@sproutboat/runtime 0.23.1 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # @sproutboat/runtime
 
+## 0.25.0
+
+### Minor Changes
+
+- ef40955: The storage quota is a hard bound when LTX capture is on. A D1 database under capture can't be capped by pinning its page count: a same-size `UPDATE`, or a `DELETE`, still adds a file to the replication spool, and the spool counts toward the app's quota. So while the app is over its quota, every write to a captured database is refused with `D1_ERROR: storage quota exceeded: writes are refused while this app's data, including its replication log, is over its quota: SQLITE_FULL`. That covers `exec()` and `batch()` too.
+  
+  - Reads, read-only batches and transaction control still run.
+  - No LTX file is ever dropped to make room: the policy fails closed.
+  - Writes resume once the app is under its quota again, at the next rescan: for example after the operator raises the quota, or the app deletes R2 or KV data. The freeze holds across a restart.
+  
+  This freezes statements after the quota scan; it is not a hard filesystem cap. The write that crosses the quota is accepted.
+  
+  Databases without capture are unchanged: they are pinned at their size, so deletes still work.
+- 95f6bd7: A storage quota for standalone sprouts and sproutd. An app's data directory (KV, D1, R2, Durable Object storage, queues) holds at most `SB_STORAGE_MAX_BYTES` bytes; sproutd sets it per app, and it defaults to 10 GiB. Each D1 database is also capped at 10 GB, as in D1. Past the quota:
+  
+  - writes fail with an error that says so, such as `KV put() failed: storage quota exceeded (this app stores N bytes; the limit is M)`, or `D1_ERROR: database or disk is full: SQLITE_FULL` for D1;
+  - reads and deletes keep working, so an app can make room (for D1, `DELETE` and then `VACUUM`).
+  
+  This is a check after a scan, not a hard filesystem cap with zero overshoot. The size is measured at most once a second, by walking the directory, and a write is checked against the last measurement. The write that crosses the limit is accepted (an R2 object, say), and so is anything else written within that second. Writes after it are refused.
+
+## 0.24.0
+
+### Minor Changes
+
+- 9a5363e: D1 matches workerd from compatibility date `2026-10-24`:
+  
+  - `all()`, `run()`, `first()`, `raw()`, `batch()` and `exec()` return Promises, and errors reject them. `bind()` stays synchronous and still throws `D1_TYPE_ERROR` at once.
+  - `meta` has D1's keys: `served_by`, `duration`, `changes`, `last_row_id`, `changed_db`, `size_after` (always 0 here), `rows_read` and `rows_written`.
+  - `raw({ columnNames: true })` puts the column names first, and keeps duplicate names.
+  - `first("name")` throws `D1_COLUMN_NOTFOUND` for a column the result doesn't have.
+  - Empty SQL and an empty `batch([])` throw `D1_ERROR: No SQL statements detected.`
+  - `BEGIN`, `COMMIT`, `ROLLBACK`, `SAVEPOINT` and `RELEASE` are refused, as in D1. A batch is already one transaction.
+  - `exec()` runs line by line, all or nothing, and returns the number of lines. A failing line throws `D1_EXEC_ERROR: Error in line N: ...`.
+  - `withSession()` returns a session with `prepare`, `batch` and `getBookmark()`, which returns `null`. `dump()` rejects; use `backup()` instead.
+  
+  Apps with an earlier `compatibility_date` keep the synchronous API unchanged. To opt in, move the date to `2026-10-24` or later and rebuild. `await` code needs no other change, but code that reads results without `await` does.
+  
+  Not yet like D1: `rows_read` counts the rows returned, not the rows scanned, and pragmas are not limited to D1's allow-list.
+  
+  With LTX capture on (from `2026-10-22`), a capture failure during a D1 call now reports `SQLITE_IOERR` with a message saying the write is not durable in the replication log, instead of SQLite's "not an error". Writes stay refused until restart.
+
 ## 0.23.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.23.1",
+  "version": "0.25.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/d1-shim.test.js

@@ -34,81 +34,121 @@ const caught = (fn) => {
   }
   return "did not throw";
 };
+// The message a call fails with, synchronously or as a rejected Promise.
+const failure = async (fn) => {
+  try {
+    await fn();
+  } catch (error) {
+    return error.message;
+  }
+  return "did not throw";
+};
+const NO_STATEMENTS = "D1_ERROR: No SQL statements detected.";
+const WRONG_COUNT = "D1_ERROR: Wrong number of parameter bindings for SQL query.";
 
 for (const date of ["2026-09-28", "2026-10-24"]) {
-  test(`${date}: bytes bind as a BLOB, and the parameters after them are kept`, () => {
+  test(`${date}: bytes bind as a BLOB, and the parameters after them are kept`, async () => {
     const DB = fresh(date);
-    DB.exec("CREATE TABLE t (a TEXT, b BLOB, c TEXT)");
-    DB.prepare("INSERT INTO t VALUES (?, ?, ?)")
-      .bind("u8", new Uint8Array([0, 255, 7]), "after")
-      .run();
-    DB.prepare("INSERT INTO t VALUES (?, ?, ?)")
-      .bind("ab", new Uint8Array([1, 2]).buffer, "after")
-      .run();
-    DB.prepare("INSERT INTO t VALUES (?, ?, ?)")
-      .bind("view", new DataView(new Uint8Array([9, 8, 7]).buffer, 1, 2), "after")
-      .run();
-    expect(DB.prepare("SELECT a, hex(b) AS h, typeof(b) AS t, c FROM t ORDER BY rowid").all().results).toEqual([
+    await DB.exec("CREATE TABLE t (a TEXT, b BLOB, c TEXT)");
+    const insert = DB.prepare("INSERT INTO t VALUES (?, ?, ?)");
+    await insert.bind("u8", new Uint8Array([0, 255, 7]), "after").run();
+    await insert.bind("ab", new Uint8Array([1, 2]).buffer, "after").run();
+    await insert.bind("view", new DataView(new Uint8Array([9, 8, 7]).buffer, 1, 2), "after").run();
+    expect((await DB.prepare("SELECT a, hex(b) AS h, typeof(b) AS t, c FROM t ORDER BY rowid").all()).results).toEqual([
       { a: "u8", h: "00FF07", t: "blob", c: "after" },
       { a: "ab", h: "0102", t: "blob", c: "after" },
       { a: "view", h: "0807", t: "blob", c: "after" },
     ]);
   });
 
-  test(`${date}: batch() is one transaction`, () => {
+  test(`${date}: batch() is one transaction`, async () => {
     const DB = fresh(date);
-    DB.exec("CREATE TABLE t (id INTEGER PRIMARY KEY)");
-    expect(() => DB.batch([DB.prepare("INSERT INTO t VALUES (1)"), DB.prepare("INSERT INTO t VALUES (1)")])).toThrow(
-      /UNIQUE/,
-    );
-    expect(DB.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(0);
+    await DB.exec("CREATE TABLE t (id INTEGER PRIMARY KEY)");
+    expect(await failure(() => DB.batch([DB.prepare("INSERT INTO t VALUES (1)"), DB.prepare("INSERT INTO t VALUES (1)")]))).toMatch(/UNIQUE/);
+    expect(await DB.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(0);
   });
 }
 
