@blamejs/blamejs-shop 0.5.5 → 0.5.7

package/lib/vendor/blamejs/lib/self-update.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.selfUpdate
@@ -28,9 +30,11 @@
  *        P-384 from the supplied PEM) and reports the bytes' hash for
  *        SBOM correlation. A mismatched signature throws and the swap
  *        never runs.
- *     4. `b.selfUpdate.swap({ from, to, backupTo })` performs the
- *        atomic install: copy the current `to` to `backupTo`, rename
- *        `from` → `to`, fsync both directories. Cross-device renames
+ *     4. `b.selfUpdate.swap({ from, to, backupTo, expectedHash })` performs
+ *        the atomic install: re-hash `from` and refuse unless it matches
+ *        `expectedHash` (the hash step 3 returned — binding the installed
+ *        bytes to the verified bytes), copy the current `to` to `backupTo`,
+ *        rename `from` → `to`, fsync both directories. Cross-device renames
  *        fall back to copy + unlink. Any failure rolls back from the
  *        backup. `b.selfUpdate.rollback({ to, backupTo })` restores
  *        the backup post-swap when a healthcheck reports the new
@@ -54,6 +58,7 @@ var numericBounds = require("./numeric-bounds");
 var atomicFile = require("./atomic-file");
 var validateOpts = require("./validate-opts");
 var bCrypto = require("./crypto");
+var guardRegex = require("./guard-regex");
 var httpClient = require("./http-client");
 var safeJson = require("./safe-json");
 var { URL: NodeUrl } = require("node:url");
@@ -242,12 +247,25 @@ function _validatePollOpts(opts) {
         throw new SelfUpdateError("selfupdate/bad-asset-pattern",
           "selfUpdate.poll: opts.assetPattern must be a RegExp or string when present");
       }
+      // Screen an operator-supplied RegExp once at config-time; it is
+      // later .test()'d against attacker-controlled asset names in the
+      // request path, so a catastrophic-backtracking shape would be a
+      // per-request DoS. The string form is matched by substring
+      // (indexOf), never compiled, so it carries no ReDoS risk.
+      if (value instanceof RegExp) {
+        guardRegex.assertSafe(value, "selfUpdate: assetPattern",
+          SelfUpdateError, "selfupdate/unsafe-asset-pattern");
+      }
     },
     signaturePattern: function (value) {
       if (value !== undefined && !(value instanceof RegExp) && typeof value !== "string") {
         throw new SelfUpdateError("selfupdate/bad-sig-pattern",
           "selfUpdate.poll: opts.signaturePattern must be a RegExp or string when present");
       }
+      if (value instanceof RegExp) {
+        guardRegex.assertSafe(value, "selfUpdate: signaturePattern",
+          SelfUpdateError, "selfupdate/unsafe-sig-pattern");
+      }
     },
     maxBytes: function (value) {
       numericBounds.requirePositiveFiniteIntIfPresent(value,
@@ -600,6 +618,18 @@ function _validateSwapOpts(opts, label) {
   if (label === "swap") {
     schema.from = { rule: "required-string", code: "selfupdate/bad-from",
                     label: "selfUpdate.swap: opts.from" };
+    // The bytes about to be installed are re-hashed and checked against the
+    // hash selfUpdate.verify returned, closing the verify -> swap window. The
+    // binding is mandatory — an optional integrity check is opt-in security.
+    schema.expectedHash = { rule: "required-string", code: "selfupdate/bad-expected-hash",
+                            label: "selfUpdate.swap: opts.expectedHash (the hash selfUpdate.verify returned)" };
+    schema.hashAlgo = function (value) {
+      if (value !== undefined &&
+          (typeof value !== "string" || ALLOWED_HASH_ALGS.indexOf(value) === -1)) {
+        throw new SelfUpdateError("selfupdate/bad-hash-algo",
+          "selfUpdate.swap: opts.hashAlgo must be one of " + ALLOWED_HASH_ALGS.join(", "));
+      }
+    };
   }
   schema.to       = { rule: "required-string", code: "selfupdate/bad-to",
                       label: "selfUpdate." + label + ": opts.to" };
@@ -650,24 +680,31 @@ async function _safeRollback(backupTo, to, hadOriginal) {
  * @since     0.6.0
  * @related   b.selfUpdate.verify, b.selfUpdate.rollback, b.atomicFile.copy
  *
- * Atomic install: copy the existing `to` to `backupTo`, rename `from`
- * → `to`, then fsync both directories. Cross-device renames fall back
- * to copy + unlink on the destination filesystem. On any failure the
- * original `to` is restored from `backupTo`. Throws SelfUpdateError on
- * a missing `from`, backup-copy failure, cross-device install failure,
+ * Atomic install: re-hash `from` and refuse unless it matches `expectedHash`
+ * (the hash selfUpdate.verify returned — this binds the installed bytes to the
+ * signature-verified bytes and closes the verify→swap window), copy the
+ * existing `to` to `backupTo`, rename `from` → `to`, then fsync both
+ * directories. Cross-device renames fall back to copy + unlink on the
+ * destination filesystem. On any failure the original `to` is restored from
+ * `backupTo`. Throws SelfUpdateError on a missing `from`, an
+ * expectedHash mismatch, backup-copy failure, cross-device install failure,
  * or rename failure.
  *
  * @opts
- *   from:     string,   // required — newly-installed asset path
- *   to:       string,   // required — target install path
- *   backupTo: string,   // required — backup path for the existing `to`
+ *   from:         string,   // required — newly-installed asset path
+ *   to:           string,   // required — target install path
+ *   backupTo:     string,   // required — backup path for the existing `to`
+ *   expectedHash: string,   // required — the hash selfUpdate.verify returned
+ *   hashAlgo:     string,   // sha3-512 (default) | sha-256 | sha-512 | shake256
  *
  * @example
+ *   var v = await b.selfUpdate.verify({ assetPath, signaturePath, pubkeyPem });
  *   try {
  *     await b.selfUpdate.swap({
- *       from:     "/tmp/blamejs-doc-missing.bin",
- *       to:       "/tmp/blamejs-doc-target.bin",
- *       backupTo: "/tmp/blamejs-doc-backup.bin",
+ *       from:         "/tmp/blamejs-doc-missing.bin",
+ *       to:           "/tmp/blamejs-doc-target.bin",
+ *       backupTo:     "/tmp/blamejs-doc-backup.bin",
+ *       expectedHash: v.hash,
  *     });
  *   } catch (e) {
  *     e.code;                 // → "selfupdate/missing-from"
@@ -684,6 +721,37 @@ async function swap(opts) {
       "selfUpdate.swap: from path does not exist: " + from);
   }
 
