@sproutboat/runtime 0.24.0 → 0.26.0

package/src/transport-embedded.js

@@ -419,9 +419,26 @@ static int sb_ltx_begin(sb_ltx_writer *w, const char *path, sb_ltx_state *s, uin
   memset(w, 0, sizeof(*w));
   w->hash = UINT64_MAX;
   w->page_size = s->page_size;
+  // Global temporary directories are outside a sandboxed worker's writable tree.
+  // After unlink, close (including process death) reclaims the scratch file.
+  char index_path[SB_LTX_PATH];
+  if (snprintf(index_path, sizeof(index_path), "%s/index-XXXXXX", s->root) >= sizeof(index_path))
+    return -1;
+  int index = mkstemp(index_path);
+  if (index < 0)
+    return -1;
+  sb_ltx_phase("index-created");
+  if (unlink(index_path)) {
+    close(index);
+    return -1;
+  }
+  w->index = fdopen(index, "w+b");
+  if (!w->index) {
+    close(index);
+    return -1;
+  }
   w->out = fopen(path, "wbx");
-  w->index = tmpfile();
-  if (!w->out || !w->index)
+  if (!w->out)
     return -1;
   unsigned char h[100] = {0};
   memcpy(h, "LTX1", 4);
@@ -1048,6 +1065,41 @@ done:
   return 1;
 }
 
+// The capture lock is already held. Remove only reserved, regular scratch files;
+// do not open them (a hard link could share the database's POSIX-locked inode).
+static int sb_ltx_sweep_indexes(const char *root) {
+  DIR *dir = opendir(root);
+  if (!dir)
+    return -1;
+  int rc = 0;
+  for (;;) {
+    errno = 0;
+    struct dirent *entry = readdir(dir);
+    if (!entry) {
+      if (errno)
+        rc = -1;
+      break;
+    }
+    const char *name = entry->d_name;
+    if (strlen(name) != 12 || strncmp(name, "index-", 6) ||
+        strspn(name + 6, "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789") != 6)
+      continue;
+    struct stat st;
+    if (fstatat(dirfd(dir), name, &st, AT_SYMLINK_NOFOLLOW)) {
+      if (errno == ENOENT)
+        continue;
+      rc = -1;
+      break;
+    }
+    if (S_ISREG(st.st_mode) && unlinkat(dirfd(dir), name, 0) && errno != ENOENT) {
+      rc = -1;
+      break;
+    }
+  }
+  if (closedir(dir))
+    rc = -1;
+  return rc;
+}
 static int sb_ltx_start(int idx, sqlite3 *db, const char *path, int lock) {
   sb_ltx_state *s = &sb_ltx_states[idx];
   memset(s, 0, sizeof(*s));
@@ -1059,6 +1111,8 @@ static int sb_ltx_start(int idx, sqlite3 *db, const char *path, int lock) {
     return -1;
   if (mkdir(s->root, 0700) && errno != EEXIST)
     return -1;
+  if (sb_ltx_sweep_indexes(s->root))
+    return -1;
   char parent[SB_LTX_PATH];
   snprintf(parent, sizeof(parent), "%s", path);
   char *slash = strrchr(parent, '/');
@@ -1949,6 +2003,11 @@ void sb_r2_transfer_download_close(sb_r2_transfer_ctx* ctx) { if (ctx) { if (ctx
 // the replication log, and the database refuses writes until the process restarts. Said as
 // such (SQLITE_IOERR), never as SQLite's own message, which still reads "not an error".
 #define SB_LTX_FAILED "LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart"
+// The storage quota, for a database under LTX capture: while the app is over its quota,
+// every write is refused (a same-size UPDATE or a DELETE still adds an LTX file to the
+// spool, which counts toward the quota). Reads and transaction control still run.
