@sproutboat/runtime 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @sproutboat/runtime
 
+## 0.25.0
+
+### Minor Changes
+
+- ef40955: The storage quota is a hard bound when LTX capture is on. A D1 database under capture can't be capped by pinning its page count: a same-size `UPDATE`, or a `DELETE`, still adds a file to the replication spool, and the spool counts toward the app's quota. So while the app is over its quota, every write to a captured database is refused with `D1_ERROR: storage quota exceeded: writes are refused while this app's data, including its replication log, is over its quota: SQLITE_FULL`. That covers `exec()` and `batch()` too.
+  
+  - Reads, read-only batches and transaction control still run.
+  - No LTX file is ever dropped to make room: the policy fails closed.
+  - Writes resume once the app is under its quota again, at the next rescan: for example after the operator raises the quota, or the app deletes R2 or KV data. The freeze holds across a restart.
+  
+  This freezes statements after the quota scan; it is not a hard filesystem cap. The write that crosses the quota is accepted.
+  
+  Databases without capture are unchanged: they are pinned at their size, so deletes still work.
+- 95f6bd7: A storage quota for standalone sprouts and sproutd. An app's data directory (KV, D1, R2, Durable Object storage, queues) holds at most `SB_STORAGE_MAX_BYTES` bytes; sproutd sets it per app, and it defaults to 10 GiB. Each D1 database is also capped at 10 GB, as in D1. Past the quota:
+  
+  - writes fail with an error that says so, such as `KV put() failed: storage quota exceeded (this app stores N bytes; the limit is M)`, or `D1_ERROR: database or disk is full: SQLITE_FULL` for D1;
+  - reads and deletes keep working, so an app can make room (for D1, `DELETE` and then `VACUUM`).
+  
+  This is a check after a scan, not a hard filesystem cap with zero overshoot. The size is measured at most once a second, by walking the directory, and a write is checked against the last measurement. The write that crosses the limit is accepted (an R2 object, say), and so is anything else written within that second. Writes after it are refused.
+
 ## 0.24.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/transport-embedded.js

@@ -1949,6 +1949,11 @@ void sb_r2_transfer_download_close(sb_r2_transfer_ctx* ctx) { if (ctx) { if (ctx
 // the replication log, and the database refuses writes until the process restarts. Said as
 // such (SQLITE_IOERR), never as SQLite's own message, which still reads "not an error".
 #define SB_LTX_FAILED "LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart"
+// The storage quota, for a database under LTX capture: while the app is over its quota,
+// every write is refused (a same-size UPDATE or a DELETE still adds an LTX file to the
+// spool, which counts toward the quota). Reads and transaction control still run.
+#define SB_QUOTA_FULL "storage quota exceeded: writes are refused while this app's data, including its replication log, is over its quota"
+static unsigned char sb_quota_frozen[SB_MAX_DB];
 static int sb_db_capture_failed(const char* path) {
   for (int i = 0; i < sb_db_count; i++) if (strcmp(sb_db_names[i], path) == 0) return sb_ltx_states[i].failed;
   return 0;
@@ -1963,13 +1968,18 @@ static char* sb_sql_script(const char* path, const char* sql) {
   if (idx < 0 && sb_db_capture_failed(path)) { sb_puts(&b, "{\"ok\":false,\"error\":\"" SB_LTX_FAILED "\",\"code\":10}"); return b.p; }
   if (idx < 0) { sb_puts(&b, "{\"ok\":false,\"error\":\"cannot open database\"}"); return b.p; }
   char* err = 0;
-  int script_rc = 0, capture_failed = 0;
+  int script_rc = 0, capture_failed = 0, quota_full = 0, failure_code = 0;
+  char failure[512] = { 0 };
   if (sb_ltx_states[idx].db) {
     const char *next = sql;
     while (*next && !script_rc) {
       sqlite3_stmt *st = 0; const char *tail = 0;
       script_rc = sqlite3_prepare_v2(sb_dbs[idx], next, -1, &st, &tail);
+      if (!script_rc && st && sb_quota_frozen[idx] && !sqlite3_stmt_readonly(st)) { sqlite3_finalize(st); quota_full = 1; script_rc = 13; break; }
       if (!script_rc && st) { do { script_rc = sqlite3_step(st); } while (script_rc == SB_SQLITE_ROW); if (script_rc == SB_SQLITE_DONE) script_rc = 0; }
+      // Keep the statement's error before capture runs statements of its own (it would
+      // read "not an error" after them).
