@blamejs/core 0.15.40 → 0.15.41

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.41 (2026-06-28) — **Counters kept on a shared cache — byte quotas and the static server's bandwidth/concurrency caps — now accumulate with an atomic compare-and-set, so concurrent requests can no longer lose each other's charges and slip under the limit.** Several caps maintained a counter on a cache with a non-atomic read-modify-write: read the current value, add to it in memory, write it back. On a cache shared across nodes, two concurrent requests both read the same value, each added only its own contribution, and one write clobbered the other — a lost update that under-counted the cap and let a peer slip under it. b.network.byteQuota (and the b.middleware.dailyByteQuota that composes it) and the static server's per-actor/global bandwidth and per-actor concurrency caps all did this. They now accumulate through the cache's atomic update() (compare-and-set, with retry on the cluster backend under contention), so every concurrent charge is counted. A cache backing these caps must support atomic update(); b.cache provides it, and both primitives refuse a get/set-only cache at construction. The single-node in-memory paths were already safe (they accumulate synchronously). **Fixed:** *Byte quota on a shared cache counts concurrent requests atomically (no lost updates)* — b.network.byteQuota's cache backend accumulated bytes with a get → add → set that is not atomic, so concurrent requests from one peer on a multi-node deployment lost each other's byte charges and the rolling daily byte budget was under-enforced. Accounting now uses the cache's atomic compare-and-set update(), counting every concurrent request, and retries the cluster CAS under a contention burst rather than dropping a charge. A cache wired to a byte quota must support update() — b.cache does; a plain get/set cache is refused at create() (byte-quota/cache-no-atomic-update), and a backend that can't actually commit an atomic update surfaces loud on first use instead of silently disabling the quota. b.middleware.dailyByteQuota, which composes byteQuota, inherits the fix. · *Static server bandwidth + concurrency caps count concurrent requests atomically* — b.staticServe's per-actor and global bandwidth caps and its per-actor concurrency cap kept their counters on the cache with a non-atomic get → add → set, so concurrent downloads from one actor on a multi-replica deployment lost each other's charges and the caps were under-enforced (a bandwidth/concurrency limit bypass). The counters now accumulate through the cache's atomic update() with the same contention retry, and the quota cache is required to support update() at create(). **Detectors:** *Build guard: a cache-backed counter must use atomic update(), not get → set* — A codebase guard now fails the build if a primitive accumulates a counter on a cache with a get → mutate → set read-modify-write instead of the atomic update(), so the lost-update class fixed here cannot reappear at a new cap. Caches used for lookups or cache-aside (the value is replaced wholesale, not incremented), or whose writes are serialized in-process, are allowlisted with the reason they cannot lose an increment.
+
 - v0.15.40 (2026-06-27) — **The durable webhook dispatcher's retry poller now claims due deliveries with FOR UPDATE SKIP LOCKED on Postgres and MySQL, so two pollers running at once (multiple app nodes) can no longer both grab the same delivery and send the webhook twice in one cycle.** The webhook dispatcher's retry poller claimed due deliveries by flipping them pending->in-flight and then re-selecting the in-flight rows by id. On Postgres or MySQL under the default READ COMMITTED isolation, two pollers running concurrently could both re-select the same row: the loser's UPDATE matched zero rows (the winner had already flipped it), but its reselect-by-id still re-read the row the winner had just claimed, so both pollers attempted the same HTTP delivery in one cycle. The claim now row-locks the due rows with SELECT ... FOR UPDATE SKIP LOCKED on the row-locking backends, so concurrent pollers see disjoint sets and each delivery is claimed by exactly one poller; sqlite (a single writer) keeps the existing mark-then-reselect, which it serializes safely. This matches the claim used by the framework's transactional outbox and cluster queue. Receivers that already dedup on the X-Webhook-Delivery-Id header were protected from a duplicate POST; this closes the at-most-once-per-cycle gap at the dispatcher itself. **Fixed:** *Webhook retry pollers no longer double-deliver under concurrency on Postgres / MySQL* — b.webhook.dispatcher's processRetries() claimed due deliveries with a mark-then-reselect that had no row lock, so on Postgres / MySQL at READ COMMITTED two concurrent pollers (for example, the dispatcher running on more than one app node) could both hand back the same delivery and POST it twice in a single retry cycle. The claim now uses SELECT ... FOR UPDATE SKIP LOCKED on those backends so each due row is locked by exactly one poller and concurrent pollers claim disjoint sets; the rows a poller selects are exactly the rows it owns. sqlite keeps the mark-then-reselect path, which its single writer serializes. Operators running the dispatcher on a single node, or whose receivers dedup on X-Webhook-Delivery-Id, were not exposed to a duplicate delivery; no configuration change is required to pick up the fix. **Detectors:** *Build guard: a competing-consumer claim must use FOR UPDATE SKIP LOCKED* — A codebase guard now fails the build if a poller that claims due rows across workers — SELECT status='pending' inside a transaction, then flip the rows to in-flight — omits FOR UPDATE SKIP LOCKED on the row-locking backends. Without the row lock, two pollers under READ COMMITTED both claim the same row; the guard keeps any future poller from re-introducing the shape, with the transactional outbox and cluster queue as the reference claims.
 