+#define SB_QUOTA_FULL "storage quota exceeded: writes are refused while this app's data, including its replication log, is over its quota"
+static unsigned char sb_quota_frozen[SB_MAX_DB];
 static int sb_db_capture_failed(const char* path) {
   for (int i = 0; i < sb_db_count; i++) if (strcmp(sb_db_names[i], path) == 0) return sb_ltx_states[i].failed;
   return 0;
@@ -1963,13 +2022,18 @@ static char* sb_sql_script(const char* path, const char* sql) {
   if (idx < 0 && sb_db_capture_failed(path)) { sb_puts(&b, "{\"ok\":false,\"error\":\"" SB_LTX_FAILED "\",\"code\":10}"); return b.p; }
   if (idx < 0) { sb_puts(&b, "{\"ok\":false,\"error\":\"cannot open database\"}"); return b.p; }
   char* err = 0;
-  int script_rc = 0, capture_failed = 0;
+  int script_rc = 0, capture_failed = 0, quota_full = 0, failure_code = 0;
+  char failure[512] = { 0 };
   if (sb_ltx_states[idx].db) {
     const char *next = sql;
     while (*next && !script_rc) {
       sqlite3_stmt *st = 0; const char *tail = 0;
       script_rc = sqlite3_prepare_v2(sb_dbs[idx], next, -1, &st, &tail);
+      if (!script_rc && st && sb_quota_frozen[idx] && !sqlite3_stmt_readonly(st)) { sqlite3_finalize(st); quota_full = 1; script_rc = 13; break; }
       if (!script_rc && st) { do { script_rc = sqlite3_step(st); } while (script_rc == SB_SQLITE_ROW); if (script_rc == SB_SQLITE_DONE) script_rc = 0; }
+      // Keep the statement's error before capture runs statements of its own (it would
+      // read "not an error" after them).
+      if (script_rc && !failure[0]) { snprintf(failure, sizeof(failure), "%s", sqlite3_errmsg(sb_dbs[idx])); failure_code = sqlite3_extended_errcode(sb_dbs[idx]); }
       if (st) sqlite3_finalize(st);
       if (sb_ltx_after(idx)) { script_rc = 10; capture_failed = 1; }
       if (!tail || tail <= next) break;
@@ -1977,10 +2041,12 @@ static char* sb_sql_script(const char* path, const char* sql) {
     }
   } else script_rc = sqlite3_exec(sb_dbs[idx], sql, 0, 0, &err);
   if (script_rc != 0) {
-    const char* m = capture_failed ? SB_LTX_FAILED : err ? err : sqlite3_errmsg(sb_dbs[idx]);
+    const char* m = quota_full ? SB_QUOTA_FULL : capture_failed ? SB_LTX_FAILED : failure[0] ? failure : err ? err : sqlite3_errmsg(sb_dbs[idx]);
     sb_puts(&b, "{\"ok\":false,\"error\":");
     sb_putjson_text(&b, m, strlen(m));
-    sb_puts(&b, capture_failed ? ",\"code\":10}" : "}");
+    char code[32];
+    snprintf(code, sizeof(code), ",\"code\":%d}", quota_full ? 13 : capture_failed ? 10 : failure[0] ? failure_code : 0);
+    sb_puts(&b, code);
     return b.p;
   }
   sb_puts(&b, "{\"ok\":true}");
@@ -2021,6 +2087,10 @@ static char* sb_sql_run(const char* path, const char* sql, const char* params) {
   sqlite3_stmt* st = sb_stmt_get(idx, db, sql);
   if (!st) return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
   int bound = params && *params ? sb_bind_params(st, params) : 0;
+  if (sb_quota_frozen[idx] && !sqlite3_stmt_readonly(st)) {
+    sqlite3_reset(st);
+    return sb_sql_error(db, SB_QUOTA_FULL, 13, 0);
+  }
   if (strict && bound != sqlite3_bind_parameter_count(st)) {
     sqlite3_reset(st);
     return sb_sql_error(db, "Wrong number of parameter bindings for SQL query.", 0, 0);
@@ -2071,16 +2141,65 @@ static char* sb_sql_run(const char* path, const char* sql, const char* params) {
   // Reset, don't finalize: the statement stays compiled in sb_stmt_cache. Reset
   // now (not just on next reuse) so a SELECT stops holding its read transaction.
   sqlite3_reset(st);
+  // The statement's own error, kept before LTX capture runs: capture executes statements
+  // of its own, after which SQLite reports "not an error".
