@blamejs/blamejs-shop 0.5.4 → 0.5.6

package/lib/vendor/blamejs/lib/middleware/host-allowlist.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * host-allowlist — DNS rebinding defense.

package/lib/vendor/blamejs/lib/middleware/idempotency-key.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.idempotencyKey
@@ -45,6 +47,7 @@ var lazyRequire   = require("../lazy-require");
 var numericBounds = require("../numeric-bounds");
 var validateOpts  = require("../validate-opts");
 var safeBuffer    = require("../safe-buffer");
+var requestHelpers = require("../request-helpers");
 var safeJson      = require("../safe-json");
 var safeSql       = require("../safe-sql");
 var sql           = require("../sql");
@@ -537,6 +540,18 @@ function _validateStore(store, where) {
     where + ": store", IdempotencyError, "idempotency/bad-store", true);
 }
 
+// Bind the idempotency slot to the authenticated principal. Without it the
+// slot is keyed on the client Idempotency-Key alone, so principal B is
+// served principal A's cached response (cross-actor disclosure), or A can
+// pre-seed a key to force a 422 on B (cross-actor denial), via a shared or
+// guessed key. Mirrors b.agent.idempotency's (method, actorId, key) binding.
+// Falls back to "anon" only when no principal is resolvable — mount this
+// middleware AFTER authentication so the request carries the principal.
+function _defaultScope(req) {
+  var actor = requestHelpers.extractActorContext(req);
+  return actor && typeof actor.userId === "string" && actor.userId ? actor.userId : "anon";
+}
+
 function _fingerprintRequest(req, bodyBytes, store) {
   // Fingerprint preimage = method + path + body. Per the draft §4.3,
   // a key+body mismatch is a client-side mistake; our preimage covers
@@ -676,6 +691,13 @@ function create(opts) {
     opts.bodyFingerprint, "idempotencyKey.bodyFingerprint",
     IdempotencyError, "idempotency/bad-body-fingerprint"
   ) || null;
+  // Principal scope for the idempotency slot (see _defaultScope). Binds the
+  // cache key to the authenticated actor so one principal cannot read or
+  // 422-poison another's slot via a shared / guessed Idempotency-Key.
+  // Operators with a non-standard principal shape override via opts.scopeFn.
+  var scopeFn = validateOpts.optionalFunction(
+    opts.scopeFn, "idempotencyKey.scopeFn",
+    IdempotencyError, "idempotency/bad-scope-fn") || _defaultScope;
   // Default "deny" refuses body-bearing requests that
   // arrive with neither req._rawBody / req.body NOR an operator-
   // supplied bodyFingerprint hook. The silent-degrade-to-method+path
@@ -730,6 +752,12 @@ function create(opts) {
       return problemDetails().respond(res, bad);
     }
 
+    // Scope the store slot to the authenticated principal (length-prefixed
+    // so the scope/key boundary is unambiguous) — a shared or guessed
+    // Idempotency-Key cannot cross the actor boundary.
+    var scope = String(scopeFn(req) || "anon");
+    var scopedKey = scope.length + ":" + scope + ":" + key;
+
     var bodyBytes;
     if (bodyFingerprintFn) {
       // Operator-supplied hook — called after body-parser so req.body
@@ -801,7 +829,7 @@ function create(opts) {
     var fingerprint = _fingerprintRequest(req, bodyBytes, opts.store);
 
     var cached = null;
-    try { cached = opts.store.get(key); }
+    try { cached = opts.store.get(scopedKey); }
     catch (_storeErr) {
       // Store-read failure — emit audit + treat as miss. Idempotency is
       // a best-effort optimization; the handler runs anyway.
@@ -887,7 +915,7 @@ function create(opts) {
           } catch (_e) { /* ignore */ }
           var combined = collector.result();
           try {
-            opts.store.set(key, {
+            opts.store.set(scopedKey, {
               fingerprint: fingerprint,
               statusCode:  status,
               headers:     headerMap,

package/lib/vendor/blamejs/lib/middleware/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * HTTP middleware — request-lifecycle hardening primitives.

