deepspace 0.15.0 → 0.16.0

package/dist/worker.d.ts

@@ -3027,29 +3027,40 @@ declare const UPLOAD_PART_BYTES: number;
  */
 declare const MAX_UPLOAD_PARTS: number;
 /**
- * Per-tier storage schedule, in bytes. Product semantics, not a deployment
- * dial — the one table both storage allocations admit against:
+ * The customer-visible storage schedule, in bytes, PER ACCOUNT — the total an
+ * owner's uploaded files may occupy across every app they own, not a budget
+ * each app gets separately. This is the number the billing page advertises.
  *
- *   - the repo store (Git packs + retained bundles + deploy assets), admitted
- *     by the app's Repo DO (`platform/deploy-worker/src/vc/storage-quota.ts`)
- *   - the app-files allocation, admitted by the shared files handler
- *     (`server/utils/scoped-r2-files.ts`)
+ * Admitted by the shared files handler (`server/utils/scoped-r2-files.ts`),
+ * which sums the owner's apps rather than the one being written to.
  *
- * Each allocation gets the full amount independently; they are different
- * buckets with different writers (docs/platform/r2-storage.md). The
- * customer-visible "storage" number is the app-files allocation — the repo
- * store is platform bookkeeping that degrades (drops rollback retention)
- * rather than surfacing here.
+ * It deliberately does NOT govern the repo store — see
+ * `REPO_STORE_LIMIT_BYTES` below, and docs/platform/r2-storage.md.
  */
-declare const APP_STORAGE_LIMIT_BYTES: {
+declare const ACCOUNT_STORAGE_LIMIT_BYTES: {
     readonly test: 0;
     readonly free: number;
     readonly starter: number;
     readonly premium: number;
     readonly admin: number;
 };
-/** The storage limit for a billing tier; unknown or missing tiers get free. */
+/** The account storage limit for a billing tier; unknown or missing tiers get free. */
 declare function storageLimitForTier(tier: string | null | undefined): number;
+/**
+ * The repo store's budget, per app, flat across every tier.
+ *
+ * Git packs, retained rollback bundles, and stored deploy assets are platform
+ * bookkeeping, not something a customer buys — so this is a working ceiling,
+ * not an entitlement, and it is deliberately small. An app that cannot fit its
+ * SOURCE plus a few rollback bundles in this has something in the wrong place:
+ * user uploads belong in the app-files allocation above, which is what the
+ * account schedule sizes.
+ *
+ * Being flat is the point. Tying it to the tier table meant every raise to the
+ * customer-facing number silently multiplied platform-side storage per app,
+ * and made a push depend on a billing lookup that could refuse it.
+ */
+declare const REPO_STORE_LIMIT_BYTES: number;
 /** The one storage-quota refusal sentence. `usedBytes` is net of any object
  *  the upload replaces, so an upsert is charged only for its growth. */
 declare function storageQuotaMessage(incomingBytes: number, usedBytes: number, limitBytes: number): string;
@@ -3131,15 +3142,26 @@ interface ScopedR2Config {
  * applies.
  */
 interface StorageAdmission {
-    /** The WHOLE allocation the quota governs — the app prefix, not the
-     *  (possibly deeper) scope prefix a request resolved to. */
+    /** This app's own prefix — the one the incoming write lands under. */
     prefix: string;
     /**
      * Resolve the owner's limit in bytes. `null` means the lookup failed;
-     * writes then fail closed (503) rather than admitting unmetered storage,
-     * mirroring the repo store's `StorageBillingUnavailableError`.
+     * writes then fail closed (503) rather than admitting unmetered storage.
      */
     limitBytes: () => Promise<number | null>;
+    /**
+     * The OTHER app prefixes this owner's storage spans, if any.
+     *
+     * The limit is per ACCOUNT, not per app: an owner's allocation is the total
+     * across everything they own, so admission has to see the siblings too. `[]`
+     * for an owner with one app, which is the common case and costs exactly what
+     * it did when this was a per-app limit.
+     *
+     * Returning `null` means the owner's apps could not be enumerated. Like a
+     * failed limit lookup that fails the write closed rather than admitting a
+     * write against an allocation we cannot measure.
+     */
+    siblingPrefixes?: () => Promise<string[] | null>;
 }
 interface ScopedR2Auth {
     userId: string | null;
@@ -5361,4 +5383,4 @@ interface AppLogsResponse {
 declare const APP_LOG_EVENT_KEYS: readonly ["id", "timestamp", "level", "eventType", "message", "source", "outcome", "request", "exception"];
 type AppLogEventKey = (typeof APP_LOG_EVENT_KEYS)[number];
 
