@blamejs/core 0.16.26 → 0.16.27

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.27 (2026-07-12) — **Fix b.pubsub pattern subscriptions silently dropping every message for a single-wildcard pattern such as orders.*.created.** b.pubsub.subscribePattern with a * wildcard between dotted segments never matched any channel, so a pattern subscriber received nothing. The documented flagship pattern orders.*.created silently dropped orders.eu.created, and the same held for a.*.c, a.*.b.*.c, and any pattern whose wildcard sits between literal segments -- the source @example itself did not work. The segment matcher required a literal that follows a * to fit entirely before the next dot, but a trailing literal like .created contains a dot and legitimately begins before that boundary, so the match was rejected. The matcher now lets a post-wildcard literal begin at or before the next dot and matches it verbatim, while a single-segment * still never spans a dot -- so orders.*.created matches orders.eu.created but not orders.eu.fr.created or orders.created, and a pattern subscriber never receives a message from an extra path segment. Surfaced while covering the pub/sub matcher's branches. **Fixed:** *b.pubsub.subscribePattern matches a single-segment wildcard between literal segments* — A pattern with a * between dotted segments (the documented orders.*.created, or any a.*.c / a.*.b.*.c) matched no channel at all, so the pattern subscriber's handler never fired. The matcher rejected the literal that follows a wildcard unless it fit entirely before the next dot, but a trailing literal such as .created contains a dot and starts before that boundary, so a legitimate match was dropped. The literal after a wildcard is now allowed to begin at or before the next dot and is matched verbatim; the wildcard still matches exactly one non-dot segment, so orders.*.created matches orders.eu.created but not orders.eu.fr.created (two segments) or orders.created (none) -- a pattern subscription never widens to an extra path segment. Behaviour is now consistent with the documented example.
+
 - v0.16.26 (2026-07-12) — **Stop b.db.exportCsv from crashing on an out-of-range timestamp value, and fix two CLI reporting faults (a vault-status stack trace and rollback-point metadata that never rendered).** Three defects surfaced while covering the db, cli, and http-client/mail-store error branches. b.db.exportCsv formatted a declared timestampFields column with new Date(v).toISOString(), which throws a RangeError for a finite millisecond value outside JavaScript's representable date range (beyond +/-8.64e15) and aborted the entire export; the one out-of-range value now degrades to its raw numeric string. The blamejs vault status command crashed with an uncaught VaultPassphraseError and a stack trace when the data directory did not exist, because the status path lacked the try/catch its sibling seal / unseal / rotate paths use; it now reports the same one-line reporter error. And blamejs restore list-rollbacks annotated each point from a non-existent recordedAt / bundleId, so the bundle id and timestamp never rendered; it now reads them from the fields b.restoreRollback.list returns (swappedAt, and bundleId / reason on the marker's operator metadata). **Fixed:** *b.db.exportCsv degrades an out-of-range timestamp value instead of aborting the export* — For a column named in timestampFields, exportCsv rendered a numeric value as new Date(value).toISOString(). A finite millisecond value beyond JavaScript's representable date range (greater than +/-8.64e15) produces an Invalid Date whose toISOString() throws a RangeError, which propagated out and aborted the whole export -- one out-of-range row could deny the entire CSV. Such a value now degrades to its raw numeric string, so the rest of the export completes. · *b.cli vault status reports a clean error when the data directory is absent* — The vault status subcommand called the sealable/unsealable preflight checks without the try/catch that its sibling seal / unseal / rotate subcommands use, so a missing or unreadable data directory raised an uncaught VaultPassphraseError -- the CLI shim printed a stack trace and exited on an unhandled rejection instead of the one-line "data-dir does not exist" reporter error the other vault subcommands give. The status path now catches the preflight error and reports it cleanly. · *b.cli restore list-rollbacks renders each rollback point's metadata* — The list-rollbacks row annotated each point with recordedAt and bundleId read from the top level of the point object, but b.restoreRollback.list returns { rollbackPath, swappedAt, marker } with the operator metadata (bundleId, reason) on marker.operator -- so those annotations were always empty. The listing now reads swappedAt from the point and bundleId / reason from the marker's operator metadata, so a rollback point's provenance is actually shown.
 
