@verax-ai/body 0.3.0 → 0.4.0

package/dist/keys.d.ts

@@ -6,6 +6,12 @@ export declare class KeysPartialError extends Error {
     readonly code = 78;
     constructor();
 }
+export declare class KeyAlgorithmError extends Error {
+    readonly code = 78;
+    constructor(which: string);
+}
+/** A public key this process will verify with. Anything but Ed25519 stops start. */
+export declare function assertEd25519PublicKey(pem: string, which: string): void;
 export declare function loadOrCreateSigners(stateDir: string): {
     recordSigner: KeyPair;
     effectSigner: KeyPair;

package/dist/keys.js

@@ -1,4 +1,4 @@
-import { generateKeyPairSync } from "node:crypto";
+import { createPublicKey, generateKeyPairSync } from "node:crypto";
 import { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { EX_CONFIG } from "./config.js";
@@ -9,6 +9,25 @@ export class KeysPartialError extends Error {
         this.name = "KeysPartialError";
     }
 }
+export class KeyAlgorithmError extends Error {
+    code = EX_CONFIG;
+    constructor(which) {
+        super(`${which} public key is not ed25519`);
+        this.name = "KeyAlgorithmError";
+    }
+}
+/** A public key this process will verify with. Anything but Ed25519 stops start. */
+export function assertEd25519PublicKey(pem, which) {
+    let type;
+    try {
+        type = createPublicKey(pem).asymmetricKeyType;
+    }
+    catch {
+        throw new KeyAlgorithmError(which);
+    }
+    if (type !== "ed25519")
+        throw new KeyAlgorithmError(which);
+}
 function pair() {
     const { publicKey, privateKey } = generateKeyPairSync("ed25519");
     return {
@@ -33,23 +52,27 @@ export function loadOrCreateSigners(stateDir) {
     if (present !== 0 && present !== 4) {
         throw new KeysPartialError();
     }
-    if (present === 0) {
-        const record = pair();
-        const effect = pair();
-        writePemAtomic(recPriv, record.privateKeyPem);
-        writePemAtomic(recPub, record.publicKeyPem);
-        writePemAtomic(effPriv, effect.privateKeyPem);
-        writePemAtomic(effPub, effect.publicKeyPem);
-        return { recordSigner: record, effectSigner: effect };
-    }
-    return {
-        recordSigner: {
-            privateKeyPem: readFileSync(recPriv, "utf8"),
-            publicKeyPem: readFileSync(recPub, "utf8"),
-        },
-        effectSigner: {
-            privateKeyPem: readFileSync(effPriv, "utf8"),
-            publicKeyPem: readFileSync(effPub, "utf8"),
-        },
-    };
+    const loaded = present === 0
+        ? (() => {
+            const record = pair();
+            const effect = pair();
+            writePemAtomic(recPriv, record.privateKeyPem);
+            writePemAtomic(recPub, record.publicKeyPem);
+            writePemAtomic(effPriv, effect.privateKeyPem);
+            writePemAtomic(effPub, effect.publicKeyPem);
+            return { recordSigner: record, effectSigner: effect };
+        })()
+        : {
+            recordSigner: {
+                privateKeyPem: readFileSync(recPriv, "utf8"),
+                publicKeyPem: readFileSync(recPub, "utf8"),
+            },
+            effectSigner: {
+                privateKeyPem: readFileSync(effPriv, "utf8"),
+                publicKeyPem: readFileSync(effPub, "utf8"),
+            },
+        };
+    assertEd25519PublicKey(loaded.recordSigner.publicKeyPem, "record");
+    assertEd25519PublicKey(loaded.effectSigner.publicKeyPem, "effect");
+    return loaded;
 }

