('SpiceModel - Constructor JSON parse resilience', () => {
+  let warnSpy;
+
+  beforeEach(() => {
+    warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  test('should fall back to {} for HTML in object-typed field and finish init', () => {
+    const modifiersSpy = jest.spyOn(
+      SpiceModel.prototype,
+      'createModifiersFromProps'
+    );
+
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        name: { type: String },
+        metadata: { type: Object },
+        title: { type: String },
+      },
+      args: {
+        name: 'App One',
+        metadata: '<p style="color:red">broken</p>',
+        title: 'Still set',
+      },
+    });
+
+    expect(model.metadata).toEqual({});
+    expect(model.name).toBe('App One');
+    expect(model.title).toBe('Still set');
+    expect(modifiersSpy).toHaveBeenCalled();
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining('failed to parse field "metadata"')
+    );
+
+    modifiersSpy.mockRestore();
+  });
+
+  test('should fall back to [] for invalid JSON in array-typed field', () => {
+    const model = createTestModel({
+      type: 'addition',
+      props: {
+        name: { type: String },
+        tags: { type: Array },
+      },
+      args: {
+        name: 'Addition One',
+        tags: '<p style="">not json</p>',
+      },
+    });
+
+    expect(model.tags).toEqual([]);
+    expect(model.name).toBe('Addition One');
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining('failed to parse field "tags"')
+    );
+  });
+
+  test('should parse valid JSON strings for object and array fields', () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+        tags: { type: Array },
+      },
+      args: {
+        metadata: '{"foo":"bar"}',
+        tags: '["a","b"]',
+      },
+    });
+
+    expect(model.metadata).toEqual({ foo: 'bar' });
+    expect(model.tags).toEqual(['a', 'b']);
+    expect(warnSpy).not.toHaveBeenCalledWith(
+      expect.stringContaining('failed to parse field')
+    );
+  });
+
+  test('should pass through already-parsed object and array values', () => {
+    const metadata = { foo: 'bar' };
+    const tags = ['a', 'b'];
+
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+        tags: { type: Array },
+      },
+      args: {
+        metadata,
+        tags,
+      },
+    });
+
+    expect(model.metadata).toBe(metadata);
+    expect(model.tags).toBe(tags);
+  });
+
+  test('should track failed fields on the model', () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+        tags: { type: Array },
+      },
+      args: {
+        metadata: '<p>bad</p>',
+        tags: 'also bad',
+      },
+    });
+
+    expect(model.failedJsonFields.sort()).toEqual(['metadata', 'tags']);
+  });
+
+  test('should have no failed fields when all values parse', () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+      },
+      args: {
+        metadata: '{"foo":"bar"}',
+      },
+    });
+
+    expect(model.failedJsonFields).toEqual([]);
+  });
+});
+
+describe('SpiceModel - Write protection for failed JSON fields', () => {
+  let warnSpy;
+
+  beforeEach(() => {
+    warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  test('update should reject and preserve stored data when a field failed to parse', async () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        name: { type: String },
+        metadata: { type: Object },
+      },
+      args: {
+        name: 'Updated Name',
+        metadata: '<p style="color:red">broken html</p>',
+        skip_serialize: true,
+        skip_hooks: true,
+      },
+    });
+
+    const storedDoc = {
+      id: 'application-1',
+      name: 'Original Name',
+      metadata: { important: 'data' },
+    };
+    seedDatabase(model, storedDoc);
+    jest.spyOn(model.database, 'update');
+
+    await expect(
+      model.update({ id: 'application-1', skip_serialize: true, skip_hooks: true })
+    ).rejects.toThrow(/cannot update.*metadata.*invalid JSON/);
+
+    // No write must reach the database; stored data stays intact
+    expect(model.database.update).not.toHaveBeenCalled();
+    const stored = await model.database.get('application-1');
+    expect(stored.metadata).toEqual({ important: 'data' });
+  });
+
+  test('update rejection should carry status 400 and the failed field names', async () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+      },
+      args: {
+        metadata: 'not json at all',
+        skip_serialize: true,
+        skip_hooks: true,
+      },
+    });
+    seedDatabase(model, { id: 'application-1', metadata: { keep: true } });
+
+    let caught;
+    try {
+      await model.update({ id: 'application-1', skip_serialize: true, skip_hooks: true });
+    } catch (e) {
+      caught = e;
+    }
+
+    expect(caught).toBeDefined();
+    expect(caught.status).toBe(400);
+    expect(caught.failed_json_fields).toEqual(['metadata']);
+  });
+
+  test('create should reject when a field failed to parse', async () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+      },
+      args: {
+        metadata: '<div>nope</div>',
+        skip_serialize: true,
+        skip_hooks: true,
+      },
+    });
+    jest.spyOn(model.database, 'insert');
+
+    await expect(
+      model.create({ skip_serialize: true, skip_hooks: true })
+    ).rejects.toThrow(/cannot create.*metadata.*invalid JSON/);
+    expect(model.database.insert).not.toHaveBeenCalled();
+  });
+
+  test('update should proceed normally when all fields parsed', async () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        name: { type: String },
+        metadata: { type: Object },
+      },
+      args: {
+        name: 'New Name',
+        metadata: '{"valid":"json"}',
+        skip_serialize: true,
+        skip_hooks: true,
+      },
+    });
+    seedDatabase(model, { id: 'application-1', name: 'Old', metadata: {} });
+    // setMonitor needs the real cache global, which test mocks don't provide
+    jest.spyOn(model, 'setMonitor').mockImplementation(() => {});
+
+    const result = await model.update({
+      id: 'application-1',
+      skip_serialize: true,
+      skip_hooks: true,
+    });
+
+    expect(result.name).toBe('New Name');
+    expect(result.metadata).toEqual({ valid: 'json' });
+  });
+});