@zackbart/connecta 0.40.0 → 0.42.0

package/dist/module-contracts.d.ts

@@ -1,5 +1,5 @@
 import type { ConnectaBranding } from "./types.js";
-import type { ActivityStore, ActivityReadGate, recordToolActivity, recordCatalogChangeActivity } from "./activity.js";
+import type { ActivityStore, ActivityReadGate, recordToolActivity, recordCatalogChangeActivity, recordOperationActivity } from "./activity.js";
 import type { RouteContext } from "./routes/shared.js";
 /** Construction-time UI contract. Core never imports the implementation. */
 export interface OperatorSurface {
@@ -10,6 +10,8 @@ export interface OperatorSurface {
 }
 /** Optional recording and reading callbacks supplied by /activity. */
 export interface ActivityModule {
+    readonly operations?: boolean;
+    readonly recordOperation?: typeof recordOperationActivity;
     readonly store: ActivityStore;
     readonly deploymentId?: string;
     readonly readGate?: ActivityReadGate;

package/dist/native-recovery.js

@@ -20,11 +20,14 @@ export function nativeRecovery(result, wireName) {
             : { operator: "Check connector authentication in deployment configuration." };
     }
     else if (action?.tool === "call_tool" || action?.tool === "call_destructive_tool") {
+        const purpose = error.code === "destructive_tool_requires_approval"
+            ? "Nothing was sent. Refresh the host's tool list, then call this tool only if the write is still wanted; the host asks for approval."
+            : (action.purpose ?? "Retry the original native call.");
         error.nextAction = wireName
             ? {
                 tool: wireName,
                 arguments: action.arguments?.args ?? {},
-                purpose: `${action.purpose ?? "Retry the original native call."}${action.arguments?.argsRedacted ? " Resend the original arguments; sensitive fields were omitted." : ""}`,
+                purpose: `${purpose}${action.arguments?.argsRedacted ? " Resend the original arguments; sensitive fields were omitted." : ""}`,
             }
             : { host: "search", purpose: action.purpose };
     }

package/dist/native-tools.js

@@ -1,3 +1,4 @@
+import { resolvedConnectorGuides } from "./skills.js";
 import { bytesToHex } from "./bytes.js";
 import { routeNames } from "./agent-routes.js";
 import { duringViewEffect } from "./runtime/call.js";
@@ -11,6 +12,7 @@ import { withAuthorizationHandoff } from "./authorization-handoff.js";
 import { classifyCallError } from "./errors.js";
 import { nativeRecovery } from "./native-recovery.js";
 import { CatalogService } from "./catalog-service.js";
+import { catalogStaleness } from "./catalog-freshness.js";
 import { jsonResult } from "./meta-tools.js";
 import { failureRecord, logFailure } from "./operator-record.js";
 /**
@@ -23,8 +25,19 @@ export const NATIVE_NAME_MAX = 48;
 const MAX_NATIVE_TOOLS = 1_000;
 /** Native `tools/list` cache hint. Shorter than the meta surface's hour: the list follows downstream catalogs. */
 export const NATIVE_TOOLS_LIST_TTL_MS = 300_000;
+/** The hint when a listing omits a connector or lists one stale: about when that connector is next asked. */
+export const NATIVE_DEGRADED_TOOLS_LIST_TTL_MS = 60_000;
 const HASH_CHARS = 6;
 const SEPARATOR = "__";
+/**
+ * What every write's name carries. It sits before the tool, because Eve displays
+ * a name's last `__` segment and a suffix there would show every write as "write".
+ */
+const WRITE_SEGMENT = `${SEPARATOR}WRITE${SEPARATOR}`;
+/** How every hashed read ends, and so what no write's name may end in. See {@link nativeToolName}. */
+const READ_HASH_TAIL = /_[0-9a-f]{6}$/;
+/** A hashed write keeps this much of its connector, leaving the rest of the budget to its tool. */
+const WRITE_CONNECTOR_HEAD = 24;
 /** No `__`, no leading `_`: the last `__` of a plain name is then always its separator. */
 const PLAIN_TOOL = /^[A-Za-z0-9-](?:[A-Za-z0-9-]|_(?!_))*$/;
 const NATIVE_NAME = new RegExp(`^[A-Za-z][A-Za-z0-9_-]{0,${NATIVE_NAME_MAX - 1}}$`);
@@ -48,28 +61,82 @@ const shortHashNative = /* @__PURE__ */ registerAuth(shortHash, function (text)
 function connectorPart(connectorId) {
     return /^[a-z]/.test(connectorId) ? connectorId : `C${connectorId}`;
 }
+/** The classification a wire name is bound to. A name never changes what it is bound to. */
+function boundClassification(name) {
+    return name.includes(WRITE_SEGMENT) && !READ_HASH_TAIL.test(name) ? "write" : "read";
+}
 /**
- * A pure function of the connector id and downstream tool name, so it is
- * stable across catalog refreshes: `<connector>__<tool>` when that is exact,
- * legal and short, otherwise its head plus a six-hex SHA-256 suffix of the
- * original pair.