 - v0.15.39 (2026-06-27) — **Nine more places that matched an operator-supplied regex against request data — User-Agent, Origin, request path, form fields, SMTP HELO, release-asset names — now screen the pattern for catastrophic backtracking (ReDoS) before use, and a new b.guardRegex.assertSafe helper makes that screening one call.** The previous release screened feature-flag and MCP regex patterns for ReDoS but did not sweep every place the framework matches an operator-supplied regex against attacker-controlled input. Nine more were found and fixed: the bot guard (User-Agent), CORS (Origin), the HTTP span middleware and the shared request skip-matcher used by CSRF / fetch-metadata / rate-limit / access-lock / age-gate and the request logger (request path), static serving (hashed-asset path pattern), form field validation (submitted field value), SMTP HELO generic-rDNS patterns (HELO name), and the self-updater's asset/signature patterns (names from a remote release feed). Each accepted an operator RegExp with only a type check and ran it on every matching request, so an accidentally catastrophic pattern such as (a+)+$ or ((a)+)+$ could pin a CPU on a crafted input — a length cap does not bound backtracking. Every one now screens the pattern through b.guardRegex at configuration time. A new b.guardRegex.assertSafe(input, label?, ErrorClass?, code?) primitive performs that screen in one call (accepting a RegExp or a pattern string), which operators can also use on their own patterns. **Added:** *b.guardRegex.assertSafe — screen a RegExp or pattern string for ReDoS in one call* — b.guardRegex.assertSafe(input, label?, ErrorClass?, code?, opts?) screens an already-compiled RegExp (its source) or a raw pattern string for the catastrophic-backtracking classes — nested, alternation-with, and lookaround quantifiers — throwing the supplied framework-error class (or the underlying GuardRegexError) on a hostile pattern and returning the input on success. It allows large or open-ended bounded repeats (`{8,}`, `{n,m}`): a single counted repeat matches in linear time and legitimate patterns (including the framework's own defaults) use them. It is the config-time guard used by the request-lifecycle fixes above, and operators can apply it to their own patterns before matching them against untrusted input. **Security:** *Operator regex patterns matched against request data are screened for ReDoS framework-wide* — An operator-supplied RegExp matched against attacker-controllable input is a denial-of-service surface if it has a catastrophic-backtracking shape: the input triggers exponential work in the regex engine. Nine sites accepted such patterns with only an `instanceof RegExp` type check and executed them per request — bot-guard against the User-Agent, CORS against the Origin header, the HTTP span middleware and the shared skip-path matcher (CSRF / fetch-metadata / rate-limit / access-lock / age-gate / request-log) against the request path, static serving against the request path, form validation against the submitted field value, SMTP HELO checks against the HELO name, and the self-updater against asset names from a remote release feed. Each now routes the pattern through b.guardRegex at configuration time, so a catastrophic shape is refused up front instead of being weaponized by a crafted request. A length bound on the input is not a defense: a nested-quantifier pattern backtracks catastrophically at a few dozen characters. **Detectors:** *Build guard: an operator regex matched against request input must be ReDoS-screened* — A codebase guard now fails the build if a primitive accepts an operator-supplied RegExp and executes it against request input without screening the pattern through b.guardRegex.assertSafe — so the catastrophic-backtracking class fixed in this release cannot be reintroduced at a new site (the trusted-input cases — local filesystem paths, operator config keys, operator-owned schemas — are explicitly allowlisted). · *Build guard: process.moduleLoadList filters must match the 'NativeModule X' naming* — A guard now fails the build if a test filters process.moduleLoadList by the 'node:X' name only. Node 20+ records a loaded builtin as 'NativeModule X', so a 'node:'-only filter in an edge-runtime no-eager-load test would rot green and miss a reintroduced top-level networking require.