-test("before 2026-10-24: lenient parameters, no foreign keys, BLOBs as one char per byte", () => {
+test("before 2026-10-24: synchronous, lenient, no foreign keys, BLOBs as one char per byte", () => {
   const DB = fresh("2026-09-28");
+  const result = DB.prepare("SELECT 1 AS a").all();
+  expect(result.then).toBeUndefined();
+  expect(result.results).toEqual([{ a: 1 }]);
   // (bun:sqlite has always refused a wrong parameter count here; the embedded transport has not.)
   expect(DB.prepare("SELECT ?1 AS a").bind(undefined).first()).toEqual({ a: null });
-  DB.exec("CREATE TABLE p (id INTEGER PRIMARY KEY); CREATE TABLE c (p INTEGER REFERENCES p(id))");
+  expect(DB.exec("CREATE TABLE p (id INTEGER PRIMARY KEY); CREATE TABLE c (p INTEGER REFERENCES p(id))").count).toBe(1);
   DB.prepare("INSERT INTO c VALUES (99)").run();
   expect(DB.prepare("SELECT x'00ff' AS b").first("b")).toBe("\u0000ÿ");
+  expect(DB.prepare("SELECT 1 AS a").first("nope")).toBeUndefined();
   expect(caught(() => DB.prepare("SELEC 1").all())).toMatch(/^sproutboat d1\.query: /);
 });
 
-test("from 2026-10-24: D1's parameter rules", () => {
+test("from 2026-10-24: D1's parameter rules", async () => {
   const DB = fresh("2026-10-24");
-  expect(caught(() => DB.prepare("SELECT ?1").bind(undefined))).toBe(
-    "D1_TYPE_ERROR: Type 'undefined' not supported for value 'undefined'",
-  );
-  expect(caught(() => DB.prepare("SELECT ?1").bind({ a: 1 }))).toBe(
-    "D1_TYPE_ERROR: Type 'object' not supported for value '[object Object]'",
-  );
-  expect(caught(() => DB.prepare("SELECT ?1").bind(10n))).toBe(
-    "D1_TYPE_ERROR: Type 'bigint' not supported for value '10'",
-  );
-  expect(caught(() => DB.prepare("SELECT ?1, ?2").bind(1).all())).toBe(
-    "D1_ERROR: Wrong number of parameter bindings for SQL query.",
-  );
-  expect(caught(() => DB.prepare("SELECT ?1").bind(1, 2).all())).toBe(
-    "D1_ERROR: Wrong number of parameter bindings for SQL query.",
-  );
-  expect(caught(() => DB.prepare("SELECT ?1").all())).toBe(
-    "D1_ERROR: Wrong number of parameter bindings for SQL query.",
-  );
-  expect(DB.prepare("SELECT ?1 AS a, ?1 AS b, ?2 AS c").bind("x", true).first()).toEqual({ a: "x", b: "x", c: 1 });
+  expect(caught(() => DB.prepare("SELECT ?1").bind(undefined))).toBe("D1_TYPE_ERROR: Type 'undefined' not supported for value 'undefined'");
+  expect(caught(() => DB.prepare("SELECT ?1").bind({ a: 1 }))).toBe("D1_TYPE_ERROR: Type 'object' not supported for value '[object Object]'");
+  expect(caught(() => DB.prepare("SELECT ?1").bind(10n))).toBe("D1_TYPE_ERROR: Type 'bigint' not supported for value '10'");
+  expect(await failure(() => DB.prepare("SELECT ?1, ?2").bind(1).all())).toBe(WRONG_COUNT);
+  expect(await failure(() => DB.prepare("SELECT ?1").bind(1, 2).all())).toBe(WRONG_COUNT);
+  expect(await failure(() => DB.prepare("SELECT ?1").all())).toBe(WRONG_COUNT);
+  expect(await DB.prepare("SELECT ?1 AS a, ?1 AS b, ?2 AS c").bind("x", true).first()).toEqual({ a: "x", b: "x", c: 1 });
 });
 