+ * A pure function of the connector id, downstream tool name and classification,
+ * so it is stable across catalog refreshes until the classification changes. A
+ * read is `<connector>__<tool>` when that is exact, legal and short, otherwise its
+ * head plus `_` and a six-hex SHA-256 of the original pair. A write is
+ * `<connector>__WRITE__<tool>` under the same conditions and when that does not end
+ * like a hashed read, otherwise a connector head, the marker, a tool head, `_w` and
+ * the same hash.
+ *
+ * No read's name is ever a write's, including a name a host cached before writes
+ * had their own, because a read's name has not changed. A read can carry the marker
+ * only when hashed: connector ids have no uppercase, so `WRITE` and the `__` after
+ * it would fall inside the tool, and a plain tool has no `__`. Every hashed read
+ * ends in `_` and six hex digits. Every write carries the marker and never ends so.
  */
-export function nativeToolName(connectorId, toolName) {
-    return runEdge(nativeToolNameNative(connectorId, toolName));
+export function nativeToolName(connectorId, toolName, classification) {
+    return runEdge(nativeToolNameNative(connectorId, toolName, classification));
 }
-const nativeToolNameNative = /* @__PURE__ */ registerAuth(nativeToolName, function (connectorId, toolName) {
+const nativeToolNameNative = /* @__PURE__ */ registerAuth(nativeToolName, function (connectorId, toolName, classification) {
     return authFlow(function* () {
+        const connector = connectorPart(connectorId);
         const tool = toolName.replace(/[^A-Za-z0-9_-]/g, "_");
-        const plain = `${connectorPart(connectorId)}${SEPARATOR}${tool}`;
-        if (tool === toolName && PLAIN_TOOL.test(tool) && plain.length <= NATIVE_NAME_MAX)
+        const write = classification === "write";
+        const plain = `${connector}${write ? WRITE_SEGMENT : SEPARATOR}${tool}`;
+        if (tool === toolName &&
+            PLAIN_TOOL.test(tool) &&
+            plain.length <= NATIVE_NAME_MAX &&
+            !(write && READ_HASH_TAIL.test(plain)))
             return plain;
-        const head = plain.slice(0, NATIVE_NAME_MAX - HASH_CHARS - 1).replace(/_+$/, "");
-        return `${head}_${yield* upwardStep(authCall(shortHash, [`${connectorId}.${toolName}`]))}`;
+        const hash = yield* upwardStep(authCall(shortHash, [`${connectorId}.${toolName}`]));
+        if (write) {
+            const owner = connector.slice(0, WRITE_CONNECTOR_HEAD);
+            const suffix = `_w${hash}`;
+            const room = NATIVE_NAME_MAX - suffix.length - owner.length - WRITE_SEGMENT.length;
+            return `${owner}${WRITE_SEGMENT}${tool.slice(0, room).replace(/_+$/, "")}${suffix}`;
+        }
+        return `${plain.slice(0, NATIVE_NAME_MAX - HASH_CHARS - 1).replace(/_+$/, "")}_${hash}`;
     });
 });
-/** Read or write, from the served classification only. */
-function annotationsFor(tool) {
-    return tool.classification === "read"
+/**
+ * Whether any tool of a connector could hold a name: every shape in
+ * {@link nativeToolName}, including truncated connector prefixes.
+ */
+function couldClaim(connector, name) {
+    const part = connectorPart(connector.id);
+    const prefix = `${part}${SEPARATOR}`;
+    // A hashed name can truncate even the connector prefix, and strips trailing
+    // underscores from its head. Such a name is exactly `${head}_` + six hex digits.
