fix: check ticket holds with Object.hasOwn

Review feedback on #63. The ticket sale examples tested holds with
`buyer in this.holds`. The `in` operator also matches names that
Object.prototype supplies, so a buyer named "constructor" could not
hold the free ticket, and expire could add a ticket that no hold had
taken. Before the fix, `node examples/ticket-sale.ts hold constructor`
printed [{"held":false,"available":1}]. It now prints
[{"held":true,"available":0}]. Use Object.hasOwn in the example, both
guides, and the README.

The example now takes buyer names after `hold`, with ada and grace as
the default, and test:package holds a ticket for "constructor"
against the packed tarball.

Two fixes in docs/agents.md:

- The production policy read userId from an unchecked cast, so a null
  authorization context threw a TypeError instead of a denial. It now
  narrows the context and returns false for any malformed value.
- runDueReminders requires { now }. The verification step now passes
  a Date and drains the actor role, as the test helper requires.

Both snippets type-check against the package.

Author: cardmagic

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## 0.17.1 - 2026-10-08
 
+- Check holds with `Object.hasOwn` in the README and guide ticket sale
+  examples. The `in` operator also matched inherited names, so a buyer named
+  `constructor` could not hold a free ticket, and `expire` could add a ticket
+  that no hold had taken. `pnpm run test:package` now holds a ticket for that
+  buyer.
 - Override `sharp` with 0.35.5 and `source-map-js` with 1.2.2. Two high
   advisories reach the repository only through the development tooling:
   `sharp` through Miniflare and `source-map-js` through Vite and PostCSS. The

README.md

@@ -76,7 +76,7 @@ class TicketSale extends Actor {
   holds = {}
 
   hold({ buyer }) {
-    if (this.available === 0 || buyer in this.holds) {
+    if (this.available === 0 || Object.hasOwn(this.holds, buyer)) {
       return { held: false, available: this.available }
     }
 
@@ -90,7 +90,7 @@ class TicketSale extends Actor {
   }
 
   expire({ buyer }) {
-    if (!(buyer in this.holds)) return this.available
+    if (!Object.hasOwn(this.holds, buyer)) return this.available
 
     const remainingHolds = { ...this.holds }
     delete remainingHolds[buyer]