+  // Bind the installed object to the signature-verified bytes. Read `from` with
+  // O_NOFOLLOW (refuseSymlink) so a symlinked source is refused AT OPEN rather
+  // than followed — otherwise the bytes hashed (the link target) would differ
+  // from the object a by-path rename installs (the link itself). The verified
+  // bytes are then installed FROM MEMORY below, so the installed object is
+  // exactly what was hashed: no symlink-install surface and no time-of-check /
+  // time-of-use window between the hash and the install (which a by-path rename
+  // or re-read would reopen).
+  var swapAlg = opts.hashAlgo || DEFAULT_HASH_ALG;
+  var fromMode;
+  try { fromMode = (nodeFs.statSync(from).mode & 0o777); } catch (_m) { fromMode = 0o600; }
+  var fromBytes;
+  try {
+    fromBytes = atomicFile.fdSafeReadSync(from, {
+      maxBytes: typeof opts.maxBytes === "number" ? opts.maxBytes : C.BYTES.gib(1),
+      refuseSymlink: true,
+    });
+  } catch (e) {
+    throw new SelfUpdateError("selfupdate/swap-read-failed",
+      "selfUpdate.swap: failed to read from for the integrity re-check (a symlinked source is refused): " +
+      ((e && e.message) || String(e)));
+  }
+  var actualHash = nodeCrypto.createHash(swapAlg).update(fromBytes).digest("hex");
+  if (actualHash !== opts.expectedHash) {
+    _safeAuditEmit("selfupdate.swap.hash_mismatch", "denied", {
+      from: from, to: to, alg: swapAlg, expected: opts.expectedHash, actual: actualHash,
+    });
+    throw new SelfUpdateError("selfupdate/swap-hash-mismatch",
+      "selfUpdate.swap: from bytes do not match expectedHash (asset changed after verify?) — refusing to install");
+  }
+
   var toDir       = nodePath.dirname(to);
   var backupDir   = nodePath.dirname(backupTo);
   atomicFile.ensureDir(toDir);
@@ -702,53 +770,33 @@ async function swap(opts) {
     }
   }
 