+    const head = prefix.slice(0, NATIVE_NAME_MAX - HASH_CHARS - 1).replace(/_+$/, "");
+    return (name.startsWith(prefix) ||
+        // A hashed write keeps only the head of a long connector id.
+        name.startsWith(`${part.slice(0, WRITE_CONNECTOR_HEAD)}${WRITE_SEGMENT}`) ||
+        (name.length === head.length + 1 + HASH_CHARS &&
+            name.startsWith(`${head}_`) &&
+            /^[0-9a-f]+$/.test(name.slice(-HASH_CHARS))));
+}
+/**
+ * The name recovery should give: what the refusing verdict selects, because a
+ * catalog can change between resolving a name and invoking it.
+ */
+function recoveryName(result, called, names) {
+    const error = result?.structuredContent?.error;
+    const route = error?.code === "destructive_tool_requires_approval" ? "call_destructive_tool" : error?.nextAction?.tool;
+    return route === "call_destructive_tool" ? names.write : route === "call_tool" ? names.read : called;
+}
+/**
+ * Read or write, from the served classification only. A stale listing cannot
+ * vouch for a read: the connector may have reclassified the tool since, so it
+ * fails closed (INV-1). The call's own verdict comes from a live catalog.
+ */
+function annotationsFor(tool, stale) {
+    return tool.classification === "read" && !stale
         ? { readOnlyHint: true, destructiveHint: false, openWorldHint: true }
         : { readOnlyHint: false, destructiveHint: true, openWorldHint: true };
 }
@@ -129,10 +196,12 @@ function passThroughSchema(schema) {
         },
     };
 }
-function describe(entry, executeCode) {
+function describe(entry, executeCode, guideName) {
     const lines = [entry.tool.description?.trim() || entry.tool.title || entry.tool.name];
     if (executeCode)
         lines.push(`Program address: ${entry.connector.id}.${entry.tool.name}`);
+    if (guideName)
+        lines.push(`Guide: skills ${guideName}`);
     return lines.join("\n\n");
 }
 export class NativeSurface {
@@ -157,10 +226,13 @@ export class NativeSurface {
     /**
      * Every listable native tool. A connector whose catalog fails is omitted
      * whole, never partially, with an operator warning; two tools claiming one
-     * name are both omitted and stay reachable by address in execute_code.
+     * name are both omitted and stay reachable by address in execute_code. A tool
+     * claims its read and write names alike, whichever it is now, so a collision
+     * does not come and go with a classification and a name cached under the other
+     * classification still finds its tool.
      */
-    claims(connectors = this.registry.listConnectors()) {
-        return runEdge(authOwnMethod(NativeSurface.prototype, this, "claims", [connectors]));
+    claims(connectors = this.registry.listConnectors(), allowStale = false) {
+        return runEdge(authOwnMethod(NativeSurface.prototype, this, "claims", [connectors, allowStale]));
     }
     list() {
         return runEdge(authOwnMethod(NativeSurface.prototype, this, "list", []));
@@ -173,20 +245,38 @@ export class NativeSurface {
     resolve(name) {
         return runEdge(authOwnMethod(NativeSurface.prototype, this, "resolve", [name]));
     }
-    /** A native call: the existing route its current verdict selects. */
+    /**
+     * A native call: the existing route the name is bound to, never one chosen from
+     * the current verdict. A read name takes the read route, which refuses a current
+     * write before dispatch, so a host's replay of a cached read cannot reach a write.