docs/agents.md

@@ -105,8 +105,6 @@ A production policy must bind the actor type and ID to the authenticated user
 or tenant. An actor ID is not a permission:
 
 ```typescript
-type Subject = { userId: string } | undefined
-
 const ownsCart = ({
   actorType,
   actorId,
@@ -116,8 +114,10 @@ const ownsCart = ({
   actorId: string
   authorizationContext: unknown
 }) => {
-  const subject = authorizationContext as Subject
-  return actorType === "ShoppingCart" && subject !== undefined && actorId === subject.userId
+  if (actorType !== "ShoppingCart") return false
+  if (typeof authorizationContext !== "object" || authorizationContext === null) return false
+  if (!("userId" in authorizationContext)) return false
+  return typeof authorizationContext.userId === "string" && actorId === authorizationContext.userId
 }
 
 const runtime = configure({
@@ -153,7 +153,7 @@ export class TicketSale extends Actor {
   holds: Record<string, number> = {}
 
   hold({ buyer }: { buyer: string }): { held: boolean; available: number } {
-    if (this.available === 0 || buyer in this.holds) {
+    if (this.available === 0 || Object.hasOwn(this.holds, buyer)) {
       return { held: false, available: this.available }
     }
 
@@ -164,7 +164,7 @@ export class TicketSale extends Actor {
   }
 
   expire({ buyer }: { buyer: string }): number {
-    if (!(buyer in this.holds)) return this.available
+    if (!Object.hasOwn(this.holds, buyer)) return this.available
 
     const remainingHolds = { ...this.holds }
     delete remainingHolds[buyer]
@@ -251,8 +251,15 @@ Do these checks before you report that the work is complete:
 1. Call `await runtime.doctor.run()`. The report must contain no failed check.
 2. Send concurrent calls to one identity with `Promise.all`, and from two
    processes if the application runs more than one. Assert the final state.
-3. Use `runtime.testing.drain()` and `runtime.testing.runDueReminders()` to
-   test delayed work without sleeps.
+3. Test delayed work without sleeps. `runDueReminders({ now })` enqueues the
+   reminders that are due at the `Date` you pass. `drain()` then runs the
+   enqueued actor work:
+
+   ```typescript
+   await runtime.testing.runDueReminders({ now: new Date(Date.now() + HOLD_MILLISECONDS) })
+   await runtime.testing.drain({ roles: ["actors"] })
+   ```
+
 4. Start a process that calls `runtime.run(signal)`, schedule a short
    reminder, and stop the process. Start it again after the deadline and
    confirm that the reminder ran.

docs/virtual-actors.md

@@ -52,7 +52,7 @@ export class TicketSale extends Actor {
   holds: Record<string, number> = {}
 
   hold({ buyer }: { buyer: string }): { held: boolean; available: number } {
-    if (this.available === 0 || buyer in this.holds) {
+    if (this.available === 0 || Object.hasOwn(this.holds, buyer)) {
       return { held: false, available: this.available }
     }
 
@@ -63,7 +63,7 @@ export class TicketSale extends Actor {
   }
 
   expire({ buyer }: { buyer: string }): number {
-    if (!(buyer in this.holds)) return this.available
+    if (!Object.hasOwn(this.holds, buyer)) return this.available
 
     const remainingHolds = { ...this.holds }
     delete remainingHolds[buyer]
@@ -90,7 +90,8 @@ try {
     process.once("SIGTERM", () => controller.abort())
     await runtime.run(controller.signal)
   } else {
-    const results = await Promise.all(["ada", "grace"].map((buyer) => sale.hold({ buyer })))
+    const buyers = process.argv.length > 3 ? process.argv.slice(3) : ["ada", "grace"]
+    const results = await Promise.all(buyers.map((buyer) => sale.hold({ buyer })))
     console.log(JSON.stringify(results))
   }
 } finally {

examples/ticket-sale.ts

@@ -10,7 +10,7 @@ export class TicketSale extends Actor {
   holds: Record<string, number> = {}
 
   hold({ buyer }: { buyer: string }): { held: boolean; available: number } {
-    if (this.available === 0 || buyer in this.holds) {
+    if (this.available === 0 || Object.hasOwn(this.holds, buyer)) {
       return { held: false, available: this.available }
     }
 
@@ -21,7 +21,7 @@ export class TicketSale extends Actor {
   }
 
   expire({ buyer }: { buyer: string }): number {
-    if (!(buyer in this.holds)) return this.available
+    if (!Object.hasOwn(this.holds, buyer)) return this.available
 
     const remainingHolds = { ...this.holds }
     delete remainingHolds[buyer]
@@ -48,7 +48,8 @@ try {
     process.once("SIGTERM", () => controller.abort())
     await runtime.run(controller.signal)
   } else {
-    const results = await Promise.all(["ada", "grace"].map((buyer) => sale.hold({ buyer })))
+    const buyers = process.argv.length > 3 ? process.argv.slice(3) : ["ada", "grace"]
+    const results = await Promise.all(buyers.map((buyer) => sale.hold({ buyer })))
     console.log(JSON.stringify(results))
   }
 } finally {

scripts/release-artifact-smoke.mjs

@@ -141,6 +141,17 @@ try {
     ticketSaleHolds.map((result) => result.available),
     [0, 0],
   )
+  const inheritedNameHold = JSON.parse(
+    await run(process.execPath, [ticketSaleExample, "hold", "constructor"], {
+      cwd: projectDirectory,
+      env: { TICKET_DATABASE: join(projectDirectory, "inherited-name.sqlite3") },
+    }),
+  )
+  assert.deepEqual(
+    inheritedNameHold,
+    [{ held: true, available: 0 }],
+    "a buyer named after an Object.prototype property must get the free ticket",
+  )
 
   const quickstartJson = await run(
     join(projectDirectory, "node_modules/.bin/solid-objects"),