@objectstack/service-sms 17.0.0-rc.2 → 17.0.0-rc.4

package/dist/index.d.ts

@@ -1,6 +1,213 @@
 import { ISmsTransport, NormalizedSmsMessage, SmsTransportSendResult, ISmsService, SendSmsInput, SendSmsResult } from '@objectstack/spec/contracts';
+import { CounterStore } from '@objectstack/plugin-auth';
 import { Plugin, PluginContext } from '@objectstack/core';
 
+/**
+ * Global daily SMS send quota — the COST TOTAL gate (#2814).
+ *
+ * ## What this adds that the per-number guard cannot
+ *
+ * #2780 gave the OTP endpoints a per-NUMBER budget (60s cooldown + 5 sends per
+ * number per hour, `plugin-auth/src/otp-send-guard.ts`). That bounds what one
+ * phone number costs. It does not bound what the DEPLOYMENT costs: an attacker
+ * rotating through ten thousand distinct numbers keeps every one of them inside
+ * its own budget while the daily bill has no ceiling at all — classic SMS
+ * pumping / toll fraud. And the per-number guard sits in better-auth's
+ * `hooks.before`, so it only ever sees the auth endpoints: `notify(channels:
+ * ['sms'])` and the invitation path walk straight past it.
+ *
+ * This gate is therefore counted at the ONE place every outbound message
+ * already funnels through — `SmsService.send()` — so OTP, invitations and the
+ * messaging `sms` channel are all charged against the same budget, whatever
+ * door they came in by.
+ *
+ * ## Where it counts (#4790's answer, reused verbatim)
+ *
+ * A budget is only worth what its store is worth: counted per process, a
+ * declared "2000 per day" is really 2000×N across N nodes, and nothing says so
+ * (ADR-0049 — declared ≠ enforced). So this counts through the SAME resolution
+ * the auth counters use — `createLazyCounterStore` over the kernel `cache`
+ * service, resolved at COUNTING time (not at plugin init, the #4772 trap),
+ * with a bounded per-process fallback that announces itself. The counting
+ * algorithm is `incrementFixedWindow`, imported rather than re-implemented:
+ * this repo has exactly one fixed-window counter and #4790 said plainly that a
+ * third copy is not wanted.
+ *
+ * ## The window is a UTC calendar day, twice over
+ *
+ * "Daily quota" means the calendar day, not "24h from the first send", so the
+ * counter key carries the UTC date (`sms-daily-sends:2026-08-06`) AND the
+ * window is opened with exactly the seconds remaining until the next UTC
+ * midnight. Either mechanism alone would roll the budget over; together they
+ * cannot disagree — a clock skew that mis-sizes the TTL still lands on a fresh
+ * key at 00:00Z, and a store that ignores TTLs still starts a new key.
+ *
+ * ## Admission-time counting, and fail-open
+ *
+ * A unit is consumed when a send is ADMITTED, before the transport runs —
+ * exactly like `OtpSendGuard.checkAndRecord` and
+ * `createLazyCacheRateLimitStorage.consume`, both of which take the
+ * post-increment count and compare it to the cap. Two consequences, stated
+ * rather than discovered later: a transport failure still spends a unit (the
+ * conservative direction for a COST ceiling, and the alternative is a second
+ * store round-trip on every send), and attempts refused by this gate keep
+ * incrementing the day's counter, so the number in the log line is "attempts
+ * today", not "messages delivered today".
+ *
+ * Every store interaction is fail-OPEN: a cache outage must not take phone
+ * sign-in down with it (#2814 requirement 4). A degraded gate is announced once
+ * and then admits.
+ *
+ * ## What is NOT here
+ *
+ * The per-tenant dimension (`daily_quota_per_tenant`, keyed by
+ * `organizationId`) is deliberately absent: `SendSmsInput`
+ * (`@objectstack/spec/contracts/sms-service.ts`) carries no tenant identifier,
+ * and inventing a second, service-local spelling of one would be exactly the
+ * shadow contract AGENTS.md Prime Directive #12 forbids. See the issue thread
+ * on #2814 — the tenant identifier belongs on the spec contract or nowhere.