-  // Step 3 — install. Rename is atomic on same FS; on cross-device we
-  // fall back to copy + unlink. Rollback failure on either branch
-  // surfaces as a DISTINCT error class and audit event so operators
-  // don't silently lose both binaries (the prior best-effort comment
-  // swallowed the rollback exception — SSDF RV.1 violation).
+  // Step 3 — install the verified in-memory bytes via an atomic temp+fsync+
+  // rename on the DESTINATION filesystem (atomicFile.write), so the installed
+  // object is exactly the bytes just hashed: cross-device is handled (the temp
+  // is created on the dest FS), there is no by-path re-read to race, and a
+  // symlinked source can't be moved into place. Roll back from the backup on
+  // failure; a rollback failure surfaces as a DISTINCT error class + audit
+  // event so operators don't silently lose both binaries (SSDF RV.1).
   try {
-    atomicFile.renameWithRetry(from, to);
+    await atomicFile.write(to, fromBytes, { fileMode: fromMode, overwrite: true });
   } catch (e) {
-    if (e && e.code === "EXDEV") {
-      // Cross-device — copy + unlink. Use atomicFile.copy for the safety
-      // net (temp+fsync+rename on dest FS); then remove the source.
-      try {
-        await atomicFile.copy(from, to, { fileMode: 0o600 });
-        try { nodeFs.unlinkSync(from); } catch (_u) { /* tmp source leak — operator-cleanable */ }
-      } catch (ce) {
-        // Roll back from backup if we have one. Rollback failure here
-        // is catastrophic — both the new asset (corrupt cross-device
-        // copy) AND the original (overwritten partial) are now
-        // unreachable. Surface to operator with a dedicated error.
-        var rbErrXdev = await _safeRollback(backupTo, to, hadOriginal);
-        if (rbErrXdev) {
-          throw new SelfUpdateError("selfupdate/swap-rollback-failed",
-            "selfUpdate.swap: cross-device install failed AND rollback ALSO " +
-            "failed — operator must manually restore from backupTo=" + backupTo +
-            ". install-error=" + ((ce && ce.message) || String(ce)) +
-            "; rollback-error=" + rbErrXdev.message);
-        }
-        throw new SelfUpdateError("selfupdate/cross-device",
-          "selfUpdate.swap: cross-device install failed: " + ((ce && ce.message) || String(ce)));
-      }
-    } else {
-      // Other rename failure — try to roll back. Same rollback-failure
-      // semantics as the cross-device branch.
-      var rbErr = await _safeRollback(backupTo, to, hadOriginal);
-      if (rbErr) {
-        throw new SelfUpdateError("selfupdate/swap-rollback-failed",
-          "selfUpdate.swap: rename " + from + " -> " + to + " failed AND " +
-          "rollback ALSO failed — operator must manually restore from " +
-          "backupTo=" + backupTo + ". rename-error=" + e.message +
-          "; rollback-error=" + rbErr.message);
-      }
-      throw new SelfUpdateError("selfupdate/swap-failed",
-        "selfUpdate.swap: rename " + from + " -> " + to + " failed: " + e.message);
+    var rbErr = await _safeRollback(backupTo, to, hadOriginal);
+    if (rbErr) {
+      throw new SelfUpdateError("selfupdate/swap-rollback-failed",
+        "selfUpdate.swap: install of " + to + " failed AND rollback ALSO failed — " +
+        "operator must manually restore from backupTo=" + backupTo +
+        ". install-error=" + ((e && e.message) || String(e)) +
+        "; rollback-error=" + rbErr.message);
     }
+    throw new SelfUpdateError("selfupdate/swap-failed",
+      "selfUpdate.swap: install of " + to + " failed: " + ((e && e.message) || String(e)));
   }
+  // Consume the source asset now that the verified bytes are installed
+  // (best-effort — the install already succeeded; a leftover temp is
+  // operator-cleanable).
+  try { nodeFs.unlinkSync(from); } catch (_u) { /* tmp source leak — operator-cleanable */ }
 