package/dist/main.js

@@ -1,8 +1,10 @@
 import { JwksFileError } from "./auth.js";
 import { EX_CONFIG, loadConfig, overlayInventoryArg } from "./config.js";
-import { KeysPartialError } from "./keys.js";
+import { watchDesktopParent } from "./desktop-parent.js";
+import { KeyAlgorithmError, KeysPartialError } from "./keys.js";
 import { listen } from "./server.js";
 export async function main(env = process.env, argv = process.argv) {
+    watchDesktopParent({ env });
     const overlaid = overlayInventoryArg(env, argv);
     if ("error" in overlaid) {
         process.stderr.write(`${overlaid.error}\n`);
@@ -15,6 +17,10 @@ export async function main(env = process.env, argv = process.argv) {
     }
     try {
         const server = await listen(loaded.value);
+        const addr = server.address();
+        if (addr && typeof addr === "object") {
+            process.stderr.write(`listening ${addr.address}:${addr.port}\n`);
+        }
         const shutdown = () => {
             server.close(() => process.exit(0));
         };
@@ -26,6 +32,10 @@ export async function main(env = process.env, argv = process.argv) {
             process.stderr.write("keys-partial\n");
             process.exit(err.code);
         }
+        if (err instanceof KeyAlgorithmError) {
+            process.stderr.write(`${err.message}\n`);
+            process.exit(err.code);
+        }
         if (err instanceof JwksFileError) {
             process.stderr.write(`${err.message}\n`);
             process.exit(err.code);

package/dist/no-bypass-scan.js

@@ -52,8 +52,9 @@ export function scanNoBypass(base = pkgRoot, extra = []) {
         if (rel === "src/no-bypass-scan.ts")
             continue;
         const wiring = rel === "src/wiring.ts";
-        // Desktop supervises issuer/body/panel. It is not a tool-call path.
-        const desktop = rel === "src/desktop.ts";
+        // Desktop supervises issuer/body/panel. Install copies the body under another
+        // account. Neither file is a tool-call path.
+        const desktop = rel === "src/desktop.ts" || rel === "src/install.ts";
         // The downstream spike attaches one stdio MCP server. Not a tool-call path.
         const downstream = rel === "src/downstream.ts";
         const originalLines = text.split(/\r?\n/);

package/dist/reconcile-cli.js

@@ -1,6 +1,6 @@
 import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { loadApprovalsFromDir, loadEffectsFromDir, loadPolicy, parseCardCsv, parseChannelJsonl, reconcile } from "@verax-ai/proxy";
+import { loadApprovalsFromDir, loadDecisionRefsFromDir, loadEffectsFromDir, loadPolicy, parseCardCsv, parseChannelJsonl, reconcile, } from "@verax-ai/proxy";
 const SNAPSHOT_NAME = /^[0-9a-f]{64}\.json$/;
 function descriptorsFromDoc(doc) {
     const out = {};
@@ -229,11 +229,13 @@ export function runReconcile(argv, writeErr = (s) => process.stderr.write(s)) {
             : undefined;
         const channel = card ?? parseChannelJsonl(raw);
         const effects = loadEffectsFromDir(parsed.stateDir);
+        const decisionRefs = loadDecisionRefsFromDir(parsed.stateDir);
         const loaded = parsed.channel === "card" ? loadDescriptorsFromDir(parsed.stateDir) : undefined;
         const descriptorsByPayee = loaded?.descriptorsByPayee;
         const report = reconcile(channel, effects, {
             toleranceMs: parsed.toleranceMs,
             window: parsed.window,
+            decisionRefs,
             approvals: parsed.channel === "card" ? loadApprovalsFromDir(parsed.stateDir) : undefined,
             skipped: card?.skipped,
             ...(descriptorsByPayee && Object.keys(descriptorsByPayee).length > 0

