@nifrajs/core 3.3.0 → 4.0.0

package/src/evidence.ts

@@ -14,11 +14,14 @@ import type {
   CapabilityFinding,
 } from "./capabilities.ts"
 import type { ResponseClassification } from "./classification.ts"
+import { codeUnitOrder } from "./internal/code-unit-order.ts"
 import { evidenceProvenance } from "./internal/route-assurance.ts"
 import {
   type JsonSchema,
+  type ReflectedMount,
   type ReflectedRoute,
   type ReflectedSchemaField,
+  reflectMounts,
   reflectRoutes,
   type SchemaReflection,
 } from "./reflection.ts"
@@ -26,12 +29,15 @@ import {
 export interface ProjectEvidenceSchemaPart {
   readonly jsonSchema?: JsonSchema
   readonly fields?: readonly ReflectedSchemaField[]
+  /** The media types a body schema reads through a parser of its own. */
+  readonly mediaTypes?: readonly string[]
 }
 
 export interface ProjectEvidenceSchema {
   readonly bodyLimit?: number | "unlimited"
   readonly bodyLimitReason?: string
   readonly headers?: ProjectEvidenceSchemaPart
+  readonly cookies?: ProjectEvidenceSchemaPart
   readonly body?: ProjectEvidenceSchemaPart
   readonly query?: ProjectEvidenceSchemaPart
   readonly params?: ProjectEvidenceSchemaPart
@@ -50,6 +56,7 @@ export interface ProjectEvidenceRoute {
   readonly method: string
   readonly path: string
   readonly schema?: ProjectEvidenceSchema
+  readonly responseContract?: "warn" | "enforce"
   readonly assurance?: readonly AssuranceEvidence[]
   readonly capabilities?: readonly string[]
   readonly family?: boolean
@@ -93,6 +100,8 @@ export interface ProjectEvidenceCapabilities {
 export interface ProjectEvidenceSnapshot {
   readonly version: 1
   readonly routes: readonly ProjectEvidenceRoute[]
+  /** Mounted children whose routes are not in `routes`, present when there is at least one. */
+  readonly mounts?: readonly ReflectedMount[]
   readonly assurance?: ProjectEvidenceAssurance
   readonly capabilities?: ProjectEvidenceCapabilities
 }
@@ -100,8 +109,23 @@ export interface ProjectEvidenceSnapshot {
 export interface ProjectEvidenceOptions {
   readonly assurance?: AssuranceReport
   readonly capabilities?: CapabilityAssuranceReport
+  /**
+   * An existing reflection pass. Supplying it lets several offline projections share one pass
+   * without asking the runtime source for `.routes()` again. Validators are consumed only while
+   * building the token-only snapshot and never cross this seam.
+   */
+  readonly routes?: readonly ReflectedRoute[]
   /** Optional static source locations keyed by `${METHOD}\n${path}`. */
   readonly sourceLocations?: ReadonlyMap<string, readonly ProjectEvidenceSourceLocation[]>
+  /** An existing mount reflection, like `routes`. Default: `reflectMounts(source)`. */
+  readonly mounts?: readonly ReflectedMount[]
+}
+
+/** One token-only evidence snapshot in a composed application surface. */
+export interface ProjectEvidenceCompositionPart {
+  readonly evidence: ProjectEvidenceSnapshot
+  /** Public pathname prefix to add when the child receives a stripped mount request. */
+  readonly pathPrefix?: string
 }
 
 const recordOf = (value: unknown): Readonly<Record<string, unknown>> | undefined =>
@@ -114,6 +138,9 @@ function schemaPart(value: SchemaReflection | undefined): ProjectEvidenceSchemaP
   return Object.freeze({
     ...(value.jsonSchema !== undefined ? { jsonSchema: value.jsonSchema } : {}),
     ...(value.fields !== undefined ? { fields: Object.freeze([...value.fields]) } : {}),
+    ...(value.mediaTypes !== undefined
+      ? { mediaTypes: Object.freeze([...value.mediaTypes].sort()) }
+      : {}),
   })
 }
 