-test("from 2026-10-24: foreign keys, BLOBs as byte arrays, D1's error text", () => {
+test("from 2026-10-24: foreign keys, BLOBs as byte arrays, D1's error text", async () => {
   const DB = fresh("2026-10-24");
-  DB.exec("CREATE TABLE p (id INTEGER PRIMARY KEY); CREATE TABLE c (p INTEGER REFERENCES p(id))");
-  expect(caught(() => DB.prepare("INSERT INTO c VALUES (99)").run())).toBe(
+  await DB.exec("CREATE TABLE p (id INTEGER PRIMARY KEY)\nCREATE TABLE c (p INTEGER REFERENCES p(id))");
+  expect(await failure(() => DB.prepare("INSERT INTO c VALUES (99)").run())).toBe(
     "D1_ERROR: FOREIGN KEY constraint failed: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_FOREIGNKEY)",
   );
-  DB.prepare("INSERT INTO p VALUES (1)").run();
-  expect(caught(() => DB.prepare("INSERT INTO p VALUES (1)").run())).toBe(
+  await DB.prepare("INSERT INTO p VALUES (1)").run();
+  expect(await failure(() => DB.prepare("INSERT INTO p VALUES (1)").run())).toBe(
     "D1_ERROR: UNIQUE constraint failed: p.id: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_PRIMARYKEY)",
   );
-  expect(caught(() => DB.prepare("SELECT * FROM nope").all())).toBe("D1_ERROR: no such table: nope: SQLITE_ERROR");
-  expect(DB.prepare("SELECT x'00ff' AS b").first("b")).toEqual([0, 255]);
-  expect(DB.prepare("SELECT count(*) AS n FROM p").run().meta.changes).toBe(0);
+  expect(await failure(() => DB.prepare("SELECT * FROM nope").all())).toBe("D1_ERROR: no such table: nope: SQLITE_ERROR");
+  expect(await DB.prepare("SELECT x'00ff' AS b").first("b")).toEqual([0, 255]);
+});
+
+test("from 2026-10-24: every query method returns a Promise", async () => {
+  const DB = fresh("2026-10-24");
+  const s = DB.prepare("SELECT 41 AS a");
+  for (const p of [s.all(), s.run(), s.first(), s.raw(), DB.batch([s]), DB.exec("SELECT 1"), DB.dump().catch(() => 0)]) expect(p).toBeInstanceOf(Promise);
+  expect(await s.first("a").then((a) => a + 1)).toBe(42);
+  expect(await Promise.all([s.first("a"), DB.prepare("SELECT 2 AS a").first("a")])).toEqual([41, 2]);
+  // Errors reject rather than throw: .catch() sees them.
+  expect(await DB.prepare("SELEC 1").all().catch((e) => e.message)).toMatch(/^D1_ERROR: near "SELEC": syntax error/);
+});
+
+test("from 2026-10-24: results, meta, raw() and first() as in workerd", async () => {
+  const DB = fresh("2026-10-24");
+  await DB.exec("CREATE TABLE t (id INTEGER PRIMARY KEY, name TEXT)");
+  const inserted = await DB.prepare("INSERT INTO t (name) VALUES (?), (?)").bind("one", "two").run();
+  expect(Object.keys(inserted).sort()).toEqual(["meta", "results", "success"]);
+  expect(Object.keys(inserted.meta).sort()).toEqual(["changed_db", "changes", "duration", "last_row_id", "rows_read", "rows_written", "served_by", "size_after"]);
+  expect([inserted.meta.changes, inserted.meta.last_row_id, inserted.meta.changed_db, inserted.meta.rows_written]).toEqual([2, 2, true, 2]);
+  const read = await DB.prepare("SELECT id, name FROM t ORDER BY id").all();
+  expect([read.meta.changes, read.meta.changed_db, read.meta.rows_written]).toEqual([0, false, 0]);
+  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw()).toEqual([[1, "one"], [2, "two"]]);
+  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw({ columnNames: true })).toEqual([["id", "name"], [1, "one"], [2, "two"]]);
+  expect(await DB.prepare("SELECT id FROM t WHERE id > 9").raw({ columnNames: true })).toEqual([["id"]]);
+  expect(await DB.prepare("SELECT 1 AS a, 2 AS a").raw({ columnNames: true })).toEqual([["a", "a"], [1, 2]]);
+  expect((await DB.prepare("SELECT 1 AS a, 2 AS a").all()).results).toEqual([{ a: 2 }]);
+  expect(await failure(() => DB.prepare("SELECT id FROM t").first("nope"))).toBe("D1_COLUMN_NOTFOUND: Column not found (nope)");
+  expect(await DB.prepare("SELECT id FROM t WHERE id > 9").first("nope")).toBeNull();
+});
+
+test("from 2026-10-24: empty SQL, transactions, exec() and sessions as in workerd", async () => {
+  const DB = fresh("2026-10-24");
+  expect(await failure(() => DB.prepare("").all())).toBe(NO_STATEMENTS);
+  expect(await failure(() => DB.batch([]))).toBe(NO_STATEMENTS);
+  expect(await failure(() => DB.prepare("BEGIN TRANSACTION").run())).toMatch(/^D1_ERROR: To execute a transaction, please use the state\.storage\.transaction\(\)/);
+  expect(await failure(() => DB.prepare("savepoint x").run())).toMatch(/^D1_ERROR: To execute a transaction/);
+  const done = await DB.exec("CREATE TABLE t (id INTEGER)\nINSERT INTO t VALUES (1);\n\nINSERT INTO t VALUES (2);\n");
+  expect([done.count, Number.isFinite(done.duration)]).toEqual([3, true]);
+  expect(await DB.exec("SELECT 1").then((r) => r.count)).toBe(1);
+  expect(await failure(() => DB.exec("INSERT INTO t VALUES (3);\nSELEC 2"))).toMatch(/^D1_EXEC_ERROR: Error in line 2: SELEC 2: near "SELEC": syntax error/);
+  expect(await DB.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(2);
+  const session = DB.withSession("first-unconstrained");
+  expect(await session.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(2);
+  expect(session.getBookmark()).toBeNull();
+  expect(await session.batch([session.prepare("SELECT 1 AS a")]).then((r) => r[0].results)).toEqual([{ a: 1 }]);
 });