 - v0.16.25 (2026-07-12) — **Correct the OTLP protobuf span encoder's dropped_links_count field number so a future non-zero count cannot corrupt the Status field.** The OTLP/protobuf span encoder wrote the dropped_links_count placeholder on proto field 15, which is the Span's status field, instead of field 14 (dropped_links_count) per the OpenTelemetry trace proto. The emitted bytes are identical today because the count is always zero and proto3 omits zero-valued scalars, so no exported span is affected; but if a non-zero dropped-links count were ever emitted it would place a bare varint on the status field number and corrupt the Status message for a strict OTLP collector. The field number is corrected to 14. This surfaced while covering the OTLP exporter's previously-untested wire-format branches; a field-layout assertion now pins the span message's field numbers so a regression onto the status field is caught. **Fixed:** *b.observability OTLP protobuf span encoder emits dropped_links_count on the correct proto field* — In the protobuf span serializer, the dropped_links_count placeholder was encoded on field 15 -- the Span's status field, a length-delimited message -- rather than field 14, its correct number in the OpenTelemetry trace proto schema (the code's own inline comment already named field 14). Because the count is hardcoded to zero and proto3 omits zero-valued scalar fields, the serialized bytes are byte-identical today and no exported trace is affected. Were the placeholder ever set to a non-zero value (for example when span-link counting is added), each protobuf-encoded span would carry a wire-type-0 varint on the status field number and corrupt the Status message for a strict OTLP collector. The field number is now 14, and a wire-layout test pins the span message's field numbers (dropped_attributes_count at 10, dropped_events_count at 12, status length-delimited at 15) so this cannot regress silently.

package/lib/pubsub.js

@@ -102,19 +102,30 @@ function _matchGlobPart(part, channel, fromIdx) {
       if (channel.substr(pos, lit.length) !== lit) return -1;
       pos += lit.length;
     } else if (i === segments.length - 1) {
-      // Trailing literal: search forward in this segment (no '.' jump).
+      // Trailing literal after the final '*'. The '*' gap between the
+      // previous literal and this one matches non-'.' chars only, so the
+      // literal must START at or before the next '.' boundary — but the
+      // literal itself MAY contain '.' (it is matched verbatim, e.g. the
+      // '.created' tail in 'orders.*.created'). Greedy: pick the
+      // rightmost dot-free-reachable start.
       var hardStop = channel.indexOf(".", pos);
-      var searchEnd = hardStop === -1 ? channel.length : hardStop;
-      if (lit === "") { pos = searchEnd; break; }
-      var found = channel.lastIndexOf(lit, searchEnd - lit.length);
-      if (found < pos) return -1;
-      pos = found + lit.length;
+      var maxStart = hardStop === -1 ? channel.length : hardStop;
+      if (lit === "") { pos = maxStart; break; }
+      var placed = -1;
+      for (var s = maxStart; s >= pos; s--) {
+        if (channel.substr(s, lit.length) === lit) { placed = s; break; }
+      }
+      if (placed < 0) return -1;
+      pos = placed + lit.length;
     } else {
-      // Middle literal: find next occurrence within current segment.
+      // Middle literal after a '*'. The '*' gap must be dot-free, so the
+      // literal must START at or before the next '.'; the literal itself
+      // MAY contain '.'. Leftmost occurrence keeps the preceding '*'
+      // minimal.
       var hardStop2 = channel.indexOf(".", pos);
-      var searchEnd2 = hardStop2 === -1 ? channel.length : hardStop2;
+      var maxStart2 = hardStop2 === -1 ? channel.length : hardStop2;
       var f2 = channel.indexOf(lit, pos);
-      if (f2 < 0 || f2 + lit.length > searchEnd2) return -1;
+      if (f2 < 0 || f2 > maxStart2) return -1;
       pos = f2 + lit.length;
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.26",
+  "version": "0.16.27",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:932e1114-8d1e-4148-9026-c2c7511c8b89",
+  "serialNumber": "urn:uuid:569a359f-c69b-4562-a2ec-f31668019c7f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-13T06:13:22.382Z",
+    "timestamp": "2026-07-13T07:47:49.374Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.26",
+      "bom-ref": "@blamejs/core@0.16.27",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.26",
+      "version": "0.16.27",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.26",
+      "purl": "pkg:npm/%40blamejs/core@0.16.27",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.26",
+      "ref": "@blamejs/core@0.16.27",
       "dependsOn": []
     }
   ]