+ */
+
+/**
+ * The error code a quota-refused send answers with, as the `CODE: message`
+ * prefix `SmsService` already uses for `VALIDATION_FAILED`.
+ *
+ * Deliberately the same code the per-number guard raises in `plugin-auth`
+ * (`APIError('TOO_MANY_REQUESTS')`), because #2814 asks the two walls to be
+ * indistinguishable from outside: an attacker must not be able to tell which
+ * budget they hit, and a legitimate caller needs no more than "not now".
+ * The message carries NO remaining-quota detail for the same reason.
+ */
+declare const SMS_QUOTA_EXCEEDED_CODE = "TOO_MANY_REQUESTS";
+/** The refusal text handed back on `SendSmsResult.error`. Contains no counts. */
+declare const SMS_QUOTA_EXCEEDED_ERROR = "TOO_MANY_REQUESTS: daily SMS quota exhausted";
+type LoggerLike = {
+    info?(msg: string, meta?: Record<string, unknown>): void;
+    warn?(msg: string, meta?: Record<string, unknown>): void;
+};
+interface SmsDailyQuotaOptions {
+    /**
+     * Resolve the store the day counter lives in — called on EVERY check, so a
+     * shared cache registered after this gate was constructed is picked up on the
+     * next send rather than never (#4772/#4790). `SmsServicePlugin` supplies
+     * `createLazyCounterStore(...)`; omitted ⇒ a per-process store, silently
+     * (the gate constructed standalone, e.g. in tests).
+     */
+    resolveStore?: () => Promise<CounterStore>;
+    /** Diagnostics sink. NEVER receives a message body or a recipient. */
+    logger?: LoggerLike;
+    /** Clock override for tests. */
+    now?: () => number;
+}
+/** Outcome of one admission check. */
+interface SmsDailyQuotaDecision {
+    /** Whether the send may proceed. */
+    ok: boolean;
+    /**
+     * Attempts counted for the current UTC day AFTER this one, when the counter
+     * was actually consulted. Absent when the gate is off or degraded.
+     */
+    count?: number;
+    /** The enforced ceiling this decision was measured against (`0` ⇒ off). */
+    quota?: number;
+}
+/** `YYYY-MM-DD` in UTC — the day the counter key is scoped to. */
+declare function utcDayStamp(now: number): string;
+/**
+ * Seconds from `now` to the next UTC midnight, at least 1. This is the window
+ * `incrementFixedWindow` opens on the day's first send, so the counter expires
+ * with the day it belongs to instead of 24h after whenever it started.
+ */
+declare function secondsUntilNextUtcMidnight(now: number): number;
+/**
+ * Result of reading an authored quota value: the ceiling actually enforced,
+ * plus the offending input when one had to be discarded.
+ */
+interface NormalizedDailyQuota {
+    /** Enforced ceiling. `0` means unlimited. Always a non-negative integer. */
+    limit: number;
+    /** Set when the authored value was unusable and `0` was substituted. */
+    rejected?: string;
+}
+/**
+ * Clamp an authored `sms.daily_quota` into the value actually enforced.
+ *
+ * **This lives on the CONSUMER side on purpose (#5932).** `SettingsService`
+ * declares `min`/`max` on a manifest specifier but `validatePatch` does not
+ * enforce them today, so a `min: 0` declaration is inert: negative, fractional
+ * and outright non-numeric values all reach a reader intact. Anything that
+ * depends on the manifest having filtered them is declared-but-unenforced
+ * (ADR-0049), so the clamp is here, where the value becomes behaviour, and is
+ * pinned by tests.
+ *
+ * The rules, and why each is the safe direction for a paid channel:
+ *
+ * - **absent / empty string** → `0` (unlimited), quietly. That is "the operator
+ *   has not configured a ceiling", which is the shipped default, not an error.
+ * - **finite number ≥ 0** → `Math.floor(v)`. A fractional message count is
+ *   rounded DOWN, the stricter direction for a cost ceiling, and is not worth a
+ *   diagnostic — `100.5` unambiguously means "at most 100 messages".
+ * - **negative, NaN, ±Infinity, or a non-numeric type** → `0` (unlimited) plus
+ *   a named rejection the caller logs LOUDLY.
