@blamejs/core 0.17.23 → 0.18.0

package/lib/webhook-dispatcher.js

@@ -76,6 +76,27 @@ function _validateTableName(name, label) {
   return name;
 }
 
+// The dispatcher's endpoints/deliveries tables are operator-supplied names
+// executed against a concrete externalDb handle (never b.clusterStorage —
+// nothing here rewrites bare table names), so every b.sql builder quotes the
+// table name by construction (quoteName: true). A quoted identifier is what
+// makes a reserved-word or case-sensitive operator table (a table literally
+// named "from") emit valid SQL — parity with b.db.from()'s allowReserved. Same
+// posture as b.mailStore against its concrete sqlite handle.
+function _tableOpts(dialect) { return { dialect: dialect, quoteName: true }; }
+
+// PostgreSQL folds UNQUOTED identifiers to lowercase, so every pre-0.18 deployment
+// (whose DDL and queries emitted the table name unquoted) already has a
+// lowercase-folded table. Now that the name is always quoted (quoteName above), a
+// mixed-case custom endpoints/deliveries table would target a NEW case-sensitive
+// table and strand the existing rows. Fold to lowercase on postgres BEFORE quoting
+// so a legacy config keeps resolving to its existing table; reserved words (already
+// lowercase) still quote correctly. sqlite is case-insensitive (no fold); MySQL
+// folding is server-configured and applied equally to the pre-quote name.
+function _foldTableForDialect(name, dialect) {
+  return dialect === "postgres" ? String(name).toLowerCase() : name;
+}
+
 function _sqlDialect(externalDb) {
   var d = externalDb && externalDb.dialect;
   if (d === "postgres" || d === "postgresql") return "postgres";
@@ -190,12 +211,16 @@ function dispatcher(opts) {
     dnsLookup:                 "optional-function",
   }, "webhook.dispatcher", WebhookDispatcherError, "webhook-dispatcher/bad-opts");
   var externalDb = opts.externalDb;
-  var endpointsTable = _validateTableName(
+  // Fold operator table names for the backend's identifier rules BEFORE they are
+  // quoted downstream, so a legacy mixed-case config still targets its existing
+  // (folded) table on postgres.
+  var _createDialect = _sqlDialect(externalDb);
+  var endpointsTable = _foldTableForDialect(_validateTableName(
     opts.endpointsTable || frameworkSchema.tableName("webhook_endpoints"),
-    "dispatcher: endpointsTable");
-  var deliveriesTable = _validateTableName(
+    "dispatcher: endpointsTable"), _createDialect);
+  var deliveriesTable = _foldTableForDialect(_validateTableName(
     opts.deliveriesTable || frameworkSchema.tableName("webhook_deliveries"),
-    "dispatcher: deliveriesTable");
+    "dispatcher: deliveriesTable"), _createDialect);
 
   var maxAttempts    = opts.maxAttempts   || DEFAULT_MAX_ATTEMPTS;
   var batchSize      = opts.batchSize     || DEFAULT_BATCH_SIZE;
@@ -286,9 +311,9 @@ function dispatcher(opts) {
       { name: "secret_sealed", type: "TEXT",         notNull: true },
       { name: "disabled",      type: "INTEGER",      notNull: true, default: 0 },
       { name: "created_at",    type: tsType,         notNull: true },
-    ], { dialect: dialect }), dialect);
+    ], _tableOpts(dialect)), dialect);
     var endpointsIdx = sql.toExternalSql(sql.createIndex(endpointsTable + "_eid_idx",
-      endpointsTable, ["endpoint_id"], { dialect: dialect }), dialect);
+      endpointsTable, ["endpoint_id"], _tableOpts(dialect)), dialect);
 
     var deliveriesDdl = sql.toExternalSql(sql.createTable(deliveriesTable, [
       { name: "id",              serial: true },
@@ -306,14 +331,14 @@ function dispatcher(opts) {
       { name: "response_status", type: "INTEGER" },
       { name: "last_error",      type: "TEXT" },
       { name: "created_at",      type: tsType,         notNull: true },
-    ], { dialect: dialect }), dialect);
+    ], _tableOpts(dialect)), dialect);
     // Index on the due-pending pool the retry poller scans. Postgres/SQLite
     // get a PARTIAL index (status = 'pending'); MySQL has no partial indexes
     // (sql.createIndex refuses `where` for the mysql dialect), so it gets a
     // plain index on next_attempt_at — the processRetries query still filters
     // status = 'pending', so correctness is unchanged, only the index is a
     // touch less selective.
-    var deliveriesIdxOpts = { dialect: dialect };
+    var deliveriesIdxOpts = _tableOpts(dialect);
     if (dialect !== "mysql") deliveriesIdxOpts.where = "status = 'pending'";
     var deliveriesIdx = sql.toExternalSql(sql.createIndex(deliveriesTable + "_pending_idx",
       deliveriesTable, ["next_attempt_at"], deliveriesIdxOpts), dialect);
@@ -342,7 +367,7 @@ function dispatcher(opts) {
 