package/lib/vendor/blamejs/lib/middleware/nel.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.nel

package/lib/vendor/blamejs/lib/middleware/network-allowlist.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * network-allowlist — restrict an opt-named set of paths to operator-

package/lib/vendor/blamejs/lib/middleware/no-cache.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.noCache

package/lib/vendor/blamejs/lib/middleware/openapi-serve.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * openapi-serve middleware — expose an OpenAPI 3.1 document as a

package/lib/vendor/blamejs/lib/middleware/protected-resource-metadata.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.protectedResourceMetadata

package/lib/vendor/blamejs/lib/middleware/rate-limit.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Rate-limit middleware — pluggable backend, default in-memory.

package/lib/vendor/blamejs/lib/middleware/request-id.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Request-ID middleware. Propagates an existing X-Request-Id header

package/lib/vendor/blamejs/lib/middleware/request-log.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * request-log — HTTP access-log middleware. Captures method, path,
@@ -29,6 +31,7 @@
  * for fully custom logic (e.g. "warn" only on slow-path requests).
  */
 var C = require("../constants");
+var guardRegex = require("../guard-regex");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 
@@ -95,6 +98,9 @@ function create(opts) {
     if (typeof skipPaths[i] !== "string" && !(skipPaths[i] instanceof RegExp)) {
       throw new Error("middleware.requestLog: skipPaths[" + i + "] must be a string prefix or RegExp");
     }
+    if (skipPaths[i] instanceof RegExp) {
+      guardRegex.assertSafe(skipPaths[i], "middleware.requestLog: skipPaths[" + i + "]");
+    }
   }
   var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
     ? opts.trustProxy : false;

package/lib/vendor/blamejs/lib/middleware/require-aal.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * require-aal middleware — gate routes by NIST SP 800-63-4 AAL band.

package/lib/vendor/blamejs/lib/middleware/require-auth.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * require-auth middleware — gates routes that require an authenticated

package/lib/vendor/blamejs/lib/middleware/require-bound-key.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * requireBoundKey middleware — Bearer-API-key auth with scope + bound-

package/lib/vendor/blamejs/lib/middleware/require-content-type.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * require-content-type middleware — refuses requests with a body

package/lib/vendor/blamejs/lib/middleware/require-methods.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * require-methods middleware — refuses HTTP methods outside an

package/lib/vendor/blamejs/lib/middleware/require-mtls.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * requireMtls middleware — soft-enforcement gate for routes that

package/lib/vendor/blamejs/lib/middleware/require-step-up.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * require-step-up middleware — gate routes per RFC 9470 OAuth 2.0
@@ -64,6 +66,30 @@ function _defaultGetClaims(req) {
   return null;
 }
 
