test(worker): ratchet mutation 88→90 — xlsx regex, d1 schema, token timing

Worker mutation score: 90.07% → **90.79%** (+0.72). `break` threshold
88 → 90. Key additions target mutants Stryker marked as "survived"
where the original test was too loose to distinguish a semantic
mutation from the real behavior.

**xlsx-build.ts 68.37% → 72.45%**

- New boundary tests for `sanitizeSheetName` — 31 chars exact vs 32
  chars, pinning the `base.length > 31` predicate.
- Four new `csvToBinaryWorkbook` tests pin the numeric-coercion regex
  `/^-?\d+(\.\d+)?$/` against each of the four surviving mutations:
  - `"abc42"` stays string (catches the `^` anchor drop)
  - `"42abc"` stays string (catches the `$` anchor drop)
  - `"1.234"` becomes number (catches `+` quantifier drop)
  - `"1.abc"` stays string (catches `\d` → `\D` swap)

**d1-schema.ts (unchanged file score — schema is now pinned)**

- Existing `withRoomsSchema` test checked `.toContain('CREATE TABLE')`
  against the exec'd SQL; added column-definition asserts so
  StringLiteral mutations that zero-out the column list don't survive
  the prefix-only check. Same for `cron_triggers`.
- New cross-table cases: an error about a *different* table must NOT
  trigger the current schema's retry — pins the `'rooms'` and
  `'cron_triggers'` table-name literals that flow into
  `isMissingTableError`.

**migrate-auth.ts — timing-safe loop body**

- Added two `verifyMigrateToken` cases with same-length tokens that
  differ in a single byte (last byte, first byte). Previous "bad"
  tests all short-circuited at the length check, leaving the XOR
  loop body unexercised — so `i < a.length` → `i >= a.length` could
  survive by skipping the loop and returning `ok` (all-zero diff).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: audreyt

packages/worker/stryker.conf.json

@@ -24,7 +24,7 @@
   "thresholds": {
     "high": 100,
     "low": 95,
-    "break": 88
+    "break": 90
   },
   "timeoutMS": 120000,
   "concurrency": 4,

packages/worker/test/d1-schema.node.test.ts

@@ -31,7 +31,14 @@ describe('withRoomsSchema', () => {
     expect(attempts).toBe(2);
     expect(execCalls).toHaveLength(2);
     expect(execCalls[0]).toContain('CREATE TABLE IF NOT EXISTS rooms');
+    // Pin the column definitions too — a StringLiteral mutation that
+    // zeros-out the column list would leave only the CREATE TABLE header
+    // and still satisfy the prefix check above.
+    expect(execCalls[0]).toContain('room TEXT PRIMARY KEY');
+    expect(execCalls[0]).toContain('updated_at INTEGER NOT NULL');
+    expect(execCalls[0]).toContain('cors_public INTEGER NOT NULL DEFAULT 0');
     expect(execCalls[1]).toContain('CREATE INDEX IF NOT EXISTS rooms_updated_at');
+    expect(execCalls[1]).toContain('ON rooms(updated_at DESC)');
   });
 
   it('rethrows unrelated errors without touching the schema', async () => {
@@ -66,6 +73,41 @@ describe('withCronSchema', () => {
     expect(attempts).toBe(2);
     expect(execCalls).toHaveLength(2);
     expect(execCalls[0]).toContain('CREATE TABLE IF NOT EXISTS cron_triggers');
+    expect(execCalls[0]).toContain('room TEXT NOT NULL');
+    expect(execCalls[0]).toContain('cell TEXT NOT NULL');
+    expect(execCalls[0]).toContain('fire_at INTEGER NOT NULL');
+    expect(execCalls[0]).toContain('PRIMARY KEY (room, cell, fire_at)');
     expect(execCalls[1]).toContain('CREATE INDEX IF NOT EXISTS cron_triggers_fire_at');
+    expect(execCalls[1]).toContain('ON cron_triggers(fire_at)');
+  });
+
+  it('does not retry when the error is about a different table', async () => {
+    // Pin the `'cron_triggers'` table-name literal on line 55 — a
+    // mutation replacing it with `""` would make isMissingTableError
+    // match against the empty-string suffix, and effectively flip
+    // match-on-anything behavior.
+    const { db, execCalls } = makeFakeDb();
+    await expect(
+      withCronSchema(db, async () => {
+        throw new Error('D1_ERROR: no such table: rooms: SQLITE_ERROR');
+      }),
+    ).rejects.toThrow(/no such table: rooms/);
+    expect(execCalls).toEqual([]);
+  });
+});
+
+describe('withRoomsSchema — cross-table distinction', () => {
+  it('does not retry when the error is about a different table', async () => {
+    // Pin the `'rooms'` table-name literal on line 46.
+    const { db, execCalls } = Object.assign(
+      { db: { exec: vi.fn() }, execCalls: [] as string[] },
+      makeFakeDb(),
+    );
+    await expect(
+      withRoomsSchema(db, async () => {
+        throw new Error('D1_ERROR: no such table: cron_triggers: SQLITE_ERROR');
+      }),
+    ).rejects.toThrow(/no such table: cron_triggers/);
+    expect(execCalls).toEqual([]);
   });
 });

packages/worker/test/migrate.node.test.ts

@@ -315,6 +315,24 @@ describe('verifyMigrateToken', () => {
     });
   });
 