+  char failure[512] = { 0 };
+  int failure_code = 0;
+  if (rc != SB_SQLITE_DONE && rc != SB_SQLITE_ROW) {
+    snprintf(failure, sizeof(failure), "%s", sqlite3_errmsg(db));
+    failure_code = sqlite3_extended_errcode(db);
+  }
   const int capture_failed = sb_ltx_after(idx) != 0;
   if (capture_failed) rc = 10;
   if (rc != SB_SQLITE_DONE && rc != SB_SQLITE_ROW) {
     free(b.p);
     if (capture_failed) return sb_sql_error(db, SB_LTX_FAILED, 10, 0);
-    return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
+    return sb_sql_error(db, failure, failure_code, 0);
   }
   return b.p;
 }
 
+// The storage quota (docs: an app's data directory is capped): bytes in regular files under
+// dir, symlinks not followed. Bounded by depth; an unreadable entry counts as 0.
+static long long sb_dir_bytes(const char* dir, int depth) {
+  DIR* d = opendir(dir);
+  if (!d || depth > 16) { if (d) closedir(d); return 0; }
+  long long total = 0;
+  struct dirent* e;
+  char path[4096];
+  while ((e = readdir(d))) {
+    if (!strcmp(e->d_name, ".") || !strcmp(e->d_name, "..")) continue;
+    if (snprintf(path, sizeof(path), "%s/%s", dir, e->d_name) >= (int)sizeof(path)) continue;
+    struct stat st;
+    if (lstat(path, &st)) continue;
+    if (S_ISREG(st.st_mode)) total += (long long)st.st_size;
+    else if (S_ISDIR(st.st_mode)) total += sb_dir_bytes(path, depth + 1);
+  }
+  closedir(d);
+  return total;
+}
+
+// A database's page size without SQL: under LTX capture the authorizer refuses every
+// page_size pragma (the getter too), and capture records the size itself.
+static int sb_db_page_size(const char* path) {
+  int idx = sb_db_for(path);
+  if (idx < 0) return 0;
+  if (sb_ltx_states[idx].db) return (int)sb_ltx_states[idx].page_size;
+  sqlite3_stmt* st = 0;
+  int size = 0;
+  if (sqlite3_prepare_v2(sb_dbs[idx], "PRAGMA page_size", -1, &st, 0) == 0 && st && sqlite3_step(st) == SB_SQLITE_ROW) size = sqlite3_column_int(st, 0);
+  if (st) sqlite3_finalize(st);
+  return size;
+}
+// Freeze (refuse writes to) or thaw a database for the quota; on < 0 only asks. Returns 1
+// when the database is under LTX capture, 0 when not, -1 when it cannot be opened.
+static int sb_db_quota_freeze(const char* path, int on) {
+  int idx = sb_db_for(path);
+  if (idx < 0) return -1;
+  if (on >= 0) sb_quota_frozen[idx] = on && sb_ltx_states[idx].db ? 1 : 0;
+  return sb_ltx_states[idx].db ? 1 : 0;
+}
+
 // #164 — an online, consistent single-file snapshot of a database, via
 // VACUUM INTO. Runs against the live db with no downtime (SQLite holds a read
 // transaction for the copy) and writes a fresh, defragmented file with no WAL
@@ -3103,6 +3222,44 @@ function __sbSqlScriptRaw(path, sql) {
   return res;
 }
 
+// The bytes under a directory, as a decimal string (sb_dir_bytes).
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbDirBytesRaw(dir) {
+  let res = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __d; size_t __dl; char* __do = 0;
+    porf_native_fetch_read_value(dir, &__d, &__dl, &__do);
+    char* __dir = (char*)malloc(__dl + 1); memcpy(__dir, __d, __dl); __dir[__dl] = 0;
+    if (__do) free(__do);
+    char __n[32]; int __k = snprintf(__n, sizeof(__n), "%lld", sb_dir_bytes(__dir, 0));
+    free(__dir);
+    res = porf_box((f64)porf_native_fetch_alloc_bytestring(__n, (size_t)__k), 195);
+  `;
+  return res;
+}
+
+// sb_db_page_size and sb_db_quota_freeze, for the quota (a path and a "0"/"1" in, a number out).