@@ -121,6 +148,7 @@ function schemaOf(route: ReflectedRoute): ProjectEvidenceSchema | undefined {
   const source = route.schema
   if (source === undefined) return undefined
   const headers = schemaPart(source.headers)
+  const cookies = schemaPart(source.cookies)
   const body = schemaPart(source.body)
   const query = schemaPart(source.query)
   const params = schemaPart(source.params)
@@ -135,6 +163,7 @@ function schemaOf(route: ReflectedRoute): ProjectEvidenceSchema | undefined {
     ...(source.bodyLimit !== undefined ? { bodyLimit: source.bodyLimit } : {}),
     ...(source.bodyLimitReason !== undefined ? { bodyLimitReason: source.bodyLimitReason } : {}),
     ...(headers !== undefined ? { headers } : {}),
+    ...(cookies !== undefined ? { cookies } : {}),
     ...(body !== undefined ? { body } : {}),
     ...(query !== undefined ? { query } : {}),
     ...(params !== undefined ? { params } : {}),
@@ -157,7 +186,7 @@ function assuranceEvidenceOf(values: readonly AssuranceEvidence[]): readonly Ass
           provenance: evidenceProvenance(item),
         }),
       )
-      .sort((a, b) => a.id.localeCompare(b.id) || a.source.localeCompare(b.source)),
+      .sort((a, b) => codeUnitOrder(a.id, b.id) || codeUnitOrder(a.source, b.source)),
   )
 }
 
@@ -169,9 +198,9 @@ function capabilityEvidenceOf(
       .map((item) => Object.freeze({ id: item.id, kind: item.kind, source: item.source }))
       .sort(
         (a, b) =>
-          a.id.localeCompare(b.id) ||
-          a.kind.localeCompare(b.kind) ||
-          a.source.localeCompare(b.source),
+          codeUnitOrder(a.id, b.id) ||
+          codeUnitOrder(a.kind, b.kind) ||
+          codeUnitOrder(a.source, b.source),
       ),
   )
 }
@@ -180,7 +209,7 @@ const sortByRoute = <T extends { readonly method: string; readonly path: string
   values: readonly T[],
 ): readonly T[] =>
   Object.freeze(
-    [...values].sort((a, b) => a.path.localeCompare(b.path) || a.method.localeCompare(b.method)),
+    [...values].sort((a, b) => codeUnitOrder(a.path, b.path) || codeUnitOrder(a.method, b.method)),
   )
 
 function evidenceRouteOf(
@@ -192,6 +221,7 @@ function evidenceRouteOf(
     method: route.method.toUpperCase(),
     path: route.path,
     ...(schema !== undefined ? { schema } : {}),
+    ...(route.responseContract === undefined ? {} : { responseContract: route.responseContract }),
     ...(route.assurance !== undefined ? { assurance: assuranceEvidenceOf(route.assurance) } : {}),
     ...(route.capabilities !== undefined
       ? { capabilities: Object.freeze([...route.capabilities].sort()) }
@@ -224,9 +254,9 @@ function assuranceOf(report: AssuranceReport | undefined): ProjectEvidenceAssura
     findings: Object.freeze(
       [...report.findings].sort(
         (a, b) =>
-          a.path.localeCompare(b.path) ||
-          a.method.localeCompare(b.method) ||
-          a.code.localeCompare(b.code),
+          codeUnitOrder(a.path, b.path) ||
+          codeUnitOrder(a.method, b.method) ||
+          codeUnitOrder(a.code, b.code),
       ),
     ),
   })
@@ -254,14 +284,259 @@ function capabilitiesOf(
     findings: Object.freeze(
       [...report.findings].sort(
         (a, b) =>
-          a.path.localeCompare(b.path) ||
-          a.method.localeCompare(b.method) ||
-          a.code.localeCompare(b.code),
+          codeUnitOrder(a.path, b.path) ||
+          codeUnitOrder(a.method, b.method) ||
+          codeUnitOrder(a.code, b.code),
       ),
     ),
   })
 }
 