package/lib/network-byte-quota.js

@@ -51,6 +51,10 @@ var ByteQuotaError = defineClass("ByteQuotaError", { alwaysPermanent: true });
 
 var BINS_PER_DAY = 24;                                                                  // 24 hours in a day
 var BIN_MS = C.TIME.hours(1);
+// Outer retries when the cache's internal CAS exhausts under a concurrency
+// burst on one key — absorbs the burst so a charge is not dropped (each retry
+// re-reads the latest counter). Total CAS attempts ≈ this × the cache's own 5.
+var ACCOUNT_MAX_RETRIES = 6;
 
 function _hourBin(nowMs) { return Math.floor(nowMs / BIN_MS); }
 function _newEntry()    { return { bins: new Array(BINS_PER_DAY).fill(0), startHour: 0 }; }
@@ -108,22 +112,44 @@ function _memoryBackend() {
 
 function _cacheBackend(cache) {
   function _key(k) { return "byteQuota:" + k; }
-  async function _read(key) {
-    var raw = await cache.get(_key(key));
+  function _coerce(raw) {
     return raw && typeof raw === "object" && Array.isArray(raw.bins) ? raw : _newEntry();
   }
   return {
     async total(key, nowMs) {
-      var entry = await _read(key);
-      var slid = _slideAndSum(entry, _hourBin(nowMs));
-      if (slid.moved) await cache.set(_key(key), slid.entry, { ttlMs: BIN_MS * BINS_PER_DAY });
+      // Read-only: slide + sum without writing back. A writeback here would
+      // race a concurrent account() — it could read the pre-increment entry
+      // and clobber the increment (lost update). The slide is recomputed on
+      // every read/account, so persisting it is a pure optimization not worth
+      // the clobber risk.
+      var slid = _slideAndSum(_coerce(await cache.get(_key(key))), _hourBin(nowMs));
       return slid.total;
     },
     async account(key, bytes, nowMs) {
-      var entry = await _read(key);
-      var slid = _slideAndSum(entry, _hourBin(nowMs));
-      slid.entry.bins[BINS_PER_DAY - 1] += bytes;
-      await cache.set(_key(key), slid.entry, { ttlMs: BIN_MS * BINS_PER_DAY });
+      // Atomic read-modify-write. A plain get → mutate → set loses concurrent
+      // charges on the shared cache (two callers read the same counter and one
+      // set clobbers the other). cache.update runs the slide + add under a
+      // compare-and-set (with retry on the cluster backend), so every
+      // concurrent record is counted toward the quota.
+      var nowHour = _hourBin(nowMs);
+      // The cluster CAS retries internally and throws UPDATE_CONTENTION once it
+      // gives up. A concurrency burst on one key must not drop a charge (that
+      // lets a peer undercount the quota), so retry the whole RMW; each attempt
+      // re-reads the latest value (a full transaction whose latency naturally
+      // spreads the contenders) and eventually wins the CAS.
+      for (var attempt = 0; ; attempt++) {
+        try {
+          await cache.update(_key(key), function (current) {
+            var slid = _slideAndSum(_coerce(current), nowHour);
+            slid.entry.bins[BINS_PER_DAY - 1] += bytes;
+            return { value: slid.entry };
+          }, { ttlMs: BIN_MS * BINS_PER_DAY });
+          return;
+        } catch (e) {
+          if (e && e.code === "UPDATE_CONTENTION" && attempt < ACCOUNT_MAX_RETRIES) continue;
+          throw e;
+        }
+      }
     },
     async reset(key) {
       if (typeof cache.delete === "function") await cache.delete(_key(key));
@@ -172,9 +198,27 @@ function create(opts) {
   _requirePositiveBytes("bytesPerDay", opts.bytesPerDay);
   var bytesPerDay = opts.bytesPerDay;
   var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
-  var backend = opts.cache && typeof opts.cache.get === "function"
-    ? _cacheBackend(opts.cache)
-    : _memoryBackend();
+  var backend;
+  if (opts.cache && typeof opts.cache.get === "function") {
+    // A byte quota is a shared counter — the cache backend MUST support atomic
+    // read-modify-write. A plain get/set cache loses concurrent byte charges
+    // (lost update) on the multi-node path, silently under-counting the quota.
+    // This is an early-catch for a cache that lacks an update method entirely;
+    // a b.cache whose backend doesn't implement update (e.g. a get/set-only
+    // custom backend) exposes the method but throws UNSUPPORTED at call time —
+    // that case is surfaced loud on the first record() (see below).
+    if (typeof opts.cache.update !== "function") {
+      throw new ByteQuotaError(
+        "byte-quota/cache-no-atomic-update",
+        "network.byteQuota: a cache backing a byte quota must support atomic update() — " +
+        "a plain get/set cache loses concurrent byte charges on the shared path; " +
+        "use b.cache.create(...), which provides it"
+      );
+    }
+    backend = _cacheBackend(opts.cache);
+  } else {
+    backend = _memoryBackend();
+  }
 