+// Resolve the authenticated principal an elevation grant must be bound to.
+// The principal subject lives under different keys depending on the
+// authenticator: a session populates req.user.id / req.user.userId, while
+// bearerAuth with an external JWT verifier (auth.jwt.verifyExternal)
+// populates req.user.claims.sub (or a flattened req.user.sub) — the same
+// shapes _defaultGetClaims reads. Resolving all of them keeps a grant
+// legitimately minted for a claims.sub principal from being silently
+// dropped to a 401. Returns undefined when no principal is resolvable, in
+// which case the caller refuses the grant path (fail-closed: an unbound or
+// mismatched subject can only narrow what a grant satisfies, never widen).
+function _resolveStepUpPrincipal(req) {
+  if (!req || typeof req !== "object" || !req.user || typeof req.user !== "object") {
+    return undefined;
+  }
+  var u = req.user;
+  if (u.id != null)     return u.id;
+  if (u.userId != null) return u.userId;
+  if (u.claims && typeof u.claims === "object" && u.claims.sub != null) {
+    return u.claims.sub;
+  }
+  if (u.sub != null)    return u.sub;
+  return undefined;
+}
+
 function _writeChallenge(res, challenge, body, statusCode) {
   if (res.headersSent) return;
   var json = JSON.stringify(body);
@@ -159,7 +185,22 @@ function create(opts) {
       if (typeof grantToken === "string" && grantToken.length > 0) {
         var verifyOpts = {};
         if (grantScope) verifyOpts.scope = grantScope;
-        var grantResult = elevation().verify(grantToken, verifyOpts);
+        // Bind the grant to the authenticated principal: an elevation grant
+        // carries its subject (payload.sub) and must only satisfy step-up for
+        // THAT subject. Without this, a grant minted for one user (leaked via a
+        // shared cache / log / kiosk) elevates ANY other authenticated user's
+        // session — a cross-user step-up replay. When no principal is resolvable
+        // the grant cannot be bound, so the grant path is refused (the request
+        // falls through to the claims-based path / 401 challenge).
+        var stepUpPrincipal = _resolveStepUpPrincipal(req);
+        var grantResult;
+        if (stepUpPrincipal == null) {
+          grantResult = { ok: false, error: "no_principal",
+                          reason: "step-up grant requires an authenticated principal to bind to" };
+        } else {
+          verifyOpts.subject = stepUpPrincipal;
+          grantResult = elevation().verify(grantToken, verifyOpts);
+        }
         if (grantResult.ok) {
           if (auditOn) {
             try {

package/lib/vendor/blamejs/lib/middleware/scim-server.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // SCIM 2.0 server middleware (RFC 7642 / 7643 / 7644).
 // Provides /Users + /Groups + /ServiceProviderConfig + /ResourceTypes

package/lib/vendor/blamejs/lib/middleware/security-headers.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Security headers middleware. Sets the headers every modern app should

package/lib/vendor/blamejs/lib/middleware/security-txt.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * security-txt middleware — RFC 9116 /.well-known/security.txt emitter.

package/lib/vendor/blamejs/lib/middleware/span-http-server.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * spanHttpServer middleware — auto-creates a root span per HTTP
@@ -49,6 +51,7 @@ var { defineClass } = require("../framework-error");
 var SpanHttpError = defineClass("SpanHttpError", { alwaysPermanent: true });
 
 var observability = lazyRequire(function () { return require("../observability"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 
 function _shouldIgnore(path, ignorePaths) {
   if (!ignorePaths || !Array.isArray(ignorePaths)) return false;
@@ -177,6 +180,15 @@ function create(opts) {
   var tracer            = opts.tracer;
   var onEnd             = opts.onEnd || null;
   var ignorePaths       = opts.ignorePaths || null;
+  if (Array.isArray(ignorePaths)) {
+    for (var ip = 0; ip < ignorePaths.length; ip++) {
+      if (ignorePaths[ip] instanceof RegExp) {
+        guardRegex().assertSafe(ignorePaths[ip],
+          "middleware.spanHttpServer: ignorePaths[" + ip + "]",
+          SpanHttpError, "span-http/unsafe-pattern");
+      }
+    }
+  }
   var captureReqHeaders = opts.captureRequestHeaders || null;
   var captureResHeaders = opts.captureResponseHeaders || null;
   var spanNameFn        = opts.spanNameFn || null;

package/lib/vendor/blamejs/lib/middleware/speculation-rules.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.speculationRules

package/lib/vendor/blamejs/lib/middleware/sse.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * sse — Server-Sent Events middleware. One-way streaming from server

package/lib/vendor/blamejs/lib/middleware/trace-log-correlation.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * trace-log-correlation middleware — wraps the operator's b.log

package/lib/vendor/blamejs/lib/middleware/trace-propagate.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * trace-propagate middleware — consumes the inbound `traceparent`

package/lib/vendor/blamejs/lib/middleware/tus-upload.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * TUS resumable upload middleware (tus.io v1.0.0).

package/lib/vendor/blamejs/lib/middleware/web-app-manifest.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * web-app-manifest middleware — emits the W3C Web App Manifest at

package/lib/vendor/blamejs/lib/migration-files.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * migration-files — shared filename-shape primitive.