+      if (script_rc && !failure[0]) { snprintf(failure, sizeof(failure), "%s", sqlite3_errmsg(sb_dbs[idx])); failure_code = sqlite3_extended_errcode(sb_dbs[idx]); }
       if (st) sqlite3_finalize(st);
       if (sb_ltx_after(idx)) { script_rc = 10; capture_failed = 1; }
       if (!tail || tail <= next) break;
@@ -1977,10 +1987,12 @@ static char* sb_sql_script(const char* path, const char* sql) {
     }
   } else script_rc = sqlite3_exec(sb_dbs[idx], sql, 0, 0, &err);
   if (script_rc != 0) {
-    const char* m = capture_failed ? SB_LTX_FAILED : err ? err : sqlite3_errmsg(sb_dbs[idx]);
+    const char* m = quota_full ? SB_QUOTA_FULL : capture_failed ? SB_LTX_FAILED : failure[0] ? failure : err ? err : sqlite3_errmsg(sb_dbs[idx]);
     sb_puts(&b, "{\"ok\":false,\"error\":");
     sb_putjson_text(&b, m, strlen(m));
-    sb_puts(&b, capture_failed ? ",\"code\":10}" : "}");
+    char code[32];
+    snprintf(code, sizeof(code), ",\"code\":%d}", quota_full ? 13 : capture_failed ? 10 : failure[0] ? failure_code : 0);
+    sb_puts(&b, code);
     return b.p;
   }
   sb_puts(&b, "{\"ok\":true}");
@@ -2021,6 +2033,10 @@ static char* sb_sql_run(const char* path, const char* sql, const char* params) {
   sqlite3_stmt* st = sb_stmt_get(idx, db, sql);
   if (!st) return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
   int bound = params && *params ? sb_bind_params(st, params) : 0;
+  if (sb_quota_frozen[idx] && !sqlite3_stmt_readonly(st)) {
+    sqlite3_reset(st);
+    return sb_sql_error(db, SB_QUOTA_FULL, 13, 0);
+  }
   if (strict && bound != sqlite3_bind_parameter_count(st)) {
     sqlite3_reset(st);
     return sb_sql_error(db, "Wrong number of parameter bindings for SQL query.", 0, 0);
@@ -2071,16 +2087,65 @@ static char* sb_sql_run(const char* path, const char* sql, const char* params) {
   // Reset, don't finalize: the statement stays compiled in sb_stmt_cache. Reset
   // now (not just on next reuse) so a SELECT stops holding its read transaction.
   sqlite3_reset(st);
+  // The statement's own error, kept before LTX capture runs: capture executes statements
+  // of its own, after which SQLite reports "not an error".
+  char failure[512] = { 0 };
+  int failure_code = 0;
+  if (rc != SB_SQLITE_DONE && rc != SB_SQLITE_ROW) {
+    snprintf(failure, sizeof(failure), "%s", sqlite3_errmsg(db));
+    failure_code = sqlite3_extended_errcode(db);
+  }
   const int capture_failed = sb_ltx_after(idx) != 0;
   if (capture_failed) rc = 10;
   if (rc != SB_SQLITE_DONE && rc != SB_SQLITE_ROW) {
     free(b.p);
     if (capture_failed) return sb_sql_error(db, SB_LTX_FAILED, 10, 0);
-    return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
+    return sb_sql_error(db, failure, failure_code, 0);
   }
   return b.p;
 }
 
+// The storage quota (docs: an app's data directory is capped): bytes in regular files under
+// dir, symlinks not followed. Bounded by depth; an unreadable entry counts as 0.
+static long long sb_dir_bytes(const char* dir, int depth) {
+  DIR* d = opendir(dir);
+  if (!d || depth > 16) { if (d) closedir(d); return 0; }
+  long long total = 0;
+  struct dirent* e;
+  char path[4096];
+  while ((e = readdir(d))) {
+    if (!strcmp(e->d_name, ".") || !strcmp(e->d_name, "..")) continue;
+    if (snprintf(path, sizeof(path), "%s/%s", dir, e->d_name) >= (int)sizeof(path)) continue;
+    struct stat st;
+    if (lstat(path, &st)) continue;
+    if (S_ISREG(st.st_mode)) total += (long long)st.st_size;
+    else if (S_ISDIR(st.st_mode)) total += sb_dir_bytes(path, depth + 1);
+  }
+  closedir(d);
+  return total;
+}
+
+// A database's page size without SQL: under LTX capture the authorizer refuses every
+// page_size pragma (the getter too), and capture records the size itself.