package/dist/server.d.ts

@@ -1,5 +1,5 @@
 import { type Server } from "node:http";
-import type { BodyConfig } from "./config.ts";
+import { type BodyConfig } from "./config.ts";
 import { TOOL_NAMES } from "./wiring.ts";
 export declare const TOOL_META: ({
     name: string;
@@ -184,5 +184,18 @@ export declare const TOOL_META: ({
         required: string[];
     };
 })[];
+/** `malformed` falls through so `Host: [` stays the existing bad-request. */
+export declare function loopbackHostDecision(hostHeader: string | undefined, bindPort: number): "allow" | "deny" | "malformed";
+/**
+ * Second look at a bearer that already verified. The first look runs before
+ * the body is read; this one runs after the body and before dispatch or
+ * approval. `exp` is seconds since the epoch. A passed `exp` is dead even
+ * inside the verifier's clock tolerance: that tolerance applied at the door,
+ * and the body has since arrived. A missing `exp` is dead too.
+ */
+export declare function bearerStillLive(payload: {
+    jti?: unknown;
+    exp?: unknown;
+}, stateDir: string): boolean;
 export declare function listen(config: BodyConfig): Promise<Server>;
 export { TOOL_NAMES };

package/dist/server.js

@@ -4,6 +4,7 @@ import { createServer } from "node:http";
 import { Server as McpServer } from "@modelcontextprotocol/sdk/server/index.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { isLoopbackHost } from "./config.js";
 import { approvalsLogFor, approvePending, createApprovalBudgetGuard, explain, LedgerDenyUnrecorded, loadApprovalsFromDir, } from "@verax-ai/proxy";
 import { createVerifier, readBearer, resourceMetadataUrl, wwwAuthenticate } from "./auth.js";
 import { bumpMetric, bumpUnauthenticated } from "./metrics.js";
@@ -11,7 +12,7 @@ import { isRevokedJti } from "./revoke.js";
 import { loadOrCreateSigners } from "./keys.js";
 import { matchingInputs } from "./inputs-read.js";
 import { readPolicySnapshots } from "./policy-store.js";
-import { readHeartbeat, readWitnessPulse } from "./health-extras.js";
+import { readHeartbeat, readInstallHealthNonce, readWitnessPulse } from "./health-extras.js";
 import { agentsWindow } from "./agents.js";
 import { inventoryHealth, readInventoryFile } from "./inventory-file.js";
 import { createBodyServices, TOOL_NAMES } from "./wiring.js";
@@ -170,10 +171,48 @@ export const TOOL_META = [
     },
 ];
 const MAX_BODY_BYTES = 1024 * 1024;
+// Node's default requestTimeout is 300s. A stalled body would otherwise stay
+// authorised until that default. Headers are bounded tighter than the body.
+const REQUEST_TIMEOUT_MS = 30_000;
+const HEADERS_TIMEOUT_MS = 20_000;
 // Unbounded GET /api/ledger stringified ~690 MB at 200k rows and threw Invalid string length (HTTP 500).
 const DEFAULT_LEDGER_LIMIT = 1000;
 const MAX_LEDGER_LIMIT = 5000;
 const responseSlot = new AsyncLocalStorage();
+/** `malformed` falls through so `Host: [` stays the existing bad-request. */
+export function loopbackHostDecision(hostHeader, bindPort) {
+    if (hostHeader === undefined || hostHeader.trim() === "")
+        return "deny";
+    const raw = hostHeader.trim();
+    if (raw.startsWith("[") && !raw.includes("]"))
+        return "malformed";
+    let name = raw;
+    let port;
+    if (raw.startsWith("[")) {
+        const end = raw.indexOf("]");
+        name = raw.slice(1, end);
+        const rest = raw.slice(end + 1);
+        if (rest === "")
+            port = undefined;
+        else if (/^:[0-9]+$/.test(rest))
+            port = Number(rest.slice(1));
+        else
+            return "deny";
+    }
+    else {
+        const colon = raw.lastIndexOf(":");
+        if (colon > 0 && /^[0-9]+$/.test(raw.slice(colon + 1))) {
+            name = raw.slice(0, colon);
+            port = Number(raw.slice(colon + 1));
+        }
+    }
+    const lowered = name.toLowerCase();
+    if (lowered !== "127.0.0.1" && lowered !== "localhost" && lowered !== "::1")
+        return "deny";
+    if (port === undefined)
+        return bindPort === 80 ? "allow" : "deny";
+    return port === bindPort ? "allow" : "deny";
+}
 function contentLengthOverLimit(req) {
     const raw = req.headers["content-length"];
     if (raw === undefined)
@@ -209,6 +248,21 @@ async function readJsonBody(req, max) {
         return { ok: false, bad: true };
     }
 }
+/**
+ * Second look at a bearer that already verified. The first look runs before