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbD1DbRaw(path, what) {
+  let res = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __p; size_t __pl; char* __po = 0;
+    porf_native_fetch_read_value(path, &__p, &__pl, &__po);
+    char* __path = (char*)malloc(__pl + 1); memcpy(__path, __p, __pl); __path[__pl] = 0;
+    if (__po) free(__po);
+    const char* __w; size_t __wl; char* __wo = 0;
+    porf_native_fetch_read_value(what, &__w, &__wl, &__wo);
+    int __r = __wl && __w[0] == 'p' ? sb_db_page_size(__path) : __wl && __w[0] == 'c' ? sb_db_quota_freeze(__path, -1) : sb_db_quota_freeze(__path, __wl && __w[0] == 'f');
+    if (__wo) free(__wo);
+    free(__path);
+    char __n[16]; int __k = snprintf(__n, sizeof(__n), "%d", __r);
+    res = porf_box((f64)porf_native_fetch_alloc_bytestring(__n, (size_t)__k), 195);
+  `;
+  return res;
+}
+
 // #164 — VACUUM INTO a fresh file. Two strings in, JSON out. Same pattern as
 // __sbSqlScriptRaw.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
@@ -3306,6 +3463,84 @@ function __sbDir() {
   }
   return __sbDataDir;
 }
+// The storage quota: an app's data directory holds at most SB_STORAGE_MAX_BYTES (sproutd
+// sets it per app; 10 GiB when unset, after D1's 10 GB per database). Past it, writes are
+// refused with an error that says so; reads and deletes still work, so an app can make
+// room. The size is measured at most once a second, and on a write's way in, so a write
+// can overshoot by what one second of writes adds. A D1 database is also capped at 10 GB.
+var __sbQuotaMax = -1;
+var __sbQuotaUsed = 0;
+var __sbQuotaAt = -1;
+function __sbQuotaLimit() {
+  if (__sbQuotaMax < 0) {
+    const v = Number(__sbEnv("SB_STORAGE_MAX_BYTES"));
+    __sbQuotaMax = v > 0 ? v : 10737418240;
+  }
+  return __sbQuotaMax;
+}
+function __sbQuotaFull() {
+  const now = Date.now();
+  if (__sbQuotaAt < 0 || now - __sbQuotaAt >= 1000) {
+    __sbQuotaUsed = Number(__sbDirBytesRaw(__sbDir())) || 0;
+    __sbQuotaAt = now;
+  }
+  return __sbQuotaUsed >= __sbQuotaLimit();
+}
+function __sbQuotaCheck(what) {
+  if (__sbQuotaFull())
+    throw new Error(
+      what + " failed: storage quota exceeded (this app stores " + __sbQuotaUsed + " bytes; the limit is " + __sbQuotaLimit() + ")",
+    );
+}
+var __sbQuotaOps = {
+  "kv.put": "KV put()",
+  "do.storage.put": "Durable Object storage put()",
+  "do.alarm.set": "Durable Object setAlarm()",
+  "queue.send": "Queue send()",
+  "queue.send_batch": "Queue sendBatch()",
+  "cache.put": "Cache put()",
+  "ae.write": "Analytics Engine writeDataPoint()",
+  "r2.put": "R2 put()",
+  "r2.multipart.create": "R2 createMultipartUpload()",
+  "r2.multipart.complete": "R2 completeMultipartUpload()",
+};
+// D1 over the quota: pin each database at its current size (SQLITE_FULL on growth, so
+// reads and deletes still run); under it, cap it at 10 GB or the quota, whichever is less.
+// A database under LTX capture is frozen instead: every write is refused, because even a
+// DELETE adds a file to the replication spool, which counts toward the quota.
+var __sbD1Capped = {};
+var __sbD1Captured = {};
+var __sbD1Checkpointed = {};
+function __sbD1Quota(path) {
+  // Whether capture owns this database, from the private helper (no SQL), before anything
+  // below depends on it. A database that cannot open (or whose capture failed) is left to
+  // the call itself, which reports why.
+  const status = Number(__sbD1DbRaw(path, "captured"));
+  if (status < 0) return;
+  __sbD1Captured[path] = status === 1;
+  let full = __sbQuotaFull();
+  // Over the quota, a database's -wal file can hold space the app has already freed (a
+  // DELETE, a VACUUM): checkpoint it into the database and truncate it, at most once a
+  // second, then measure again. Not under capture: LTX owns that database's checkpoints.
