tina4-nodejs 3.13.97 → 3.13.99

package/packages/cli/src/bin.ts

@@ -11,7 +11,7 @@ import { runSeeds } from "./commands/seed.js";
 import { runMetrics } from "./commands/metrics.js";
 import { queueCommand, QUEUE_SUBCOMMAND_NAMES } from "./commands/queue.js";
 import { buildImage } from "./commands/build.js";
-import { execSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { delimiter, dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -43,81 +43,34 @@ function readCliVersion(): string {
   return "0.0.0";
 }
 
-// ── Port-kill helper ────────────────────────────────────────────────
-
-/**
- * Whether this process is running inside a container.
- *
- * Reclaiming a port makes sense on a dev machine, where a previous serve may
- * still hold it. Inside a container the server IS the container, so there is no
- * stale sibling to reclaim from -- and trying is dangerous (see below).
- */
-function inContainer(): boolean {
-  if (existsSync("/.dockerenv") || existsSync("/run/.containerenv")) return true;
-  try {
-    const blob = readFileSync("/proc/1/cgroup", "utf-8");
-    return blob.includes("docker") || blob.includes("containerd") || blob.includes("kubepods");
-  } catch {
-    return false;
-  }
-}
+// ── Port-takeover helper ────────────────────────────────────────────
+//
+// The identity check, PID safety filter, container guard, dev gate and opt-out
+// all live in ONE shared module (@tina4/core portTakeover) so this CLI path and
+// the runtime bind-failure fallback in core/server.ts cannot diverge
+// (TAKEOVER-DEC-02). Loaded lazily (mirroring how serve.ts pulls in core) so a
+// quick `tina4nodejs --help` never pays to import it.
 
 /**
- * Kill any process listening on `port`. Returns true if anything was killed.
- *
- * Every PID is validated first. `parseInt` on a non-numeric lsof field yields
- * 1, and SIGTERM to PID 1 is the container's own init -- which is exactly how a
- * production container logged "Killed existing process on port 7148 (PID: 1
- * ...)" and then exited 143, killing itself on startup.
- */
-/**
- * The PIDs from `lsof -ti` output that are safe to signal.
+ * Reclaim `port` from a stale Tina4 dev server, only when it is safe.
  *
- * Pure so the safety rule can be tested directly. An unvalidated parse is a
- * footgun with real teeth: where lsof prints a different shape than -ti
- * implies, a non-numeric field becomes 0, and signalling PID 0 hits EVERY
- * process in the caller's own process group -- the server kills itself. That
- * is what produced "Killed existing process on port 7148 (PID: 1 ...)" in a
- * real image, where the container then exited 143.
+ * Signals a holder ONLY when a Tina4 dev server recorded its PID in the per-port
+ * PID file (TAKEOVER-DEC-01). A foreign holder is left running and a clear
+ * message is printed; takeover is also skipped in a container, outside dev mode,
+ * and when opted out (`TINA4_NO_TAKEOVER` / `tina4 serve --no-kill`).
  *
- * Accepts only all-digit tokens; never PID 0 (our group), PID 1 (init),
- * ourselves, or our own process group.
+ * Returns true only when a Tina4 holder was actually signalled.
  */
-export function selectablePids(lsofOutput: string, me: number, myGroup?: number): number[] {
-  const pids: number[] = [];
-  for (const token of lsofOutput.split(/\s+/)) {
-    if (!/^\d+$/.test(token)) continue;   // never coerce junk into a PID
-    const pid = Number(token);
-    if (pid <= 1 || pid === me) continue;  // 0 = our group, 1 = init, me = suicide
-    if (myGroup !== undefined && pid === myGroup) continue;
-    if (!pids.includes(pid)) pids.push(pid);
-  }
-  return pids;
-}
-
-function killProcessOnPort(port: number): boolean {
-  if (inContainer()) return false;
-  try {
-    const result = execSync(`lsof -ti :${port}`, { encoding: "utf-8", timeout: 5000 }).trim();
-    if (!result) return false;
-
-    const killed: string[] = [];
-    // Node core exposes no getpgrp(), so myGroup stays unset here. The pid <= 1
-    // guard already covers the dangerous case (a junk field coercing to 0);
-    // Python and Ruby pass their real process group in addition.
-    for (const pid of selectablePids(result, process.pid)) {
-      try {
-        process.kill(pid, "SIGTERM");
-        killed.push(String(pid));
-      } catch {
-        // ignore ProcessLookupError / PermissionError
-      }
-    }
-    if (killed.length === 0) return false;
-    console.log(`  Killed existing process on port ${port} (PID: ${killed.join(", ")})`);
+async function killProcessOnPort(port: number): Promise<boolean> {
+  const { takeOverPort, isDev, noTakeoverOptedOut, TAKEOVER_KILLED, TAKEOVER_REFUSALS } =
+    await import("../../core/src/portTakeover.js");
+  const result = takeOverPort(port, isDev(), noTakeoverOptedOut());
+  if (result.status === TAKEOVER_KILLED) {
+    console.log(`  ${result.message}`);
     return true;
-  } catch {
-    // lsof not found or no process on port — that's fine
+  }
+  if (result.message && TAKEOVER_REFUSALS.includes(result.status)) {
+    console.log(`  ${result.message}`);
   }
   return false;
 }
@@ -352,7 +305,11 @@ export const COMMANDS: Record<string, CommandSpec> = {
       const port = portIndex !== -1 ? parseInt(a[portIndex + 1], 10) : 7148;
       const noBrowser = a.includes("--no-browser");
       const noReload = a.includes("--no-reload");
-      killProcessOnPort(port);
+      // --no-kill opts out of port takeover for the whole process, so the CLI
+      // path here AND the runtime bind-failure fallback both honour it
+      // (TAKEOVER-DEC-03).
+      if (a.includes("--no-kill")) process.env.TINA4_NO_TAKEOVER = "true";
+      await killProcessOnPort(port);
       await serveProject({ port, noBrowser, noReload });
     },
     usage: "[--port P] [--no-browser] [--no-reload]",