+     */
     call(name, args, request) {
         return runEdge(authOwnMethod(NativeSurface.prototype, this, "call", [name, args, request]));
     }
-    registerTool(server, name, entry) {
+    registerTool(server, name, entry, guideName) {
         server.registerTool(name, {
             ...(entry?.tool.title ? { title: entry.tool.title } : {}),
-            ...(entry ? { description: describe(entry, this.options.executeCode) } : {}),
+            ...(entry ? { description: describe(entry, this.options.executeCode, guideName) } : {}),
             inputSchema: passThroughSchema(entry?.tool.inputSchema),
-            ...(entry ? { annotations: annotationsFor(entry.tool) } : {}),
-            ...(entry ? { _meta: { "dev.connecta/address": `${entry.connector.id}.${entry.tool.name}` } } : {}),
+            ...(entry ? { annotations: annotationsFor(entry.tool, entry.stale !== undefined) } : {}),
+            ...(entry
+                ? {
+                    _meta: {
+                        "dev.connecta/address": `${entry.connector.id}.${entry.tool.name}`,
+                        ...(entry.stale
+                            ? {
+                                "dev.connecta/stale": {
+                                    code: entry.stale.code,
+                                    ageMs: entry.stale.ageMs,
+                                    ...(entry.stale.retryAfterMs === undefined ? {} : { retryAfterMs: entry.stale.retryAfterMs }),
+                                },
+                            }
+                            : {}),
+                    },
+                }
+                : {}),
         }, authMethod((args, request) => Effect.gen({ self: this }, function* () {
-            const result = yield* authInvoke(this, "call", [name, args ?? {}, request]);
-            return nativeRecovery(result, name);
+            return yield* authInvoke(this, "call", [name, args ?? {}, request]);
         })));
     }
     /**
@@ -220,8 +310,12 @@ export class NativeSurface {
                     });
                     return;
                 }
+                const guides = yield* upwardStep(authCall(resolvedConnectorGuides, [
+                    self.registry.listConnectors(),
+                ]));
+                const guideNames = new Map(guides.map(({ connector, reference }) => [connector.id, reference]));
                 for (const entry of tools)
-                    self.registerTool(server, entry.name, entry);
+                    self.registerTool(server, entry.name, entry, guideNames.get(entry.connector.id));
             })).pipe(Effect.provideService(RequestScope, requestOwner(this.options.requestScope)));
         }, NativeSurface.prototype.register);
         registerAuthMethod(NativeSurface.prototype, "call", function (name, args, request) {
@@ -259,14 +353,15 @@ export class NativeSurface {
                         error: yield* upwardStep(authCall(withAuthorizationHandoff, [self.options.requestScope, error])),
                     });
                     result.isError = true;
-                    return result;
+                    return nativeRecovery(result, name);
                 }
                 const address = `${target.entry.connector.id}.${target.entry.tool.name}`;
-                return yield* upwardStep(authInvoke(self.options, "route", [
-                    target.entry.tool.classification === "read" ? "call_tool" : "call_destructive_tool",
+                const result = yield* upwardStep(authInvoke(self.options, "route", [
+                    boundClassification(name) === "read" ? "call_tool" : "call_destructive_tool",
                     { address, args },
                     request,
                 ]));
+                return nativeRecovery(result, recoveryName(result, name, target.entry.names));
             })).pipe(Effect.provideService(RequestScope, requestOwner(this.options.requestScope)));
         }, NativeSurface.prototype.call);
         registerAuthMethod(NativeSurface.prototype, "resolve", function (name) {
@@ -275,19 +370,20 @@ export class NativeSurface {
                 requestScope: this.options.requestScope,
                 signal: this.options.requestSignal,
             }, () => authFlow(function* () {
-                const prefixed = self.registry.listConnectors().filter((connector) => {
-                    const prefix = `${connectorPart(connector.id)}${SEPARATOR}`;
-                    // A hashed name can truncate even the connector prefix, and strips
-                    // trailing underscores from its head. Include every possible claimant.
-                    const head = prefix.slice(0, NATIVE_NAME_MAX - HASH_CHARS - 1).replace(/_+$/, "");
-                    // A hashed name carries a stripped head only as exactly `${head}_` + six hex digits.
-                    return (name.startsWith(prefix) ||
-                        (name.length === head.length + 1 + HASH_CHARS &&
-                            name.startsWith(`${head}_`) &&
-                            /^[0-9a-f]+$/.test(name.slice(-HASH_CHARS))));
-                });
-                const { loaded, byName } = yield* upwardStep(authInvoke(self, "claims", [prefixed]));
-                const found = byName.get(name);
+                const possible = (...names) => self.registry.listConnectors().filter((connector) => names.some((held) => couldClaim(connector, held)));
+                const prefixed = possible(name);
+                let { loaded, byName } = yield* upwardStep(authInvoke(self, "claims", [prefixed]));
+                let found = byName.get(name);
+                if (found) {
+                    // A tool that loses either name loses both, as listing omits it, so the
+                    // other name's claimants decide this one too. One step is enough: only a
+                    // tool sharing one of these two names can take them from this tool.
+                    const every = possible(found.names.read, found.names.write);
+                    if (every.length > prefixed.length) {
+                        ({ loaded, byName } = yield* upwardStep(authInvoke(self, "claims", [every])));
+                        found = byName.get(name);
+                    }
+                }
                 if (found === null)
                     return { kind: "ambiguous" };
                 // An unavailable possible claimant cannot prove uniqueness.