+function trimTrailingSlashes(path: string): string {
+  // Index-scan instead of `/\/+$/`: path prefixes can be library input, and the
+  // unanchored-start trailing-run replacement can backtrack quadratically.
+  let end = path.length
+  while (end > 0 && path.charCodeAt(end - 1) === 47 /* '/' */) end--
+  return path.slice(0, end)
+}
+
+const composedPath = (prefix: string, path: string): string => {
+  if (path === "*") return path
+  if (!path.startsWith("/"))
+    throw new TypeError(`project evidence: route path must start with "/": ${path}`)
+  if (prefix === "") return path
+  if (!prefix.startsWith("/")) {
+    throw new TypeError(`project evidence: path prefix must start with "/": ${prefix}`)
+  }
+  const normalized = prefix === "/" ? "" : trimTrailingSlashes(prefix)
+  return normalized === "" ? path : path === "/" ? normalized : `${normalized}${path}`
+}
+
+function remapEvidenceSnapshot(
+  evidence: ProjectEvidenceSnapshot,
+  pathPrefix: string,
+): ProjectEvidenceSnapshot {
+  if (evidence.version !== 1) throw new Error("project evidence: unsupported snapshot version")
+  const route = (
+    method: string,
+    path: string,
+  ): { readonly method: string; readonly path: string } => ({
+    method: method.toUpperCase(),
+    path: composedPath(pathPrefix, path),
+  })
+  const routes = evidence.routes.map((item) => {
+    const key = route(item.method, item.path)
+    return Object.freeze({ ...item, ...key })
+  })
+  const mounts = evidence.mounts?.map((item) =>
+    Object.freeze({ ...item, path: composedPath(pathPrefix, item.path) }),
+  )
+  const assurance =
+    evidence.assurance === undefined
+      ? undefined
+      : Object.freeze({
+          ok: evidence.assurance.ok,
+          routes: Object.freeze(
+            evidence.assurance.routes.map((item) =>
+              Object.freeze({ ...item, ...route(item.method, item.path) }),
+            ),
+          ),
+          findings: Object.freeze(
+            evidence.assurance.findings.map((item) =>
+              Object.freeze({ ...item, ...route(item.method, item.path) }),
+            ),
+          ),
+        })
+  const capabilities =
+    evidence.capabilities === undefined
+      ? undefined
+      : Object.freeze({
+          ok: evidence.capabilities.ok,
+          routes: Object.freeze(
+            evidence.capabilities.routes.map((item) =>
+              Object.freeze({ ...item, ...route(item.method, item.path) }),
+            ),
+          ),
+          findings: Object.freeze(
+            evidence.capabilities.findings.map((item) =>
+              Object.freeze({ ...item, ...route(item.method, item.path) }),
+            ),
+          ),
+        })
+  return Object.freeze({
+    version: 1,
+    routes: Object.freeze(routes),
+    ...(mounts === undefined ? {} : { mounts: Object.freeze(mounts) }),
+    ...(assurance === undefined ? {} : { assurance }),
+    ...(capabilities === undefined ? {} : { capabilities }),
+  })
+}
+
+function routeKeyForEvidence(method: string, path: string): string {
+  return `${method.toUpperCase()}\n${path}`
+}
+
+function validateComposedReportRoutes(
+  report: ProjectEvidenceAssurance | ProjectEvidenceCapabilities,
+  routeKeys: ReadonlySet<string>,
+  kind: "assurance" | "capabilities",
+): void {
+  for (const route of report.routes) {
+    if (!routeKeys.has(routeKeyForEvidence(route.method, route.path))) {
+      throw new Error(
+        `project evidence: ${kind} route ${route.method} ${route.path} is not present in the composed route set`,
+      )
+    }
+  }
+}
+
+/**