+ * the body is read; this one runs after the body and before dispatch or
+ * approval. `exp` is seconds since the epoch. A passed `exp` is dead even
+ * inside the verifier's clock tolerance: that tolerance applied at the door,
+ * and the body has since arrived. A missing `exp` is dead too.
+ */
+export function bearerStillLive(payload, stateDir) {
+    const jti = typeof payload.jti === "string" ? payload.jti : "";
+    if (jti === "" || isRevokedJti(stateDir, jti))
+        return false;
+    if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp))
+        return false;
+    return payload.exp * 1000 > Date.now();
+}
 function isProtectedResourcePath(pathname, audience) {
     const want = new URL(resourceMetadataUrl(audience)).pathname;
     return pathname === want || pathname === "/.well-known/oauth-protected-resource";
@@ -308,7 +362,7 @@ export async function listen(config) {
         throw err;
     }
     const toolMeta = [...TOOL_META, ...extraTools.map(downstreamMeta)];
-    const verify = createVerifier(config.jwksUrl, config.issuer, config.audience, config.jwksFile);
+    const verify = createVerifier(config.jwksUrl, config.issuer, config.audience, config.jwksFile, config.jwksPin);
     const attachHandlers = (mcp) => {
         mcp.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: toolMeta }));
         mcp.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
@@ -340,6 +394,25 @@ export async function listen(config) {
     };
     const server = createServer(async (req, res) => {
         try {
+            if (isLoopbackHost(config.bindHost)) {
+                const hostHeader = Array.isArray(req.headers.host) ? req.headers.host[0] : req.headers.host;
+                const listenPort = server.address().port;
+                const hostDecision = loopbackHostDecision(hostHeader, listenPort);
+                if (hostDecision === "deny") {
+                    send(res, 400, { error: "host-not-allowed" });
+                    req.resume();
+                    return;
+                }
+            }
+            if (req.headers.origin !== undefined) {
+                const origin = Array.isArray(req.headers.origin) ? (req.headers.origin[0] ?? "") : req.headers.origin;
+                const allowed = config.allowedOrigins ?? [];
+                if (!allowed.includes(origin)) {
+                    send(res, 403, { error: "origin-not-allowed" });
+                    req.resume();
+                    return;
+                }
+            }
             const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "127.0.0.1"}`);
             if (req.method === "POST" && contentLengthOverLimit(req)) {
                 send(res, 413, { error: "payload-too-large" });
@@ -347,6 +420,14 @@ export async function listen(config) {
                 return;
             }
             if (req.method === "GET" && url.pathname === "/healthz") {
+                // Local mode reads VERAX_JWKS_FILE. Any process that can read that key
+                // file can mint verax:audit, so counts are not a door here: liveness only.
+                const installNonce = readInstallHealthNonce(config.stateDir);
+                const nonceField = installNonce === null ? {} : { nonce: installNonce };
+                if (config.jwksFile) {
+                    send(res, 200, { ok: true, ...nonceField });
+                    return;
+                }
                 const token = readBearer(req.headers.authorization);
                 let canRead = false;
                 if (token) {
@@ -367,7 +448,7 @@ export async function listen(config) {
                     }
                 }
                 if (!canRead) {
-                    send(res, 200, { ok: true });
+                    send(res, 200, { ok: true, ...nonceField });
                     return;
                 }
                 // The ledger counts its own lines as it writes them; asking it is free.
@@ -389,6 +470,7 @@ export async function listen(config) {
                 }
                 send(res, 200, {
                     ok: true,
+                    ...nonceField,
                     ...counted,
                     lock: services.ledger.lockStatus(),
                     heartbeat: readHeartbeat(config.stateDir),
@@ -446,6 +528,21 @@ export async function listen(config) {
