@k2b/cloud 0.41.0 → 0.42.0

package/src/services/app-access.ts

@@ -0,0 +1,123 @@
+import { type SQL, sql } from "bun";
+import type { Context } from "hono";
+import type { AppMeta } from "../contracts/app";
+import { AppAccessRuleSchema, type FixedAppAccessRule } from "../contracts/app-access";
+import { userFromActor } from "../server/actor";
+import type { AuthContext, RequestAuthority } from "../server/middleware/auth";
+import { buildAccessPrincipalCondition } from "../server/services/access";
+import { logger } from "./logging";
+import { toPgTextArray } from "./postgres";
+
+type AccessApp = Pick<AppMeta, "id" | "access">;
+type GrantState = { app_id: string; configured: boolean; permission: "read" | "admin" | null };
+
+/** Read the already resolved identity; never reload unrestricted roles from its subject ID. */
+export const appAccessAuthority = <E extends AuthContext>(c: Context<E>): RequestAuthority | null => {
+  const actor = c.get("actor");
+  const accessSubject = c.get("accessSubject");
+  const credentialKind = c.get("credentialKind");
+  if (!actor || !accessSubject || !credentialKind) return null;
+  return { actor, accessSubject, credentialKind, scopes: c.get("credentialScopes") ?? [] };
+};
+
+const credentialAllows = (authority: RequestAuthority, appId: string): boolean => {
+  const actor = authority.actor;
+  if (actor.kind === "service_account") {
+    if (actor.serviceAccount.status !== "active") return false;
+    if (actor.serviceAccount.kind === "resource_bound" && actor.serviceAccount.appId !== appId) return false;
+    if (actor.credentialExpiresAt && !(new Date(actor.credentialExpiresAt).getTime() > Date.now())) return false;
+  }
+  const credentialKind = authority.credentialKind === "invocation" ? actor.delegation?.credentialKind : authority.credentialKind;
+  if (authority.scopes.includes("ai:inference")) return false;
+  // Full personal API keys intentionally carry no scopes. Resource/standalone
+  // keys retain their caps; app-prefixed scopes are already used by applications.
+  if (credentialKind === "session" || credentialKind === "mandate") return true;
+  if (
+    credentialKind === "api_key" &&
+    actor.kind === "service_account" &&
+    actor.serviceAccount.kind === "user_delegated" &&
+    authority.scopes.length === 0
+  )
+    return true;
+  return authority.scopes.some((scope) =>
+    ["read", "write", "admin", `${appId}:read`, `${appId}:write`, `${appId}:admin`, `${appId}:*`].includes(scope),
+  );
+};
+
+const fixedAllows = (authority: RequestAuthority, rule: FixedAppAccessRule): boolean => {
+  const user = userFromActor(authority.actor);
+  switch (rule.kind) {
+    case "signedIn":
+      return true;
+    case "noGuests":
+      return user?.profile !== "guest";
+    case "roles":
+      return !!user && rule.roles.some((role) => (role === "guest" ? user.profile === "guest" : user.roles.includes(role)));
+    default:
+      return false;
+  }
+};
+
+/** Pure decision shared by single-app and batched reads. Missing grant state means unconfigured, not an implicit grant. */
+export const evaluateAppAccess = (authority: RequestAuthority | null, app: AccessApp, state?: GrantState): boolean => {
+  if (app.access === undefined) return true; // Step 1 compatibility; no inferred entry rule.
+  if (!authority || !credentialAllows(authority, app.id)) return false;
+  const parsed = AppAccessRuleSchema.safeParse(app.access);
+  if (!parsed.success) return false;
+  const rule = parsed.data;
+  if (rule.kind !== "grants") return fixedAllows(authority, rule);
+  if (!state?.configured) return !!rule.until && fixedAllows(authority, rule.until);
+  return state.permission === "read" || state.permission === "admin";
+};
+
+let lastFailureLog = -Infinity;
+const reportFailure = () => {
+  if (Date.now() - lastFailureLog < 60_000) return;
+  lastFailureLog = Date.now();
+  logger("app-access").error("Application access could not be resolved; configurable applications are unavailable");
+};
+
+/**
+ * One authoritative SQL read for all configurable apps. No grant cache: revocation applies on the next request.
+ * Pass the reserved transaction as `db` when checking access inside a guarded operation.
+ */
+export const usableAppIds = async (
+  authority: RequestAuthority | null,
+  apps: readonly AccessApp[],
+  options: { db?: SQL } = {},
+): Promise<Set<string>> => {
+  const db = options.db ?? sql;
+  const allowed = new Set(apps.filter((app) => app.access?.kind !== "grants" && evaluateAppAccess(authority, app)).map((app) => app.id));
+  if (!authority) return allowed;
+  const configurable = apps.filter((app) => app.access?.kind === "grants" && credentialAllows(authority, app.id));
+  if (configurable.length === 0) return allowed;
+  try {
+    const principal = buildAccessPrincipalCondition({
+      subject: authority.accessSubject,
+      columns: {
+        userId: db`a.user_id`,
+        groupId: db`a.group_id`,
+        serviceAccountId: db`a.service_account_id`,
+        authenticatedOnly: db`a.authenticated_only`,
+      },
+    });
+    const states = await db<GrantState[]>`
+      SELECT requested.app_id, s.configured_at IS NOT NULL AS configured,
+        (SELECT a.permission FROM auth.app_access j JOIN auth.access a ON a.id = j.access_id
+         WHERE j.app_id = requested.app_id AND a.permission IN ('read', 'admin')
+           AND (a.user_id IS NOT NULL OR a.group_id IS NOT NULL OR a.service_account_id IS NOT NULL OR a.authenticated_only)
+           AND ${principal}
+         ORDER BY CASE a.permission WHEN 'admin' THEN 2 ELSE 1 END DESC LIMIT 1) AS permission
+      FROM unnest(${toPgTextArray(configurable.map((app) => app.id))}::text[]) AS requested(app_id)
+      LEFT JOIN auth.app_access_state s ON s.app_id = requested.app_id
+    `;
+    const byApp = new Map(states.map((state) => [state.app_id, state]));
+    for (const app of configurable) if (evaluateAppAccess(authority, app, byApp.get(app.id))) allowed.add(app.id);
+  } catch {
+    reportFailure();
+  }
+  return allowed;
+};
+
+export const canUseApp = async (authority: RequestAuthority | null, app: AccessApp, options: { db?: SQL } = {}): Promise<boolean> =>
+  (await usableAppIds(authority, [app], options)).has(app.id);