+static int sb_db_page_size(const char* path) {
+  int idx = sb_db_for(path);
+  if (idx < 0) return 0;
+  if (sb_ltx_states[idx].db) return (int)sb_ltx_states[idx].page_size;
+  sqlite3_stmt* st = 0;
+  int size = 0;
+  if (sqlite3_prepare_v2(sb_dbs[idx], "PRAGMA page_size", -1, &st, 0) == 0 && st && sqlite3_step(st) == SB_SQLITE_ROW) size = sqlite3_column_int(st, 0);
+  if (st) sqlite3_finalize(st);
+  return size;
+}
+// Freeze (refuse writes to) or thaw a database for the quota. Returns 1 when the database
+// is under LTX capture, 0 when not, -1 when it cannot be opened.
+static int sb_db_quota_freeze(const char* path, int on) {
+  int idx = sb_db_for(path);
+  if (idx < 0) return -1;
+  sb_quota_frozen[idx] = on && sb_ltx_states[idx].db ? 1 : 0;
+  return sb_ltx_states[idx].db ? 1 : 0;
+}
+
 // #164 — an online, consistent single-file snapshot of a database, via
 // VACUUM INTO. Runs against the live db with no downtime (SQLite holds a read
 // transaction for the copy) and writes a fresh, defragmented file with no WAL
@@ -3103,6 +3168,44 @@ function __sbSqlScriptRaw(path, sql) {
   return res;
 }
 
+// The bytes under a directory, as a decimal string (sb_dir_bytes).
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbDirBytesRaw(dir) {
+  let res = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __d; size_t __dl; char* __do = 0;
+    porf_native_fetch_read_value(dir, &__d, &__dl, &__do);
+    char* __dir = (char*)malloc(__dl + 1); memcpy(__dir, __d, __dl); __dir[__dl] = 0;
+    if (__do) free(__do);
+    char __n[32]; int __k = snprintf(__n, sizeof(__n), "%lld", sb_dir_bytes(__dir, 0));
+    free(__dir);
+    res = porf_box((f64)porf_native_fetch_alloc_bytestring(__n, (size_t)__k), 195);
+  `;
+  return res;
+}
+
+// sb_db_page_size and sb_db_quota_freeze, for the quota (a path and a "0"/"1" in, a number out).
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbD1DbRaw(path, what) {
+  let res = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __p; size_t __pl; char* __po = 0;
+    porf_native_fetch_read_value(path, &__p, &__pl, &__po);
+    char* __path = (char*)malloc(__pl + 1); memcpy(__path, __p, __pl); __path[__pl] = 0;
+    if (__po) free(__po);
+    const char* __w; size_t __wl; char* __wo = 0;
+    porf_native_fetch_read_value(what, &__w, &__wl, &__wo);
+    int __r = __wl && __w[0] == 'p' ? sb_db_page_size(__path) : sb_db_quota_freeze(__path, __wl && __w[0] == 'f');
+    if (__wo) free(__wo);
+    free(__path);
+    char __n[16]; int __k = snprintf(__n, sizeof(__n), "%d", __r);
+    res = porf_box((f64)porf_native_fetch_alloc_bytestring(__n, (size_t)__k), 195);
+  `;
+  return res;
+}
+
 // #164 — VACUUM INTO a fresh file. Two strings in, JSON out. Same pattern as
 // __sbSqlScriptRaw.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
@@ -3306,6 +3409,64 @@ function __sbDir() {
   }
   return __sbDataDir;
 }
+// The storage quota: an app's data directory holds at most SB_STORAGE_MAX_BYTES (sproutd
+// sets it per app; 10 GiB when unset, after D1's 10 GB per database). Past it, writes are
+// refused with an error that says so; reads and deletes still work, so an app can make
+// room. The size is measured at most once a second, and on a write's way in, so a write
+// can overshoot by what one second of writes adds. A D1 database is also capped at 10 GB.