package/src/native-fetch-prelude.js

@@ -4869,7 +4869,62 @@ function __sbD1Result(r, strict) {
   if (!strict) return { results: r.results || [], success: true, meta: r.meta || {} };
   return { results: __sbD1Objects(r.columns || [], __sbD1Rows(r)), success: true, meta: r.meta || {} };
 }
+function __sbD1Fail(message) {
+  return new Error(message);
+}
+// From 2026-10-24: workerd's surface. Every query method returns a Promise, meta has D1's
+// keys, raw() takes { columnNames }, first(name) checks the column, empty SQL and
+// transaction statements are refused, exec() runs line by line, and withSession() exists.
+var __sbD1NoTransactions =
+  "D1_ERROR: To execute a transaction, please use the state.storage.transaction() or state.storage.transactionSync() APIs instead of the SQL BEGIN TRANSACTION or SAVEPOINT statements. The JavaScript API is safer because it will automatically roll back on exceptions, and because it interacts correctly with Durable Objects' automatic atomic write coalescing.";
+function __sbD1Check(sql) {
+  const text = String(sql).trim();
+  if (!text) throw __sbD1Fail("D1_ERROR: No SQL statements detected.");
+  if (/^(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(text)) throw __sbD1Fail(__sbD1NoTransactions);
+}
+function __sbD1Meta(meta, started) {
+  const changes = Number(meta.changes) || 0;
+  return {
+    served_by: "sproutboat",
+    duration: Date.now() - started,
+    changes,
+    last_row_id: Number(meta.last_row_id) || 0,
+    changed_db: changes > 0,
+    size_after: 0,
+    rows_read: Number(meta.rows_read) || 0,
+    rows_written: changes,
+  };
+}
+// Columns and rows of a strict reply (an older broker answers with objects only).
+function __sbD1Table(r) {
+  if (r.columns) return { columns: r.columns, rows: __sbD1Rows(r) };
+  const objects = r.results || [];
+  const columns = objects.length ? Object.keys(objects[0]) : [];
+  const rows = [];
+  for (let i = 0; i < objects.length; i++) {
+    const row = [];
+    for (let c = 0; c < columns.length; c++) row.push(objects[i][columns[c]]);
+    rows.push(row);
+  }
+  return { columns, rows };
+}
+function __sbD1Promise(run) {
+  try {
+    return Promise.resolve(run());
+  } catch (err) {
+    return Promise.reject(err);
+  }
+}
 function __sbMakeD1(dbName) {
+  // The synchronous core: the answer to one statement as columns, rows and meta.
+  function query(sql, params, strict) {
+    if (strict) __sbD1Check(sql);
+    const started = Date.now();
+    const r = __sbD1Rpc("d1.query", { db: dbName, sql, params }, strict);
+    if (!strict) return { results: r.results || [], success: true, meta: r.meta || {} };
+    const table = __sbD1Table(r);
+    return { columns: table.columns, rows: table.rows, meta: __sbD1Meta(r.meta || {}, started) };
+  }
   function stmt(sql, params) {
     const s = {
       __sql: sql,
@@ -4881,47 +4936,109 @@ function __sbMakeD1(dbName) {
         return stmt(sql, list);
       },
       all() {
-        const strict = __sbD1Strict();
-        return __sbD1Result(__sbD1Rpc("d1.query", { db: dbName, sql, params }, strict), strict);
+        if (!__sbD1Strict()) return query(sql, params, false);
+        return __sbD1Promise(() => {
+          const t = query(sql, params, true);
+          return { success: true, meta: t.meta, results: __sbD1Objects(t.columns, t.rows) };
+        });
       },
       run() {
         return s.all();
       },
-      raw() {
-        const rows = s.all().results;
-        const out = [];
-        for (let i = 0; i < rows.length; i++) {
-          const cols = [];
-          for (const k in rows[i]) cols.push(rows[i][k]);
-          out.push(cols);
+      raw(options) {
+        if (!__sbD1Strict()) {
+          const rows = query(sql, params, false).results;
+          const out = [];
+          for (let i = 0; i < rows.length; i++) {
+            const cols = [];
+            for (const k in rows[i]) cols.push(rows[i][k]);
+            out.push(cols);
+          }
+          return out;
         }
-        return out;
+        return __sbD1Promise(() => {
+          const t = query(sql, params, true);
+          return options && options.columnNames ? [t.columns].concat(t.rows) : t.rows;
+        });
       },
       first(column) {
-        const rows = s.all().results;
-        if (rows.length === 0) return null;
-        return column == null ? rows[0] : rows[0][column];
+        if (!__sbD1Strict()) {
+          const rows = query(sql, params, false).results;
+          if (rows.length === 0) return null;
+          return column == null ? rows[0] : rows[0][column];
+        }
+        return __sbD1Promise(() => {
+          const t = query(sql, params, true);
+          if (column == null) return t.rows.length ? __sbD1Objects(t.columns, [t.rows[0]])[0] : null;
+          const at = t.columns.indexOf(String(column));
+          if (!t.rows.length) return null;
+          if (at < 0) throw __sbD1Fail("D1_COLUMN_NOTFOUND: Column not found (" + column + ")");
+          return t.rows[0][t.columns.lastIndexOf(String(column))];
+        });
       },
     };
     return s;
   }
-  return {
+  function batch(statements) {
+    const strict = __sbD1Strict();
+    const list = [];
+    for (let i = 0; i < (statements || []).length; i++) {
+      if (strict) __sbD1Check(statements[i].__sql);
+      list.push({ sql: statements[i].__sql, params: statements[i].__params });
+    }
+    if (strict && !list.length) throw __sbD1Fail("D1_ERROR: No SQL statements detected.");
+    const started = Date.now();
+    const r = __sbD1Rpc("d1.batch", { db: dbName, statements: list }, strict);
+    const out = [];
+    for (let i = 0; i < (r.results || []).length; i++) {
+      if (!strict) {
+        out.push(__sbD1Result(r.results[i], false));
+        continue;
+      }
+      const t = __sbD1Table(r.results[i]);
+      out.push({ success: true, meta: __sbD1Meta(r.results[i].meta || {}, started), results: __sbD1Objects(t.columns, t.rows) });
+    }
+    return out;
+  }
+  function exec(sql) {
+    if (!__sbD1Strict()) {
+      __sbRpc("d1.exec", { db: dbName, sql: String(sql) });
+      return { count: (String(sql).match(/;/g) || []).length, duration: 0 };
+    }
+    // workerd runs exec() line by line and counts the lines.
+    const started = Date.now();
+    const all = String(sql).trim().split("\n");
+    const lines = [];
+    for (let i = 0; i < all.length; i++) if (all[i].trim()) lines.push(all[i]);
+    if (!lines.length) throw __sbD1Fail("D1_ERROR: No SQL statements detected.");
+    __sbD1Rpc("d1.exec", { db: dbName, sql: lines.join("\n"), lines }, true);
+    return { count: lines.length, duration: Date.now() - started };
+  }
+  const db = {
     prepare(sql) {
       return stmt(String(sql), []);
     },
     batch(statements) {
-      const strict = __sbD1Strict();
-      const list = [];
-      for (let i = 0; i < (statements || []).length; i++)
-        list.push({ sql: statements[i].__sql, params: statements[i].__params });
-      const r = __sbD1Rpc("d1.batch", { db: dbName, statements: list }, strict);
-      const out = [];
-      for (let i = 0; i < (r.results || []).length; i++) out.push(__sbD1Result(r.results[i], strict));
-      return out;
+      if (!__sbD1Strict()) return batch(statements);
+      return __sbD1Promise(() => batch(statements));
     },
     exec(sql) {
-      __sbD1Rpc("d1.exec", { db: dbName, sql: String(sql) }, __sbD1Strict());
-      return { count: (String(sql).match(/;/g) || []).length, duration: 0 };
+      if (!__sbD1Strict()) return exec(sql);
+      return __sbD1Promise(() => exec(sql));
+    },
+    // workerd's D1 sessions (read replication). One database here, so a session is the
+    // database itself, and there is never a bookmark to return.
+    withSession() {
+      return {
+        prepare: db.prepare,
+        batch: db.batch,
+        getBookmark() {
+          return null;
+        },
+      };
+    },
+    dump() {
+      return Promise.reject(__sbD1Fail("D1_DUMP_ERROR: dump() is not supported; use backup()"));
     },
     // Sproutboat extension (not in CF Workers D1): an online, integrity-checked
     // snapshot of this database. Both transports implement it: standalone writes
@@ -4932,6 +5049,7 @@ function __sbMakeD1(dbName) {
       return { path: r.path, bytes: r.bytes };
     },
   };
+  return db;
 }
 
 // R2: a Cloudflare-shaped object. When `body` is present the sync accessors

package/src/transport-embedded.js

@@ -1945,6 +1945,19 @@ size_t sb_r2_transfer_download_read(sb_r2_transfer_ctx* ctx, size_t offset, char
 }
 void sb_r2_transfer_download_close(sb_r2_transfer_ctx* ctx) { if (ctx) { if (ctx->file) fclose(ctx->file); free(ctx); } }
 
