@blamejs/core 0.18.54 → 0.18.56

package/lib/vendor/noble-post-quantum.cjs

@@ -1,4 +1,4 @@
-// @noble/post-quantum v0.7.0 — vendored from Paul Miller
+// @noble/post-quantum v0.7.1 — vendored from Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-post-quantum
 // Bundled with esbuild. Exports: ml_kem512 / ml_kem768 / ml_kem1024 (FIPS 203 KEM),
 //   ml_dsa44 / ml_dsa65 / ml_dsa87 (FIPS 204 lattice signatures),
@@ -124,6 +124,14 @@ var aobject = (value, label) => {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
 };
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
     throw new Error("hash was destroyed");
@@ -224,10 +232,10 @@ function concatBytes(...arrays) {
   return res;
 }
 function checkOpts(defaults, opts2, title = "opts") {
-  aobject(defaults, "defaults");
+  aopts(defaults, "defaults");
   if (opts2 !== void 0)
-    aobject(opts2, title);
-  const merged = Object.assign(defaults, opts2);
+    aopts(opts2, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts2);
   return merged;
 }
 function createHasher(hashCons, info = {}) {
@@ -686,22 +694,47 @@ function equalBytes(a, b) {
   return diff === 0;
 }
 function copyBytes(bytes) {
-  return Uint8Array.from(abytes(bytes));
+  return new Uint8Array(abytes(bytes));
 }
 function validateOpts(opts2) {
   if (isBytes(opts2))
     throw new TypeError('"opts" expected object, got Uint8Array');
   aobject3(opts2, "opts");
+  const proto = Object.getPrototypeOf(opts2);
+  if (proto !== null && proto !== Object.prototype)
+    throw new TypeError('"opts" expected a plain object');
 }
-function validateVerOpts(opts2) {
+var VER_OPT_KEYS = /* @__PURE__ */ Object.freeze([
+  "context"
+]);
+var SIG_OPT_KEYS = /* @__PURE__ */ Object.freeze([
+  "context",
+  "extraEntropy"
+]);
+function checkOptKeys(opts2, allowed) {
   validateOpts(opts2);
-  if (opts2.context !== void 0)
-    abytes(opts2.context, void 0, "opts.context");
-}
-function validateSigOpts(opts2) {
-  validateVerOpts(opts2);
-  if (opts2.extraEntropy !== false && opts2.extraEntropy !== void 0)
-    abytes(opts2.extraEntropy, void 0, "opts.extraEntropy");
+  const normalized = Object.assign(/* @__PURE__ */ Object.create(null), opts2);
+  for (const [k, v] of Object.entries(normalized)) {
+    if (v === void 0)
+      continue;
+    if (!allowed.includes(k))
+      throw new TypeError('unexpected option "' + String(k) + '"; expected one of: ' + allowed.join(", "));
+  }
+  return Object.freeze(normalized);
+}
+function validateVerOpts(opts2, allowed = VER_OPT_KEYS) {
+  const normalized = checkOptKeys(opts2, allowed);
+  if (normalized.context !== void 0)
+    abytes(normalized.context, void 0, "opts.context");
+  return normalized;
+}
+function validateSigOpts(opts2, allowed = SIG_OPT_KEYS) {
+  const normalized = checkOptKeys(opts2, allowed);
+  if (normalized.context !== void 0)
+    abytes(normalized.context, void 0, "opts.context");
+  if (normalized.extraEntropy !== false && normalized.extraEntropy !== void 0)
+    abytes(normalized.extraEntropy, void 0, "opts.extraEntropy");
+  return normalized;
 }
 function splitCoder(label, ...lengths) {
   const getLength = (c) => typeof c === "number" ? c : c.bytesLen;
@@ -786,6 +819,12 @@ function getMessage(msg, ctx = EMPTY) {
   return concatBytes(new Uint8Array([0, ctx.length]), ctx, msg);
 }
 var oidNistP = /* @__PURE__ */ Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2]);
+var XOF_OID_OUTPUT_LEN = /* @__PURE__ */ (() => ({
+  "060960864801650304020b": 32,
+  // id-shake128, SHAKE128(M, 256)
+  "060960864801650304020c": 64