@@ -303,8 +399,10 @@ export class NativeSurface {
                 requestScope: this.options.requestScope,
                 signal: this.options.requestSignal,
             }, () => authFlow(function* () {
-                const { loaded, byName } = yield* upwardStep(authInvoke(self, "claims", []));
+                const { loaded, byName } = yield* upwardStep(authInvoke(self, "claims", [undefined, true]));
                 for (const entry of loaded) {
+                    if ("tools" in entry && catalogStaleness(entry.tools))
+                        self.options.staleCatalogs.push(entry.connector.id);
                     // Validate the whole connector before registering any of its tools.
                     const tool = "tools" in entry
                         ? entry.tools.find((tool) => tool.inputSchema !== undefined && !nativeInputSchema(tool.inputSchema))
@@ -314,32 +412,56 @@ export class NativeSurface {
                     self.options.catalogErrors.push(entry.connector.id);
                     logFailure(self.options.logger, "native catalog unavailable", failureRecord({ connector: entry.connector.id, ...(tool ? { tool } : {}) }, "error" in entry ? entry.error : undefined));
                 }
-                return [...byName.values()].filter((entry) => entry !== null &&
+                if (self.options.catalogErrors.length || self.options.staleCatalogs.length)
+                    self.options.onDegradedListing?.();
+                return [...byName].flatMap(([name, entry]) => entry !== null &&
+                    entry.name === name &&
                     !self.options.catalogErrors.includes(entry.connector.id) &&
-                    (!(self.options.readOnly || entry.connector.readOnly) || entry.tool.classification === "read"));
+                    (!(self.options.readOnly || entry.connector.readOnly) || entry.tool.classification === "read")
+                    ? [entry]
+                    : []);
             })).pipe(Effect.provideService(RequestScope, requestOwner(this.options.requestScope)));
         }, NativeSurface.prototype.list);
-        registerAuthMethod(NativeSurface.prototype, "claims", function (connectors) {
+        registerAuthMethod(NativeSurface.prototype, "claims", function (connectors, allowStale = false) {
             const self = this;
             return duringViewEffect({
                 requestScope: this.options.requestScope,
                 signal: this.options.requestSignal,
             }, () => authFlow(function* () {
-                const loaded = yield* upwardStep(authInvoke(self.catalog, "listCatalogs", [true, connectors ?? self.registry.listConnectors()]));
-                const byName = new Map();
+                const loaded = yield* upwardStep(authInvoke(self.catalog, "listCatalogs", [true, connectors ?? self.registry.listConnectors(), allowStale]));
+                const claimed = [];
+                const claimants = new Map();
                 for (const entry of loaded) {
                     if (!("tools" in entry))
                         continue;
                     for (const tool of entry.tools) {
-                        const name = yield* upwardStep(authCall(nativeToolName, [entry.connector.id, tool.name]));
-                        if (byName.has(name)) {
-                            byName.set(name, null);
-                            logFailure(self.options.logger, "native name collision", failureRecord({ connector: entry.connector.id, tool }));
-                        }
-                        else
-                            byName.set(name, { name, connector: entry.connector, tool });
+                        const read = yield* upwardStep(authCall(nativeToolName, [entry.connector.id, tool.name, "read"]));
+                        const write = yield* upwardStep(authCall(nativeToolName, [entry.connector.id, tool.name, "write"]));
+                        const name = tool.classification === "read" ? read : write;
+                        const stale = catalogStaleness(entry.tools);
+                        claimed.push({
+                            names: [read, write],
+                            claim: {
+                                name,
+                                names: { read, write },
+                                connector: entry.connector,
+                                tool,
+                                ...(stale ? { stale } : {}),
+                            },
+                        });
+                        for (const held of [read, write])
+                            claimants.set(held, (claimants.get(held) ?? 0) + 1);
                     }
                 }
+                const byName = new Map();
+                for (const { names, claim } of claimed) {
+                    // A tool that loses either name loses both: it is omitted, not half listed.