+ * Compose page and mounted-app evidence into one deterministic snapshot.
+ *
+ * This is an offline operation. It carries route contracts, assurance/capability tokens, and source
+ * locations only; it never invokes handlers or copies request/business data. A duplicate public
+ * method+path or a report that no longer describes a composed route is rejected rather than silently
+ * dropping one side of the trust boundary.
+ */
+export function composeProjectEvidence(
+  parts: readonly ProjectEvidenceCompositionPart[],
+): ProjectEvidenceSnapshot {
+  const routes: ProjectEvidenceRoute[] = []
+  const routeKeys = new Set<string>()
+  const mounts: ReflectedMount[] = []
+  const assuranceReports: ProjectEvidenceAssurance[] = []
+  const capabilityReports: ProjectEvidenceCapabilities[] = []
+
+  for (const part of parts) {
+    const prefix = part.pathPrefix ?? ""
+    const mapped = remapEvidenceSnapshot(part.evidence, prefix)
+    for (const route of mapped.routes) {
+      const key = routeKeyForEvidence(route.method, route.path)
+      if (routeKeys.has(key)) {
+        throw new Error(`project evidence: duplicate composed route ${route.method} ${route.path}`)
+      }
+      routeKeys.add(key)
+      routes.push(route)
+    }
+    mounts.push(...(mapped.mounts ?? []))
+    if (mapped.assurance !== undefined) assuranceReports.push(mapped.assurance)
+    if (mapped.capabilities !== undefined) capabilityReports.push(mapped.capabilities)
+  }
+
+  const assurance =
+    assuranceReports.length === 0
+      ? undefined
+      : Object.freeze({
+          ok: assuranceReports.every((report) => report.ok),
+          routes: sortByRoute(assuranceReports.flatMap((report) => report.routes)),
+          findings: Object.freeze(
+            assuranceReports
+              .flatMap((report) => report.findings)
+              .sort(
+                (a, b) =>
+                  codeUnitOrder(a.path, b.path) ||
+                  codeUnitOrder(a.method, b.method) ||
+                  codeUnitOrder(a.code, b.code),
+              ),
+          ),
+        })
+  const capabilities =
+    capabilityReports.length === 0
+      ? undefined
+      : Object.freeze({
+          ok: capabilityReports.every((report) => report.ok),
+          routes: sortByRoute(capabilityReports.flatMap((report) => report.routes)),
+          findings: Object.freeze(
+            capabilityReports
+              .flatMap((report) => report.findings)
+              .sort(
+                (a, b) =>
+                  codeUnitOrder(a.path, b.path) ||
+                  codeUnitOrder(a.method, b.method) ||
+                  codeUnitOrder(a.code, b.code),
+              ),
+          ),
+        })
+  if (assurance !== undefined) validateComposedReportRoutes(assurance, routeKeys, "assurance")
+  if (capabilities !== undefined)
+    validateComposedReportRoutes(capabilities, routeKeys, "capabilities")
+
+  return Object.freeze({
+    version: 1,
+    routes: sortByRoute(routes),
+    ...mountsPart(mounts),
+    ...(assurance === undefined ? {} : { assurance }),
+    ...(capabilities === undefined ? {} : { capabilities }),
+  })
+}
+
+function schemaPartToReflection(
+  value: ProjectEvidenceSchemaPart | undefined,
+): SchemaReflection | undefined {
+  return value === undefined
+    ? undefined
+    : {
+        standard: undefined,
+        jsonSchema: value.jsonSchema,
+        fields: value.fields,
+        ...(value.mediaTypes !== undefined ? { mediaTypes: value.mediaTypes } : {}),
+      }
+}
+