+var __sbQuotaMax = -1;
+var __sbQuotaUsed = 0;
+var __sbQuotaAt = -1;
+function __sbQuotaLimit() {
+  if (__sbQuotaMax < 0) {
+    const v = Number(__sbEnv("SB_STORAGE_MAX_BYTES"));
+    __sbQuotaMax = v > 0 ? v : 10737418240;
+  }
+  return __sbQuotaMax;
+}
+function __sbQuotaFull() {
+  const now = Date.now();
+  if (__sbQuotaAt < 0 || now - __sbQuotaAt >= 1000) {
+    __sbQuotaUsed = Number(__sbDirBytesRaw(__sbDir())) || 0;
+    __sbQuotaAt = now;
+  }
+  return __sbQuotaUsed >= __sbQuotaLimit();
+}
+function __sbQuotaCheck(what) {
+  if (__sbQuotaFull())
+    throw new Error(
+      what + " failed: storage quota exceeded (this app stores " + __sbQuotaUsed + " bytes; the limit is " + __sbQuotaLimit() + ")",
+    );
+}
+var __sbQuotaOps = {
+  "kv.put": "KV put()",
+  "do.storage.put": "Durable Object storage put()",
+  "do.alarm.set": "Durable Object setAlarm()",
+  "queue.send": "Queue send()",
+  "queue.send_batch": "Queue sendBatch()",
+  "cache.put": "Cache put()",
+  "ae.write": "Analytics Engine writeDataPoint()",
+  "r2.put": "R2 put()",
+  "r2.multipart.create": "R2 createMultipartUpload()",
+  "r2.multipart.complete": "R2 completeMultipartUpload()",
+};
+// D1 over the quota: pin each database at its current size (SQLITE_FULL on growth, so
+// reads and deletes still run); under it, cap it at 10 GB or the quota, whichever is less.
+// A database under LTX capture is frozen instead: every write is refused, because even a
+// DELETE adds a file to the replication spool, which counts toward the quota.
+var __sbD1Capped = {};
+function __sbD1Quota(path) {
+  const full = __sbQuotaFull();
+  if (__sbD1Capped[path] === full) return;
+  __sbD1Capped[path] = full;
+  const captured = Number(__sbD1DbRaw(path, full ? "freeze" : "thaw")) === 1;
+  if (full && captured) return;
+  const size = Number(__sbD1DbRaw(path, "page_size")) || 4096;
+  const pages = full
+    ? Number(__sbSql(path, "PRAGMA page_count", []).rows[0][0])
+    : Math.floor(Math.min(__sbQuotaLimit(), 10000000000) / size);
+  __sbSql(path, "PRAGMA max_page_count = " + Math.max(1, pages), []);
+}
 function __sbStore() {
   return __sbDir() + "/store.sqlite";
 }
@@ -3436,6 +3597,7 @@ function __sbEmbeddedDispatch(msg) {
   __sbEnsureSchema();
   const store = __sbStore();
   const op = msg.op;
+  if (__sbQuotaOps[op]) __sbQuotaCheck(__sbQuotaOps[op]);
 
   if (op === "ping") return { ok: true, op: "pong", echo: msg.msg };
 
@@ -3586,6 +3748,7 @@ function __sbEmbeddedDispatch(msg) {
       // exec() takes a script; a single prepare would run only its first
       // statement and quietly drop the rest.
       __sbD1Open(path, msg.strict === true);
+      __sbD1Quota(path);
       if (msg.strict === true && Array.isArray(msg.lines)) {
         __sbD1ExecLines(path, msg.lines);
         return { ok: true };
@@ -3596,6 +3759,7 @@ function __sbEmbeddedDispatch(msg) {
     }
     const strict = msg.strict === true;
     __sbD1Open(path, strict);
+    __sbD1Quota(path);
     if (op === "d1.batch") return { ok: true, results: __sbD1Batch(path, msg.statements || [], strict) };
     const one = __sbD1Run(path, msg.sql, msg.params, strict);
     return { ok: true, results: one.results, columns: one.columns, rows: one.rows, meta: one.meta, success: true };
@@ -4166,6 +4330,7 @@ function __sbD1ExecLines(path, lines) {
  * itself does not know which backend it is on.