-  // Step 4 — fsync directories so the rename is durable.
+  // Step 4 — fsync directories so the install is durable.
   atomicFile.fsyncDir(toDir);
   if (backupDir !== toDir) atomicFile.fsyncDir(backupDir);
 

package/lib/vendor/blamejs/lib/server-timing.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.serverTiming

package/lib/vendor/blamejs/lib/session-device-binding.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.sessionDeviceBinding — bind sessions to a device fingerprint and

package/lib/vendor/blamejs/lib/session-stores.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.session.stores

package/lib/vendor/blamejs/lib/session.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.session
@@ -510,6 +512,30 @@ async function create(opts) {
  *   var roles  = (info.data && info.data.roles) || [];
  *   // → { userId: "user-42", data: { roles: ["admin"] }, createdAt: ..., expiresAt: ..., lastActivity: ..., fingerprintDrift: false, fingerprintAnomalyScore: null }
  */
+// Evaluate the idle + absolute timeout floors against a session row.
+// Returns { action, metadata } describing the breach, or null if the session
+// is within both floors. Centralized so EVERY session-read path (verify,
+// touch, ...) enforces the floors identically — a refresh must never
+// resurrect a session that verify() would expire.
+function _timeoutFloorBreach(row, nowMs, opts) {
+  opts = opts || {};
+  var idleMs = opts.idleTimeoutMs !== undefined ? opts.idleTimeoutMs : DEFAULT_IDLE_TIMEOUT_MS;
+  var absMs = opts.absoluteTimeoutMs !== undefined ? opts.absoluteTimeoutMs : DEFAULT_ABSOLUTE_TIMEOUT_MS;
+  if (idleMs > 0) {
+    var lastActivity = Number(row.lastActivity);
+    if ((nowMs - lastActivity) > idleMs) {
+      return { action: "auth.session.expired_idle", metadata: { idleMs: nowMs - lastActivity, threshold: idleMs } };
+    }
+  }
+  if (absMs > 0) {
+    var createdAt = Number(row.createdAt);
+    if ((nowMs - createdAt) > absMs) {
+      return { action: "auth.session.expired_absolute", metadata: { ageMs: nowMs - createdAt, threshold: absMs } };
+    }
+  }
+  return null;
+}
+
 async function verify(token, verifyOpts) {
   if (typeof token !== "string" || token.length === 0) return null;
   verifyOpts = verifyOpts || {};
@@ -541,39 +567,15 @@ async function verify(token, verifyOpts) {
   // SP 800-63B-4). These shorten the effective lifetime even when the
   // operator picked a long ttlMs. Defaults: idle 30m, absolute 12h.
   // Operator opt-out by passing 0 (disables that timeout).
-  var idleMs = verifyOpts.idleTimeoutMs !== undefined
-    ? verifyOpts.idleTimeoutMs : DEFAULT_IDLE_TIMEOUT_MS;
-  var absMs = verifyOpts.absoluteTimeoutMs !== undefined
-    ? verifyOpts.absoluteTimeoutMs : DEFAULT_ABSOLUTE_TIMEOUT_MS;
-  if (idleMs > 0) {
-    var lastActivity = Number(row.lastActivity);
-    if ((nowMs - lastActivity) > idleMs) {
-      try {
-        audit.safeEmit({
-          action: "auth.session.expired_idle", outcome: "success",
-          metadata: { idleMs: nowMs - lastActivity, threshold: idleMs },
-        });
-      } catch (_ignored) { /* audit best-effort */ }
-      if (cluster.isLeader()) {
-        try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
-      }
-      return null;
-    }
-  }
-  if (absMs > 0) {
-    var createdAt = Number(row.createdAt);
-    if ((nowMs - createdAt) > absMs) {
-      try {
-        audit.safeEmit({
-          action: "auth.session.expired_absolute", outcome: "success",
-          metadata: { ageMs: nowMs - createdAt, threshold: absMs },
-        });
-      } catch (_ignored) { /* audit best-effort */ }
-      if (cluster.isLeader()) {
-        try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
-      }
-      return null;
+  var floorBreach = _timeoutFloorBreach(row, nowMs, verifyOpts);
+  if (floorBreach) {
+    try {