+function schemaFromEvidence(schema: ProjectEvidenceSchema | undefined): ReflectedRoute["schema"] {
+  if (schema === undefined) return undefined
+  const errors = Object.fromEntries(
+    Object.entries(schema.errors ?? {}).map(([status, value]) => [
+      status,
+      schemaPartToReflection(value) as SchemaReflection,
+    ]),
+  )
+  const headers = schemaPartToReflection(schema.headers)
+  const cookies = schemaPartToReflection(schema.cookies)
+  const body = schemaPartToReflection(schema.body)
+  const query = schemaPartToReflection(schema.query)
+  const params = schemaPartToReflection(schema.params)
+  const response = schemaPartToReflection(schema.response)
+  const sse = schemaPartToReflection(schema.sse)
+  return {
+    ...(schema.bodyLimit !== undefined ? { bodyLimit: schema.bodyLimit } : {}),
+    ...(schema.bodyLimitReason !== undefined ? { bodyLimitReason: schema.bodyLimitReason } : {}),
+    ...(headers !== undefined ? { headers } : {}),
+    ...(cookies !== undefined ? { cookies } : {}),
+    ...(body !== undefined ? { body } : {}),
+    ...(query !== undefined ? { query } : {}),
+    ...(params !== undefined ? { params } : {}),
+    ...(response !== undefined ? { response } : {}),
+    ...(Object.keys(errors).length > 0 ? { errors } : {}),
+    ...(sse !== undefined ? { sse } : {}),
+  }
+}
+
+/**
+ * Adapt the canonical token-only snapshot to the runtime-reflection shape used by projections.
+ * The returned schemas deliberately have no `standard` validator: this adapter is for offline
+ * contract views, not request validation or mock generation.
+ */
+export function reflectedRoutesFromEvidence(
+  evidence: ProjectEvidenceSnapshot,
+): readonly ReflectedRoute[] {
+  if (evidence.version !== 1) throw new Error("project evidence: unsupported snapshot version")
+  return evidence.routes.map((route) => {
+    const schema = schemaFromEvidence(route.schema)
+    return {
+      method: route.method,
+      path: route.path,
+      ...(schema !== undefined ? { schema } : {}),
+      ...(route.responseContract === undefined ? {} : { responseContract: route.responseContract }),
+      ...(route.assurance !== undefined ? { assurance: route.assurance } : {}),
+      ...(route.capabilities !== undefined ? { capabilities: route.capabilities } : {}),
+      ...(route.family === true ? { family: true } : {}),
+      ...(route.classification !== undefined ? { classification: route.classification } : {}),
+      ...(route.tool !== undefined ? { tool: route.tool } : {}),
+    }
+  })
+}
+
 /** Build the canonical snapshot from reflection and already-evaluated offline reports. */
 export function snapshotProjectEvidence(
   source: unknown,
@@ -270,21 +545,36 @@ export function snapshotProjectEvidence(
   const locations = options.sourceLocations
   const assurance = assuranceOf(options.assurance)
   const capabilities = capabilitiesOf(options.capabilities)
+  const reflected = options.routes ?? reflectRoutes(source)
   const routes = sortByRoute(
     // Importantly, this is the only reflection pass for this snapshot. Every projection can consume
     // the result instead of independently asking the app for `.routes()` and re-shaping schemas.
-    reflectRoutes(source).map((route) =>
+    reflected.map((route) =>
       evidenceRouteOf(route, locations?.get(keyOf(route.method, route.path))),
     ),
   )
   return Object.freeze({
     version: 1,
     routes,
+    ...mountsPart(options.mounts ?? reflectMounts(source)),
     ...(assurance !== undefined ? { assurance } : {}),
     ...(capabilities !== undefined ? { capabilities } : {}),
   })
 }
 