package/src/services/app-discovery.ts

@@ -0,0 +1,27 @@
+import { listApps } from "../_internal/registry";
+import type { AppMeta } from "../contracts/app";
+import type { AppRegistryEntry } from "../contracts/registry";
+import type { RequestAuthority } from "../server/middleware/auth";
+import { usableAppIds } from "./app-access";
+
+/** Filter before projecting any app-owned names, schemas, or content. */
+export const discoverableApps = async <T extends Pick<AppMeta, "id" | "access">>(
+  authority: RequestAuthority | null,
+  apps: readonly T[],
+): Promise<T[]> => {
+  const usable = await usableAppIds(authority, apps);
+  return apps.filter((app) => usable.has(app.id));
+};
+
+/** Capability and widget records carry an app ID; the live registry owns their access declaration. */
+export const discoverableAppEntries = async <T extends { appId: string }>(
+  authority: RequestAuthority | null,
+  entries: readonly T[],
+  registry: () => Promise<AppRegistryEntry[]> = listApps,
+): Promise<T[]> => {
+  if (!entries.length) return [];
+  const ids = new Set(entries.map((entry) => entry.appId));
+  const apps = (await registry()).filter((app) => ids.has(app.id));
+  const usable = await usableAppIds(authority, apps);
+  return entries.filter((entry) => usable.has(entry.appId));
+};