   var _emitAudit = audit().namespaced("network.byte_quota", opts.audit);
 
@@ -235,9 +279,25 @@ function create(opts) {
     var nowMs = now();
     try { await backend.account(key, bytes, nowMs); }
     catch (e) {
+      // A cache backend that doesn't actually implement atomic update() throws
+      // UNSUPPORTED at call time (the public update method exists on every
+      // b.cache, so the get/set-only case can't be caught at construction).
+      // Under the drop-silent policy below this would silently disable the
+      // quota — surface it LOUD so the operator fixes the backend rather than
+      // running an unenforced quota.
+      if (e && e.code === "UNSUPPORTED") {
+        throw new ByteQuotaError(
+          "byte-quota/cache-no-atomic-update",
+          "network.byteQuota: the configured cache backend does not support atomic update() — " +
+          "a byte quota cannot enforce on a get/set-only backend; use a cache whose backend " +
+          "implements update (the memory or cluster backend)"
+        );
+      }
       _emitAudit("backend_error", "failure", { phase: "record", key: key, bytes: bytes, error: (e && e.message) || String(e) });
-      // Drop-silent after audit — the operation already succeeded; the
-      // alternative throw would punish the handler that already accepted bytes.
+      // Drop-silent after audit for a transient/unreachable backend — the
+      // operation already succeeded; a throw would punish the handler that
+      // already accepted bytes. A contention burst is retried in account()
+      // before it can reach here.
       return;
     }
     _emitMetric("recorded", bytes, {});

package/lib/static.js

@@ -655,13 +655,23 @@ function _validateCreateOpts(opts) {
       "'user-content'; got " + JSON.stringify(opts.mountType));
   }
   // Quotas require a cache for cluster-shared coordination.
-  if ((opts.maxBytesPerActorPerWindowMs > 0 ||
-       opts.maxBytesAllActorsPerWindowMs > 0 ||
-       opts.maxConcurrentDownloadsPerActor > 0) &&
-      !opts.cache) {
-    throw _err("BAD_OPT",
-      "staticServe.create: bandwidth / concurrency quotas require opts.cache " +
-      "(pass cache: b.cache.create({ backend: 'cluster' }) so multi-replica deploys honor caps globally)");
+  if (opts.maxBytesPerActorPerWindowMs > 0 ||
+      opts.maxBytesAllActorsPerWindowMs > 0 ||
+      opts.maxConcurrentDownloadsPerActor > 0) {
+    if (!opts.cache) {
+      throw _err("BAD_OPT",
+        "staticServe.create: bandwidth / concurrency quotas require opts.cache " +
+        "(pass cache: b.cache.create({ backend: 'cluster' }) so multi-replica deploys honor caps globally)");
+    }
+    // The bandwidth / concurrency counters accumulate atomically via
+    // cache.update; a cache that lacks an update method entirely cannot
+    // coordinate the caps. (A b.cache whose backend can't do atomic RMW exposes
+    // update but throws UNSUPPORTED at call time — that surfaces on first use.)
+    if (typeof opts.cache.update !== "function") {
+      throw _err("BAD_OPT",
+        "staticServe.create: the quota cache must support atomic update() — a plain " +
+        "get/set cache loses concurrent bandwidth/concurrency charges; use b.cache.create(...)");
+    }
   }
 }
 
