[SEA-NodeJS] tests: ordered PEM markers + poll-loop terminal close (P1.3/P1.5 coverage)

Locks the round-2 fixes the review flagged as untested:
- PEM customCaCert rejects out-of-order / BEGIN-only / END-only blobs (ordered
  regex, not two independent substring checks).
- The async poll loop best-effort close()s the kernel statement on every
  server-driven terminal error (Cancelled/Closed/Unknown), proving no handle
  leak. All round-2 behaviours additionally verified end-to-end against a live
  warehouse (insecure-combo warn, async-Failed SQL error + close, Thrift
  rowLimit warn).

Co-authored-by: Isaac
Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>

Author: msrathore-db

tests/unit/sea/connectionOptions.test.ts

@@ -93,6 +93,17 @@ describe('SeaAuth TLS options (buildSeaTlsOptions)', () => {
     expect(() => buildSeaTlsOptions(opts({ customCaCert: 'not-a-pem' }))).to.throw(HiveDriverError, /PEM certificate/);
   });
 
+  it('rejects out-of-order / partial PEM markers (ordered match, not two substrings)', () => {
+    // END-before-BEGIN, BEGIN-only, and END-only must all fail — a blob that
+    // merely *contains* both literals (e.g. a proxy-intercept page) is not a cert.
+    const reversed = '-----END CERTIFICATE-----\nMIIB...\n-----BEGIN CERTIFICATE-----';
+    const beginOnly = '-----BEGIN CERTIFICATE-----\nMIIB...\n';
+    const endOnly = 'MIIB...\n-----END CERTIFICATE-----';
+    for (const bad of [reversed, beginOnly, endOnly]) {
+      expect(() => buildSeaTlsOptions(opts({ customCaCert: bad })), bad).to.throw(HiveDriverError, /PEM certificate/);
+    }
+  });
+
   it('rejects an empty Buffer', () => {
     expect(() => buildSeaTlsOptions(opts({ customCaCert: Buffer.alloc(0) }))).to.throw(HiveDriverError, /empty/);
   });

tests/unit/sea/execution.test.ts

@@ -952,6 +952,18 @@ describe('SeaOperationBackend — async (submitStatement) path', () => {
     expect((thrown as OperationStateError).errorCode).to.equal(OperationStateErrorCode.Canceled);
   });
 
+  it('best-effort close()s the kernel statement on a server-driven terminal error (no leak)', async () => {
+    // P1.5: the poll loop must release the statement handle on terminal errors,
+    // not just throw (otherwise the kernel-side statement leaks until session close).
+    for (const state of ['Cancelled', 'Closed', 'Unknown']) {
+      const stmt = new FakeAsyncStatement(state);
+      const op = makeAsyncOp(stmt);
+      // eslint-disable-next-line no-await-in-loop
+      await op.waitUntilReady().catch(() => undefined);
+      expect(stmt.closed, `closed after ${state}`).to.equal(true);
+    }
+  });
+
   it('waitUntilReady() throws OperationStateError(Closed) on a server-side Closed statement', async () => {
     const op = makeAsyncOp(new FakeAsyncStatement('Closed'));
     let thrown: unknown;