package/src/services/approvals/content.ts

@@ -0,0 +1,40 @@
+import { sql } from "bun";
+import { parseStoredReviewContent } from "../../capabilities/review-storage";
+import { CAPABILITY_MAX_REVIEW_CONTENT_BYTES } from "../../contracts/capabilities";
+
+// Start with this person's indexed pending rows; a Studio page alone cannot continue a chat.
+export const openRequests = (approverUserId: string, id?: string) => sql`SELECT r.* FROM approvals.requests r
+  WHERE r.approver_user_id=${approverUserId}::uuid AND r.status='pending' AND r.expires_at > now()
+    AND r.approver_auth_epoch=(SELECT auth_epoch FROM auth.users WHERE id=${approverUserId}::uuid)
+    AND (${id ?? null}::uuid IS NULL OR r.id=${id ?? null}::uuid)
+    AND EXISTS (SELECT 1 FROM ai.pending_actions p WHERE p.approval_id=r.id AND p.status='pending')`;
+
+/** Keep the original approval's digest and reader even when the turn has moved to a newer question. */
+export const compactApprovalDetailsSql = (row = "r") => {
+  const details = sql`${sql(`${row}.details`)}`;
+  return sql`CASE WHEN jsonb_typeof(${details}) = 'object' THEN (${details} - 'content') || CASE WHEN ${details} ? 'content' THEN jsonb_build_object(
+    'contentRef', jsonb_build_object('href', '/api/approvals/' || ${sql(`${row}.id`)}::text || '/content', 'digest', ${sql(`${row}.review_digest`)})
+  ) ELSE '{}'::jsonb END ELSE ${details} END`;
+};
+
+/** Open requests retain the existing approver, pending-action, expiry and sign-out-epoch requirements. */
+export const readApprovalContent = async (input: { id: string; approverUserId: string; digest: string; signal?: AbortSignal }) => {
+  input.signal?.throwIfAborted();
+  const query = sql<{ content: unknown }[]>`
+    SELECT r.details->'content' AS content FROM (${openRequests(input.approverUserId, input.id)}) r
+    WHERE r.review_digest=${input.digest}
+      AND octet_length((r.details->'content')::text) <= ${2 * CAPABILITY_MAX_REVIEW_CONTENT_BYTES + 2} LIMIT 1`;
+  const abort = () => query.cancel();
+  input.signal?.addEventListener("abort", abort, { once: true });
+  if (input.signal?.aborted) abort();
+  let rows: { content: unknown }[];
+  try {
+    rows = await query;
+  } finally {
+    input.signal?.removeEventListener("abort", abort);
+  }
+  input.signal?.throwIfAborted();
+  const row = rows[0];
+  const parsed = parseStoredReviewContent(row?.content);
+  return parsed.success ? parsed.data : null;
+};

package/src/services/approvals/index.ts

@@ -1,11 +1,14 @@
 import { type SQL, sql } from "bun";
 import { capabilityRequestHash } from "../../capabilities/claims";
+import { restoreReviewSnapshot, serializeReviewSnapshot } from "../../capabilities/review-storage";
 import { APPROVAL_ACP_CLIENT } from "../../contracts/approvals";
 import type { CapabilityActionReviewData } from "../../contracts/capabilities";
+import { CapabilityActionReviewPresentationSchema } from "../../contracts/capabilities";
 import { isAppSessionActor } from "../../server/actor";
 import type { RequestActor, RequestCredentialKind } from "../../server/middleware/auth";
 import { audit } from "../audit";
 import { toPgTextArray } from "../postgres";
+import { compactApprovalDetailsSql } from "./content";
 
 export { countPending, listPending, presentPendingApproval } from "./list";
 export { migrateApprovals } from "./migrate";
@@ -83,10 +86,10 @@ export type ApprovalRequest = {
 };
 // SQL aliases keep the public row shape identical for reads and locked transaction reads. A function, because a
 // fragment built at import time would bind the default sql handle before a test can choose its database.
-const columns = () => sql`id, app_id AS "appId", action, approval_scope AS "approvalScope",
+const columns = (compact = false) => sql`id, app_id AS "appId", action, approval_scope AS "approvalScope",
   requester_kind AS "requesterKind", requester_ref AS "requesterRef", requester_app_id AS "requesterAppId",
   requester_title AS "requesterTitle", subject_id AS "subjectId", approver_user_id AS "approverUserId",
-  assurance, sentence, details, args_digest AS "argsDigest", review_digest AS "reviewDigest", status,
+  assurance, sentence, ${compact ? compactApprovalDetailsSql("approvals.requests") : sql`details`} AS details, args_digest AS "argsDigest", review_digest AS "reviewDigest", status,
   decided_device_id AS "decidedDeviceId", approver_auth_epoch::text AS "approverAuthEpoch",
   decided_via AS "decidedVia", decided_at AS "decidedAt", consumed_at AS "consumedAt",
   created_at AS "createdAt", expires_at AS "expiresAt"`;
@@ -122,7 +125,7 @@ export const request = async (input: ApprovalRequestInput, db?: SQL): Promise<Ap
         requester_title, subject_id, approver_user_id, approver_auth_epoch, assurance, sentence, details, args_digest, review_digest, expires_at)
       VALUES (${input.appId}, ${input.action}, ${input.approvalScope ?? null}, ${input.requester.kind}, ${input.requester.ref},
         ${input.requester.appId}, ${input.requester.title ?? null}, ${input.subjectId}::uuid, ${input.approverUserId}::uuid,
-        (SELECT auth_epoch FROM auth.users WHERE id=${input.approverUserId}::uuid), ${input.assurance}, ${input.sentence}, ${JSON.stringify(input.review ?? null)}::text::jsonb,
+        (SELECT auth_epoch FROM auth.users WHERE id=${input.approverUserId}::uuid), ${input.assurance}, ${input.sentence}, ${serializeReviewSnapshot(input.review ?? null)}::text::jsonb,
         ${approvalArgsDigest(input.input)}, ${approvalReviewDigest(input.review)}, now() + (${expiresInMs} * interval '1 millisecond'))
       ON CONFLICT (requester_kind, requester_ref) DO NOTHING
       RETURNING id
@@ -137,10 +140,15 @@ export const request = async (input: ApprovalRequestInput, db?: SQL): Promise<Ap
   });
 };
 