+                    const collides = names.some((name) => claimants.get(name) > 1);
+                    if (collides)
+                        logFailure(self.options.logger, "native name collision", failureRecord({ connector: claim.connector.id, tool: claim.tool }));
+                    for (const name of names)
+                        byName.set(name, collides ? null : claim);
+                }
                 return { loaded, byName };
             })).pipe(Effect.provideService(RequestScope, requestOwner(this.options.requestScope)));
         }, NativeSurface.prototype.claims);

package/dist/node.d.ts

@@ -8,6 +8,13 @@ export interface ListenOptions {
     host?: string;
     /** Pre-auth buffer cap, independent of the authenticated MCP cap. Default 4 MiB. */
     maxBodyBytes?: number;
+    /**
+     * Cap on the body bytes all in-flight requests hold together, counted as
+     * each arrives and released when its response finishes or its client leaves.
+     * Past it a request is answered 503 with `Retry-After`. Default 64 MiB, or
+     * `maxBodyBytes` when larger. May not be below `maxBodyBytes`.
+     */
+    maxInFlightBodyBytes?: number;
     /**
      * Stop accepting connections on SIGTERM/SIGINT, let in-flight requests
      * finish, drain deferred work, then exit. Default true — Docker sends

package/dist/node.js

@@ -5,13 +5,40 @@ import { failureRecord, logFailure } from "./operator-record.js";
 import { configureGuardedTransport } from "./guarded-transport.js";
 import { createNodeGuardedTransport } from "./http/node-transport.js";
 import { CONFIG_DEFAULTS } from "./config-defaults.js";
+import { ConfigError } from "./config-schema.js";
 /** The adapter buffers before auth, bounded by the same default as the core. */
 const DEFAULT_MAX_BODY_BYTES = CONFIG_DEFAULTS.admission.requests.maxBodyBytes;
+/** Sixteen full default bodies; well above ordinary MCP traffic, whose bodies are small. */
+const DEFAULT_MAX_IN_FLIGHT_BODY_BYTES = 64 * 1024 * 1024;
 const BODY_TOO_LARGE = Symbol("body-too-large");
-async function toRequest(req, maxBodyBytes, signal) {
+const BODIES_AT_CAPACITY = Symbol("bodies-at-capacity");
+/** A name, IPv4 or bracketed IPv6 host with an optional port, and nothing else. */
+const REQUEST_HOST = /^(?:[a-z0-9._-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+/** `Host`, `X-Forwarded-Proto` or the request target is not a URL part; answered 400. */
+class InvalidRequestUrl extends Error {
+}
+/**
+ * The request's URL, read from values a client chooses. Each is checked on its
+ * own and the origin is parsed before the target joins it, so no value can move
+ * the boundary between authority, path and query for the routes behind it.
+ */
+function requestUrl(req) {
     const host = req.headers.host ?? "localhost";
     const proto = req.headers["x-forwarded-proto"] ?? "http";
-    const url = `${proto}://${host}${req.url ?? "/"}`;
+    // Origin-form only. Absolute-form and `*` have no path to route.
+    const target = req.url ?? "/";
+    if (!REQUEST_HOST.test(host) || typeof proto !== "string" || !/^https?$/i.test(proto) || !target.startsWith("/")) {
+        throw new InvalidRequestUrl();
+    }
+    try {
+        return `${new URL(`${proto}://${host}`).origin}${target}`;
+    }
+    catch {
+        throw new InvalidRequestUrl();
+    }
+}
+async function toRequest(req, maxBodyBytes, holdBodyBytes, signal) {
+    const url = requestUrl(req);
     const method = req.method ?? "GET";
     const headers = new Headers();
     for (const [key, value] of Object.entries(req.headers)) {
@@ -29,6 +56,8 @@ async function toRequest(req, maxBodyBytes, signal) {
             // rest of a body we have already decided to reject.
             if (size > maxBodyBytes)
                 return BODY_TOO_LARGE;
+            if (!holdBodyBytes(chunk.length))
+                return BODIES_AT_CAPACITY;
             chunks.push(chunk);
         }
         if (chunks.length)
@@ -64,6 +93,13 @@ export function listen(connecta, portOrOptions) {
     const opts = typeof portOrOptions === "number" ? { port: portOrOptions } : portOrOptions;
     configureGuardedTransport(createNodeGuardedTransport(opts.proxy));
     const maxBodyBytes = opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    const maxInFlightBodyBytes = opts.maxInFlightBodyBytes === undefined
+        ? Math.max(DEFAULT_MAX_IN_FLIGHT_BODY_BYTES, maxBodyBytes)
+        : opts.maxInFlightBodyBytes;
+    if (!Number.isSafeInteger(maxInFlightBodyBytes) || maxInFlightBodyBytes < 1 || maxInFlightBodyBytes < maxBodyBytes) {
+        throw new ConfigError("listen: maxInFlightBodyBytes must be a whole number of bytes, at least maxBodyBytes.");
+    }
+    let inFlightBodyBytes = 0;
     // Node has no ExecutionContext, so deferred work (activity sinks) would
     // otherwise be an untracked floating promise. Track it here and drain it on
     // shutdown so both runtimes behave the same.