+      audit.safeEmit({ action: floorBreach.action, outcome: "success", metadata: floorBreach.metadata });
+    } catch (_ignored) { /* audit best-effort */ }
+    if (cluster.isLeader()) {
+      try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
     }
+    return null;
   }
   // Unseal sealed columns (userId, data) using the cryptoField pipeline
   // so we return cleartext to the caller — same shape as the previous
@@ -581,6 +583,12 @@ async function verify(token, verifyOpts) {
   var unsealed = cryptoField.unsealRow(SESSION_TABLE, row);
   var data = null;
   var storedFingerprint = null;
+  // The sealed `data` cell carries the device-fingerprint binding. A cell that
+  // EXISTS on the row but does not decrypt (key-rotation skew, DB corruption, or
+  // a tamper of the independently-AEAD-sealed column) means the binding is
+  // UNREADABLE — distinct from a session that legitimately carries no binding.
+  // Under a strict binding policy that must FAIL CLOSED below, not be skipped.
+  var bindingUnreadable = (row.data != null && row.data !== "" && unsealed.data == null);
   if (unsealed.data) {
     try {
       data = safeJson.parse(unsealed.data);
@@ -599,6 +607,7 @@ async function verify(token, verifyOpts) {
       // operator notices empty-`data` flows. data stays null so the
       // session remains usable for non-data flows.
       data = null;
+      bindingUnreadable = true;   // decrypted but unparseable — binding unreadable
       try {
         audit.safeEmit({
           action:   "auth.session.data_unparseable",
@@ -618,6 +627,21 @@ async function verify(token, verifyOpts) {
   // login-from-Tokyo-then-immediately-from-Brazil pattern is not).
   var fingerprintDrift = false;
   var fingerprintAnomalyScore = null;
+  // A strict binding policy (requireFingerprintMatch / maxAnomalyScore) cannot be
+  // satisfied when the binding is UNREADABLE — we can't prove it matches, so fail
+  // CLOSED rather than silently skipping the gate (the pre-fix fail-open).
+  if (bindingUnreadable && verifyOpts.req &&
+      (verifyOpts.requireFingerprintMatch === true ||
+       typeof verifyOpts.maxAnomalyScore === "number")) {
+    try {
+      audit.safeEmit({
+        action:   "auth.session.binding_unreadable",
+        outcome:  "failure",
+        metadata: { hasUserId: !!unsealed.userId },
+      });
+    } catch (_ig) { /* audit best-effort */ }
+    return null;
+  }
   if (storedFingerprint && verifyOpts.req) {
     var fpFields = Array.isArray(verifyOpts.fingerprintFields) && verifyOpts.fingerprintFields.length > 0
       ? verifyOpts.fingerprintFields : DEFAULT_FINGERPRINT_FIELDS;
@@ -887,6 +911,21 @@ async function touch(token, opts) {
   if (sid === null) return false;
   var sidHash = _hashSid(sid);
   var nowMs = Date.now();
+  // A session past its idle / absolute timeout floor must not be resurrected
+  // by a refresh — enforce the floors (as verify does) before extending.
+  // Without this, touch() would reset lastActivity on a session verify()
+  // would have expired, defeating the floor.
+  var floorSel = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(["createdAt", "lastActivity"])
+    .where("sidHash", sidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var floorRow = await _currentStore().executeOne(floorSel.sql, floorSel.params);
+  if (!floorRow) return false;
+  if (_timeoutFloorBreach(floorRow, nowMs, opts)) {
+    try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
+    return false;
+  }
   // Two SQL paths so the SET list stays static (no dynamic column
   // assembly) and matches the call shape clusterStorage expects.
   // extendBy resets expiresAt relative to NOW, not relative to the

package/lib/vendor/blamejs/lib/slug.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.slug

package/lib/vendor/blamejs/lib/sql.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.sql