-export const get = async (id: string, db?: SQL): Promise<ApprovalRequest | null> =>
+export const get = async (id: string, db?: SQL, compactReview = false): Promise<ApprovalRequest | null> =>
   transaction(db, async (tx) => {
-    const [row] = await tx<ApprovalRequest[]>`SELECT ${columns()} FROM approvals.requests WHERE id=${id}::uuid`;
-    return row ?? null;
+    const [row] = await tx<ApprovalRequest[]>`SELECT ${columns(compactReview)} FROM approvals.requests WHERE id=${id}::uuid`;
+    return row
+      ? {
+          ...row,
+          details: row.details === null ? null : CapabilityActionReviewPresentationSchema.parse(restoreReviewSnapshot(row.details)),
+        }
+      : null;
   });
 
 export type ApprovalDecisionResult =

package/src/services/approvals/list.ts

@@ -4,8 +4,9 @@ import { AI_WEBSITE_APPROVAL_TOOL, aiTurnAllowsRememberedApprovals } from "../..
 import type { AiTurnRunConfig } from "../../ai/types";
 import type { RuntimeAppMeta } from "../../contracts/app";
 import { APPROVALS_PAGE_SIZE, type ApprovalCounts, type PendingApproval } from "../../contracts/approvals";
-import { type CapabilityActionPolicy, CapabilityActionReviewDataSchema } from "../../contracts/capabilities";
+import { type CapabilityActionPolicy, CapabilityActionReviewPresentationSchema } from "../../contracts/capabilities";
 import type { ApprovalAssurance } from ".";
+import { compactApprovalDetailsSql, openRequests } from "./content";
 import { decodeApprovalCursor, encodeApprovalCursor } from "./cursor";
 
 export type PendingApprovalRow = {
@@ -32,12 +33,6 @@ export type PendingApprovalRow = {
   runConfig: AiTurnRunConfig | null;
 };
 