@@ -78,6 +114,8 @@ export function listen(connecta, portOrOptions) {
     const activeResponses = new Map();
     let shuttingDown = false;
     const server = createServer((req, res) => {
+        // Before the body: a client's timer has been running through its upload too.
+        const requestArrivedAt = Date.now();
         awaitingRequest.delete(req.socket);
         const socket = req.socket;
         activeResponses.set(socket, (activeResponses.get(socket) ?? 0) + 1);
@@ -101,7 +139,19 @@ export function listen(connecta, portOrOptions) {
         res.once("close", finished);
         void (async () => {
             const controller = new AbortController();
+            let heldBodyBytes = 0;
+            let bodyBytesReleased = false;
+            // Pipeline teardown can wait forever on a response stream's cancel().
+            // Release on the HTTP lifecycle too, and forbid late upload reservations.
+            const releaseBodyBytes = () => {
+                if (bodyBytesReleased)
+                    return;
+                bodyBytesReleased = true;
+                inFlightBodyBytes -= heldBodyBytes;
+                heldBodyBytes = 0;
+            };
             const abortRequest = () => {
+                releaseBodyBytes();
                 if (!controller.signal.aborted) {
                     controller.abort(new Error("HTTP client disconnected."));
                 }
@@ -117,8 +167,28 @@ export function listen(connecta, portOrOptions) {
             req.once("aborted", abortRequest);
             req.once("close", abortIncompleteRequest);
             res.once("close", abortIncompleteResponse);
+            res.once("finish", releaseBodyBytes);
+            res.once("close", releaseBodyBytes);
+            // A queued pipelined response gets neither finish nor close when the
+            // socket goes away, and its completed upload's request is already closed.
+            socket.once("close", abortRequest);
+            const holdBodyBytes = (bytes) => {
+                if (bodyBytesReleased || inFlightBodyBytes + bytes > maxInFlightBodyBytes)
+                    return false;
+                inFlightBodyBytes += bytes;
+                heldBodyBytes += bytes;
+                return true;
+            };
             try {
-                const request = await toRequest(req, maxBodyBytes, controller.signal);
+                const request = await toRequest(req, maxBodyBytes, holdBodyBytes, controller.signal);
+                if (request === BODIES_AT_CAPACITY) {
+                    res.statusCode = 503;
+                    res.setHeader("Retry-After", "1");
+                    // Abandoned mid-body, like the 413 below.
+                    res.setHeader("Connection", "close");
+                    res.end("Service Unavailable");
+                    return;
+                }
                 if (request === BODY_TOO_LARGE) {
                     res.statusCode = 413;
                     // The request stream was abandoned mid-body, so this connection
@@ -128,10 +198,17 @@ export function listen(connecta, portOrOptions) {
                     res.end("Payload Too Large");
                     return;
                 }
-                const response = await connecta.fetch(request, undefined, ctx);
+                const response = await connecta.fetch(request, undefined, { ...ctx, requestArrivedAt });
                 await writeResponse(res, response);
             }
             catch (error) {
+                if (error instanceof InvalidRequestUrl) {
+                    res.statusCode = 400;
+                    // Refused before reading the body, so the connection cannot be reused.
+                    res.setHeader("Connection", "close");
+                    res.end("Bad Request");
+                    return;
+                }
                 // A client that deliberately went away can make either the request
                 // handler or response pipeline reject. The request's abort signal is
                 // the authoritative classification: there is no caller left to answer,
@@ -152,6 +229,10 @@ export function listen(connecta, portOrOptions) {
                 res.end("Internal Server Error");
             }
             finally {
+                releaseBodyBytes();
+                res.removeListener("finish", releaseBodyBytes);
+                res.removeListener("close", releaseBodyBytes);
+                socket.removeListener("close", abortRequest);
                 req.removeListener("aborted", abortRequest);
                 req.removeListener("close", abortIncompleteRequest);
                 res.removeListener("close", abortIncompleteResponse);