+  // id-shake256, SHAKE256(M, 512)
+}))();
 function checkHash(hash, requiredStrength = 0) {
   if (typeof hash !== "function" || typeof hash.create !== "function")
     throw new TypeError('"hash" expected hash function, got type=' + typeof hash);
@@ -795,6 +834,10 @@ function checkHash(hash, requiredStrength = 0) {
   abytes(oid, void 0, "hash.oid");
   if (!equalBytes(oid.subarray(0, 10), oidNistP))
     throw new Error('"hash.oid" is invalid: expected NIST hash');
+  const xofLen = XOF_OID_OUTPUT_LEN[bytesToHex(oid)];
+  if (xofLen !== void 0 && hash.outputLen !== xofLen) {
+    throw new Error("Pre-hash XOF output length must be " + xofLen + " bytes for this OID, got: " + hash.outputLen);
+  }
   const collisionResistance = hash.outputLen * 8 / 2;
   if (requiredStrength > collisionResistance) {
     throw new Error("Pre-hash security strength too low: " + collisionResistance + ", required: " + requiredStrength);
@@ -1162,8 +1205,9 @@ var genKPKE = (opts_) => {
       for (let i = 0; i < K; i++)
         polyAdd(tmp, MultiplyNTTs(sk[i], crystals.NTT.encode(u[i])));
       polySub(v, crystals.NTT.decode(tmp));
-      cleanBytes(tmp, sk, u);
-      return poly1.encode(v);
+      const res = poly1.encode(v);
+      cleanBytes(tmp, sk, u, v);
+      return res;
     }
   };
 };
@@ -1193,32 +1237,55 @@ function createKyber(opts2) {
   return Object.freeze({
     info: Object.freeze({ type: "ml-kem" }),
     lengths: kemLengths,
-    keygen: (seed = randomBytes2(seedLen)) => {
-      abytesDoc(seed, seedLen, "seed");
-      const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
-      const publicKeyHash = HASH256(publicKey);
-      const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
-      cleanBytes(sk, publicKeyHash);
-      return {
-        publicKey,
-        secretKey
-      };
+    keygen: (seed) => {
+      const ownSeed = seed === void 0;
+      const s = ownSeed ? randomBytes2(seedLen) : seed;
+      let sk;
+      let publicKeyHash;
+      try {
+        abytesDoc(s, seedLen, "seed");
+        const keys = KPKE.keygen(s.subarray(0, 32));
+        const publicKey = keys.publicKey;
+        sk = keys.secretKey;
+        publicKeyHash = HASH256(publicKey);
+        const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, s.subarray(32)]);
+        return {
+          publicKey,
+          secretKey
+        };
+      } finally {
+        if (sk !== void 0)
+          cleanBytes(sk);
+        if (publicKeyHash !== void 0)
+          cleanBytes(publicKeyHash);
+        if (ownSeed)
+          cleanBytes(s);
+      }
     },
     getPublicKey: (secretKey) => {
       const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
       return Uint8Array.from(publicKey);
     },
-    encapsulate: (publicKey, msg = randomBytes2(msgLen)) => {
-      abytesDoc(publicKey, lengths.publicKey, "publicKey");
-      abytesDoc(msg, msgLen, "message");
-      validateModulus(publicKey, "encapsulate");
-      const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
-      const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
-      cleanBytes(kr.subarray(32));
-      return {
-        cipherText,
-        sharedSecret: kr.subarray(0, 32)
-      };
+    encapsulate: (publicKey, msg) => {
+      const ownMsg = msg === void 0;
+      const m = ownMsg ? randomBytes2(msgLen) : msg;
+      let kr;
+      try {
+        abytesDoc(publicKey, lengths.publicKey, "publicKey");
+        abytesDoc(m, msgLen, "message");
+        validateModulus(publicKey, "encapsulate");