package/lib/vendor/blamejs/lib/migrations.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * migrations — public migration runner with up / down / status.

package/lib/vendor/blamejs/lib/mime-parse.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * mime-parse — minimal RFC 5322 + RFC 2045 + RFC 2046 reader shared by
@@ -37,6 +39,8 @@
  * mdn: 1 MiB) so this module's hot-path doesn't add its own cap.
  */
 
+var pick = require("./pick");
+
 function classifyHeaderBlock(text) {
   // RFC 5322 §2.2 — every line of a header section is either a header field
   // (`name: value`), a folding continuation (leading WSP), or the empty line
@@ -153,7 +157,7 @@ function parseContentType(value) {
       pval = rest.slice(j, endTok).trim();
       i = endTok;
     }
-    params[pname] = pval;
+    if (!pick.isPoisonedKey(pname)) params[pname] = pval;
   }
   return { type: typePart, params: params };
 }

package/lib/vendor/blamejs/lib/module-loader.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * lib/module-loader.js — the single audited entry point for loading an

package/lib/vendor/blamejs/lib/money.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module    b.money

package/lib/vendor/blamejs/lib/mtls-ca.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mtlsCa

package/lib/vendor/blamejs/lib/mtls-engine-default.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * mtls-engine-default — pure-JS X.509 engine wired into b.mtlsCa.

package/lib/vendor/blamejs/lib/network-byte-quota.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.network.byteQuota — per-key rolling 24-hour byte budget primitive.
@@ -51,6 +53,10 @@ var ByteQuotaError = defineClass("ByteQuotaError", { alwaysPermanent: true });
 
 var BINS_PER_DAY = 24;                                                                  // 24 hours in a day
 var BIN_MS = C.TIME.hours(1);
+// Outer retries when the cache's internal CAS exhausts under a concurrency
+// burst on one key — absorbs the burst so a charge is not dropped (each retry
+// re-reads the latest counter). Total CAS attempts ≈ this × the cache's own 5.
+var ACCOUNT_MAX_RETRIES = 6;
 
 function _hourBin(nowMs) { return Math.floor(nowMs / BIN_MS); }
 function _newEntry()    { return { bins: new Array(BINS_PER_DAY).fill(0), startHour: 0 }; }
@@ -108,22 +114,44 @@ function _memoryBackend() {
 