package/packages/cli/src/commands/migrate.ts

@@ -1,15 +1,25 @@
 /**
  * CLI command: migrate — Run pending SQL migration files.
  *
- * Scans the migrations/ directory for .sql files (excluding .down.sql),
- * executes them in order, and records each as applied with a batch number.
+ * MIG-NODE-CLI-DIVERGENT (feature 15, MIG-DEC-01): this used to be a SECOND,
+ * weaker migration implementation -- a naive `sql.split(";")` (breaks on a
+ * `;` inside a string/comment/proc block), no per-file transaction (a
+ * mid-file failure left earlier statements applied on every engine
+ * including PostgreSQL, with no rollback), no Firebird/MSSQL idempotency
+ * skips, and the ledger row recorded OUTSIDE any transaction. All untested.
+ *
+ * It now delegates to the SAME `migrate()` the ORM's programmatic API uses
+ * (`packages/orm/src/migration.ts`) -- ONE code path, so the CLI gets the
+ * transactional, robust-split, idempotent behaviour for free. The weaker
+ * re-implementation is deleted, not kept alongside (maintainability = less
+ * code).
  *
  * Supports both naming patterns:
  *   - Sequential: 000001_name.sql
  *   - Timestamp:  YYYYMMDDHHMMSS_name.sql
  */
-import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
 import { loadEnv } from "../../../core/src/dotenv.js";
 
 export async function runMigrations(migrationDir?: string): Promise<void> {
@@ -25,33 +35,22 @@ export async function runMigrations(migrationDir?: string): Promise<void> {
     return;
   }
 
-  // Initialise the database so the adapter is available
   let initDatabase: typeof import("../../../orm/src/index.js").initDatabase;
-  let ensureMigrationTable: typeof import("../../../orm/src/index.js").ensureMigrationTable;
-  let isMigrationApplied: typeof import("../../../orm/src/index.js").isMigrationApplied;
-  let recordMigration: typeof import("../../../orm/src/index.js").recordMigration;
-  let getNextBatch: typeof import("../../../orm/src/index.js").getNextBatch;
-  let getAdapter: typeof import("../../../orm/src/index.js").getAdapter;
-  let adapterExecute: typeof import("../../../orm/src/index.js").adapterExecute;
+  let migrate: typeof import("../../../orm/src/index.js").migrate;
 
   try {
     const orm = await import("../../../orm/src/index.js");
     initDatabase = orm.initDatabase;
-    ensureMigrationTable = orm.ensureMigrationTable;
-    isMigrationApplied = orm.isMigrationApplied;
-    recordMigration = orm.recordMigration;
-    getNextBatch = orm.getNextBatch;
-    getAdapter = orm.getAdapter;
-    adapterExecute = orm.adapterExecute;
+    migrate = orm.migrate;
   } catch {
     console.error("  Error: @tina4/orm is required to run migrations.");
     process.exit(1);
   }
 