+ *
+ * That last rule is the one worth arguing. Two other readings exist and both
+ * are worse here. Refusing to send at all turns one typo in a settings form
+ * into a total outage of phone sign-in — the precise failure #2814 requirement
+ * 4 rules out ("配额闸不能把登录拖下水"), and the same reasoning `SettingsService`
+ * applies when it ignores a rejected `OS_*` override rather than acting on it.
+ * Substituting some other default invents a ceiling nobody declared and hides
+ * the typo behind plausible behaviour (#5152's lesson, where a typo'd
+ * `invite_only` read as `auto` left an operator believing a wall was up).
+ * Ignoring the value and SAYING SO leaves the deployment exactly where it was
+ * before the bad edit, with a line naming the value to fix.
+ */
+declare function normalizeDailyQuota(raw: unknown): NormalizedDailyQuota;
+/**
+ * The global daily send ceiling, counted once per admitted send.
+ *
+ * Constructed by `SmsServicePlugin` and handed to `SmsService`; `setQuota` is
+ * called on every `sms` settings change so an admin edit takes effect without a
+ * restart (same live-swap contract as the transport).
+ */
+declare class SmsDailyQuota {
+    private limit;
+    private readonly resolveStore;
+    private readonly logger?;
+    private readonly now;
+    /**
+     * Per-process fallback used when no resolver was supplied at all (the gate
+     * constructed standalone). The SAME bounded store the auth counters degrade
+     * to — one fallback implementation across the repo, not a second one that can
+     * drift (#4790).
+     */
+    private readonly fallback;
+    /** The last authored value reported as unusable — deduped, per value. */
+    private reportedRejection?;
+    /** UTC day stamp the approaching-ceiling WARN has already fired for. */
+    private nearLimitWarnedFor?;
+    /** UTC day stamp the ceiling-reached WARN has already fired for. */
+    private exceededWarnedFor?;
+    /** Store-outage WARN is once per process — see `checkAndRecord`. */
+    private degradedWarned;
+    constructor(options?: SmsDailyQuotaOptions);
+    /**
+     * Apply an authored `sms.daily_quota`. Anything unusable degrades to
+     * "unlimited" and is reported once per distinct offending value — see
+     * {@link normalizeDailyQuota} for why that is the safe direction.
+     */
+    setQuota(raw: unknown): void;
+    /** The ceiling actually in force (`0` ⇒ unlimited). @internal test seam */
+    get enforcedQuota(): number;
+    /**
+     * Charge one send against today's budget and answer whether it may proceed.
+     *
+     * Never throws: a store outage fails OPEN (announced once per process), for
+     * the reason in the file header — an SMS cost ceiling that can block sign-in
+     * is a worse problem than the one it solves.
+     */
+    checkAndRecord(): Promise<SmsDailyQuotaDecision>;
+}
+
 /**
  * Normalize + validate a recipient phone number. Accepts E.164 and common
  * human formats (spaces / dashes / dots / parens are stripped). Returns
@@ -50,6 +257,14 @@ interface SmsServiceOptions {
         info: (msg: string, meta?: any) => void;
         warn: (msg: string, meta?: any) => void;
     };
+    /**
+     * The deployment-wide daily send ceiling (#2814). Charged once per admitted
+     * send, HERE rather than at the auth endpoints, so OTP, invitations and the
+     * messaging `sms` channel are all counted against the one budget — see
+     * `sms-daily-quota.ts`. Omitted ⇒ no total-cost gate (the pre-#2814
+     * behaviour).
+     */
+    dailyQuota?: SmsDailyQuota;
 }
 /**
  * Concrete ISmsService implementation.
@@ -129,7 +344,32 @@ declare class TwilioSmsTransport implements ISmsTransport {
     send(message: NormalizedSmsMessage): Promise<SmsTransportSendResult>;
 }
 
-type SmsProviderTag = 'log' | 'aliyun' | 'twilio';
+/**
+ * The provider vocabulary — every tag `makeSmsTransport` below can build, and
+ * nothing else. It is the **one** literal: the `SmsProviderTag` type is derived
+ * from it, the `switch` is exhaustive over it, and callers that have to judge an
+ * operator-supplied provider string (the CLI's `sms` capability arm, #5713) read
+ * it from here rather than restating the list.
