@blamejs/core 0.17.11 → 0.17.13

package/lib/watcher.js

@@ -74,6 +74,14 @@ var DEFAULT_POLL_MAX_FILES   = 50000;
 // Operators with legitimate high-churn directories raise this via opts.
 var DEFAULT_MAX_PENDING = 10000;                                                   // pending-event queue cap
 
+// Native fs.watch runtime-error codes that leave the underlying handle dead —
+// change detection is permanently off, not a transient blip. Classified as a
+// fatal watcher/handle-dead so a wrapper can recreate/alert rather than ignore.
+var HANDLE_DEAD_CODES = ["EPERM", "EBADF", "ENOSPC", "EMFILE", "ENFILE", "EACCES"];
+// Windows MAX_PATH is 260; a path approaching it needs the \\?\ long-path
+// prefix for lstat to resolve it (below the threshold, plain paths are fine).
+var WIN32_LONG_PATH_THRESHOLD = 250;
+
 // ---- glob-style matcher ----
 //
 // Supports three shapes per entry:
@@ -133,7 +141,7 @@ function _matchGlobBasename(parts, base) {
   return true;
 }
 
-function _compileIgnore(patterns) {
+function _compileIgnore(patterns, caseFold) {
   if (!Array.isArray(patterns) || patterns.length === 0) {
     return function () { return false; };
   }
@@ -154,26 +162,33 @@ function _compileIgnore(patterns) {
       throw new WatcherError("watcher/bad-ignore",
         "watcher.create: ignore[" + i + "] exceeds " + MAX_IGNORE_STAR_COUNT + "-wildcard cap");
     }
-    if (p.indexOf("**") !== -1) {
+    // When ignoreCaseFold is on, fold the pattern to lower case at compile time
+    // and the walked path at match time, so the walk-prune aligns with a
+    // case-insensitive consumer's own filter (an on-disk 'Node_Modules' is
+    // pruned by a 'node_modules/**' ignore, not stat'd toward pollMaxFiles).
+    // Length + wildcard caps stay measured on the original pattern.
+    var pk = caseFold ? p.toLowerCase() : p;
+    if (pk.indexOf("**") !== -1) {
       // dir/** prefix-match — strip the trailing **; reject `**` mid-pattern.
-      if (!/^[^*]*\/?\*\*$/.test(p)) {
+      if (!/^[^*]*\/?\*\*$/.test(pk)) {
         throw new WatcherError("watcher/bad-ignore",
           "watcher.create: ignore[" + i + "] '**' is only supported as a trailing dir/** prefix form");
       }
-      var prefix = p.replace(/\/?\*\*$/, "");
+      var prefix = pk.replace(/\/?\*\*$/, "");
       compiled.push({ kind: "prefix", value: prefix });
     } else if (starCount > 0) {
-      compiled.push({ kind: "glob", value: _parseGlobBasename(p) });
+      compiled.push({ kind: "glob", value: _parseGlobBasename(pk) });
     } else {
-      compiled.push({ kind: "exact", value: p });
+      compiled.push({ kind: "exact", value: pk });
     }
   }
   return function (relPath) {
-    var base = nodePath.basename(relPath);
-    var normalized = relPath.split(nodePath.sep).join("/");
+    var matchPath = caseFold ? relPath.toLowerCase() : relPath;
+    var base = nodePath.basename(matchPath);
+    var normalized = matchPath.split(nodePath.sep).join("/");
     for (var j = 0; j < compiled.length; j += 1) {
       var c = compiled[j];
-      if (c.kind === "exact" && (c.value === relPath || c.value === normalized)) return true;
+      if (c.kind === "exact" && (c.value === matchPath || c.value === normalized)) return true;
       if (c.kind === "prefix" && (normalized === c.value || normalized.indexOf(c.value + "/") === 0)) return true;
       if (c.kind === "glob" && _matchGlobBasename(c.value, base)) return true;
     }
@@ -312,6 +327,21 @@ function _validateOpts(opts) {
     throw new WatcherError("watcher/bad-ignore",
       "watcher.create: ignore must be an array of glob patterns");
   }
+  validateOpts.optionalBoolean(opts.ignoreCaseFold, "ignoreCaseFold", WatcherError, "watcher/bad-ignore");
+}
+
+function _lstatLongPathSafe(fullPath) {
+  // Windows MAX_PATH (260): lstatSync on a path at/over the limit without the
+  // \\?\ long-path prefix spuriously throws ENOENT, which _normalizeAndDispatch
+  // would misread as a delete. The prefix needs a backslashed absolute path
+  // (the watcher root is realpathSync.native'd → absolute) and disables path
+  // normalization, which is safe here — fullPath has no relative components. A
+  // genuinely-missing file still ENOENTs on the plain-path fallback → real delete.
+  if (process.platform === "win32" && fullPath.length >= WIN32_LONG_PATH_THRESHOLD && fullPath.indexOf("\\\\?\\") !== 0) {
+    try { return nodeFs.lstatSync("\\\\?\\" + fullPath); }
+    catch (_e) { /* fall through to the plain path so a real ENOENT resurfaces */ }
+  }
+  return nodeFs.lstatSync(fullPath);
 }
 