+  if (full && !__sbD1Captured[path] && Date.now() - (__sbD1Checkpointed[path] || 0) >= 1000) {
+    __sbD1Checkpointed[path] = Date.now();
+    JSON.parse(__sbSqlRaw(path, "PRAGMA wal_checkpoint(TRUNCATE)", "[]"));
+    __sbQuotaAt = -1;
+    full = __sbQuotaFull();
+  }
+  if (__sbD1Capped[path] === full) return;
+  __sbD1Capped[path] = full;
+  const frozen = Number(__sbD1DbRaw(path, full ? "freeze" : "thaw"));
+  if (frozen < 0) return;
+  const captured = frozen === 1;
+  __sbD1Captured[path] = captured;
+  if (full && captured) return;
+  const size = Number(__sbD1DbRaw(path, "page_size")) || 4096;
+  const pages = full
+    ? Number(__sbSql(path, "PRAGMA page_count", []).rows[0][0])
+    : Math.floor(Math.min(__sbQuotaLimit(), 10000000000) / size);
+  __sbSql(path, "PRAGMA max_page_count = " + Math.max(1, pages), []);
+}
 function __sbStore() {
   return __sbDir() + "/store.sqlite";
 }
@@ -3338,6 +3573,10 @@ function __sbEnsureSchema() {
   let hasKvBinary = false;
   for (let i = 0; i < kvColumns.length; i++) if (kvColumns[i][1] === "binary") hasKvBinary = true;
   if (!hasKvBinary) __sbSql(s, "ALTER TABLE kv ADD COLUMN binary INTEGER NOT NULL DEFAULT 0", []);
+  // A key's metadata (put(key, value, { metadata })), as JSON text; same column as the broker's.
+  let hasKvMetadata = false;
+  for (let i = 0; i < kvColumns.length; i++) if (kvColumns[i][1] === "metadata") hasKvMetadata = true;
+  if (!hasKvMetadata) __sbSql(s, "ALTER TABLE kv ADD COLUMN metadata TEXT", []);
   // #56 — no `body` column: an object's bytes live in their own file under
   // "<data-dir>/r2-blobs/" (sb_r2_put_c/sb_r2_get_c), never in the sqlite row.
   __sbSql(
@@ -3436,11 +3675,12 @@ function __sbEmbeddedDispatch(msg) {
   __sbEnsureSchema();
   const store = __sbStore();
   const op = msg.op;
+  if (__sbQuotaOps[op]) __sbQuotaCheck(__sbQuotaOps[op]);
 
   if (op === "ping") return { ok: true, op: "pong", echo: msg.msg };
 
   if (op === "kv.get") {
-    const r = __sbSql(store, "SELECT value, expires_at, binary FROM kv WHERE ns = ? AND key = ?", [
+    const r = __sbSql(store, "SELECT value, expires_at, binary, metadata FROM kv WHERE ns = ? AND key = ?", [
       msg.ns,
       msg.key,
     ]);
@@ -3450,7 +3690,14 @@ function __sbEmbeddedDispatch(msg) {
       __sbSql(store, "DELETE FROM kv WHERE ns = ? AND key = ?", [msg.ns, msg.key]);
       return { ok: true, found: false, value: null };
     }
-    return { ok: true, found: true, value: r.rows[0][0], binary: r.rows[0][2] === 1 };
+    return {
+      ok: true,
+      found: true,
+      value: r.rows[0][0],
+      binary: r.rows[0][2] === 1,
+      metadata: r.rows[0][3],
+      expiration: expiresAt == null ? null : Math.floor(expiresAt / 1000),
+    };
   }
   if (op === "kv.put") {
     // #58 — CF rejects expirationTtl under 60 seconds; matched here.
@@ -3464,8 +3711,8 @@ function __sbEmbeddedDispatch(msg) {
     }
     __sbSql(
       store,
-      "INSERT INTO kv (ns, key, value, expires_at, binary) VALUES (?1,?2,?3,?4,?5) ON CONFLICT (ns, key) DO UPDATE SET value = ?3, expires_at = ?4, binary = ?5",
-      [msg.ns, msg.key, msg.value, expiresAt, msg.binary === true ? 1 : 0],
+      "INSERT INTO kv (ns, key, value, expires_at, binary, metadata) VALUES (?1,?2,?3,?4,?5,?6) ON CONFLICT (ns, key) DO UPDATE SET value = ?3, expires_at = ?4, binary = ?5, metadata = ?6",
+      [msg.ns, msg.key, msg.value, expiresAt, msg.binary === true ? 1 : 0, msg.metadata == null ? null : String(msg.metadata)],
     );
     return { ok: true };
   }
@@ -3474,14 +3721,28 @@ function __sbEmbeddedDispatch(msg) {
     return { ok: true };
   }
   if (op === "kv.list") {
+    // The prefix matches exactly: LIKE ignored case and read "_" and "%" in it as wildcards.