                 send(res, 401, { error: "unauthorized" }, { "www-authenticate": wwwAuthenticate(config.audience) });
                 return;
             }
+            const refuseStaleBearer = async () => {
+                if (bearerStillLive(verified.payload, config.stateDir))
+                    return false;
+                await bumpUnauthenticated(config.stateDir);
+                send(res, 401, { error: "unauthorized" }, { "www-authenticate": wwwAuthenticate(config.audience) });
+                return true;
+            };
+            // Local mode: any process that can read the key file can mint
+            // verax:approve or verax:audit, so those scopes are not honoured at all.
+            // Nothing is written; the refusal is the whole answer.
+            if (config.jwksFile &&
+                (verified.principal.scopes.has("verax:approve") || verified.principal.scopes.has("verax:audit"))) {
+                send(res, 403, { error: "local-mode-operator-scope" });
+                return;
+            }
             try {
                 if (apiApprove) {
                     // Reading the ledger is not approving from it. The audit scope opens
@@ -456,6 +553,8 @@ export async function listen(config) {
                         return;
                     }
                     const parsed = await readJsonBody(req, MAX_BODY_BYTES);
+                    if (await refuseStaleBearer())
+                        return;
                     if (!parsed.ok) {
                         send(res, 400, { error: "bad-body" });
                         return;
@@ -504,9 +603,14 @@ export async function listen(config) {
                             policy: services.policy,
                             approvals,
                             now: () => Date.now(),
+                            ledger: services.ledger,
                         }),
                     });
                     if (!outcome.ok) {
+                        if (outcome.reason === "halted") {
+                            send(res, 409, { error: "approve-halted" });
+                            return;
+                        }
                         const code = outcome.reason === "unknown-ref" || outcome.reason === "snapshot-missing" ? 404 : 409;
                         send(res, code, {
                             error: outcome.reason,
@@ -518,6 +622,8 @@ export async function listen(config) {
                     return;
                 }
                 if (apiLedger || apiInventory || contest || apiAgents) {
+                    if (await refuseStaleBearer())
+                        return;
                     // The audit doors hand out the whole ledger: every tenant's decisions, the
                     // inputs documents that name their principals, and the approval snapshots
                     // that carry spend arguments. `verax:read` is a brain scope, so it cannot be
@@ -612,6 +718,8 @@ export async function listen(config) {
                 });
                 await mcp.connect(transport);
                 const parsed = req.method === "POST" ? await readJsonBody(req, MAX_BODY_BYTES) : { ok: true, value: undefined };
+                if (await refuseStaleBearer())
+                    return;
                 if (parsed.ok === false && "tooLarge" in parsed) {
                     send(res, 413, { error: "payload-too-large" });
                     req.destroy();
@@ -696,6 +804,8 @@ export async function listen(config) {
             // Swallow so a bad Host cannot reject the request listener.
         }
     });
+    server.requestTimeout = REQUEST_TIMEOUT_MS;
+    server.headersTimeout = HEADERS_TIMEOUT_MS;
     await new Promise((resolve, reject) => {
         server.once("error", reject);
         server.listen(config.bindPort, config.bindHost, () => resolve());
@@ -704,6 +814,18 @@ export async function listen(config) {
         services.ledger.close();
         void closeAll(sessions);
     });
+    const bound = server.address();
+    if (!bound || typeof bound === "string") {
+        await new Promise((resolve) => server.close(() => resolve()));
+        throw new Error("listen-port");
+    }
+    try {
+        services.ledger.recordListenPort(bound.port);
+    }
+    catch (err) {
+        await new Promise((resolve) => server.close(() => resolve()));
+        throw err;
+    }
     return server;
 }
 export { TOOL_NAMES };