@@ -688,17 +698,36 @@ async function _checkBandwidthQuota(cache, actorKey, perActorCap, globalCap, win
   return { ok: true, windowStart: windowStart, now: now };
 }
 
+// Atomic counter adjust on the cache. A plain cache.get → mutate → cache.set is
+// a non-atomic read-modify-write: two concurrent requests read the same value
+// and one set clobbers the other (lost update), under-counting on the shared
+// (cluster) cache so the bandwidth / concurrency caps can be bypassed. cache.update
+// runs the adjust under a compare-and-set; the cluster CAS retries internally and
+// throws UPDATE_CONTENTION once it gives up, so retry the whole RMW under a burst
+// (each attempt re-reads the latest value) rather than dropping the adjustment.
+var STATIC_COUNTER_MAX_RETRIES = 6;
+async function _atomicCounter(cache, key, mutate, ttlMs) {
+  for (var attempt = 0; ; attempt++) {
+    try {
+      await cache.update(key, function (current) {
+        var c = (typeof current === "number" && isFinite(current)) ? current : 0;
+        return { value: mutate(c) };
+      }, { ttlMs: ttlMs });
+      return;
+    } catch (e) {
+      if (e && e.code === "UPDATE_CONTENTION" && attempt < STATIC_COUNTER_MAX_RETRIES) continue;
+      throw e;
+    }
+  }
+}
+
 async function _consumeBandwidth(cache, actorKey, perActorCap, globalCap, windowMs, bytes) {
   if (!cache) return;
   if (perActorCap > 0 && actorKey) {
-    var aKey = "static:bw:actor:" + actorKey;
-    var aUsed = (await cache.get(aKey)) || 0;
-    await cache.set(aKey, aUsed + bytes, { ttlMs: windowMs });
+    await _atomicCounter(cache, "static:bw:actor:" + actorKey, function (c) { return c + bytes; }, windowMs);
   }
   if (globalCap > 0) {
-    var gKey = "static:bw:global";
-    var gUsed = (await cache.get(gKey)) || 0;
-    await cache.set(gKey, gUsed + bytes, { ttlMs: windowMs });
+    await _atomicCounter(cache, "static:bw:global", function (c) { return c + bytes; }, windowMs);
   }
 }
 
@@ -712,17 +741,12 @@ async function _checkConcurrencyCap(cache, actorKey, cap) {
 
 async function _incConcurrency(cache, actorKey) {
   if (!cache || !actorKey) return;
-  var key = "static:conc:" + actorKey;
-  var current = (await cache.get(key)) || 0;
-  await cache.set(key, current + 1, { ttlMs: C.TIME.minutes(10) });
+  await _atomicCounter(cache, "static:conc:" + actorKey, function (c) { return c + 1; }, C.TIME.minutes(10));
 }
 
 async function _decConcurrency(cache, actorKey) {
   if (!cache || !actorKey) return;
-  var key = "static:conc:" + actorKey;
-  var current = (await cache.get(key)) || 0;
-  var next = current > 0 ? current - 1 : 0;
-  await cache.set(key, next, { ttlMs: C.TIME.minutes(10) });
+  await _atomicCounter(cache, "static:conc:" + actorKey, function (c) { return c > 0 ? c - 1 : 0; }, C.TIME.minutes(10));
 }
 
 function _actorKeyFromContext(ctx) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.40",
+  "version": "0.15.41",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4538b9a5-f7e6-4723-be61-b03f474f0c0e",
+  "serialNumber": "urn:uuid:b6890c56-a06c-431c-b27d-d91ce739441d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-28T06:47:43.444Z",
+    "timestamp": "2026-06-28T08:26:04.321Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.40",
+      "bom-ref": "@blamejs/core@0.15.41",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.40",
+      "version": "0.15.41",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.40",
+      "purl": "pkg:npm/%40blamejs/core@0.15.41",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.40",
+      "ref": "@blamejs/core@0.15.41",
       "dependsOn": []
     }
   ]