+    // With a limit (the shim from 2026-10-25), a page of entries after the cursor (the last
+    // key of the previous page), with each key's expiration and metadata; without one,
+    // every key, as before.
+    const prefix = msg.prefix || "";
+    const paged = msg.limit != null;
+    const limit = paged ? Math.max(0, Math.floor(Number(msg.limit))) : -1;
     const r = __sbSql(
       store,
-      "SELECT key FROM kv WHERE ns = ? AND key LIKE ? || '%' AND (expires_at IS NULL OR expires_at > ?) ORDER BY key",
-      [msg.ns, msg.prefix || "", Date.now()],
+      "SELECT key, expires_at, metadata FROM kv WHERE ns = ?1 AND substr(key, 1, length(?2)) = ?2 AND key > ?3 " +
+        "AND (expires_at IS NULL OR expires_at > ?4) ORDER BY key LIMIT ?5",
+      [msg.ns, prefix, paged && msg.cursor ? String(msg.cursor) : "", Date.now(), paged ? limit + 1 : -1],
     );
     const keys = [];
-    for (let i = 0; i < r.rows.length; i++) keys.push(r.rows[i][0]);
-    return { ok: true, keys };
+    const entries = [];
+    const count = paged ? Math.min(r.rows.length, limit) : r.rows.length;
+    for (let i = 0; i < count; i++) {
+      keys.push(r.rows[i][0]);
+      entries.push({ name: r.rows[i][0], expiration: r.rows[i][1] == null ? null : Math.floor(r.rows[i][1] / 1000), metadata: r.rows[i][2] });
+    }
+    const complete = !paged || r.rows.length <= limit;
+    return { ok: true, keys, entries, list_complete: complete, cursor: complete ? "" : keys[keys.length - 1] };
   }
 
   if (op === "assets.get") {
@@ -3586,6 +3847,7 @@ function __sbEmbeddedDispatch(msg) {
       // exec() takes a script; a single prepare would run only its first
       // statement and quietly drop the rest.
       __sbD1Open(path, msg.strict === true);
+      __sbD1Quota(path);
       if (msg.strict === true && Array.isArray(msg.lines)) {
         __sbD1ExecLines(path, msg.lines);
         return { ok: true };
@@ -3596,6 +3858,7 @@ function __sbEmbeddedDispatch(msg) {
     }
     const strict = msg.strict === true;
     __sbD1Open(path, strict);
+    __sbD1Quota(path);
     if (op === "d1.batch") return { ok: true, results: __sbD1Batch(path, msg.statements || [], strict) };
     const one = __sbD1Run(path, msg.sql, msg.params, strict);
     return { ok: true, results: one.results, columns: one.columns, rows: one.rows, meta: one.meta, success: true };
@@ -4166,6 +4429,7 @@ function __sbD1ExecLines(path, lines) {
  * itself does not know which backend it is on.
  */
 globalThis.__sbR2Put = function (bucket, key, body, httpMetadata, customMetadata) {
+  __sbQuotaCheck("R2 put()");
   __sbEnsureSchema();
   const reply = JSON.parse(
     __sbR2PutRaw(
@@ -4195,6 +4459,7 @@ globalThis.__sbR2Get = function (bucket, key) {
 };
 
 globalThis.__sbR2MultipartPut = function (bucket, key, uploadId, partNumber, body) {
+  __sbQuotaCheck("R2 uploadPart()");
   __sbEnsureSchema();
   const store = __sbStore();
   const upload = __sbSql(

package/test/ltx-restore.ts

@@ -0,0 +1,110 @@
+// LTX chain restore, the same independent checker as native-ltx.ts (copied, so that test
+// stays as it is): every file's CRCs, checksums and TXIDs verified, pages applied in order.
+import assert from "node:assert/strict";
+import { readFile, readdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+// Independent CRC baseline in Bun. This intentionally uses BigInt, unlike C.