-  // Ensure database is initialised (uses TINA4_DATABASE_URL/DATABASE_URL or
-  // defaults to sqlite). initDatabase() is async — MUST be awaited, otherwise
-  // setAdapter() has not run by the time ensureMigrationTable() asks for the
-  // adapter and the whole CLI crashes with "No database adapter configured."
+  // Initialise the database so the adapter is available. initDatabase() is
+  // async — MUST be awaited, otherwise setAdapter() has not run by the time
+  // migrate() asks for the adapter and the whole CLI crashes with
+  // "No database adapter configured."
   try {
     await initDatabase();
   } catch (err) {
@@ -59,64 +58,26 @@ export async function runMigrations(migrationDir?: string): Promise<void> {
     process.exit(1);
   }
 
-  await ensureMigrationTable();
-
-  // Collect .sql files, excluding .down.sql, sorted by numeric prefix
-  const files = readdirSync(dir)
-    .filter((f) => f.endsWith(".sql") && !f.endsWith(".down.sql"))
-    .sort((a, b) => {
-      const aMatch = a.match(/^(\d+)/);
-      const bMatch = b.match(/^(\d+)/);
-      if (aMatch && bMatch) {
-        const aNum = BigInt(aMatch[1]);
-        const bNum = BigInt(bMatch[1]);
-        if (aNum < bNum) return -1;
-        if (aNum > bNum) return 1;
-      }
-      return a.localeCompare(b);
-    });
-
-  if (files.length === 0) {
-    console.log("  No .sql migration files found.");
-    return;
-  }
+  const result = await migrate(undefined, { migrationsDir: dir });
 
-  const batch = await getNextBatch();
-  let applied = 0;
-
-  for (const file of files) {
-    const name = file.replace(/\.sql$/, "");
-
-    if (await isMigrationApplied(name)) {
-      continue;
+  if (result.applied.length === 0 && result.failed.length === 0) {
+    console.log("  Nothing to migrate — all migrations already applied.");
+  } else {
+    for (const file of result.applied) {
+      console.log(`  Migrated: ${file}`);
     }
-
-    const sql = readFileSync(join(dir, file), "utf-8").trim();
-    if (!sql) continue;
-
-    console.log(`  Migrating: ${file}`);
-
-    const adapter = getAdapter();
-    // Split on semicolons and execute each statement
-    const statements = sql.split(";").map((s) => s.trim()).filter(Boolean);
-
-    for (const stmt of statements) {
-      try {
-        await adapterExecute(adapter, stmt);
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`  Error in ${file}: ${msg}`);
-        process.exit(1);
-      }
+    if (result.applied.length > 0) {
+      console.log(`  Applied ${result.applied.length} migration(s).`);
     }
-
-    await recordMigration(name, batch);
-    applied++;
   }
 
-  if (applied === 0) {
-    console.log("  Nothing to migrate — all migrations already applied.");
-  } else {
-    console.log(`  Applied ${applied} migration(s) (batch ${batch}).`);
+  if (result.failed.length > 0) {
+    // migrate() has already logged the specific statement error for each
+    // failed file (console.error + Log.error) -- fail-fast so CI/CD actually
+    // fails when a migration breaks, matching the explicit `tina4 migrate`
+    // CLI contract in every other framework (the startup auto-migrate hook
+    // is the one that swallows; this command must not).
+    console.error(`  ${result.failed.length} migration(s) failed: ${result.failed.join(", ")}`);
+    process.exit(1);
   }
 }

package/packages/cli/src/commands/migrateRollback.ts

@@ -54,7 +54,16 @@ export async function migrateRollback(migrationDir?: string): Promise<void> {
 
   console.log(`  Rolling back batch ${lastBatch[0].batch} (${lastBatch.length} migration(s))...`);
 
-  const rolledBack = await rollbackFn(dir);
+  // rollback() is fail-safe (MIG-DEC-02): a missing/failed down artifact now
+  // THROWS instead of silently dropping the tracking record, so the CLI must
+  // catch it and exit non-zero rather than let it crash with a raw stack.
+  let rolledBack: string[];
+  try {
+    rolledBack = await rollbackFn(dir);
+  } catch (err) {
+    console.error(`  Rollback failed: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
 
   if (rolledBack.length === 0) {
     console.log("  Nothing was rolled back.");

package/packages/cli/src/commands/test.ts

@@ -1,17 +1,92 @@
 /**
  * CLI command: test — Run project tests.
  *
- * Looks for test files and executes them with tsx.
- * Supports: test/integration.ts, test/*.ts, tests/*.ts, *.test.ts patterns.
+ * Two stages, and the process exits non-zero if EITHER fails:
+ *  1. Inline @tests stage (INLINE-DEC-01) — discover functions decorated with the
+ *     inline tests() builder under src/ and run them with a real exit code. Only
+ *     files that call tests() are imported, so discovery never runs an arbitrary
+ *     scanned source file's side effect (INLINE-DEC-02).
+ *  2. File-runner stage — execute test files with tsx (test/*.ts, tests/*.ts, an
+ *     explicit file arg), propagating their exit codes (python#96 parity).
  */
-import { existsSync, readdirSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { resolve, join } from "node:path";
+import { pathToFileURL } from "node:url";
 import { execSync } from "node:child_process";
 