+ *
+ * Two literals describing one vocabulary is how the mail settings dropdown and
+ * the mail transports drifted apart (#5094) — `sendgrid`/`ses` were offered with
+ * no transport behind them while `resend` had a working transport nobody could
+ * pick. The SMS boot path had the same shape from the other side: `os serve`
+ * passed `OS_SMS_PROVIDER` straight into `SmsServicePlugin` with nothing to
+ * compare it against, so a typo (`twilo`) reached `makeSmsTransport`, threw
+ * there, was caught, and became `LogSmsTransport` — a server that answers every
+ * OTP send `status: 'sent'` and delivers nothing.
+ */
+declare const SMS_TRANSPORT_PROVIDERS: readonly ["log", "aliyun", "twilio"];
+/** A provider tag `makeSmsTransport` can materialise a transport for. */
+type SmsProviderTag = (typeof SMS_TRANSPORT_PROVIDERS)[number];
+/**
+ * Narrow an unknown value to a buildable provider tag. The counterpart of
+ * `isEmailTransportProvider` in `@objectstack/plugin-email`, and used by the CLI
+ * for the same reason: a provider that cannot deliver must be refused where the
+ * operator declared it, not silently downgraded where it is materialised.
+ */
+declare function isSmsTransportProvider(value: unknown): value is SmsProviderTag;
 interface MakeSmsTransportOptions {
     provider: SmsProviderTag;
     /** Provider-specific credentials/options (see the transport option types). */
@@ -188,7 +428,21 @@ declare class SmsServicePlugin implements Plugin {
     type: "standard";
     private readonly options;
     private service?;
+    private dailyQuota?;
     constructor(options?: SmsServicePluginOptions);
+    /**
+     * Build the daily cost gate (#2814) over the kernel `cache` service.
+     *
+     * `resolveCache` is copied in shape from `AuthPlugin.init()` on purpose, for
+     * the two reasons stated there: the `cache` service is registered ASYNC (so
+     * `getService` throws for it and `getServiceAsync` is the only accessor that
+     * works), and resolution has to happen when a counter is CONSUMED rather than
+     * at init, or a deployment that registers its cache after this plugin freezes
+     * a "no shared store" answer for the life of the process (#4772). The
+     * degraded case is announced by `createLazyCounterStore` itself, named for
+     * this subject.
+     */
+    private buildDailyQuota;
     private resolveInitialTransport;
     init(ctx: PluginContext): Promise<void>;
     start(ctx: PluginContext): Promise<void>;
@@ -200,4 +454,4 @@ declare class SmsServicePlugin implements Plugin {
     private applySmsSettings;
 }
 
-export { AliyunSmsTransport, type AliyunSmsTransportOptions, LogSmsTransport, type MakeSmsTransportOptions, type SmsProviderTag, SmsService, type SmsServiceOptions, SmsServicePlugin, type SmsServicePluginOptions, TwilioSmsTransport, type TwilioSmsTransportOptions, makeSmsTransport, maskPhoneNumber, normalizeSmsRecipient };
+export { AliyunSmsTransport, type AliyunSmsTransportOptions, LogSmsTransport, type MakeSmsTransportOptions, type NormalizedDailyQuota, SMS_QUOTA_EXCEEDED_CODE, SMS_QUOTA_EXCEEDED_ERROR, SMS_TRANSPORT_PROVIDERS, SmsDailyQuota, type SmsDailyQuotaDecision, type SmsDailyQuotaOptions, type SmsProviderTag, SmsService, type SmsServiceOptions, SmsServicePlugin, type SmsServicePluginOptions, TwilioSmsTransport, type TwilioSmsTransportOptions, isSmsTransportProvider, makeSmsTransport, maskPhoneNumber, normalizeDailyQuota, normalizeSmsRecipient, secondsUntilNextUtcMidnight, utcDayStamp };

package/dist/index.js

@@ -22,15 +22,136 @@ var index_exports = {};
 __export(index_exports, {
   AliyunSmsTransport: () => AliyunSmsTransport,