+  it('bad when same-length tokens differ only in one byte', () => {
+    // Exercises the body of the constant-time XOR loop. Kills the
+    // EqualityOperator mutants on `i < a.length` (→ `i >= a.length`,
+    // which would skip the loop entirely and leave `diff = 0`,
+    // incorrectly returning `ok`).
+    expect(verifyMigrateToken('secret', 'Bearer secreT')).toEqual({
+      kind: 'bad',
+    });
+  });
+
+  it('bad when same-length tokens differ only in the first byte', () => {
+    // Different position of the differing byte — defends against a
+    // mutation that might mis-iterate and happen to miss the mismatch.
+    expect(verifyMigrateToken('secret', 'Bearer Secret')).toEqual({
+      kind: 'bad',
+    });
+  });
+
   it('ok when token matches exactly', () => {
     expect(verifyMigrateToken('secret', 'Bearer secret')).toEqual({
       kind: 'ok',

packages/worker/test/xlsx-build.node.test.ts

@@ -103,6 +103,51 @@ describe('csvToBinaryWorkbook', () => {
     // on the range; we only assert B1 is the non-empty value.
     expect(sheet.B1.v).toBe('a');
   });
+
+  // The next four pin specific regex mutations on the numeric-pattern at
+  // xlsx-build.ts:84 — `/^-?\d+(\.\d+)?$/`. Each mutation is observable
+  // via a carefully-chosen string that matches the mutant regex but not
+  // the original (or vice-versa).
+
+  it('does NOT coerce trailing-digit strings like "abc42" (`^` anchor)', () => {
+    // Mutation `/-?\d+(\.\d+)?$/` (no `^`) would match "abc42" and
+    // try `Number("abc42")` → NaN → cell type 'n' with bad value.
+    const bytes = csvToBinaryWorkbook('abc42\n', 'xlsx');
+    const wb = (XLSX as any).read(bytes, { type: 'array' });
+    const sheet = wb.Sheets[wb.SheetNames[0]];
+    expect(sheet.A1.t).toBe('s');
+    expect(sheet.A1.v).toBe('abc42');
+  });
+
+  it('does NOT coerce leading-digit strings like "42abc" (`$` anchor)', () => {
+    // Mutation `/^-?\d+(\.\d+)?/` (no `$`) would match "42abc" as a prefix.
+    const bytes = csvToBinaryWorkbook('42abc\n', 'xlsx');
+    const wb = (XLSX as any).read(bytes, { type: 'array' });
+    const sheet = wb.Sheets[wb.SheetNames[0]];
+    expect(sheet.A1.t).toBe('s');
+    expect(sheet.A1.v).toBe('42abc');
+  });
+
+  it('coerces multi-digit fractions like "1.234" (`+` quantifier)', () => {
+    // Mutation `/^-?\d+(\.\d)?$/` (no `+` after `\d`) would only match
+    // a single fractional digit, leaving "1.234" as a string.
+    const bytes = csvToBinaryWorkbook('1.234\n', 'xlsx');
+    const wb = (XLSX as any).read(bytes, { type: 'array' });
+    const sheet = wb.Sheets[wb.SheetNames[0]];
+    expect(sheet.A1.t).toBe('n');
+    expect(sheet.A1.v).toBeCloseTo(1.234);
+  });
+
+  it('does NOT coerce decimal-with-letters like "1.abc" (`\\d` vs `\\D`)', () => {
+    // Mutation `/^-?\d+(\.\D+)?$/` (`\d` → `\D`) would match "1.abc"
+    // (the fractional part matches non-digits). Number("1.abc") = NaN,
+    // which would produce a numeric cell with a bogus value.
+    const bytes = csvToBinaryWorkbook('1.abc\n', 'xlsx');
+    const wb = (XLSX as any).read(bytes, { type: 'array' });
+    const sheet = wb.Sheets[wb.SheetNames[0]];
+    expect(sheet.A1.t).toBe('s');
+    expect(sheet.A1.v).toBe('1.abc');
+  });
 });
 
 describe('BINARY_CONTENT_TYPES', () => {
@@ -137,6 +182,23 @@ describe('sanitizeSheetName', () => {
     expect(out).toBe('x'.repeat(31));
   });
 
+  it('leaves names EXACTLY 31 characters untouched (boundary is strict >)', () => {
+    // Pins the `base.length > 31` boundary — mutation to `>=` would
+    // truncate a length-31 name to 31 (no-op result) but the predicate
+    // difference is observable via the slice path. The assertion
+    // `.toBe(input)` guarantees identity, not just equality.
+    const input = 'x'.repeat(31);
+    const out = sanitizeSheetName(input);
+    expect(out).toBe(input);
+    expect(out.length).toBe(31);
+  });
+
+  it('truncates 32-character names (one above the boundary)', () => {
+    const input = 'x'.repeat(32);
+    const out = sanitizeSheetName(input);
+    expect(out.length).toBe(31);
+  });
+
   it('falls back to "Sheet" when the input is empty', () => {
     expect(sanitizeSheetName('')).toBe('Sheet');
   });