     var dialect = _sqlDialect(externalDb);
     var sealedSecret = vault().seal(ep.secret);
-    var stmt = sql.insert(endpointsTable, { dialect: dialect })
+    var stmt = sql.insert(endpointsTable, _tableOpts(dialect))
       .values({
         endpoint_id:   ep.endpointId,
         url:           ep.url,
@@ -362,7 +387,7 @@ function dispatcher(opts) {
     validateOpts.requireNonEmptyString(endpointId, "removeEndpoint: endpointId",
       WebhookDispatcherError, "webhook-dispatcher/bad-opts");
     var dialect = _sqlDialect(externalDb);
-    var stmt = sql.delete(endpointsTable, { dialect: dialect })
+    var stmt = sql.delete(endpointsTable, _tableOpts(dialect))
       .where("endpoint_id", endpointId)
       .toExternalSql(dialect);
     await externalDb.query(stmt.sql, stmt.params);
@@ -371,7 +396,7 @@ function dispatcher(opts) {
 
   async function listEndpoints() {
     var dialect = _sqlDialect(externalDb);
-    var stmt = sql.select(endpointsTable, { dialect: dialect })
+    var stmt = sql.select(endpointsTable, _tableOpts(dialect))
       .columns(["endpoint_id", "url", "event_types", "disabled", "created_at"])
       .toExternalSql(dialect);
     var res = await externalDb.query(stmt.sql, stmt.params);
@@ -402,7 +427,7 @@ function dispatcher(opts) {
 
   async function _loadEndpointRow(endpointId) {
     var dialect = _sqlDialect(externalDb);
-    var stmt = sql.select(endpointsTable, { dialect: dialect })
+    var stmt = sql.select(endpointsTable, _tableOpts(dialect))
       .columns(["endpoint_id", "url", "secret_sealed", "disabled"])
       .where("endpoint_id", endpointId)
       .limit(1)
@@ -432,7 +457,7 @@ function dispatcher(opts) {
       // and double-deliver it. The inline _attemptDelivery transitions it to
       // delivered / pending(+backoff) / dead; if this process dies mid-POST,
       // _reapStaleInflight reclaims it after claimReclaimMs.
-      var insertStmt = sql.insert(deliveriesTable, { dialect: dialect })
+      var insertStmt = sql.insert(deliveriesTable, _tableOpts(dialect))
         .values({
           delivery_id:     deliveryId,
           endpoint_id:     ep.endpointId,
@@ -461,7 +486,7 @@ function dispatcher(opts) {
 
   async function _loadDelivery(deliveryId) {
     var dialect = _sqlDialect(externalDb);
-    var stmt = sql.select(deliveriesTable, { dialect: dialect })
+    var stmt = sql.select(deliveriesTable, _tableOpts(dialect))
       .columns(["delivery_id", "endpoint_id", "url", "event_type", "payload",
                 "idempotency_id", "status", "attempts"])
       .where("delivery_id", deliveryId)
@@ -536,7 +561,7 @@ function dispatcher(opts) {
 
   async function _markDelivered(deliveryId, attemptNo, status) {
     var dialect = _sqlDialect(externalDb);
-    var stmt = sql.update(deliveriesTable, { dialect: dialect })
+    var stmt = sql.update(deliveriesTable, _tableOpts(dialect))
       .set({
         status:          "delivered",
         attempts:        attemptNo,
@@ -558,7 +583,7 @@ function dispatcher(opts) {
     }
     var dialect = _sqlDialect(externalDb);
     var nextAt = new Date(clock() + _backoffMs(attemptNo));
-    var stmt = sql.update(deliveriesTable, { dialect: dialect })
+    var stmt = sql.update(deliveriesTable, _tableOpts(dialect))
       .set({
         status:          "pending",
         attempts:        attemptNo,
@@ -574,7 +599,7 @@ function dispatcher(opts) {
 