+/** The snapshot's `mounts` field, sorted, and absent when empty so a mount-free app's snapshot (and its
+ * manifest hash) is unchanged. */
+const mountsPart = (
+  mounts: readonly ReflectedMount[],
+): { readonly mounts?: readonly ReflectedMount[] } =>
+  mounts.length === 0
+    ? {}
+    : {
+        mounts: Object.freeze(
+          [...mounts].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),
+        ),
+      }
+
 function canonicalValue(value: unknown): string {
   if (value === null || typeof value === "string" || typeof value === "boolean") {
     return JSON.stringify(value)

package/src/idempotency.ts

@@ -16,6 +16,9 @@ export type IdempotencyScope = "request" | "durable"
 /** Default retention for a stored idempotent response: 24 hours. */
 export const DEFAULT_IDEMPOTENCY_TTL_MS = 86_400_000
 
+/** Default lease on a key whose handler is still running, with a store that can renew it: 60 seconds. */
+export const DEFAULT_IDEMPOTENCY_PENDING_TTL_MS = 60_000
+
 /** Canonical request header carrying the client-chosen idempotency key. */
 export const DEFAULT_IDEMPOTENCY_HEADER = "idempotency-key"
 
@@ -80,7 +83,14 @@ export interface IdempotencyEntryKey {
 
 export interface IdempotencyBeginInput extends IdempotencyEntryKey {
   readonly fingerprint: string
+  /** Retention for the completed response. */
   readonly ttlMs: number
+  /**
+   * Lease on a `new` reservation: it lapses after this long unless {@link IdempotencyStore.renew}
+   * extends it, and `complete` then keeps the response for `ttlMs`. Passed only to a store with
+   * `renew`; when absent, the pending reservation holds the key for `ttlMs`.
+   */
+  readonly pendingTtlMs?: number | undefined
 }
 
 export interface IdempotencyCompletionInput extends IdempotencyEntryKey {
@@ -94,6 +104,13 @@ export interface IdempotencyAbandonInput extends IdempotencyEntryKey {
   readonly reservation: string
 }
 
+export interface IdempotencyRenewInput extends IdempotencyEntryKey {
+  /** Opaque ownership token returned by `begin(state:"new")`. */
+  readonly reservation: string
+  /** The new lease, from now. */
+  readonly ttlMs: number
+}
+
 /**
  * Storage seam for idempotent responses. `begin` MUST be atomic: for one key, exactly one concurrent
  * caller sees `new`; the rest see `in-flight` (or `replay` once completed). The in-memory store gets
@@ -115,6 +132,12 @@ export interface IdempotencyStore {
   complete(input: IdempotencyCompletionInput): boolean | Promise<boolean>
   /** Release only the pending reservation owned by `reservation`. */
   abandon(input: IdempotencyAbandonInput): boolean | Promise<boolean>
+  /**
+   * Extend the pending reservation owned by `reservation` to `ttlMs` from now. Returns false when it
+   * is gone, lapsed, or completed. The server calls it while the handler runs, so with it a key
+   * whose process died frees after `pendingTtlMs` instead of `ttlMs`.
+   */
+  renew?(input: IdempotencyRenewInput): boolean | Promise<boolean>
 }
 
 /** A key must be a non-empty, bounded, control-char-free token. Fail closed on anything else. */
@@ -240,7 +263,14 @@ async function boundedResponseBytes(response: Response, maxBytes: number): Promi
       if (done) break
       total += value.byteLength
       if (total > maxBytes) {
-        await reader.cancel()
+        // `Response.clone()` tees the body. Cancelling only the clone branch leaves the live branch
+        // unread, so a streaming producer can keep the tee pending forever. This path stores no
+        // response and the caller will replace it with a terminal error, so cancel both branches.
+        const liveBody = response.body
+        await Promise.allSettled([
+          reader.cancel(),
+          liveBody === null ? Promise.resolve() : liveBody.cancel(),
+        ])
         throw new IdempotencyResponseTooLargeError(maxBytes)
       }
       chunks.push(value)
@@ -305,6 +335,7 @@ export function responseFromStored(
 }
 
 interface MemoryEntry {
+  readonly namespace: string
   readonly fingerprint: string
   readonly reservation: string
   readonly ttlMs: number
@@ -317,6 +348,11 @@ export interface MemoryIdempotencyStoreOptions {
   readonly now?: () => number
   /** Hard memory bound. At capacity new keys fail closed; completed/pending entries are never evicted early. */
   readonly maxEntries?: number
+  /**
+   * Bound for one namespace, so a single tenant or principal cannot use up `maxEntries` for the
+   * rest: past it, only that namespace's new keys fail closed. Default: no separate bound.
+   */
+  readonly maxEntriesPerNamespace?: number
 }
 
 /**
@@ -327,8 +363,10 @@ export interface MemoryIdempotencyStoreOptions {
 export class MemoryIdempotencyStore implements IdempotencyStore {
   readonly durability = "memory" as const
   private readonly entries = new Map<string, MemoryEntry>()
+  private readonly perNamespace = new Map<string, number>()
   private readonly now: () => number
   private readonly maxEntries: number
+  private readonly maxPerNamespace: number
 
   constructor(options: MemoryIdempotencyStoreOptions = {}) {
     this.now = options.now ?? Date.now
@@ -336,6 +374,10 @@ export class MemoryIdempotencyStore implements IdempotencyStore {
     if (!Number.isInteger(this.maxEntries) || this.maxEntries < 1) {
       throw new RangeError("idempotency: maxEntries must be a positive integer")
     }
+    this.maxPerNamespace = options.maxEntriesPerNamespace ?? this.maxEntries
+    if (!Number.isInteger(this.maxPerNamespace) || this.maxPerNamespace < 1) {
+      throw new RangeError("idempotency: maxEntriesPerNamespace must be a positive integer")
+    }
   }
 