+        kr = HASH512.create().update(m).update(HASH256(publicKey)).digest();
+        const cipherText = KPKE.encrypt(publicKey, m, kr.subarray(32, 64));
+        return {
+          cipherText,
+          sharedSecret: kr.subarray(0, 32)
+        };
+      } finally {
+        if (kr !== void 0)
+          cleanBytes(kr.subarray(32));
+        if (ownMsg)
+          cleanBytes(m);
+      }
     },
     decapsulate: (cipherText, secretKey) => {
       abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");
@@ -1251,15 +1318,24 @@ function createKyber(opts2) {
       const cached = KPKE.prepare(ek);
       return Object.freeze({
         publicKey: ek,
-        encapsulate: (msg = randomBytes2(msgLen)) => {
-          abytesDoc(msg, msgLen, "message");
-          const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
-          const cipherText = cached.encrypt(msg, kr.subarray(32, 64));
-          cleanBytes(kr.subarray(32));
-          return {
-            cipherText,
-            sharedSecret: kr.subarray(0, 32)
-          };
+        encapsulate: (msg) => {
+          const ownMsg = msg === void 0;
+          const m = ownMsg ? randomBytes2(msgLen) : msg;
+          let kr;
+          try {
+            abytesDoc(m, msgLen, "message");
+            kr = HASH512.create().update(m).update(publicKeyHash).digest();
+            const cipherText = cached.encrypt(m, kr.subarray(32, 64));
+            return {
+              cipherText,
+              sharedSecret: kr.subarray(0, 32)
+            };
+          } finally {
+            if (kr !== void 0)
+              cleanBytes(kr.subarray(32));
+            if (ownMsg)
+              cleanBytes(m);
+          }
         },
         decapsulate: (cipherText, secretKey) => {
           abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");
@@ -1300,10 +1376,16 @@ var ml_kem768 = /* @__PURE__ */ (() => mk(PARAMS[768]))();
 var ml_kem1024 = /* @__PURE__ */ (() => mk(PARAMS[1024]))();
 
 // node_modules/@noble/post-quantum/ml-dsa.js
-function validateInternalOpts(opts2) {
-  validateOpts(opts2);
-  if (opts2.externalMu !== void 0)
-    abool2(opts2.externalMu, "opts.externalMu");
+var INTERNAL_SIG_OPT_KEYS = /* @__PURE__ */ Object.freeze([
+  "extraEntropy",
+  "externalMu"
+]);
+var INTERNAL_VER_OPT_KEYS = /* @__PURE__ */ Object.freeze(["externalMu"]);
+function validateInternalOpts(opts2, allowed) {
+  const normalized = checkOptKeys(opts2, allowed);
+  if (normalized.externalMu !== void 0)
+    abool2(normalized.externalMu, "opts.externalMu");
+  return normalized;
 }
 var N2 = 256;
 var Q2 = 8380417;
@@ -1646,8 +1728,8 @@ function getDilithium(opts_) {
     },
     // NOTE: random is optional.
     sign: (msg, secretKey, opts3 = {}) => {
-      validateSigOpts(opts3);
-      validateInternalOpts(opts3);
+      opts3 = validateSigOpts(opts3, INTERNAL_SIG_OPT_KEYS);
+      opts3 = validateInternalOpts(opts3, INTERNAL_SIG_OPT_KEYS);
       const { extraEntropy: random, externalMu = false } = opts3;
       if (externalMu)
         abytesDoc(msg, CRH_BYTES, "mu");
@@ -1708,26 +1790,34 @@ function getDilithium(opts_) {
         const cs1 = s1.map((i) => MultiplyNTTs2(i, cHat));
         for (let i = 0; i < L; i++) {
           polyAdd2(crystals2.NTT.decode(cs1[i]), y[i]);
-          if (polyChknorm(cs1[i], GAMMA1 - BETA))
+          if (polyChknorm(cs1[i], GAMMA1 - BETA)) {
+            cleanBytes(cTilde, cs1, cHat, w1, w, z, y);
             continue main_loop;
+          }
         }
         let cnt = 0;
         const h = [];