+const table: bigint[] = [];
+for (let i = 0; i < 256; i++) {
+  let c = BigInt(i);
+  for (let j = 0; j < 8; j++) c = (c >> 1n) ^ (c & 1n ? 0xd800000000000000n : 0n);
+  table.push(c);
+}
+function crc(data: Uint8Array, init = 0xffffffffffffffffn) {
+  let c = init;
+  for (const b of data) c = table[Number((c ^ BigInt(b)) & 255n)] ^ (c >> 8n);
+  return c;
+}
+const flag = 0x8000000000000000n,
+  mask = 0xffffffffffffffffn;
+function pageCrc(pgno: number, page: Uint8Array) {
+  const p = new Uint8Array(4);
+  new DataView(p.buffer).setUint32(0, pgno);
+  return flag | (crc(page, crc(p)) ^ mask);
+}
+
+export async function restore(epoch: string, output: string) {
+  const files = (await readdir(epoch)).filter((n) => n.endsWith(".ltx")).sort();
+  let db = new Uint8Array(0),
+    checksum = 0n,
+    txid = 0n;
+  for (const file of files) {
+    const b = new Uint8Array(await readFile(join(epoch, file)));
+    const v = new DataView(b.buffer, b.byteOffset, b.byteLength);
+    assert.equal(new TextDecoder().decode(b.subarray(0, 4)), "LTX1");
+    const pageSize = v.getUint32(8),
+      commit = v.getUint32(12);
+    assert.equal(v.getBigUint64(16), txid + 1n);
+    assert.equal(v.getBigUint64(40), checksum);
+    const next = new Uint8Array(commit * pageSize);
+    next.set(db.subarray(0, next.length));
+    db = next;
+    let offset = 100,
+      hash = crc(b.subarray(0, 100));
+    const entries = [];
+    for (;;) {
+      const begin = offset,
+        pgno = v.getUint32(offset),
+        flags = v.getUint16(offset + 4);
+      hash = crc(b.subarray(offset, offset + 6), hash);
+      offset += 6;
+      if (!pgno) {
+        assert.equal(flags, 0);
+        break;
+      }
+      assert.equal(flags, 1);
+      assert(pgno <= commit);
+      const size = v.getUint32(offset);
+      hash = crc(b.subarray(offset, offset + 4), hash);
+      offset += 4;
+      const stop = offset + size;
+      assert(stop <= b.length);
+      assert.equal(b[offset++], 0xf0);
+      let literals = 15,
+        byte;
+      do {
+        byte = b[offset++];
+        literals += byte;
+      } while (byte === 255);
+      assert.equal(literals, pageSize);
+      assert.equal(offset + pageSize, stop);
+      const page = b.subarray(offset, stop);
+      db.set(page, (pgno - 1) * pageSize);
+      hash = crc(page, hash);
+      offset = stop;
+      entries.push({ pgno, offset: begin, size: stop - begin });
+    }
+    const indexStart = offset;
+    function varint() {
+      let n = 0n,
+        s = 0n;
+      for (let i = 0; i < 10; i++) {
+        assert(offset < b.length);
+        const c = b[offset++];
+        n |= BigInt(c & 127) << s;
+        if (c < 128) return Number(n);
+        s += 7n;
+      }
+      throw new Error("varint overflow");
+    }
+    for (const entry of entries) {
+      assert.equal(varint(), entry.pgno);
+      assert.equal(varint(), entry.offset);
+      assert.equal(varint(), entry.size);
+    }
+    assert.equal(varint(), 0);
+    assert.equal(v.getBigUint64(offset), BigInt(offset - indexStart));
+    offset += 8;
+    hash = crc(b.subarray(indexStart, offset + 8), hash);
+    checksum = flag;
+    for (let p = 1; p <= commit; p++)
+      checksum = flag | (checksum ^ pageCrc(p, db.subarray((p - 1) * pageSize, p * pageSize)));
+    assert.equal(v.getBigUint64(offset), checksum, file);
+    assert.equal(v.getBigUint64(offset + 8), flag | (hash ^ mask), file);
+    assert.equal(offset + 16, b.length);
+    txid = v.getBigUint64(24);
+  }
+  await writeFile(output, db);
+  return { files: files.length, txid };
+}