package/dist/tools/audit.d.ts

@@ -1,2 +1,5 @@
-import { type ExplainOpts, type Ledger, type ToolCall, type ToolResult } from "@verax-ai/proxy";
-export declare function auditExplain(call: ToolCall, ledger: Ledger, opts?: ExplainOpts): Promise<ToolResult>;
+import { type ExplainOpts, type Ledger, type Principal, type ToolCall, type ToolResult } from "@verax-ai/proxy";
+export declare function auditExplain(call: ToolCall, ledger: Ledger, opts?: ExplainOpts, caller?: {
+    principal: Principal;
+    stateDir: string;
+}): Promise<ToolResult>;

package/dist/tools/audit.js

@@ -1,5 +1,6 @@
-import { explain, spokenReason, } from "@verax-ai/proxy";
-export async function auditExplain(call, ledger, opts) {
+import { explain, spokenReason, tenantKey, } from "@verax-ai/proxy";
+import { inputsPrincipal } from "../inputs-read.js";
+export async function auditExplain(call, ledger, opts, caller) {
     const ref = call.arguments.ref;
     if (typeof ref !== "string" || ref === "") {
         return {
@@ -7,6 +8,15 @@ export async function auditExplain(call, ledger, opts) {
             isError: true,
         };
     }
+    if (caller) {
+        const owner = await inputsPrincipal(caller.stateDir, ref);
+        if (owner !== null && tenantKey(owner) !== tenantKey(caller.principal)) {
+            return {
+                content: [{ type: "text", text: JSON.stringify({ error: spokenReason("tenant-mismatch") }) }],
+                isError: true,
+            };
+        }
+    }
     let result;
     try {
         result = await explain(ledger, ref, opts);

package/dist/tools/memory.js

@@ -1,13 +1,27 @@
 import { createHash } from "node:crypto";
 import { existsSync, readdirSync } from "node:fs";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
 import { resolve, sep } from "node:path";
 import { canonical } from "@cedulon/core";
 import { tenantKey } from "@verax-ai/proxy";
+import { memoryQuotaBytes } from "../config.js";
 function sha256Canonical(value) {
     return createHash("sha256").update(canonical(value), "utf8").digest("hex");
 }
 const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+/** One in-process chain per tenant memory directory. The body is one process per state dir. */
+const memoryQuotaChain = new Map();
+function withMemoryQuotaLock(key, fn) {
+    const previous = memoryQuotaChain.get(key) ?? Promise.resolve();
+    const run = previous.then(fn, fn);
+    const settled = run.then(() => undefined, () => undefined);
+    memoryQuotaChain.set(key, settled);
+    void settled.then(() => {
+        if (memoryQuotaChain.get(key) === settled)
+            memoryQuotaChain.delete(key);
+    });
+    return run;
+}
 function jsonResult(value, isError = false) {
     return {
         content: [{ type: "text", text: JSON.stringify(value) }],
@@ -135,10 +149,31 @@ export async function memoryPut(call, stateDir, principal) {
         versionHash,
     };
     const dir = resolve(stateDir, "tenants", tenantKey(principal), "memory");
-    await mkdir(dir, { recursive: true, mode: 0o700 });
-    await writeFile(path, `${JSON.stringify(rec)}\n`, {
-        encoding: "utf8",
-        mode: 0o600,
+    const payload = `${JSON.stringify(rec)}\n`;
+    return withMemoryQuotaLock(dir, async () => {
+        let used = 0;
+        try {
+            for (const name of await readdir(dir)) {
+                const file = resolve(dir, name);
+                if (file === path)
+                    continue;
+                const info = await stat(file);
+                if (info.isFile())
+                    used += info.size;
+            }
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        if (used + Buffer.byteLength(payload) > memoryQuotaBytes()) {
+            return jsonResult({ error: "memory-quota" }, true);
+        }
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        await writeFile(path, payload, {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+        return jsonResult({ ok: true, id, versionHash });
     });
-    return jsonResult({ ok: true, id, versionHash });
 }