package/lib/vendor/blamejs/lib/sse.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Server-Sent Events primitive — text/event-stream transport with

package/lib/vendor/blamejs/lib/ssrf-guard.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ssrfGuard
@@ -743,11 +745,17 @@ function createAllowlist(opts) {
       "ssrf-guard/empty-allowlist", {});
   }
   function _matches(list, hostOrIp) {
+    // Canonicalize BOTH the URL host and each non-CIDR operator entry before
+    // comparing: the URL parser already lowercases the host (and strips a
+    // trailing dot), so a mixed-case or trailing-dot operator entry compared
+    // raw silently failed to match — letting a denylisted host through.
+    var canonHost = canonicalizeHost(hostOrIp);
     for (var i = 0; i < list.length; i++) {
       var entry = list[i];
-      if (entry === hostOrIp) return true;
       if (entry.indexOf("/") !== -1) {
         try { if (cidrContains(entry, hostOrIp)) return true; } catch (_e) { /* ignore */ }
+      } else if (canonicalizeHost(entry) === canonHost) {
+        return true;
       }
     }
     return false;

package/lib/vendor/blamejs/lib/standard-webhooks.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.standardWebhooks

package/lib/vendor/blamejs/lib/static.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * staticServe — server-side download primitive with the same v1-defensible
@@ -60,6 +62,7 @@ var observability = lazyRequire(function () { return require("./observability");
 // import cycles. Operators opt out via contentSafety: null (audited).
 var guardAll = lazyRequire(function () { return require("./guard-all"); });
 var guardFilename = lazyRequire(function () { return require("./guard-filename"); });
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 
 var _err = StaticServeError.factory;
 
@@ -521,6 +524,13 @@ function _validateCreateOpts(opts) {
       if (value !== undefined && value !== null && !(value instanceof RegExp)) {
         throw errorClass.factory(code, "staticServe.create: hashedPathPattern must be a RegExp");
       }
+      // Screen the operator-supplied pattern once at create() time — it is
+      // .test()'d against the attacker-controlled request path on every
+      // download, so a catastrophic-backtracking (ReDoS) shape would be a
+      // per-request DoS. Reject the unsafe pattern at config time instead.
+      if (value instanceof RegExp) {
+        guardRegex().assertSafe(value, "staticServe: hashedPathPattern", StaticServeError, "static/unsafe-pattern");
+      }
     },
     // indexFile === null is the operator's "disable" sentinel; the helper
     // returns null/undefined unchanged so we keep that semantic.
@@ -647,13 +657,23 @@ function _validateCreateOpts(opts) {
       "'user-content'; got " + JSON.stringify(opts.mountType));
   }
   // Quotas require a cache for cluster-shared coordination.
-  if ((opts.maxBytesPerActorPerWindowMs > 0 ||
-       opts.maxBytesAllActorsPerWindowMs > 0 ||
-       opts.maxConcurrentDownloadsPerActor > 0) &&
-      !opts.cache) {
-    throw _err("BAD_OPT",
-      "staticServe.create: bandwidth / concurrency quotas require opts.cache " +
-      "(pass cache: b.cache.create({ backend: 'cluster' }) so multi-replica deploys honor caps globally)");
+  if (opts.maxBytesPerActorPerWindowMs > 0 ||
+      opts.maxBytesAllActorsPerWindowMs > 0 ||
+      opts.maxConcurrentDownloadsPerActor > 0) {
+    if (!opts.cache) {
+      throw _err("BAD_OPT",
+        "staticServe.create: bandwidth / concurrency quotas require opts.cache " +
+        "(pass cache: b.cache.create({ backend: 'cluster' }) so multi-replica deploys honor caps globally)");
+    }
+    // The bandwidth / concurrency counters accumulate atomically via
+    // cache.update; a cache that lacks an update method entirely cannot
+    // coordinate the caps. (A b.cache whose backend can't do atomic RMW exposes
+    // update but throws UNSUPPORTED at call time — that surfaces on first use.)
+    if (typeof opts.cache.update !== "function") {
+      throw _err("BAD_OPT",
+        "staticServe.create: the quota cache must support atomic update() — a plain " +
+        "get/set cache loses concurrent bandwidth/concurrency charges; use b.cache.create(...)");
+    }
   }
 }
 