         for (let i = 0; i < K; i++) {
           const cs2 = crystals2.NTT.decode(MultiplyNTTs2(s2[i], cHat));
           const r0 = polySub2(w[i], cs2).map(LowBits);
-          if (polyChknorm(r0, GAMMA2 - BETA))
+          if (polyChknorm(r0, GAMMA2 - BETA)) {
+            cleanBytes(cTilde, cs1, cHat, w1, w, z, y, h, cs2, r0);
             continue main_loop;
+          }
           const ct0 = crystals2.NTT.decode(MultiplyNTTs2(t0[i], cHat));
-          if (polyChknorm(ct0, GAMMA2))
+          if (polyChknorm(ct0, GAMMA2)) {
+            cleanBytes(cTilde, cs1, cHat, w1, w, z, y, h, cs2, r0, ct0);
             continue main_loop;
+          }
           polyAdd2(r0, ct0);
           const hint = polyMakeHint(r0, w1[i]);
           h.push(hint.v);
           cnt += hint.cnt;
         }
-        if (cnt > OMEGA)
+        if (cnt > OMEGA) {
+          cleanBytes(cTilde, cs1, cHat, w1, w, z, y, h);
           continue;
+        }
         x256.clean();
         const res = sigCoder.encode([cTilde, cs1, h]);
         cleanBytes(cTilde, cs1, h, cHat, w1, w, z, y, rhoprime, s1, s2, t0, ...A);
@@ -1738,7 +1828,7 @@ function getDilithium(opts_) {
       throw new Error("Unreachable code path reached, report this error");
     },
     verify: (sig, msg, publicKey, opts3 = {}) => {
-      validateInternalOpts(opts3);
+      opts3 = validateInternalOpts(opts3, INTERNAL_VER_OPT_KEYS);
       const { externalMu = false } = opts3;
       if (externalMu)
         abytesDoc(msg, CRH_BYTES, "mu");
@@ -1793,16 +1883,19 @@ function getDilithium(opts_) {
     lengths: internal.lengths,
     getPublicKey: internal.getPublicKey,
     sign: (msg, secretKey, opts3 = {}) => {
-      validateSigOpts(opts3);
+      opts3 = validateSigOpts(opts3);
       const M = getMessage(msg, opts3.context);
-      const res = internal.sign(M, secretKey, opts3);
+      const res = internal.sign(M, secretKey, {
+        extraEntropy: opts3.extraEntropy,
+        externalMu: false
+      });
       cleanBytes(M);
       return res;
     },
     verify: (sig, msg, publicKey, opts3 = {}) => {
-      validateVerOpts(opts3);
+      opts3 = validateVerOpts(opts3);
       abytesDoc(sig, void 0, "signature");
-      return internal.verify(sig, getMessage(msg, opts3.context), publicKey);
+      return internal.verify(sig, getMessage(msg, opts3.context), publicKey, { externalMu: false });
     },
     prehash: (hash) => {
       checkHash(hash, securityLevel);
@@ -1814,16 +1907,21 @@ function getDilithium(opts_) {
         keygen: internal.keygen,
         getPublicKey: internal.getPublicKey,
         sign: (msg, secretKey, opts3 = {}) => {
-          validateSigOpts(opts3);
+          opts3 = validateSigOpts(opts3);
           const M = getMessagePrehash(rawHash, msg, opts3.context);
-          const res = internal.sign(M, secretKey, opts3);
+          const res = internal.sign(M, secretKey, {
+            extraEntropy: opts3.extraEntropy,
+            externalMu: false
+          });
           cleanBytes(M);
           return res;
         },
         verify: (sig, msg, publicKey, opts3 = {}) => {
-          validateVerOpts(opts3);
+          opts3 = validateVerOpts(opts3);
           abytesDoc(sig, void 0, "signature");
-          return internal.verify(sig, getMessagePrehash(rawHash, msg, opts3.context), publicKey);
+          return internal.verify(sig, getMessagePrehash(rawHash, msg, opts3.context), publicKey, {
+            externalMu: false
+          });
         }
       });
     }
@@ -2463,6 +2561,8 @@ var sha512 = /* @__PURE__ */ createHasher(