 function create(opts) {
@@ -339,7 +369,7 @@ function create(opts) {
   var onChange    = opts.onChange || function () {};
   var onDelete    = opts.onDelete || function () {};
   var onError     = opts.onError  || function () {};
-  var isIgnored   = _compileIgnore(opts.ignore);
+  var isIgnored   = _compileIgnore(opts.ignore, opts.ignoreCaseFold === true);
   var auditOn     = opts.audit !== false;
 
   // Pre-flight: root must exist and be a directory.
@@ -375,13 +405,33 @@ function create(opts) {
     try { onError(err); } catch (_e) { /* operator error handler must not crash the watcher */ }
   }
 
+  // Native-backend (fs.watch) error handler. A runtime error whose code leaves
+  // the handle dead (EPERM after the watched root is deleted/recreated on
+  // Windows, EBADF, inotify exhaustion) permanently stops detection — classify
+  // it fatal so a consumer can react (recreate/alert) rather than treat it as a
+  // transient blip. Non-handle-dead errors pass through unclassified.
+  function _handleBackendError(err) {
+    if (err && HANDLE_DEAD_CODES.indexOf(err.code) !== -1) {
+      var dead = new WatcherError("watcher/handle-dead",
+        "watcher: native watch handle died (" + err.code + ") — change detection has " +
+        "permanently stopped; recreate the watcher to resume: " + (err.message || String(err)));
+      dead.fatal = true;
+      dead.cause = err;
+      _safeError(dead);
+      return;
+    }
+    _safeError(err);
+  }
+
   function _normalizeAndDispatch(relPath) {
     if (stopped) return;
     if (isIgnored(relPath)) return;
     var fullPath = nodePath.join(root, relPath);
-    // lstat (NOT stat) — refuses to follow symlinks out of root.
+    // lstat (NOT stat) — refuses to follow symlinks out of root. Long-path-safe
+    // so a Windows path over MAX_PATH isn't misread as a delete (issue: a deep
+    // change delivered to onDelete instead of onChange).
     var lst;
-    try { lst = nodeFs.lstatSync(fullPath); }
+    try { lst = _lstatLongPathSafe(fullPath); }
     catch (e) {
       if (e && e.code === "ENOENT") {
         // Path is gone — delete event. Type unknown by the time we
@@ -456,10 +506,23 @@ function create(opts) {
       var absDir = relDir === "" ? root : nodePath.join(root, relDir);
       var entries;
       try { entries = nodeFs.readdirSync(absDir, { withFileTypes: true }); }
-      catch (_e) {
-        // Root vanished mid-walk OR an inner dir got deleted between
-        // the parent listing and the descent. Skip — the next tick's
-        // walk surfaces the deletion via the snapshot diff.
+      catch (rootErr) {
+        if (relDir === "") {
+          // The ROOT itself is unreadable (unmounted NFS/SMB/USB volume, or a
+          // deleted root). Returning an empty snapshot would diff as a delete
+          // of EVERY tracked entry — a mass-delete a consumer can't tell apart
+          // from a real rm -rf. Surface a distinct fatal root-lost signal and
+          // abort the walk; _pollTick's catch keeps the prior snapshot, so no
+          // spurious onDelete fires.
+          var lost = new WatcherError("watcher/root-lost",
+            "watcher.poll: root '" + root + "' is no longer readable: " +
+            ((rootErr && rootErr.message) || String(rootErr)));
+          lost.fatal = true;
+          lost.cause = rootErr;
+          throw lost;
+        }
+        // Inner dir vanished mid-walk between the parent listing and the
+        // descent. Skip — the next tick's diff surfaces the deletion.
         continue;
       }
       for (var i = 0; i < entries.length; i += 1) {
@@ -544,7 +607,7 @@ function create(opts) {
         if (rel === "" || rel === ".") return;
         _enqueue(rel);
       });
-      watcherHandle.on("error", function (err) { _safeError(err); });
+      watcherHandle.on("error", function (err) { _handleBackendError(err); });
     } catch (e) {
       if (e && (e.code === "ERR_FEATURE_UNAVAILABLE_ON_PLATFORM" || e.code === "ENOSYS")) {
         throw new WatcherError("watcher/recursive-unsupported",
@@ -609,10 +672,19 @@ function create(opts) {
     root:           root,
     mode:           mode,
     _flushForTest:  _flushForTest,
+    // Test seam — drives the native-backend error classification path (the OS
+    // killing the handle isn't deterministically reproducible). Not part of the
+    // operator contract.
+    _simulateBackendErrorForTest: _handleBackendError,
   };
 }
 