-// Start with this person's indexed pending rows; a Studio page alone cannot continue a chat.
-export const openRequests = (approverUserId: string, id?: string) => sql`SELECT r.* FROM approvals.requests r
-  WHERE r.approver_user_id=${approverUserId}::uuid AND r.status='pending' AND r.expires_at > now()
-    AND r.approver_auth_epoch=(SELECT auth_epoch FROM auth.users WHERE id=${approverUserId}::uuid)
-    AND (${id ?? null}::uuid IS NULL OR r.id=${id ?? null}::uuid)
-    AND EXISTS (SELECT 1 FROM ai.pending_actions p WHERE p.approval_id=r.id AND p.status='pending')`;
 const matches = (appId?: string, link?: string) => sql`
   (${appId ?? null}::text IS NULL OR r.app_id=${appId ?? null} OR r.requester_app_id=${appId ?? null})
   AND (${link ?? null}::text IS NULL OR COALESCE(r.details->'links' @> jsonb_build_array(jsonb_build_object('href', ${link ?? null}::text)),false))`;
@@ -58,7 +53,7 @@ export const listPending = async (input: {
     SELECT count(*) FILTER (WHERE ${matches(input.appId, input.link)})::int AS count,
       count(*) FILTER (WHERE NOT (${matches(input.appId, input.link)}))::int AS elsewhere FROM open r`;
   const rows = await sql<PendingApprovalRow[]>`WITH open AS (${openRequests(input.approverUserId, input.id)})
-    SELECT r.id, r.app_id AS "appId", r.action, r.requester_app_id AS "requesterAppId", r.requester_title AS "requesterTitle", r.assurance, r.sentence, r.details, r.args_digest AS "argsDigest",
+    SELECT r.id, r.app_id AS "appId", r.action, r.requester_app_id AS "requesterAppId", r.requester_title AS "requesterTitle", r.assurance, r.sentence, ${compactApprovalDetailsSql()} AS details, r.args_digest AS "argsDigest",
       r.created_at AS "createdAt", r.expires_at AS "expiresAt",
       to_char(r.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS "cursorCreatedAt",
       question.short_id AS "conversationShortId", question.title AS "conversationTitle",
@@ -67,7 +62,7 @@ export const listPending = async (input: {
       question.stored_review AS "storedReview"
     FROM open r JOIN LATERAL (
       SELECT c.short_id, c.title, p.allow_chat, p.allow_always, p.remember_tool_name, p.tool_name, t.run_config,
-        (SELECT m.meta->'toolReviews'->review.call_id FROM (
+        (SELECT (m.meta->'toolReviews'->review.call_id) - 'content' - 'contentRef' FROM (
           SELECT meta, conversation_id, loop_id, role, seq FROM ai.messages
           UNION ALL
           SELECT meta, conversation_id, loop_id, role, seq FROM ai.task_messages
@@ -109,12 +104,12 @@ export const presentPendingApproval = (
   policy?: CapabilityActionPolicy,
 ): PendingApproval => {
   const app = apps.find((entry) => entry.id === row.appId);
-  const review = CapabilityActionReviewDataSchema.nullable().safeParse(row.details);
+  const review = CapabilityActionReviewPresentationSchema.nullable().safeParse(row.details);
   const originalReview = review.success ? review.data : null;
   const displayReview =
     originalReview && "sentence" in originalReview
       ? row.storedReview && "sentence" in row.storedReview
-        ? row.storedReview
+        ? { ...originalReview, ask: originalReview.ask ?? row.storedReview.ask }
         : storedActionReview(originalReview, policy)
       : originalReview;
   const remember = row.assurance === "standard" && aiTurnAllowsRememberedApprovals(row.runConfig);

package/src/services/approvals/question.ts

@@ -3,9 +3,8 @@ import { type AiStoredActionReview, storedActionReview } from "../../ai/action-r
 import type { ActionCard } from "../../ai/chat/action-card";
 import { approvalCard } from "../../approvals/approval-card";
 import {
-  CapabilityActionCallReviewSchema,
   type CapabilityActionPolicy,
-  CapabilityActionReviewDataSchema,
+  CapabilityActionReviewPresentationSchema,
   capabilityActionPolicy,
 } from "../../contracts/capabilities";
 import { DEFAULT_LOCALE } from "../../server/locale";
@@ -23,8 +22,8 @@ import type { PendingApprovalRow } from "./list";
 export type ApprovalActionPolicy = CapabilityActionPolicy | null | undefined;
 const needsPolicy = (row: PendingApprovalRow): boolean => {
   if (row.storedReview && "sentence" in row.storedReview) return true;
-  const review = CapabilityActionCallReviewSchema.safeParse(row.details);
-  return review.success;
+  const review = CapabilityActionReviewPresentationSchema.safeParse(row.details);
+  return review.success && "sentence" in review.data;
 };
 /** Reads the registry once for the rows that need their Action's declared policy, as the approvals page does. */
 export const loadApprovalActionPolicies = async (
@@ -41,13 +40,18 @@ export const loadApprovalActionPolicies = async (
   };
 };
 
-/** Prefer the turn's snapshot, then the linked request's review. */
+/** The open request binds the content; the turn supplies the declared reason for older snapshots. */
 export const pendingApprovalReview = (
   row: Pick<PendingApprovalRow, "storedReview" | "details">,
   policy?: ApprovalActionPolicy,
 ): AiStoredActionReview | null => {
-  const parsed = CapabilityActionReviewDataSchema.safeParse(row.details);
-  return row.storedReview ?? (parsed.success ? storedActionReview(parsed.data, policy ?? undefined) : null);
+  const parsed = CapabilityActionReviewPresentationSchema.safeParse(row.details);
+  if (parsed.success && "sentence" in parsed.data)
+    return storedActionReview(
+      { ...parsed.data, ask: parsed.data.ask ?? (row.storedReview && "sentence" in row.storedReview ? row.storedReview.ask : undefined) },
+      policy,
+    );
+  return row.storedReview ?? (parsed.success ? storedActionReview(parsed.data, policy) : null);
 };
 