@@ -680,17 +700,36 @@ async function _checkBandwidthQuota(cache, actorKey, perActorCap, globalCap, win
   return { ok: true, windowStart: windowStart, now: now };
 }
 
+// Atomic counter adjust on the cache. A plain cache.get → mutate → cache.set is
+// a non-atomic read-modify-write: two concurrent requests read the same value
+// and one set clobbers the other (lost update), under-counting on the shared
+// (cluster) cache so the bandwidth / concurrency caps can be bypassed. cache.update
+// runs the adjust under a compare-and-set; the cluster CAS retries internally and
+// throws UPDATE_CONTENTION once it gives up, so retry the whole RMW under a burst
+// (each attempt re-reads the latest value) rather than dropping the adjustment.
+var STATIC_COUNTER_MAX_RETRIES = 6;
+async function _atomicCounter(cache, key, mutate, ttlMs) {
+  for (var attempt = 0; ; attempt++) {
+    try {
+      await cache.update(key, function (current) {
+        var c = (typeof current === "number" && isFinite(current)) ? current : 0;
+        return { value: mutate(c) };
+      }, { ttlMs: ttlMs });
+      return;
+    } catch (e) {
+      if (e && e.code === "UPDATE_CONTENTION" && attempt < STATIC_COUNTER_MAX_RETRIES) continue;
+      throw e;
+    }
+  }
+}
+
 async function _consumeBandwidth(cache, actorKey, perActorCap, globalCap, windowMs, bytes) {
   if (!cache) return;
   if (perActorCap > 0 && actorKey) {
-    var aKey = "static:bw:actor:" + actorKey;
-    var aUsed = (await cache.get(aKey)) || 0;
-    await cache.set(aKey, aUsed + bytes, { ttlMs: windowMs });
+    await _atomicCounter(cache, "static:bw:actor:" + actorKey, function (c) { return c + bytes; }, windowMs);
   }
   if (globalCap > 0) {
-    var gKey = "static:bw:global";
-    var gUsed = (await cache.get(gKey)) || 0;
-    await cache.set(gKey, gUsed + bytes, { ttlMs: windowMs });
+    await _atomicCounter(cache, "static:bw:global", function (c) { return c + bytes; }, windowMs);
   }
 }
 
@@ -704,17 +743,12 @@ async function _checkConcurrencyCap(cache, actorKey, cap) {
 
 async function _incConcurrency(cache, actorKey) {
   if (!cache || !actorKey) return;
-  var key = "static:conc:" + actorKey;
-  var current = (await cache.get(key)) || 0;
-  await cache.set(key, current + 1, { ttlMs: C.TIME.minutes(10) });
+  await _atomicCounter(cache, "static:conc:" + actorKey, function (c) { return c + 1; }, C.TIME.minutes(10));
 }
 
 async function _decConcurrency(cache, actorKey) {
   if (!cache || !actorKey) return;
-  var key = "static:conc:" + actorKey;
-  var current = (await cache.get(key)) || 0;
-  var next = current > 0 ? current - 1 : 0;
-  await cache.set(key, next, { ttlMs: C.TIME.minutes(10) });
+  await _atomicCounter(cache, "static:conc:" + actorKey, function (c) { return c > 0 ? c - 1 : 0; }, C.TIME.minutes(10));
 }
 
 function _actorKeyFromContext(ctx) {

package/lib/vendor/blamejs/lib/storage.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.storage

package/lib/vendor/blamejs/lib/stream-throttle.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.streamThrottle

package/lib/vendor/blamejs/lib/structured-fields.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.structuredFields

package/lib/vendor/blamejs/lib/subject.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.subject

package/lib/vendor/blamejs/lib/tcpa-10dlc.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.tcpa10dlc — TCPA 10DLC (10-Digit Long Code) consent-record audit

package/lib/vendor/blamejs/lib/template.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.template

package/lib/vendor/blamejs/lib/tenant-quota.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.tenantQuota

package/lib/vendor/blamejs/lib/test-harness.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.testHarness

package/lib/vendor/blamejs/lib/testing.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.testing

package/lib/vendor/blamejs/lib/time.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.time