+// LTX capture (#141) failed after SQLite committed: the write is in the database but not in
+// the replication log, and the database refuses writes until the process restarts. Said as
+// such (SQLITE_IOERR), never as SQLite's own message, which still reads "not an error".
+#define SB_LTX_FAILED "LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart"
+// The storage quota, for a database under LTX capture: while the app is over its quota,
+// every write is refused (a same-size UPDATE or a DELETE still adds an LTX file to the
+// spool, which counts toward the quota). Reads and transaction control still run.
+#define SB_QUOTA_FULL "storage quota exceeded: writes are refused while this app's data, including its replication log, is over its quota"
+static unsigned char sb_quota_frozen[SB_MAX_DB];
+static int sb_db_capture_failed(const char* path) {
+  for (int i = 0; i < sb_db_count; i++) if (strcmp(sb_db_names[i], path) == 0) return sb_ltx_states[i].failed;
+  return 0;
+}
 // Run a script: one or more statements separated by semicolons. sqlite3_exec
 // handles the whole string, which prepare/step does not — it compiles the first
 // statement and silently ignores the rest, so a schema built from one exec call
@@ -1952,25 +1965,34 @@ void sb_r2_transfer_download_close(sb_r2_transfer_ctx* ctx) { if (ctx) { if (ctx
 static char* sb_sql_script(const char* path, const char* sql) {
   sb_buf b = { 0, 0, 0 };
   int idx = sb_db_for(path);
+  if (idx < 0 && sb_db_capture_failed(path)) { sb_puts(&b, "{\"ok\":false,\"error\":\"" SB_LTX_FAILED "\",\"code\":10}"); return b.p; }
   if (idx < 0) { sb_puts(&b, "{\"ok\":false,\"error\":\"cannot open database\"}"); return b.p; }
   char* err = 0;
-  int script_rc = 0;
+  int script_rc = 0, capture_failed = 0, quota_full = 0, failure_code = 0;
+  char failure[512] = { 0 };
   if (sb_ltx_states[idx].db) {
     const char *next = sql;
     while (*next && !script_rc) {
       sqlite3_stmt *st = 0; const char *tail = 0;
       script_rc = sqlite3_prepare_v2(sb_dbs[idx], next, -1, &st, &tail);
+      if (!script_rc && st && sb_quota_frozen[idx] && !sqlite3_stmt_readonly(st)) { sqlite3_finalize(st); quota_full = 1; script_rc = 13; break; }
       if (!script_rc && st) { do { script_rc = sqlite3_step(st); } while (script_rc == SB_SQLITE_ROW); if (script_rc == SB_SQLITE_DONE) script_rc = 0; }
+      // Keep the statement's error before capture runs statements of its own (it would
+      // read "not an error" after them).
+      if (script_rc && !failure[0]) { snprintf(failure, sizeof(failure), "%s", sqlite3_errmsg(sb_dbs[idx])); failure_code = sqlite3_extended_errcode(sb_dbs[idx]); }
       if (st) sqlite3_finalize(st);
-      if (sb_ltx_after(idx)) script_rc = 10;
+      if (sb_ltx_after(idx)) { script_rc = 10; capture_failed = 1; }
       if (!tail || tail <= next) break;
       next = tail;
     }
   } else script_rc = sqlite3_exec(sb_dbs[idx], sql, 0, 0, &err);
   if (script_rc != 0) {
+    const char* m = quota_full ? SB_QUOTA_FULL : capture_failed ? SB_LTX_FAILED : failure[0] ? failure : err ? err : sqlite3_errmsg(sb_dbs[idx]);
     sb_puts(&b, "{\"ok\":false,\"error\":");
-    sb_putjson_text(&b, err ? err : sqlite3_errmsg(sb_dbs[idx]), err ? strlen(err) : strlen(sqlite3_errmsg(sb_dbs[idx])));
-    sb_puts(&b, "}");
+    sb_putjson_text(&b, m, strlen(m));
+    char code[32];
+    snprintf(code, sizeof(code), ",\"code\":%d}", quota_full ? 13 : capture_failed ? 10 : failure[0] ? failure_code : 0);
+    sb_puts(&b, code);
     return b.p;
   }
   sb_puts(&b, "{\"ok\":true}");
@@ -1995,14 +2017,6 @@ static char* sb_sql_error(sqlite3* db, const char* message, int code, int skip)
 // D1 calls from compatibility date 2026-10-24 put this comment first: the statement must
 // get exactly as many parameters as it has, like D1.
 #define SB_D1_STRICT "/*sb-d1-strict*/"
-// LTX capture (#141) failed after SQLite committed: the write is in the database but not in
-// the replication log, and the database refuses writes until the process restarts. Said as
-// such (SQLITE_IOERR), never as SQLite's own message, which still reads "not an error".
-#define SB_LTX_FAILED "LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart"
-static int sb_db_capture_failed(const char* path) {
-  for (int i = 0; i < sb_db_count; i++) if (strcmp(sb_db_names[i], path) == 0) return sb_ltx_states[i].failed;
-  return 0;
-}
 
 // Run one statement. Returns malloc'd JSON:
 //   {"ok":true,"cols":[...],"rows":[[...]],"changes":n,"rowid":n}
@@ -2019,6 +2033,10 @@ static char* sb_sql_run(const char* path, const char* sql, const char* params) {
   sqlite3_stmt* st = sb_stmt_get(idx, db, sql);
   if (!st) return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
   int bound = params && *params ? sb_bind_params(st, params) : 0;
+  if (sb_quota_frozen[idx] && !sqlite3_stmt_readonly(st)) {
+    sqlite3_reset(st);
+    return sb_sql_error(db, SB_QUOTA_FULL, 13, 0);
+  }
   if (strict && bound != sqlite3_bind_parameter_count(st)) {
     sqlite3_reset(st);
     return sb_sql_error(db, "Wrong number of parameter bindings for SQL query.", 0, 0);
@@ -2069,16 +2087,65 @@ static char* sb_sql_run(const char* path, const char* sql, const char* params) {
   // Reset, don't finalize: the statement stays compiled in sb_stmt_cache. Reset
   // now (not just on next reuse) so a SELECT stops holding its read transaction.
   sqlite3_reset(st);
+  // The statement's own error, kept before LTX capture runs: capture executes statements
+  // of its own, after which SQLite reports "not an error".
+  char failure[512] = { 0 };
+  int failure_code = 0;
+  if (rc != SB_SQLITE_DONE && rc != SB_SQLITE_ROW) {
+    snprintf(failure, sizeof(failure), "%s", sqlite3_errmsg(db));
+    failure_code = sqlite3_extended_errcode(db);
+  }
   const int capture_failed = sb_ltx_after(idx) != 0;
   if (capture_failed) rc = 10;
   if (rc != SB_SQLITE_DONE && rc != SB_SQLITE_ROW) {
     free(b.p);
     if (capture_failed) return sb_sql_error(db, SB_LTX_FAILED, 10, 0);
-    return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
+    return sb_sql_error(db, failure, failure_code, 0);
   }
   return b.p;
 }
 