 module.exports = {
   create:        create,
   WatcherError:  WatcherError,
+  // Exported so a consumer pre-filtering operator ignore patterns (to keep one
+  // bad pattern from aborting the whole watcher) can align with the caps
+  // create() enforces, instead of pinning hand-copied mirror constants.
+  MAX_IGNORE_PATTERN_LEN: MAX_IGNORE_PATTERN_LEN,
+  MAX_IGNORE_STAR_COUNT:  MAX_IGNORE_STAR_COUNT,
 };

package/lib/webhook-dispatcher.js

@@ -72,7 +72,7 @@ var HTTP_OK_MAX = 300;
 function _validateTableName(name, label) {
   validateOpts.requireNonEmptyString(name, label, WebhookDispatcherError, "webhook-dispatcher/bad-opts");
   // safeSql.quoteIdentifier refuses an injection-bearing name at construction.
-  safeSql.quoteIdentifier(name);
+  safeSql.quoteIdentifier(name, undefined, { allowReserved: true }); // parity with b.db.from()
   return name;
 }
 

package/lib/ws-client.js

@@ -268,6 +268,7 @@ function connect(target, opts) {
   // performs the (async) check + pinning before the dial and reruns it on
   // every reconnect, so a urlFor-swapped target is validated too.
   client._prepareDial().then(function () {
+    if (client._closed) return;   // close() during the async SSRF re-resolve retires the dial
     client._dial();
   }).catch(function (e) {
     setImmediate(function () { client._handleSocketError(e); });
@@ -366,6 +367,10 @@ class WsClient extends EventEmitter {
   }
 
   _dial() {
+    // Guard the shared dial funnel: a close() during the pending _prepareDial
+    // (initial dial) or the reconnect backoff sets _closed; without this check
+    // the resolved continuation would open a socket + heartbeat nobody owns.
+    if (this._closed) return;
     var self = this;
     this._readyState = "connecting";
 
@@ -883,6 +888,18 @@ class WsClient extends EventEmitter {
       this._closed = true;
       return;
     }
+    if (this._readyState === "connecting") {
+      // No socket is established yet (the dial is still in _prepareDial's SSRF
+      // re-resolve or the handshake). There is no peer to exchange a graceful
+      // close frame with, so the 1000ms grace window buys nothing — and leaving
+      // _closed false across it lets a slow _prepareDial resolve into _dial()
+      // and open a socket nobody owns. Retire immediately (sets _closed and
+      // destroys any partial socket).
+      code = (typeof code === "number") ? code : CLOSE_NORMAL;
+      reason = (typeof reason === "string") ? reason : "";
+      this._teardown(code, reason, false);
+      return;
+    }
     code = (typeof code === "number") ? code : CLOSE_NORMAL;
     reason = (typeof reason === "string") ? reason : "";
     // RFC 6455 §5.5: control frames must be <= 125 bytes total. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.17.11",
+  "version": "0.17.13",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:8b687625-0aed-45e7-a4c6-fd40648ecbeb",
+  "serialNumber": "urn:uuid:dd71bb9a-bc83-498e-b1da-0abc600f88d2",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-18T06:24:31.795Z",
+    "timestamp": "2026-07-23T20:20:36.895Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.17.11",
+      "bom-ref": "@blamejs/core@0.17.13",
       "type": "application",
       "name": "blamejs",
-      "version": "0.17.11",
+      "version": "0.17.13",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.17.11",
+      "purl": "pkg:npm/%40blamejs/core@0.17.13",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.17.11",
+      "ref": "@blamejs/core@0.17.13",
       "dependsOn": []
     }
   ]