   async function _markDead(deliveryId, attemptNo, errMsg) {
     var dialect = _sqlDialect(externalDb);
-    var stmt = sql.update(deliveriesTable, { dialect: dialect })
+    var stmt = sql.update(deliveriesTable, _tableOpts(dialect))
       .set({ status: "dead", attempts: attemptNo, last_error: errMsg, claimed_at: null })
       .where("delivery_id", deliveryId)
       .toExternalSql(dialect);
@@ -590,7 +615,7 @@ function dispatcher(opts) {
   async function _reapStaleInflight() {
     var dialect = _sqlDialect(externalDb);
     var cutoff = new Date(clock() - claimReclaimMs);
-    var stmt = sql.update(deliveriesTable, { dialect: dialect })
+    var stmt = sql.update(deliveriesTable, _tableOpts(dialect))
       .set({ status: "pending", claimed_at: null })
       .whereRaw("status = 'in-flight'", [], { allowLiterals: true })
       .whereRaw("(claimed_at IS NULL OR claimed_at <= ?)", [cutoff])
@@ -625,7 +650,7 @@ function dispatcher(opts) {
     var supportsSkipLocked = _supportsForUpdateSkipLocked();
     var claimed = await externalDb.transaction(async function (xdb) {
       var nowDate = _nowDate();
-      var selBuilder = sql.select(deliveriesTable, { dialect: dialect })
+      var selBuilder = sql.select(deliveriesTable, _tableOpts(dialect))
         .columns(["delivery_id"])
         .whereRaw("status = 'pending'", [], { allowLiterals: true })
         .whereRaw("next_attempt_at <= ?", [nowDate])
@@ -636,7 +661,7 @@ function dispatcher(opts) {
       var rows = await xdb.query(sel.sql, sel.params);
       var ids = ((rows && rows.rows) || []).map(function (r) { return r.delivery_id; });
       if (ids.length === 0) return [];
-      var mark = sql.update(deliveriesTable, { dialect: dialect })
+      var mark = sql.update(deliveriesTable, _tableOpts(dialect))
         .set({ status: "in-flight", claimed_at: _nowDate() })
         .whereRaw("status = 'pending'", [], { allowLiterals: true })
         .whereInArray("delivery_id", ids)
@@ -648,7 +673,7 @@ function dispatcher(opts) {
       // sqlite / other: no row lock, so re-read which rows WE flipped. The
       // single writer serializes the gated UPDATE, so the in-flight rows in our
       // id set are ours.
-      var after = sql.select(deliveriesTable, { dialect: dialect })
+      var after = sql.select(deliveriesTable, _tableOpts(dialect))
         .columns(["delivery_id"])
         .whereRaw("status = 'in-flight'", [], { allowLiterals: true })
         .whereInArray("delivery_id", ids)
@@ -688,7 +713,7 @@ function dispatcher(opts) {
   async function _listDeliveries(filter) {
     filter = filter || {};
     var dialect = _sqlDialect(externalDb);
-    var builder = sql.select(deliveriesTable, { dialect: dialect }).columns(DELIVERY_VIEW_COLS);
+    var builder = sql.select(deliveriesTable, _tableOpts(dialect)).columns(DELIVERY_VIEW_COLS);
     if (filter.endpointId) builder.where("endpoint_id", filter.endpointId);
     if (filter.status) builder.where("status", filter.status);
     builder.orderBy("id").limit(filter.limit || DEFAULT_BATCH_SIZE);
@@ -699,7 +724,7 @@ function dispatcher(opts) {
 
   async function _getDelivery(deliveryId) {
     var dialect = _sqlDialect(externalDb);
-    var stmt = sql.select(deliveriesTable, { dialect: dialect })
+    var stmt = sql.select(deliveriesTable, _tableOpts(dialect))
       .columns(DELIVERY_VIEW_COLS)
       .where("delivery_id", deliveryId)
       .limit(1)
@@ -715,7 +740,7 @@ function dispatcher(opts) {
     validateOpts.requireNonEmptyString(deliveryId, "retry: deliveryId",
       WebhookDispatcherError, "webhook-dispatcher/bad-opts");
     var dialect = _sqlDialect(externalDb);
-    var stmt = sql.update(deliveriesTable, { dialect: dialect })
+    var stmt = sql.update(deliveriesTable, _tableOpts(dialect))
       .set({ status: "pending", attempts: 0, next_attempt_at: _nowDate(), claimed_at: null, last_error: null })
       .where("delivery_id", deliveryId)
       .toExternalSql(dialect);
@@ -724,12 +749,18 @@ function dispatcher(opts) {
   }
 
   function _emitAudit(action, outcome, metadata) {
+    // Drop-silent hot-path sinks: metadata is always an object at both call
+    // sites (so the `|| {}` guards never fire) and safeEmit / safeEvent never
+    // throw for the dispatcher's fixed string actions, so the catch arms are
+    // belt-and-suspenders the public API can't reach.
+    /* c8 ignore start */
     try {
       audit().safeEmit({ action: action, outcome: outcome, metadata: metadata || {} });
     } catch (_e) { /* audit is a drop-silent hot-path sink — never crash the delivery */ }
     try {
       observability().safeEvent(action, 1, metadata || {});
     } catch (_e) { /* drop-silent */ }
+    /* c8 ignore stop */
   }
 
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.17.23",
+  "version": "0.18.0",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:68e789d5-46ad-4384-8b09-fafa7350c7fb",
+  "serialNumber": "urn:uuid:cd7168a2-46e6-4f4b-a75c-259ff3ea2998",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-25T18:00:59.595Z",
+    "timestamp": "2026-07-27T07:19:29.355Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.17.23",
+      "bom-ref": "@blamejs/core@0.18.0",
       "type": "application",
       "name": "blamejs",
-      "version": "0.17.23",
+      "version": "0.18.0",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.17.23",
+      "purl": "pkg:npm/%40blamejs/core@0.18.0",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.17.23",
+      "ref": "@blamejs/core@0.18.0",
       "dependsOn": []
     }
   ]