+// The storage quota (docs: an app's data directory is capped): bytes in regular files under
+// dir, symlinks not followed. Bounded by depth; an unreadable entry counts as 0.
+static long long sb_dir_bytes(const char* dir, int depth) {
+  DIR* d = opendir(dir);
+  if (!d || depth > 16) { if (d) closedir(d); return 0; }
+  long long total = 0;
+  struct dirent* e;
+  char path[4096];
+  while ((e = readdir(d))) {
+    if (!strcmp(e->d_name, ".") || !strcmp(e->d_name, "..")) continue;
+    if (snprintf(path, sizeof(path), "%s/%s", dir, e->d_name) >= (int)sizeof(path)) continue;
+    struct stat st;
+    if (lstat(path, &st)) continue;
+    if (S_ISREG(st.st_mode)) total += (long long)st.st_size;
+    else if (S_ISDIR(st.st_mode)) total += sb_dir_bytes(path, depth + 1);
+  }
+  closedir(d);
+  return total;
+}
+
+// A database's page size without SQL: under LTX capture the authorizer refuses every
+// page_size pragma (the getter too), and capture records the size itself.
+static int sb_db_page_size(const char* path) {
+  int idx = sb_db_for(path);
+  if (idx < 0) return 0;
+  if (sb_ltx_states[idx].db) return (int)sb_ltx_states[idx].page_size;
+  sqlite3_stmt* st = 0;
+  int size = 0;
+  if (sqlite3_prepare_v2(sb_dbs[idx], "PRAGMA page_size", -1, &st, 0) == 0 && st && sqlite3_step(st) == SB_SQLITE_ROW) size = sqlite3_column_int(st, 0);
+  if (st) sqlite3_finalize(st);
+  return size;
+}
+// Freeze (refuse writes to) or thaw a database for the quota. Returns 1 when the database
+// is under LTX capture, 0 when not, -1 when it cannot be opened.
+static int sb_db_quota_freeze(const char* path, int on) {
+  int idx = sb_db_for(path);
+  if (idx < 0) return -1;
+  sb_quota_frozen[idx] = on && sb_ltx_states[idx].db ? 1 : 0;
+  return sb_ltx_states[idx].db ? 1 : 0;
+}
+
 // #164 — an online, consistent single-file snapshot of a database, via
 // VACUUM INTO. Runs against the live db with no downtime (SQLite holds a read
 // transaction for the copy) and writes a fresh, defragmented file with no WAL
@@ -3101,6 +3168,44 @@ function __sbSqlScriptRaw(path, sql) {
   return res;
 }
 
+// The bytes under a directory, as a decimal string (sb_dir_bytes).
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbDirBytesRaw(dir) {
+  let res = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __d; size_t __dl; char* __do = 0;
+    porf_native_fetch_read_value(dir, &__d, &__dl, &__do);
+    char* __dir = (char*)malloc(__dl + 1); memcpy(__dir, __d, __dl); __dir[__dl] = 0;
+    if (__do) free(__do);
+    char __n[32]; int __k = snprintf(__n, sizeof(__n), "%lld", sb_dir_bytes(__dir, 0));
+    free(__dir);
+    res = porf_box((f64)porf_native_fetch_alloc_bytestring(__n, (size_t)__k), 195);
+  `;
+  return res;
+}
+
+// sb_db_page_size and sb_db_quota_freeze, for the quota (a path and a "0"/"1" in, a number out).
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbD1DbRaw(path, what) {
+  let res = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __p; size_t __pl; char* __po = 0;
+    porf_native_fetch_read_value(path, &__p, &__pl, &__po);
+    char* __path = (char*)malloc(__pl + 1); memcpy(__path, __p, __pl); __path[__pl] = 0;
+    if (__po) free(__po);
+    const char* __w; size_t __wl; char* __wo = 0;
+    porf_native_fetch_read_value(what, &__w, &__wl, &__wo);
+    int __r = __wl && __w[0] == 'p' ? sb_db_page_size(__path) : sb_db_quota_freeze(__path, __wl && __w[0] == 'f');
+    if (__wo) free(__wo);
+    free(__path);
+    char __n[16]; int __k = snprintf(__n, sizeof(__n), "%d", __r);
+    res = porf_box((f64)porf_native_fetch_alloc_bytestring(__n, (size_t)__k), 195);
+  `;
+  return res;
+}
+
 // #164 — VACUUM INTO a fresh file. Two strings in, JSON out. Same pattern as
 // __sbSqlScriptRaw.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
@@ -3304,6 +3409,64 @@ function __sbDir() {
   }
   return __sbDataDir;
 }
+// The storage quota: an app's data directory holds at most SB_STORAGE_MAX_BYTES (sproutd
+// sets it per app; 10 GiB when unset, after D1's 10 GB per database). Past it, writes are
+// refused with an error that says so; reads and deletes still work, so an app can make
+// room. The size is measured at most once a second, and on a write's way in, so a write
+// can overshoot by what one second of writes adds. A D1 database is also capped at 10 GB.
+var __sbQuotaMax = -1;
+var __sbQuotaUsed = 0;
+var __sbQuotaAt = -1;
+function __sbQuotaLimit() {
+  if (__sbQuotaMax < 0) {
+    const v = Number(__sbEnv("SB_STORAGE_MAX_BYTES"));
+    __sbQuotaMax = v > 0 ? v : 10737418240;
+  }
+  return __sbQuotaMax;
+}
+function __sbQuotaFull() {
+  const now = Date.now();
+  if (__sbQuotaAt < 0 || now - __sbQuotaAt >= 1000) {
+    __sbQuotaUsed = Number(__sbDirBytesRaw(__sbDir())) || 0;
+    __sbQuotaAt = now;
+  }
+  return __sbQuotaUsed >= __sbQuotaLimit();
+}
+function __sbQuotaCheck(what) {
+  if (__sbQuotaFull())
+    throw new Error(
+      what + " failed: storage quota exceeded (this app stores " + __sbQuotaUsed + " bytes; the limit is " + __sbQuotaLimit() + ")",
+    );
+}
+var __sbQuotaOps = {
+  "kv.put": "KV put()",
+  "do.storage.put": "Durable Object storage put()",
+  "do.alarm.set": "Durable Object setAlarm()",
+  "queue.send": "Queue send()",
+  "queue.send_batch": "Queue sendBatch()",
+  "cache.put": "Cache put()",
+  "ae.write": "Analytics Engine writeDataPoint()",
+  "r2.put": "R2 put()",
+  "r2.multipart.create": "R2 createMultipartUpload()",
+  "r2.multipart.complete": "R2 completeMultipartUpload()",
+};
+// D1 over the quota: pin each database at its current size (SQLITE_FULL on growth, so
+// reads and deletes still run); under it, cap it at 10 GB or the quota, whichever is less.
+// A database under LTX capture is frozen instead: every write is refused, because even a
+// DELETE adds a file to the replication spool, which counts toward the quota.
+var __sbD1Capped = {};
+function __sbD1Quota(path) {
+  const full = __sbQuotaFull();
+  if (__sbD1Capped[path] === full) return;
+  __sbD1Capped[path] = full;
+  const captured = Number(__sbD1DbRaw(path, full ? "freeze" : "thaw")) === 1;
+  if (full && captured) return;
+  const size = Number(__sbD1DbRaw(path, "page_size")) || 4096;
+  const pages = full
+    ? Number(__sbSql(path, "PRAGMA page_count", []).rows[0][0])
+    : Math.floor(Math.min(__sbQuotaLimit(), 10000000000) / size);
+  __sbSql(path, "PRAGMA max_page_count = " + Math.max(1, pages), []);
+}
 function __sbStore() {
   return __sbDir() + "/store.sqlite";
 }
@@ -3434,6 +3597,7 @@ function __sbEmbeddedDispatch(msg) {
   __sbEnsureSchema();
   const store = __sbStore();
   const op = msg.op;
+  if (__sbQuotaOps[op]) __sbQuotaCheck(__sbQuotaOps[op]);
 
   if (op === "ping") return { ok: true, op: "pong", echo: msg.msg };
 