-export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_LOG_EVENT_KEYS, APP_NAME_RULES, APP_STORAGE_LIMIT_BYTES, ASSET_NOT_FOUND_HANDLING_VALUES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMigrationIdsValidation, type AppNameResolution, type AppNameValidation, type AssetNotFoundHandling, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BROWSER_PROXY_ROUTES, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, CANONICAL_APP_IDENTITY_MIGRATION_ID, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CLIENT_LOG_MARKER, CONVERSATION_SCHEMAS, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientErrorKind, type ClientErrorReport, type ClientMessage, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIOptions, type DeepSpaceAIProvider, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, type DeepSpaceAgentProfile, DeepSpaceAgentProfileError, type DeepSpaceAgentProfileId, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAgentSupport, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DeepSpaceDocumentationRouteEnv, type DeepSpaceDocumentationRouteOptions, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, LOG_LEVELS, type LogLevel, MAX_APP_FILE_BYTES, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type ProxyRoute, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RELEASE_STAMP_PATH, REQUIRED_COMPATIBILITY_FLAGS, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, RESERVED_RUN_WORKER_FIRST, RESOURCE_ID_RE, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, RegistryClientError, type ResolvedColumn, type ResolvedDeepSpaceAgentModel, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, SDK_RUN_WORKER_FIRST, STRICT_APP_ID_RE, SYSTEM_COLLECTIONS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type ServerMessage, type SharedConnection, type StorageAdmission, type StoredRecord, type Summarizer, type SyncResult, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, UNDECLARED_ASSET_NOT_FOUND_HANDLING, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, WORKSPACE_SCHEMAS, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, clientBuild, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, formatBytes, getChat, getDeepSpaceAIModel, getGlobalDOSchemas, getGlobalDOType, getMessageType, getRolePermissions, handleAwarenessMessage, handleClientErrorReport, handleSyncMessage, hasContent, isAssetNotFoundHandling, isAutoProvision, isFilesVerbPath, isOwner, isPlatformReservedPath, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, lintSchema, listDeepSpaceAgentModels, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, noopPermissionContext, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readVarUint, readVarUint8Array, registerClientErrorRoute, registerDeepSpaceDocumentation, registryErrorJson, registryStub, resolveAppName, resolveColumn, resolveCompatibilityFlags, resolveDeepSpaceAgentModel, rowToData, runMigrations, serverBuild, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppMigrationIds, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema, writeVarUint, writeVarUint8Array };
+export { ACCOUNT_STORAGE_LIMIT_BYTES, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_LOG_EVENT_KEYS, APP_NAME_RULES, ASSET_NOT_FOUND_HANDLING_VALUES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMigrationIdsValidation, type AppNameResolution, type AppNameValidation, type AssetNotFoundHandling, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BROWSER_PROXY_ROUTES, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, CANONICAL_APP_IDENTITY_MIGRATION_ID, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CLIENT_LOG_MARKER, CONVERSATION_SCHEMAS, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientErrorKind, type ClientErrorReport, type ClientMessage, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIOptions, type DeepSpaceAIProvider, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, type DeepSpaceAgentProfile, DeepSpaceAgentProfileError, type DeepSpaceAgentProfileId, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAgentSupport, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DeepSpaceDocumentationRouteEnv, type DeepSpaceDocumentationRouteOptions, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, LOG_LEVELS, type LogLevel, MAX_APP_FILE_BYTES, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type ProxyRoute, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RELEASE_STAMP_PATH, REPO_STORE_LIMIT_BYTES, REQUIRED_COMPATIBILITY_FLAGS, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, RESERVED_RUN_WORKER_FIRST, RESOURCE_ID_RE, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, RegistryClientError, type ResolvedColumn, type ResolvedDeepSpaceAgentModel, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, SDK_RUN_WORKER_FIRST, STRICT_APP_ID_RE, SYSTEM_COLLECTIONS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type ServerMessage, type SharedConnection, type StorageAdmission, type StoredRecord, type Summarizer, type SyncResult, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, UNDECLARED_ASSET_NOT_FOUND_HANDLING, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, WORKSPACE_SCHEMAS, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, clientBuild, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, formatBytes, getChat, getDeepSpaceAIModel, getGlobalDOSchemas, getGlobalDOType, getMessageType, getRolePermissions, handleAwarenessMessage, handleClientErrorReport, handleSyncMessage, hasContent, isAssetNotFoundHandling, isAutoProvision, isFilesVerbPath, isOwner, isPlatformReservedPath, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, lintSchema, listDeepSpaceAgentModels, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, noopPermissionContext, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readVarUint, readVarUint8Array, registerClientErrorRoute, registerDeepSpaceDocumentation, registryErrorJson, registryStub, resolveAppName, resolveColumn, resolveCompatibilityFlags, resolveDeepSpaceAgentModel, rowToData, runMigrations, serverBuild, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppMigrationIds, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema, writeVarUint, writeVarUint8Array };