   LogSmsTransport: () => LogSmsTransport,
+  SMS_QUOTA_EXCEEDED_CODE: () => SMS_QUOTA_EXCEEDED_CODE,
+  SMS_QUOTA_EXCEEDED_ERROR: () => SMS_QUOTA_EXCEEDED_ERROR,
+  SMS_TRANSPORT_PROVIDERS: () => SMS_TRANSPORT_PROVIDERS,
+  SmsDailyQuota: () => SmsDailyQuota,
   SmsService: () => SmsService,
   SmsServicePlugin: () => SmsServicePlugin,
   TwilioSmsTransport: () => TwilioSmsTransport,
+  isSmsTransportProvider: () => isSmsTransportProvider,
   makeSmsTransport: () => makeSmsTransport,
   maskPhoneNumber: () => maskPhoneNumber,
-  normalizeSmsRecipient: () => normalizeSmsRecipient
+  normalizeDailyQuota: () => normalizeDailyQuota,
+  normalizeSmsRecipient: () => normalizeSmsRecipient,
+  secondsUntilNextUtcMidnight: () => secondsUntilNextUtcMidnight,
+  utcDayStamp: () => utcDayStamp
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/sms-daily-quota.ts
+var import_plugin_auth = require("@objectstack/plugin-auth");
+var SMS_QUOTA_EXCEEDED_CODE = "TOO_MANY_REQUESTS";
+var SMS_QUOTA_EXCEEDED_ERROR = `${SMS_QUOTA_EXCEEDED_CODE}: daily SMS quota exhausted`;
+var KEY_PREFIX = "sms-daily-sends:";
+var NEAR_LIMIT_RATIO = 0.8;
+function utcDayStamp(now) {
+  return new Date(now).toISOString().slice(0, 10);
+}
+function secondsUntilNextUtcMidnight(now) {
+  const d = new Date(now);
+  const next = Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate() + 1);
+  return Math.max(1, Math.ceil((next - now) / 1e3));
+}
+function normalizeDailyQuota(raw) {
+  if (raw === void 0 || raw === null) return { limit: 0 };
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) return { limit: 0 };
+    const parsed = Number(trimmed);
+    if (Number.isFinite(parsed) && parsed >= 0) return { limit: Math.floor(parsed) };
+    return { limit: 0, rejected: trimmed };
+  }
+  if (typeof raw === "number") {
+    if (Number.isFinite(raw) && raw >= 0) return { limit: Math.floor(raw) };
+    return { limit: 0, rejected: String(raw) };
+  }
+  return { limit: 0, rejected: typeof raw === "object" ? JSON.stringify(raw) : String(raw) };
+}
+var SmsDailyQuota = class {
+  constructor(options = {}) {
+    this.limit = 0;
+    /**
+     * Per-process fallback used when no resolver was supplied at all (the gate
+     * constructed standalone). The SAME bounded store the auth counters degrade
+     * to — one fallback implementation across the repo, not a second one that can
+     * drift (#4790).
+     */
+    this.fallback = new import_plugin_auth.InProcessCounterStore();
+    /** Store-outage WARN is once per process — see `checkAndRecord`. */
+    this.degradedWarned = false;
+    this.logger = options.logger;
+    this.now = options.now ?? Date.now;
+    this.resolveStore = options.resolveStore ?? (async () => this.fallback);
+  }
+  /**
+   * Apply an authored `sms.daily_quota`. Anything unusable degrades to
+   * "unlimited" and is reported once per distinct offending value — see
+   * {@link normalizeDailyQuota} for why that is the safe direction.
+   */
+  setQuota(raw) {
+    const { limit, rejected } = normalizeDailyQuota(raw);
+    this.limit = limit;
+    if (rejected !== void 0 && rejected !== this.reportedRejection) {
+      this.reportedRejection = rejected;
+      this.logger?.warn?.(
+        `[sms] daily_quota value '${rejected}' is not a usable message count \u2014 the daily SMS quota is NOT enforced until it is corrected. Use a non-negative whole number, or 0 for "no limit".`
+      );
+    }
+  }
+  /** The ceiling actually in force (`0` ⇒ unlimited). @internal test seam */
+  get enforcedQuota() {
+    return this.limit;
+  }
+  /**
+   * Charge one send against today's budget and answer whether it may proceed.