+/** Collect every .ts/.js file under a directory, recursively. */
+function walkSource(dir: string): string[] {
+  const out: string[] = [];
+  let entries: string[];
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return out;
+  }
+  for (const name of entries) {
+    const full = join(dir, name);
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      out.push(...walkSource(full));
+    } else if (name.endsWith(".ts") || name.endsWith(".js")) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+/**
+ * Discover inline tests() under src/ and run them. Returns true if any inline
+ * test FAILED or ERRORED. Only files that call tests() are imported, so a source
+ * file without an inline test is never executed during discovery.
+ */
+async function runInlineTests(cwd: string): Promise<boolean> {
+  const srcDir = resolve(cwd, "src");
+  if (!existsSync(srcDir)) return false;
+
+  const { runAll, reset } = await import("@tina4/core");
+  reset();
+
+  let discovered = 0;
+  for (const file of walkSource(srcDir)) {
+    let text: string;
+    try {
+      text = readFileSync(file, "utf-8");
+    } catch {
+      continue;
+    }
+    if (!/\btests\s*\(/.test(text)) continue; // only files using the inline decorator
+    discovered++;
+    try {
+      await import(pathToFileURL(file).href);
+    } catch (err) {
+      console.log(
+        `  ! could not import ${file}: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+  }
+
+  if (discovered === 0) return false;
+
+  const results = runAll();
+  return results.failed + results.errors > 0;
+}
+
 export async function runTests(testPath?: string): Promise<void> {
   const cwd = process.cwd();
 
-  // If a specific test file is provided, run it directly
+  // Stage 1 — inline @tests discovered under src/, run with a real exit code.
+  const inlineFailed = await runInlineTests(cwd);
+
+  // Stage 2 — file runner (existing behaviour), capturing failure into fileFailed.
+  let fileFailed = false;
+
+  // If a specific test file is provided, run it directly.
   if (testPath) {
     const file = resolve(testPath);
     if (!existsSync(file)) {
@@ -22,17 +97,13 @@ export async function runTests(testPath?: string): Promise<void> {
     try {
       execSync(`npx tsx "${file}"`, { cwd, stdio: "inherit" });
     } catch {
-      process.exit(1);
+      fileFailed = true;
     }
-    return;
+    process.exit(inlineFailed || fileFailed ? 1 : 0);
   }
 
-  // Auto-discover test files
-  const candidates = [
-    "test/integration.ts",
-    "test",
-    "tests",
-  ];
+  // Auto-discover test files.
+  const candidates = ["test/integration.ts", "test", "tests"];
 
   let testFiles: string[] = [];
 
@@ -40,13 +111,13 @@ export async function runTests(testPath?: string): Promise<void> {
     const fullPath = resolve(cwd, candidate);
     if (!existsSync(fullPath)) continue;
 
-    // If it's a file, run it
+    // If it's a file, run it.
     if (candidate.endsWith(".ts")) {
       testFiles.push(fullPath);
       break;
     }
 
-    // If it's a directory, collect all .ts and .test.ts files
+    // If it's a directory, collect all .ts and .test.ts files.
     try {
       const files = readdirSync(fullPath)
         .filter((f) => f.endsWith(".ts"))
@@ -59,25 +130,25 @@ export async function runTests(testPath?: string): Promise<void> {
   }
 
   if (testFiles.length === 0) {
+    if (inlineFailed) {
+      process.exit(1);
+    }
     console.log("  No test files found.");
-    console.log("  Looked in: test/integration.ts, test/*.ts, tests/*.ts");
-    return;
+    console.log("  Looked in: src/**/*.ts (@tests), test/integration.ts, test/*.ts, tests/*.ts");
+    process.exit(0);
   }
 
   console.log(`  Found ${testFiles.length} test file(s)\n`);
 
-  let failed = false;
   for (const file of testFiles) {
     const relative = file.replace(cwd + "/", "");
     console.log(`  Running: ${relative}`);
     try {
       execSync(`npx tsx "${file}"`, { cwd, stdio: "inherit" });
     } catch {
-      failed = true;
+      fileFailed = true;
     }
   }
 
-  if (failed) {
-    process.exit(1);
-  }
+  process.exit(inlineFailed || fileFailed ? 1 : 0);
 }