 );
 
 // node_modules/@noble/post-quantum/slh-dsa.js
+var INTERNAL_SIG_OPT_KEYS2 = /* @__PURE__ */ Object.freeze(["extraEntropy"]);
+var INTERNAL_VER_OPT_KEYS2 = /* @__PURE__ */ Object.freeze([]);
 var PARAMS3 = /* @__PURE__ */ (() => Object.freeze({
   "128f": Object.freeze({ W: 16, N: 16, H: 66, D: 22, K: 33, A: 6, securityLevel: 128 }),
   "128s": Object.freeze({ W: 16, N: 16, H: 63, D: 7, K: 14, A: 12, securityLevel: 128 }),
@@ -2533,8 +2633,16 @@ function gen(opts2, hashOpts_) {
     OFFSET_HASH_ADDR += 10;
   }
   const setAddr = (opts3, addr = new Uint8Array(ADDR_BYTES)) => {
-    const { type, height, tree, layer, index, chain, hash, keypair } = opts3;
-    const { subtreeAddr, keypairAddr } = opts3;
+    const type = Object.hasOwn(opts3, "type") ? opts3.type : void 0;
+    const height = Object.hasOwn(opts3, "height") ? opts3.height : void 0;
+    const tree = Object.hasOwn(opts3, "tree") ? opts3.tree : void 0;
+    const layer = Object.hasOwn(opts3, "layer") ? opts3.layer : void 0;
+    const index = Object.hasOwn(opts3, "index") ? opts3.index : void 0;
+    const chain = Object.hasOwn(opts3, "chain") ? opts3.chain : void 0;
+    const hash = Object.hasOwn(opts3, "hash") ? opts3.hash : void 0;
+    const keypair = Object.hasOwn(opts3, "keypair") ? opts3.keypair : void 0;
+    const subtreeAddr = Object.hasOwn(opts3, "subtreeAddr") ? opts3.subtreeAddr : void 0;
+    const keypairAddr = Object.hasOwn(opts3, "keypairAddr") ? opts3.keypairAddr : void 0;
     if (height !== void 0)
       addr[OFFSET_CHAIN_ADDR] = height;
     if (layer !== void 0)
@@ -2735,7 +2843,7 @@ function gen(opts2, hashOpts_) {
       return Uint8Array.from(pk);
     },
     sign: (msg, sk, opts3 = {}) => {
-      validateSigOpts(opts3);
+      opts3 = validateSigOpts(opts3, INTERNAL_SIG_OPT_KEYS2);
       let { extraEntropy: random } = opts3;
       const [skSeed, skPRF, pk] = secretCoder.decode(sk);
       const [pkSeed, _] = publicCoder.decode(pk);
@@ -2793,7 +2901,8 @@ function gen(opts2, hashOpts_) {
       cleanBytes(R, random, treeAddr, wotsAddr, forsLeaf, forsTreeAddr, indices, roots);
       return SIG;
     },
-    verify: (sig, msg, publicKey) => {
+    verify: (sig, msg, publicKey, opts3 = {}) => {
+      validateVerOpts(opts3, INTERNAL_VER_OPT_KEYS2);
       const [pkSeed, pubRoot] = publicCoder.decode(publicKey);
       const pk = publicKey;
       abytesDoc(sig, void 0, "signature");
@@ -2860,14 +2969,14 @@ function gen(opts2, hashOpts_) {
     keygen: internal.keygen,
     getPublicKey: internal.getPublicKey,
     sign: (msg, secretKey, opts3 = {}) => {
-      validateSigOpts(opts3);
+      opts3 = validateSigOpts(opts3);
       const M = getMessage(msg, opts3.context);
-      const res = internal.sign(M, secretKey, opts3);
+      const res = internal.sign(M, secretKey, { extraEntropy: opts3.extraEntropy });
       cleanBytes(M);
       return res;
     },
     verify: (sig, msg, publicKey, opts3 = {}) => {
-      validateVerOpts(opts3);
+      opts3 = validateVerOpts(opts3);
       return internal.verify(sig, getMessage(msg, opts3.context), publicKey);
     },
     prehash: (hash) => {
@@ -2879,14 +2988,14 @@ function gen(opts2, hashOpts_) {
         keygen: internal.keygen,
         getPublicKey: internal.getPublicKey,
         sign: (msg, secretKey, opts3 = {}) => {
-          validateSigOpts(opts3);
+          opts3 = validateSigOpts(opts3);
           const M = getMessagePrehash(rawHash, msg, opts3.context);
-          const res = internal.sign(M, secretKey, opts3);