   begin(input: IdempotencyBeginInput): IdempotencyBeginResult {
@@ -346,17 +388,19 @@ export class MemoryIdempotencyStore implements IdempotencyStore {
       if (existing.response !== undefined) return { state: "replay", response: existing.response }
       return { state: "in-flight" }
     }
-    if (existing !== undefined) this.entries.delete(storageKey)
-    if (this.entries.size >= this.maxEntries) {
+    if (existing !== undefined) this.drop(storageKey, existing)
+    if (this.full(input.namespace)) {
       this.sweep()
-      if (this.entries.size >= this.maxEntries) return { state: "capacity" }
+      if (this.full(input.namespace)) return { state: "capacity" }
     }
     const reservation = crypto.randomUUID()
+    this.perNamespace.set(input.namespace, (this.perNamespace.get(input.namespace) ?? 0) + 1)
     this.entries.set(storageKey, {
+      namespace: input.namespace,
       fingerprint: input.fingerprint,
       reservation,
       ttlMs: input.ttlMs,
-      expiresAt: this.now() + input.ttlMs,
+      expiresAt: this.now() + (input.pendingTtlMs ?? input.ttlMs),
       response: undefined,
     })
     return { state: "new", reservation }
@@ -367,7 +411,7 @@ export class MemoryIdempotencyStore implements IdempotencyStore {
     const entry = this.entries.get(key)
     if (entry === undefined || entry.reservation !== input.reservation) return false
     if (entry.expiresAt <= this.now()) {
-      this.entries.delete(key)
+      this.drop(key, entry)
       return false
     }
     entry.response = input.response
@@ -379,7 +423,7 @@ export class MemoryIdempotencyStore implements IdempotencyStore {
     const key = this.storageKey(input)
     const entry = this.entries.get(key)
     if (entry !== undefined && entry.expiresAt <= this.now()) {
-      this.entries.delete(key)
+      this.drop(key, entry)
       return false
     }
     // Only drop a still-pending reservation; never evict a completed (replayable) response.
@@ -388,17 +432,30 @@ export class MemoryIdempotencyStore implements IdempotencyStore {
       entry.response === undefined &&
       entry.reservation === input.reservation
     ) {
-      this.entries.delete(key)
+      this.drop(key, entry)
       return true
     }
     return false
   }
 
+  renew(input: IdempotencyRenewInput): boolean {
+    const entry = this.entries.get(this.storageKey(input))
+    if (
+      entry?.reservation !== input.reservation ||
+      entry.response !== undefined ||
+      entry.expiresAt <= this.now()
+    ) {
+      return false
+    }
+    entry.expiresAt = this.now() + input.ttlMs
+    return true
+  }
+
   /** Evict expired entries. Callers may run this on an interval; access-time eviction covers the rest. */
   sweep(): void {
     const now = this.now()
     for (const [key, entry] of this.entries) {
-      if (entry.expiresAt <= now) this.entries.delete(key)
+      if (entry.expiresAt <= now) this.drop(key, entry)
     }
   }
 
@@ -410,6 +467,20 @@ export class MemoryIdempotencyStore implements IdempotencyStore {
   private storageKey(input: IdempotencyEntryKey): string {
     return `${input.namespace.length}:${input.namespace}${input.key}`
   }
+
+  private full(namespace: string): boolean {
+    return (
+      this.entries.size >= this.maxEntries ||
+      (this.perNamespace.get(namespace) ?? 0) >= this.maxPerNamespace
+    )
+  }
+
+  private drop(key: string, entry: MemoryEntry): void {
+    this.entries.delete(key)
+    const left = (this.perNamespace.get(entry.namespace) ?? 1) - 1
+    if (left > 0) this.perNamespace.set(entry.namespace, left)
+    else this.perNamespace.delete(entry.namespace)
+  }
 }
 
 /** Convenience factory mirroring the other core primitives' `create*` style. */