 /** Resolve the recorded question in the language and time zone of its originating turn. */

package/src/services/downstream-budget.ts

@@ -0,0 +1,87 @@
+import { env } from "../config/env";
+import { logger } from "./logging";
+import { requestCacheRedis } from "./request-cache-redis";
+
+// Preserve the existing single-process PDF and immediate SMTP limits as the
+// installation's baseline. Local counters still protect each process's memory.
+const CAPACITY = { gotenberg: 2, smtp: 8 } as const;
+type Downstream = keyof typeof CAPACITY;
+type Client = { send(command: string, args: string[]): Promise<unknown> };
+
+const ACQUIRE = `
+local clock = redis.call('TIME')
+local now = tonumber(clock[1]) * 1000 + math.floor(tonumber(clock[2]) / 1000)
+redis.call('ZREMRANGEBYSCORE', KEYS[1], '-inf', now)
+if redis.call('ZCARD', KEYS[1]) >= tonumber(ARGV[1]) then return 0 end
+redis.call('ZADD', KEYS[1], now + tonumber(ARGV[2]), ARGV[3])
+local last = redis.call('ZRANGE', KEYS[1], -1, -1, 'WITHSCORES')
+redis.call('PEXPIRE', KEYS[1], math.ceil(tonumber(last[2]) - now))
+return 1
+`;
+
+export class DownstreamBusyError extends Error {
+  constructor(readonly downstream: Downstream) {
+    super(`${downstream} is busy; retry later.`);
+    this.name = "DownstreamBusyError";
+  }
+}
+
+/** No admission queue: one atomic attempt, bounded by the caller's operation deadline. */
+export const createDownstreamBudget = (options: { client?: () => Promise<Client>; namespace?: () => string } = {}) => ({
+  async acquire(input: { downstream: Downstream; timeoutMs: number; signal: AbortSignal }): Promise<() => void> {
+    input.signal.throwIfAborted();
+    if (!Number.isFinite(input.timeoutMs) || input.timeoutMs <= 0) throw new RangeError("Downstream timeout must be positive and finite");
+    const namespace = options.namespace?.() ?? env.SYNC_NAMESPACE;
+    if (!namespace.trim()) throw new Error("SYNC_NAMESPACE is required for shared downstream budgets");
+    const key = `cloud:downstream:{${namespace}}:${input.downstream}`;
+    const token = crypto.randomUUID();
+    let client: Client | undefined;
+    const release = () => {
+      // Release does not delay a response or shutdown during a Valkey outage.
+      // Tokens also expire after twice the operation deadline, allowing time
+      // for aborted HTTP/SMTP sockets to close before a crashed slot is reused.
+      try {
+        void client?.send("ZREM", [key, token]).catch(() => {});
+      } catch {
+        // A synchronous client failure must not turn SMTP success into a retry.
+      }
+    };
+    let cancelled = false;
+    let onAbort: () => void = () => {};
+    const admission = (async () => {
+      client = await (options.client ?? requestCacheRedis)();
+      if (cancelled) return false;
+      const admitted =
+        Number(await client.send("EVAL", [ACQUIRE, "1", key, String(CAPACITY[input.downstream]), String(input.timeoutMs * 2), token])) ===
+        1;
+      if (cancelled && admitted) release();
+      return admitted;
+    })();
+    try {
+      const admitted = await Promise.race([
+        admission,
+        new Promise<never>((_, reject) => {
+          onAbort = () => {
+            cancelled = true;
+            reject(input.signal.reason);
+          };
+          input.signal.addEventListener("abort", onAbort, { once: true });
+          if (input.signal.aborted) onAbort();
+        }),
+      ]);
+      if (!admitted) throw new DownstreamBusyError(input.downstream);
+      return release;
+    } catch (error) {
+      if (input.signal.aborted) throw input.signal.reason;
+      if (!(error instanceof DownstreamBusyError)) {
+        // Do not expose connection details, which can include credentials.
+        logger("downstream-budget").warn("Downstream admission unavailable", { downstream: input.downstream });
+      }
+      throw new DownstreamBusyError(input.downstream);
+    } finally {
+      input.signal.removeEventListener("abort", onAbort);
+    }
+  },
+});
+
+export const downstreamBudget = createDownstreamBudget();