@@ -3584,12 +3748,18 @@ function __sbEmbeddedDispatch(msg) {
       // exec() takes a script; a single prepare would run only its first
       // statement and quietly drop the rest.
       __sbD1Open(path, msg.strict === true);
+      __sbD1Quota(path);
+      if (msg.strict === true && Array.isArray(msg.lines)) {
+        __sbD1ExecLines(path, msg.lines);
+        return { ok: true };
+      }
       const reply = JSON.parse(__sbSqlScriptRaw(path, String(msg.sql)));
       if (reply.ok === false) throw new Error("sqlite: " + reply.error);
       return { ok: true };
     }
     const strict = msg.strict === true;
     __sbD1Open(path, strict);
+    __sbD1Quota(path);
     if (op === "d1.batch") return { ok: true, results: __sbD1Batch(path, msg.statements || [], strict) };
     const one = __sbD1Run(path, msg.sql, msg.params, strict);
     return { ok: true, results: one.results, columns: one.columns, rows: one.rows, meta: one.meta, success: true };
@@ -4138,6 +4308,18 @@ function __sbD1Release(path, savepoint, strict) {
   if (Number(r.code) !== 10) __sbD1Undo(path, savepoint);
   throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
 }
+// exec() from 2026-10-24: line by line as workerd runs it, all or nothing.
+function __sbD1ExecLines(path, lines) {
+  __sbD1Control(path, "SAVEPOINT sb_d1_exec", true);
+  for (let i = 0; i < lines.length; i++) {
+    const reply = JSON.parse(__sbSqlScriptRaw(path, String(lines[i])));
+    if (reply.ok === false) {
+      if (Number(reply.code) !== 10) __sbD1Undo(path, "sb_d1_exec");
+      throw new Error("D1_EXEC_ERROR: Error in line " + (i + 1) + ": " + lines[i] + ": " + reply.error);
+    }
+  }
+  __sbD1Release(path, "sb_d1_exec", true);
+}
 // END D1 OPS
 
 /**
@@ -4148,6 +4330,7 @@ function __sbD1Release(path, savepoint, strict) {
  * itself does not know which backend it is on.
  */
 globalThis.__sbR2Put = function (bucket, key, body, httpMetadata, customMetadata) {
+  __sbQuotaCheck("R2 put()");
   __sbEnsureSchema();
   const reply = JSON.parse(
     __sbR2PutRaw(
@@ -4177,6 +4360,7 @@ globalThis.__sbR2Get = function (bucket, key) {
 };
 
 globalThis.__sbR2MultipartPut = function (bucket, key, uploadId, partNumber, body) {
+  __sbQuotaCheck("R2 uploadPart()");
   __sbEnsureSchema();
   const store = __sbStore();
   const upload = __sbSql(