  */
 globalThis.__sbR2Put = function (bucket, key, body, httpMetadata, customMetadata) {
+  __sbQuotaCheck("R2 put()");
   __sbEnsureSchema();
   const reply = JSON.parse(
     __sbR2PutRaw(
@@ -4195,6 +4360,7 @@ globalThis.__sbR2Get = function (bucket, key) {
 };
 
 globalThis.__sbR2MultipartPut = function (bucket, key, uploadId, partNumber, body) {
+  __sbQuotaCheck("R2 uploadPart()");
   __sbEnsureSchema();
   const store = __sbStore();
   const upload = __sbSql(

package/test/native-d1.ts

@@ -47,6 +47,8 @@ int main(void) {
     if (!strncmp(line, ":break ", 7)) { line[strcspn(line, "\\t")] = 0; char p[1024]; snprintf(p, sizeof(p), "%s.ltx/position.tmp", line + 7); mkdir(p, 0700); puts("{}"); fflush(stdout); continue; }
     char* sql = strchr(line, '\\t'); if (!sql) return 2; *sql++ = 0;
     char* params = strchr(sql, '\\t'); if (!params) return 2; *params++ = 0;
+    if (!strncmp(line, ":db ", 4)) { int r = sql[0] == 'p' ? sb_db_page_size(line + 4) : sb_db_quota_freeze(line + 4, sql[0] == 'f'); printf("{\\"n\\":%d}\\n", r); fflush(stdout); continue; }
+    if (!strncmp(line, ":bytes ", 7)) { line[strcspn(line, "\\t")] = 0; printf("{\\"n\\":%lld}\\n", sb_dir_bytes(line + 7, 0)); fflush(stdout); continue; }
     // ":script PATH" runs SQL as a script (sb_sql_script, what exec() uses).
     char* out = !strncmp(line, ":script ", 8) ? sb_sql_script(line + 8, sql) : sb_sql_run(line, sql, params); puts(out); fflush(stdout); free(out);
   }
@@ -172,6 +174,26 @@ int main(void) {
     "__sbSqlScriptRaw",
     `${transport.slice(opsStart, opsEnd)}\nreturn { __sbD1Run, __sbD1Batch, __sbD1Open, __sbD1ExecLines };`,
   )(sqlRaw, sql, scriptRaw);
+  // The storage quota, lifted from "The storage quota" to __sbStore, for DIR and LIMIT.
+  const quotaStart = transport.indexOf("// The storage quota: an app's data directory");
+  const quotaEnd = transport.indexOf("function __sbStore() {");
+  assert(quotaStart > 0 && quotaEnd > quotaStart, "quota block moved");
+  const liftQuota = (dir: string, limit: number) =>
+    new Function(
+      "__sbEnv",
+      "__sbDir",
+      "__sbDirBytesRaw",
+      "__sbD1DbRaw",
+      "__sbSql",
+      `${transport.slice(quotaStart, quotaEnd)}\nreturn { __sbQuotaCheck, __sbD1Quota, __sbQuotaFull, expire() { __sbQuotaAt = -1; } };`,
+    )(
+      (name: string) => (name === "SB_STORAGE_MAX_BYTES" ? String(limit) : ""),
+      () => dir,
+      (d: string) => String(JSON.parse(sqlRaw(":bytes " + d, "", "")).n),
+      (path: string, what: string) => String(JSON.parse(sqlRaw(":db " + path, what, "")).n),
+      sql,
+    );
+  const dirBytes = (d: string) => Number(JSON.parse(sqlRaw(":bytes " + d, "", "")).n);
   // exec() from 2026-10-24: line by line, all or nothing, the failing line named.
   const ex = join(work, "data/d1/EXEC.sqlite");
   ops.__sbD1ExecLines(ex, ["CREATE TABLE x (id INTEGER)", "INSERT INTO x VALUES (1); INSERT INTO x VALUES (2);"]);
@@ -257,6 +279,34 @@ int main(void) {
     true,
   );
   assert.equal(ltxFiles(), beforeBatch + 1, "a batch is one LTX commit");
+  // With capture on, an authorization failure says so (it read "not an error" once capture
+  // had run), and the quota works: its page size comes from capture, not from the
+  // page_size pragma the capture authorizer refuses.
+  assert.throws(() => ops.__sbD1Run(ltx, "PRAGMA page_size", [], true), (e: Error) => e.message === "D1_ERROR: not authorized: SQLITE_AUTH");
+  assert.throws(() => ops.__sbD1ExecLines(ltx, ["PRAGMA journal_mode = DELETE"]), (e: Error) => e.message === "D1_EXEC_ERROR: Error in line 1: PRAGMA journal_mode = DELETE: not authorized");
+  const data = join(work, "data");
+  const roomy = liftQuota(data, dirBytes(data) + (1 << 20));
+  roomy.__sbD1Quota(ltx);
+  ops.__sbD1Run(ltx, "INSERT INTO e VALUES (10, 'under the quota')", [], true);
+  assert.equal(ops.__sbD1Run(ltx, "SELECT v FROM e WHERE id = 10", [], true).rows[0][0], "under the quota");
+  // Over the quota with capture on, every write is refused, a same-size UPDATE and a DELETE
+  // too (each would add an LTX file to the spool), and the spool stops growing; reads and
+  // read-only batches still run. Under the quota again, writes resume.