+          const res = internal.sign(M, secretKey, { extraEntropy: opts3.extraEntropy });
           cleanBytes(M);
           return res;
         },
         verify: (sig, msg, publicKey, opts3 = {}) => {
-          validateVerOpts(opts3);
+          opts3 = validateVerOpts(opts3);
           return internal.verify(sig, getMessagePrehash(rawHash, msg, opts3.context), publicKey);
         }
       });
@@ -2931,7 +3040,7 @@ var genShake2 = () => (opts2) => (pubSeed, skSeed) => {
     }
   };
 };
-var SHAKE_SIMPLE = /* @__PURE__ */ (() => ({ getContext: genShake2() }))();
+var SHAKE_SIMPLE = /* @__PURE__ */ (() => ({ isCompressed: false, getContext: genShake2() }))();
 var slh_dsa_shake_128f = /* @__PURE__ */ (() => gen(PARAMS3["128f"], SHAKE_SIMPLE))();
 var slh_dsa_shake_192f = /* @__PURE__ */ (() => gen(PARAMS3["192f"], SHAKE_SIMPLE))();
 var slh_dsa_shake_256f = /* @__PURE__ */ (() => gen(PARAMS3["256f"], SHAKE_SIMPLE))();

package/lib/watcher.js

@@ -231,7 +231,7 @@ var AUTO_PROBE_POLL_FSTYPES = new Set([
   "vboxsf",
 ]);
 
-function _detectAutoMode(rootPath) {
+function _detectAutoMode(rootPath, probe) {
   // Sync probe — looks at the kernel's view of the mount carrying the
   // watcher's root and decides whether fs.watch will deliver events.
   // Three signals contribute, in priority order:
@@ -246,7 +246,21 @@ function _detectAutoMode(rootPath) {
   //   3. Otherwise — fs.
   //
   // Returns { mode, reason, fsType, inContainer }.
-  if (process.platform !== "linux") {
+  // Injectable so the branches that only exist on a restricted Linux can be
+  // driven from any host. A rule about what happens when mountinfo cannot be
+  // read is untestable while reaching it requires unmounting /proc.
+  var platform = (probe && probe.platform) || process.platform;
+  var readEntries = (probe && probe.readEntries) ||
+    function () { return safeMountInfo.read(); };
+  // Injected for the same reason as readEntries, and for one more: "/.dockerenv"
+  // is drive-relative on Windows, so a direct probe there asks about C:\.dockerenv
+  // rather than about being in a container. It is only reached below the
+  // non-Linux return, but reaching a POSIX path through the injected reader is
+  // what keeps that ordering from being the only thing holding it up.
+  var exists = (probe && probe.exists) ||
+    function (p) { return nodeFs.existsSync(p); };
+
+  if (platform !== "linux") {
     // macOS + Windows fs.watch backends use FSEvents + ReadDirectoryChangesW
     // respectively, which DO deliver recursive events natively for
     // operator-owned local filesystems. Containerized Linux is the
@@ -255,7 +269,7 @@ function _detectAutoMode(rootPath) {
   }
 
   var inContainer = false;
-  try { inContainer = nodeFs.existsSync("/.dockerenv"); }
+  try { inContainer = exists("/.dockerenv"); }
   catch (_e) { inContainer = false; }
 
   // Route through b.safeMountInfo — single canonical parser that
@@ -263,13 +277,23 @@ function _detectAutoMode(rootPath) {
   // mount check below. Pre-v0.11.6 this parsed inline; centralizing
   // it means future container-escape / sealed-store / sandbox call
   // sites inherit the discipline.
-  var entries = safeMountInfo.read();
+  var entries = readEntries();
+  // Not knowing which filesystem this is resolves toward polling, not toward
+  // fs.watch. On Linux mountinfo is always there, so failing to read it means
+  // /proc is unmounted or restricted — which is the containerized case this
+  // probe exists for, and the one where inotify is least likely to deliver.