package/test/native-d1.ts

@@ -47,7 +47,10 @@ int main(void) {
     if (!strncmp(line, ":break ", 7)) { line[strcspn(line, "\\t")] = 0; char p[1024]; snprintf(p, sizeof(p), "%s.ltx/position.tmp", line + 7); mkdir(p, 0700); puts("{}"); fflush(stdout); continue; }
     char* sql = strchr(line, '\\t'); if (!sql) return 2; *sql++ = 0;
     char* params = strchr(sql, '\\t'); if (!params) return 2; *params++ = 0;
-    char* out = sb_sql_run(line, sql, params); puts(out); fflush(stdout); free(out);
+    if (!strncmp(line, ":db ", 4)) { int r = sql[0] == 'p' ? sb_db_page_size(line + 4) : sb_db_quota_freeze(line + 4, sql[0] == 'f'); printf("{\\"n\\":%d}\\n", r); fflush(stdout); continue; }
+    if (!strncmp(line, ":bytes ", 7)) { line[strcspn(line, "\\t")] = 0; printf("{\\"n\\":%lld}\\n", sb_dir_bytes(line + 7, 0)); fflush(stdout); continue; }
+    // ":script PATH" runs SQL as a script (sb_sql_script, what exec() uses).
+    char* out = !strncmp(line, ":script ", 8) ? sb_sql_script(line + 8, sql) : sb_sql_run(line, sql, params); puts(out); fflush(stdout); free(out);
   }
   return 0;
 }
@@ -164,11 +167,41 @@ int main(void) {
     return r;
   };
   // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
+  const scriptRaw = (path: string, text: string) => sqlRaw(":script " + path, text, "[]");
   const ops = new Function(
     "__sbSqlRaw",
     "__sbSql",
-    `${transport.slice(opsStart, opsEnd)}\nreturn { __sbD1Run, __sbD1Batch, __sbD1Open };`,
-  )(sqlRaw, sql);
+    "__sbSqlScriptRaw",
+    `${transport.slice(opsStart, opsEnd)}\nreturn { __sbD1Run, __sbD1Batch, __sbD1Open, __sbD1ExecLines };`,
+  )(sqlRaw, sql, scriptRaw);
+  // The storage quota, lifted from "The storage quota" to __sbStore, for DIR and LIMIT.
+  const quotaStart = transport.indexOf("// The storage quota: an app's data directory");
+  const quotaEnd = transport.indexOf("function __sbStore() {");
+  assert(quotaStart > 0 && quotaEnd > quotaStart, "quota block moved");
+  const liftQuota = (dir: string, limit: number) =>
+    new Function(
+      "__sbEnv",
+      "__sbDir",
+      "__sbDirBytesRaw",
+      "__sbD1DbRaw",
+      "__sbSql",
+      `${transport.slice(quotaStart, quotaEnd)}\nreturn { __sbQuotaCheck, __sbD1Quota, __sbQuotaFull, expire() { __sbQuotaAt = -1; } };`,
+    )(
+      (name: string) => (name === "SB_STORAGE_MAX_BYTES" ? String(limit) : ""),
+      () => dir,
+      (d: string) => String(JSON.parse(sqlRaw(":bytes " + d, "", "")).n),
+      (path: string, what: string) => String(JSON.parse(sqlRaw(":db " + path, what, "")).n),
+      sql,
+    );
+  const dirBytes = (d: string) => Number(JSON.parse(sqlRaw(":bytes " + d, "", "")).n);
+  // exec() from 2026-10-24: line by line, all or nothing, the failing line named.
+  const ex = join(work, "data/d1/EXEC.sqlite");
+  ops.__sbD1ExecLines(ex, ["CREATE TABLE x (id INTEGER)", "INSERT INTO x VALUES (1); INSERT INTO x VALUES (2);"]);
+  assert.throws(
+    () => ops.__sbD1ExecLines(ex, ["INSERT INTO x VALUES (3);", "SELEC 2"]),
+    (e: Error) => e.message === 'D1_EXEC_ERROR: Error in line 2: SELEC 2: near "SELEC": syntax error',
+  );
+  assert.equal(ops.__sbD1Run(ex, "SELECT count(*) AS n FROM x", [], false).results[0].n, 2, "exec rolled back");
   const db2 = join(work, "data/d1/OPS.sqlite");
   ops.__sbD1Run(db2, "CREATE TABLE p (id INTEGER PRIMARY KEY)", [], false);
   ops.__sbD1Run(db2, "CREATE TABLE c (id INTEGER PRIMARY KEY, p INTEGER REFERENCES p(id))", [], false);
@@ -246,16 +279,45 @@ int main(void) {
     true,
   );
   assert.equal(ltxFiles(), beforeBatch + 1, "a batch is one LTX commit");
+  // With capture on, an authorization failure says so (it read "not an error" once capture
+  // had run), and the quota works: its page size comes from capture, not from the
+  // page_size pragma the capture authorizer refuses.
+  assert.throws(() => ops.__sbD1Run(ltx, "PRAGMA page_size", [], true), (e: Error) => e.message === "D1_ERROR: not authorized: SQLITE_AUTH");
+  assert.throws(() => ops.__sbD1ExecLines(ltx, ["PRAGMA journal_mode = DELETE"]), (e: Error) => e.message === "D1_EXEC_ERROR: Error in line 1: PRAGMA journal_mode = DELETE: not authorized");
+  const data = join(work, "data");
+  const roomy = liftQuota(data, dirBytes(data) + (1 << 20));
+  roomy.__sbD1Quota(ltx);
+  ops.__sbD1Run(ltx, "INSERT INTO e VALUES (10, 'under the quota')", [], true);
+  assert.equal(ops.__sbD1Run(ltx, "SELECT v FROM e WHERE id = 10", [], true).rows[0][0], "under the quota");
+  // Over the quota with capture on, every write is refused, a same-size UPDATE and a DELETE
+  // too (each would add an LTX file to the spool), and the spool stops growing; reads and
+  // read-only batches still run. Under the quota again, writes resume.
+  const tight = liftQuota(data, 1);
+  tight.__sbD1Quota(ltx);
+  const spool = ltxFiles();
+  const QUOTA = "D1_ERROR: storage quota exceeded: writes are refused while this app's data, including its replication log, is over its quota: SQLITE_FULL";
+  for (const write of ["INSERT INTO e VALUES (11, 'x')", "UPDATE e SET v = 'y' WHERE id = 10", "DELETE FROM e WHERE id = 10"])
+    assert.throws(() => ops.__sbD1Run(ltx, write, [], true), (e: Error) => e.message === QUOTA, write);
+  assert.throws(() => ops.__sbD1ExecLines(ltx, ["UPDATE e SET v = 'z'"]), (e: Error) => e.message.startsWith("D1_EXEC_ERROR: Error in line 1: UPDATE e SET v = 'z': storage quota exceeded"));
+  assert.throws(() => ops.__sbD1Batch(ltx, [{ sql: "SELECT 1", params: [] }, { sql: "DELETE FROM e", params: [] }], true), (e: Error) => e.message === QUOTA);
+  assert.equal(ops.__sbD1Batch(ltx, [{ sql: "SELECT count(*) FROM e", params: [] }], true).length, 1, "a read-only batch runs");
+  assert.equal(ops.__sbD1Run(ltx, "SELECT v FROM e WHERE id = 10", [], true).rows[0][0], "under the quota");
+  assert.equal(ltxFiles(), spool, "no LTX file while over the quota");
+  const again = liftQuota(data, dirBytes(data) + (1 << 20));
+  again.__sbD1Quota(ltx);
+  ops.__sbD1Run(ltx, "UPDATE e SET v = 'thawed' WHERE id = 10", [], true);
+  assert.equal(ltxFiles(), spool + 1, "writes, and capture, resume under the quota");
   // Break capture just before the batch's RELEASE.
   // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
   const breaking = new Function(
     "__sbSqlRaw",
     "__sbSql",
+    "__sbSqlScriptRaw",
     `${transport.slice(opsStart, opsEnd)}\nreturn { __sbD1Run, __sbD1Batch };`,
   )((path: string, text: string, params: string) => {
     if (text === "RELEASE sb_d1_batch") sqlRaw(":break " + path, "", "");
     return sqlRaw(path, text, params);
-  }, sql);
+  }, sql, scriptRaw);
   const LTX_FAILED =
     "D1_ERROR: LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart: SQLITE_IOERR";
   assert.throws(
@@ -272,6 +334,37 @@ int main(void) {
     /^Error: sqlite: LTX capture failed/,
     "old dates see the same failure",
   );
+  assert.throws(
+    () => ops.__sbD1ExecLines(ltx, ["INSERT INTO e VALUES (5, 'e')"]),
+    (e: Error) => e.message === "D1_ERROR: LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart: SQLITE_IOERR",
+    "exec() after a capture failure",
+  );
+  const qdir = join(work, "quota");
+  const qdb = join(qdir, "d1/Q.sqlite");
+  const quota = liftQuota(qdir, 262144);
+  ops.__sbD1Run(qdb, "CREATE TABLE q (b BLOB)", [], true);
+  quota.__sbD1Quota(qdb);
+  quota.__sbQuotaCheck("KV put()");
+  // Fill to the limit: a database is capped at the quota, so growth past it fails with
+  // SQLITE_FULL; then the directory is over, a KV write is refused, and reads and deletes
+  // keep working. VACUUM gives the space back and writes resume.
+  let rows = 0;
+  assert.throws(() => {
+    for (; rows < 64; rows++) ops.__sbD1Run(qdb, "INSERT INTO q VALUES (zeroblob(65536))", [], true);
+  }, (e: Error) => e.message === "D1_ERROR: database or disk is full: SQLITE_FULL");
+  assert(rows >= 2 && rows < 5, "filled to about 256 KiB: " + rows);
+  quota.expire();
+  assert.equal(quota.__sbQuotaFull(), true);
+  assert.throws(() => quota.__sbQuotaCheck("KV put()"), /^Error: KV put\(\) failed: storage quota exceeded \(this app stores \d+ bytes; the limit is 262144\)$/);
+  quota.__sbD1Quota(qdb);
+  assert.equal(ops.__sbD1Run(qdb, "SELECT count(*) FROM q", [], true).rows[0][0], rows, "reads still work");
+  ops.__sbD1Run(qdb, "DELETE FROM q", [], true);
+  ops.__sbD1Run(qdb, "VACUUM", [], true);
+  ops.__sbD1Run(qdb, "PRAGMA wal_checkpoint(TRUNCATE)", [], true);
+  quota.expire();
+  quota.__sbD1Quota(qdb);
+  quota.__sbQuotaCheck("KV put()");
+  ops.__sbD1Run(qdb, "INSERT INTO q VALUES (zeroblob(65536))", [], true);
   closeSync(toDriver);
   closeSync(fromDriver);
   await driver.exited;