package/dist/tools/message.js

@@ -1,7 +1,21 @@
-import { appendFileSync, mkdirSync } from "node:fs";
+import { appendFileSync, mkdirSync, statSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { tenantKey } from "@verax-ai/proxy";
+import { messageQuotaBytes } from "../config.js";
+/** One in-process chain per tenant directory. The body is one process per state dir. */
+const messageQuotaChain = new Map();
+function withMessageQuotaLock(key, fn) {
+    const previous = messageQuotaChain.get(key) ?? Promise.resolve();
+    const run = previous.then(fn, fn);
+    const settled = run.then(() => undefined, () => undefined);
+    messageQuotaChain.set(key, settled);
+    void settled.then(() => {
+        if (messageQuotaChain.get(key) === settled)
+            messageQuotaChain.delete(key);
+    });
+    return run;
+}
 function tenantDir(stateDir, principal) {
     return join(stateDir, "tenants", tenantKey(principal));
 }
@@ -32,13 +46,28 @@ export async function messageSend(call, stateDir, ref, principal) {
         ref,
     };
     const dir = tenantDir(stateDir, principal);
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    appendFileSync(join(dir, "outbox.jsonl"), `${JSON.stringify(row)}\n`, {
-        encoding: "utf8",
-        mode: 0o600,
+    const file = join(dir, "outbox.jsonl");
+    const payload = `${JSON.stringify(row)}\n`;
+    return withMessageQuotaLock(dir, async () => {
+        let used = 0;
+        try {
+            used = statSync(file).size;
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        if (used + Buffer.byteLength(payload) > messageQuotaBytes()) {
+            return {
+                content: [{ type: "text", text: JSON.stringify({ error: "message-quota" }) }],
+                isError: true,
+            };
+        }
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        appendFileSync(file, payload, { encoding: "utf8", mode: 0o600 });
+        return {
+            content: [{ type: "text", text: JSON.stringify({ queued: true, ref }) }],
+            isError: false,
+        };
     });
-    return {
-        content: [{ type: "text", text: JSON.stringify({ queued: true, ref }) }],
-        isError: false,
-    };
 }

package/dist/unlock.d.ts

@@ -1,8 +1,11 @@
 export declare function pidAlive(pid: number): boolean;
-export declare function readLockFile(path: string): {
+export type LockRecord = {
     pid: number;
     startedAt: number;
-} | null;
+    port?: number;
+};
+/** A lock from before the body recorded its port has no `port`. That is still a lock. */
+export declare function readLockFile(path: string): LockRecord | null;
 export declare function runUnlock(stateDir: string, writeErr?: (s: string) => void, options?: {
     force?: boolean;
     unlink?: (path: string) => void;

package/dist/unlock.js

@@ -12,12 +12,17 @@ export function pidAlive(pid) {
         return err.code === "EPERM";
     }
 }
+/** A lock from before the body recorded its port has no `port`. That is still a lock. */
 export function readLockFile(path) {
     try {
         const raw = JSON.parse(readFileSync(path, "utf8"));
         if (typeof raw.pid !== "number" || typeof raw.startedAt !== "number")
             return null;
-        return { pid: raw.pid, startedAt: raw.startedAt };
+        const record = { pid: raw.pid, startedAt: raw.startedAt };
+        if (typeof raw.port === "number" && Number.isInteger(raw.port) && raw.port > 0 && raw.port < 65536) {
+            record.port = raw.port;
+        }
+        return record;
     }
     catch {
         return null;