+  // The two answers are not symmetric: polling costs stat calls the operator
+  // can see, while fs.watch on a filesystem that does not chain inotify drops
+  // events silently and nothing downstream can tell that it did.
   if (entries === null || entries.length === 0) {
-    return { mode: "fs", reason: "no-mountinfo", fsType: null, inContainer: inContainer };
+    return { mode: "poll", reason: "no-mountinfo", fsType: null, inContainer: inContainer };
   }
   var bestMatch = safeMountInfo.bestMatch(entries, rootPath);
   if (!bestMatch) {
-    return { mode: "fs", reason: "no-mount-match", fsType: null, inContainer: inContainer };
+    // Same reasoning: "/" matches every path on a healthy Linux, so no match
+    // means the mount table did not describe this root and its fstype is
+    // unknown rather than known-good.
+    return { mode: "poll", reason: "no-mount-match", fsType: null, inContainer: inContainer };
   }
   if (AUTO_PROBE_POLL_FSTYPES.has(bestMatch.fstype)) {
     return {
@@ -687,4 +711,5 @@ module.exports = {
   // create() enforces, instead of pinning hand-copied mirror constants.
   MAX_IGNORE_PATTERN_LEN: MAX_IGNORE_PATTERN_LEN,
   MAX_IGNORE_STAR_COUNT:  MAX_IGNORE_STAR_COUNT,
+  _detectAutoModeForTest: _detectAutoMode,
 };

package/lib/ws-client.js

@@ -361,7 +361,12 @@ class WsClient extends EventEmitter {
       allowInternal: opts.allowInternal,
       errorClass:    WsClientError,
     });
-    this._ssrfPinnedIps = probe && probe.ips ? probe.ips : null;
+    // `null` when the gate produced no pin at all, the array when it did —
+    // including an EMPTY one. An empty pin means the gate admitted no address,
+    // so there is nothing to connect to; treating it as "no pin" would hand the
+    // connect back to the ordinary resolver and re-open the rebinding window
+    // the pin exists to close.
+    this._ssrfPinnedIps = probe && Array.isArray(probe.ips) ? probe.ips : null;
     this._dialParsed    = dialParsed;
     this._dialTlsOpts   = dialTlsOpts;
   }
@@ -405,12 +410,22 @@ class WsClient extends EventEmitter {
     // private one between the check and the connect.
     var pinnedIps = self._ssrfPinnedIps || null;
     var lookup = null;
-    if (pinnedIps && pinnedIps.length > 0) {
+    if (pinnedIps) {
       lookup = function (h, lookupOpts, cb) {
         // Node's lookup callback signatures:
         //   (err, address, family) for legacy { all: false } (default)
         //   (err, addresses)        for { all: true }
         if (typeof lookupOpts === "function") { cb = lookupOpts; lookupOpts = {}; }
+        // An empty pin admits no address, so there is nothing to connect to.
+        // Answer the lookup with an error, which fails the dial through the
+        // socket's ordinary error path — reading `pinnedIps[0].address` here
+        // would throw a TypeError out of a lookup callback instead, which is a
+        // crash rather than a refusal.
+        if (pinnedIps.length === 0) {
+          var noneErr = new Error("ws.connect: the SSRF gate admitted no address for " + h);
+          noneErr.code = "ENOTFOUND";
+          return cb(noneErr);
+        }
         var first = pinnedIps[0];
         if (lookupOpts && lookupOpts.all) {
           return cb(null, pinnedIps.map(function (ip) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.54",
+  "version": "0.18.56",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:df56ad31-5a1c-4fe3-91c9-28416a675962",
+  "serialNumber": "urn:uuid:e4edcf7d-70cf-4995-b5eb-587eff95c384",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-25T01:22:53.297Z",
+    "timestamp": "2026-08-28T06:45:48.742Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.54",
+      "bom-ref": "@blamejs/core@0.18.56",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.54",
+      "version": "0.18.56",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.54",
+      "purl": "pkg:npm/%40blamejs/core@0.18.56",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.54",
+      "ref": "@blamejs/core@0.18.56",
       "dependsOn": []
     }
   ]