 function _cacheBackend(cache) {
   function _key(k) { return "byteQuota:" + k; }
-  async function _read(key) {
-    var raw = await cache.get(_key(key));
+  function _coerce(raw) {
     return raw && typeof raw === "object" && Array.isArray(raw.bins) ? raw : _newEntry();
   }
   return {
     async total(key, nowMs) {
-      var entry = await _read(key);
-      var slid = _slideAndSum(entry, _hourBin(nowMs));
-      if (slid.moved) await cache.set(_key(key), slid.entry, { ttlMs: BIN_MS * BINS_PER_DAY });
+      // Read-only: slide + sum without writing back. A writeback here would
+      // race a concurrent account() — it could read the pre-increment entry
+      // and clobber the increment (lost update). The slide is recomputed on
+      // every read/account, so persisting it is a pure optimization not worth
+      // the clobber risk.
+      var slid = _slideAndSum(_coerce(await cache.get(_key(key))), _hourBin(nowMs));
       return slid.total;
     },
     async account(key, bytes, nowMs) {
-      var entry = await _read(key);
-      var slid = _slideAndSum(entry, _hourBin(nowMs));
-      slid.entry.bins[BINS_PER_DAY - 1] += bytes;
-      await cache.set(_key(key), slid.entry, { ttlMs: BIN_MS * BINS_PER_DAY });
+      // Atomic read-modify-write. A plain get → mutate → set loses concurrent
+      // charges on the shared cache (two callers read the same counter and one
+      // set clobbers the other). cache.update runs the slide + add under a
+      // compare-and-set (with retry on the cluster backend), so every
+      // concurrent record is counted toward the quota.
+      var nowHour = _hourBin(nowMs);
+      // The cluster CAS retries internally and throws UPDATE_CONTENTION once it
+      // gives up. A concurrency burst on one key must not drop a charge (that
+      // lets a peer undercount the quota), so retry the whole RMW; each attempt
+      // re-reads the latest value (a full transaction whose latency naturally
+      // spreads the contenders) and eventually wins the CAS.
+      for (var attempt = 0; ; attempt++) {
+        try {
+          await cache.update(_key(key), function (current) {
+            var slid = _slideAndSum(_coerce(current), nowHour);
+            slid.entry.bins[BINS_PER_DAY - 1] += bytes;
+            return { value: slid.entry };
+          }, { ttlMs: BIN_MS * BINS_PER_DAY });
+          return;
+        } catch (e) {
+          if (e && e.code === "UPDATE_CONTENTION" && attempt < ACCOUNT_MAX_RETRIES) continue;
+          throw e;
+        }
+      }
     },
     async reset(key) {
       if (typeof cache.delete === "function") await cache.delete(_key(key));
@@ -172,9 +200,27 @@ function create(opts) {
   _requirePositiveBytes("bytesPerDay", opts.bytesPerDay);
   var bytesPerDay = opts.bytesPerDay;
   var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
-  var backend = opts.cache && typeof opts.cache.get === "function"
-    ? _cacheBackend(opts.cache)
-    : _memoryBackend();
+  var backend;
+  if (opts.cache && typeof opts.cache.get === "function") {
+    // A byte quota is a shared counter — the cache backend MUST support atomic
+    // read-modify-write. A plain get/set cache loses concurrent byte charges
+    // (lost update) on the multi-node path, silently under-counting the quota.
+    // This is an early-catch for a cache that lacks an update method entirely;
+    // a b.cache whose backend doesn't implement update (e.g. a get/set-only
+    // custom backend) exposes the method but throws UNSUPPORTED at call time —
+    // that case is surfaced loud on the first record() (see below).
+    if (typeof opts.cache.update !== "function") {
+      throw new ByteQuotaError(
+        "byte-quota/cache-no-atomic-update",
+        "network.byteQuota: a cache backing a byte quota must support atomic update() — " +
+        "a plain get/set cache loses concurrent byte charges on the shared path; " +
+        "use b.cache.create(...), which provides it"
+      );
+    }
+    backend = _cacheBackend(opts.cache);
+  } else {
+    backend = _memoryBackend();
+  }
 
   var _emitAudit = audit().namespaced("network.byte_quota", opts.audit);
 
@@ -235,9 +281,25 @@ function create(opts) {
     var nowMs = now();
     try { await backend.account(key, bytes, nowMs); }
     catch (e) {
+      // A cache backend that doesn't actually implement atomic update() throws
+      // UNSUPPORTED at call time (the public update method exists on every
+      // b.cache, so the get/set-only case can't be caught at construction).
+      // Under the drop-silent policy below this would silently disable the
+      // quota — surface it LOUD so the operator fixes the backend rather than
+      // running an unenforced quota.
+      if (e && e.code === "UNSUPPORTED") {
+        throw new ByteQuotaError(
+          "byte-quota/cache-no-atomic-update",
+          "network.byteQuota: the configured cache backend does not support atomic update() — " +
+          "a byte quota cannot enforce on a get/set-only backend; use a cache whose backend " +
+          "implements update (the memory or cluster backend)"
+        );
+      }
       _emitAudit("backend_error", "failure", { phase: "record", key: key, bytes: bytes, error: (e && e.message) || String(e) });
-      // Drop-silent after audit — the operation already succeeded; the
-      // alternative throw would punish the handler that already accepted bytes.
+      // Drop-silent after audit for a transient/unreachable backend — the
+      // operation already succeeded; a throw would punish the handler that
+      // already accepted bytes. A contention burst is retried in account()
+      // before it can reach here.
       return;
     }
     _emitMetric("recorded", bytes, {});

package/lib/vendor/blamejs/lib/network-dane.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.network.dns.dane