+   *
+   * Never throws: a store outage fails OPEN (announced once per process), for
+   * the reason in the file header — an SMS cost ceiling that can block sign-in
+   * is a worse problem than the one it solves.
+   */
+  async checkAndRecord() {
+    if (this.limit <= 0) return { ok: true, quota: 0 };
+    const now = this.now();
+    const day = utcDayStamp(now);
+    try {
+      const store = await this.resolveStore();
+      const { count } = await (0, import_plugin_auth.incrementFixedWindow)(
+        store,
+        KEY_PREFIX + day,
+        secondsUntilNextUtcMidnight(now),
+        now
+      );
+      if (count > this.limit) {
+        if (this.exceededWarnedFor !== day) {
+          this.exceededWarnedFor = day;
+          this.logger?.warn?.(
+            `[sms] daily SMS quota reached \u2014 further sends are refused until 00:00 UTC.`,
+            { day, count, quota: this.limit }
+          );
+        }
+        return { ok: false, count, quota: this.limit };
+      }
+      if (count >= Math.ceil(this.limit * NEAR_LIMIT_RATIO) && this.nearLimitWarnedFor !== day) {
+        this.nearLimitWarnedFor = day;
+        this.logger?.warn?.(
+          `[sms] daily SMS quota is ${Math.round(NEAR_LIMIT_RATIO * 100)}% consumed.`,
+          { day, count, quota: this.limit }
+        );
+      }
+      return { ok: true, count, quota: this.limit };
+    } catch (err) {
+      if (!this.degradedWarned) {
+        this.degradedWarned = true;
+        this.logger?.warn?.(
+          "[sms] daily SMS quota counter is unreadable (" + String(err?.message ?? err) + ") \u2014 the gate is FAILING OPEN and today's spend is unbounded until the counter store recovers. Sign-in is deliberately not taken down with it (#2814)."
+        );
+      }
+      return { ok: true };
+    }
+  }
+};
+
 // src/sms-service.ts
 function normalizeSmsRecipient(raw) {
   const stripped = String(raw ?? "").replace(/[\s\-().]/g, "");
@@ -88,6 +209,15 @@ var SmsService = class {
       ...input.templateParams ? { templateParams: input.templateParams } : {}
     };
     const id = `sms-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+    if (this.options.dailyQuota) {
+      const decision = await this.options.dailyQuota.checkAndRecord();
+      if (!decision.ok) {
+        this.options.logger?.warn?.(
+          `[SmsService] send to ${maskPhoneNumber(to)} refused: daily quota exhausted`
+        );
+        return { id, status: "failed", error: SMS_QUOTA_EXCEEDED_ERROR };
+      }
+    }
     const maxAttempts = (this.options.retries ?? 0) + 1;
     let lastError;
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -112,6 +242,9 @@ var SmsService = class {
   }
 };
 
+// src/sms-plugin.ts
+var import_plugin_auth2 = require("@objectstack/plugin-auth");
+
 // src/transports/aliyun.ts
 var import_node_crypto = require("crypto");
 var API_VERSION = "2017-05-25";
@@ -230,6 +363,10 @@ var TwilioSmsTransport = class {
 };
 
 // src/transports/index.ts
+var SMS_TRANSPORT_PROVIDERS = ["log", "aliyun", "twilio"];
+function isSmsTransportProvider(value) {
+  return typeof value === "string" && SMS_TRANSPORT_PROVIDERS.includes(value);
+}
 function makeSmsTransport(opts) {
   const { provider, options = {}, logger } = opts;
   switch (provider) {
@@ -300,6 +437,40 @@ var SmsServicePlugin = class {
     this.type = "standard";
     this.options = options;
   }
+  /**
+   * Build the daily cost gate (#2814) over the kernel `cache` service.