+  const tight = liftQuota(data, 1);
+  tight.__sbD1Quota(ltx);
+  const spool = ltxFiles();
+  const QUOTA = "D1_ERROR: storage quota exceeded: writes are refused while this app's data, including its replication log, is over its quota: SQLITE_FULL";
+  for (const write of ["INSERT INTO e VALUES (11, 'x')", "UPDATE e SET v = 'y' WHERE id = 10", "DELETE FROM e WHERE id = 10"])
+    assert.throws(() => ops.__sbD1Run(ltx, write, [], true), (e: Error) => e.message === QUOTA, write);
+  assert.throws(() => ops.__sbD1ExecLines(ltx, ["UPDATE e SET v = 'z'"]), (e: Error) => e.message.startsWith("D1_EXEC_ERROR: Error in line 1: UPDATE e SET v = 'z': storage quota exceeded"));
+  assert.throws(() => ops.__sbD1Batch(ltx, [{ sql: "SELECT 1", params: [] }, { sql: "DELETE FROM e", params: [] }], true), (e: Error) => e.message === QUOTA);
+  assert.equal(ops.__sbD1Batch(ltx, [{ sql: "SELECT count(*) FROM e", params: [] }], true).length, 1, "a read-only batch runs");
+  assert.equal(ops.__sbD1Run(ltx, "SELECT v FROM e WHERE id = 10", [], true).rows[0][0], "under the quota");
+  assert.equal(ltxFiles(), spool, "no LTX file while over the quota");
+  const again = liftQuota(data, dirBytes(data) + (1 << 20));
+  again.__sbD1Quota(ltx);
+  ops.__sbD1Run(ltx, "UPDATE e SET v = 'thawed' WHERE id = 10", [], true);
+  assert.equal(ltxFiles(), spool + 1, "writes, and capture, resume under the quota");
   // Break capture just before the batch's RELEASE.
   // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
   const breaking = new Function(
@@ -289,6 +339,32 @@ int main(void) {
     (e: Error) => e.message === "D1_ERROR: LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart: SQLITE_IOERR",
     "exec() after a capture failure",
   );
+  const qdir = join(work, "quota");
+  const qdb = join(qdir, "d1/Q.sqlite");
+  const quota = liftQuota(qdir, 262144);
+  ops.__sbD1Run(qdb, "CREATE TABLE q (b BLOB)", [], true);
+  quota.__sbD1Quota(qdb);
+  quota.__sbQuotaCheck("KV put()");
+  // Fill to the limit: a database is capped at the quota, so growth past it fails with
+  // SQLITE_FULL; then the directory is over, a KV write is refused, and reads and deletes
+  // keep working. VACUUM gives the space back and writes resume.
+  let rows = 0;
+  assert.throws(() => {
+    for (; rows < 64; rows++) ops.__sbD1Run(qdb, "INSERT INTO q VALUES (zeroblob(65536))", [], true);
+  }, (e: Error) => e.message === "D1_ERROR: database or disk is full: SQLITE_FULL");
+  assert(rows >= 2 && rows < 5, "filled to about 256 KiB: " + rows);
+  quota.expire();
+  assert.equal(quota.__sbQuotaFull(), true);
+  assert.throws(() => quota.__sbQuotaCheck("KV put()"), /^Error: KV put\(\) failed: storage quota exceeded \(this app stores \d+ bytes; the limit is 262144\)$/);
+  quota.__sbD1Quota(qdb);
+  assert.equal(ops.__sbD1Run(qdb, "SELECT count(*) FROM q", [], true).rows[0][0], rows, "reads still work");
+  ops.__sbD1Run(qdb, "DELETE FROM q", [], true);
+  ops.__sbD1Run(qdb, "VACUUM", [], true);
+  ops.__sbD1Run(qdb, "PRAGMA wal_checkpoint(TRUNCATE)", [], true);
+  quota.expire();
+  quota.__sbD1Quota(qdb);
+  quota.__sbQuotaCheck("KV put()");
+  ops.__sbD1Run(qdb, "INSERT INTO q VALUES (zeroblob(65536))", [], true);
   closeSync(toDriver);
   closeSync(fromDriver);
   await driver.exited;