+   *
+   * `resolveCache` is copied in shape from `AuthPlugin.init()` on purpose, for
+   * the two reasons stated there: the `cache` service is registered ASYNC (so
+   * `getService` throws for it and `getServiceAsync` is the only accessor that
+   * works), and resolution has to happen when a counter is CONSUMED rather than
+   * at init, or a deployment that registers its cache after this plugin freezes
+   * a "no shared store" answer for the life of the process (#4772). The
+   * degraded case is announced by `createLazyCounterStore` itself, named for
+   * this subject.
+   */
+  buildDailyQuota(ctx) {
+    const resolveCache = async () => {
+      let cache;
+      try {
+        cache = await ctx.getServiceAsync?.("cache");
+      } catch {
+        return void 0;
+      }
+      if (cache && typeof cache.get === "function" && typeof cache.set === "function") return cache;
+      return void 0;
+    };
+    return new SmsDailyQuota({
+      resolveStore: (0, import_plugin_auth2.createLazyCounterStore)({
+        resolveCache,
+        logger: ctx.logger,
+        logPrefix: "[sms]",
+        subject: "daily SMS send quota (#2814)",
+        degradedImpact: "The ceiling is still enforced, but PER NODE: an N-node deployment can spend up to N\xD7 the configured number of PAID SMS per day, which is exactly the total-cost hole this gate exists to close"
+      }),
+      logger: ctx.logger
+    });
+  }
   resolveInitialTransport(ctx) {
     if (this.options.transport) return { transport: this.options.transport, configured: true };
     const provider = this.options.provider ?? "log";
@@ -323,11 +494,13 @@ var SmsServicePlugin = class {
     } else {
       ctx.logger.info(`SmsServicePlugin: using '${this.options.provider ?? "custom"}' provider`);
     }
+    this.dailyQuota = this.buildDailyQuota(ctx);
     this.service = new SmsService({
       transport,
       configured,
       retries: this.options.retries,
-      logger: ctx.logger
+      logger: ctx.logger,
+      dailyQuota: this.dailyQuota
     });
     ctx.registerService("sms", this.service);
     ctx.logger.info("SmsServicePlugin: sms service registered");
@@ -335,7 +508,6 @@ var SmsServicePlugin = class {
   async start(ctx) {
     ctx.hook("kernel:ready", async () => {
       if (!this.service) return;
-      if (this.options.transport) return;
       try {
         const settings = ctx.getService("settings");
         if (!settings || typeof settings.getNamespace !== "function") return;
@@ -346,7 +518,8 @@ var SmsServicePlugin = class {
             for (const [k, v] of Object.entries(payload.values)) {
               values[k] = v?.value;
             }
-            this.applySmsSettings(values, ctx);
+            this.dailyQuota?.setQuota(values.daily_quota);
+            if (!this.options.transport) this.applySmsSettings(values, ctx);
           } catch (err) {
             ctx.logger.warn("SmsServicePlugin: failed to apply sms settings: " + (err?.message ?? err));
           }
@@ -358,7 +531,7 @@ var SmsServicePlugin = class {
           });
           ctx.logger.info("SmsServicePlugin: bound to settings:changed for namespace=sms");
         }
-        if (typeof settings.registerAction === "function") {
+        if (!this.options.transport && typeof settings.registerAction === "function") {
           const svc = this.service;
           settings.registerAction("sms", "test", async ({ values, payload, ctx: actionCtx }) => {
             const overrides = payload && typeof payload === "object" && payload.values && typeof payload.values === "object" ? payload.values : payload ?? {};
@@ -438,11 +611,19 @@ var SmsServicePlugin = class {
 0 && (module.exports = {
   AliyunSmsTransport,
   LogSmsTransport,
+  SMS_QUOTA_EXCEEDED_CODE,
+  SMS_QUOTA_EXCEEDED_ERROR,
+  SMS_TRANSPORT_PROVIDERS,
+  SmsDailyQuota,
   SmsService,
   SmsServicePlugin,
   TwilioSmsTransport,
+  isSmsTransportProvider,
   makeSmsTransport,
   maskPhoneNumber,
-  normalizeSmsRecipient
+  normalizeDailyQuota,
+  normalizeSmsRecipient,
+  secondsUntilNextUtcMidnight,
+  utcDayStamp
 });
 //# sourceMappingURL=index.js.map