package/dist/worker.js

@@ -6317,19 +6317,21 @@ var MAX_UPLOAD_REQUEST_BYTES = 25 * 1024 * 1024;
 var UPLOAD_PART_BYTES = 20 * 1024 * 1024;
 var MAX_UPLOAD_PARTS = Math.ceil(MAX_APP_FILE_BYTES / UPLOAD_PART_BYTES);
 var MAX_BASE64_UPLOAD_BYTES = Math.floor(MAX_UPLOAD_REQUEST_BYTES * 3 / 4);
-var APP_STORAGE_LIMIT_BYTES = {
+var GIB = 1024 * 1024 * 1024;
+var ACCOUNT_STORAGE_LIMIT_BYTES = {
   test: 0,
-  free: 128 * 1024 * 1024,
-  starter: 512 * 1024 * 1024,
-  premium: 2 * 1024 * 1024 * 1024,
-  admin: 10 * 1024 * 1024 * 1024
+  free: 1 * GIB,
+  starter: 10 * GIB,
+  premium: 30 * GIB,
+  admin: 100 * GIB
 };
 function storageLimitForTier(tier) {
-  if (tier && Object.hasOwn(APP_STORAGE_LIMIT_BYTES, tier)) {
-    return APP_STORAGE_LIMIT_BYTES[tier];
+  if (tier && Object.hasOwn(ACCOUNT_STORAGE_LIMIT_BYTES, tier)) {
+    return ACCOUNT_STORAGE_LIMIT_BYTES[tier];
   }
-  return APP_STORAGE_LIMIT_BYTES.free;
+  return ACCOUNT_STORAGE_LIMIT_BYTES.free;
 }
+var REPO_STORE_LIMIT_BYTES = 256 * 1024 * 1024;
 function storageQuotaMessage(incomingBytes, usedBytes, limitBytes) {
   const free = Math.max(0, limitBytes - usedBytes);
   return `This upload needs ${formatBytes(incomingBytes)} but the app's file storage has ${formatBytes(free)} free (${formatBytes(usedBytes)} of ${formatBytes(limitBytes)} used). Delete files with \`deepspace app files rm <key>\`, or upgrade the owner's plan.`;
@@ -6420,7 +6422,7 @@ function declaredLength(request, what) {
 function isKeyWithinPrefix(key, prefix) {
   return key.startsWith(prefix);
 }
-async function allocationUsage(bucket, prefix) {
+async function prefixUsage(bucket, prefix) {
   let total = 0;
   let cursor;
   do {
@@ -6430,6 +6432,13 @@ async function allocationUsage(bucket, prefix) {
   } while (cursor !== void 0);
   return total;
 }
+async function allocationUsage(bucket, storage) {
+  const siblings = storage.siblingPrefixes ? await storage.siblingPrefixes() : [];
+  if (siblings === null) return null;
+  const prefixes = [storage.prefix, ...siblings.filter((p) => p !== storage.prefix)];
+  const totals = await Promise.all(prefixes.map((prefix) => prefixUsage(bucket, prefix)));
+  return totals.reduce((sum, bytes) => sum + bytes, 0);
+}
 async function admitStorage(bucket, storage, incomingBytes, replacesKey) {
   if (!storage) return null;
   const limit = await storage.limitBytes();
@@ -6440,7 +6449,14 @@ async function admitStorage(bucket, storage, incomingBytes, replacesKey) {
       "storage_limit_unavailable"
     );
   }
-  const stored = await allocationUsage(bucket, storage.prefix);
+  const stored = await allocationUsage(bucket, storage);
+  if (stored === null) {
+    return fail(
+      503,
+      "The storage already used by this account could not be measured; nothing was uploaded. Retry shortly.",
+      "storage_limit_unavailable"
+    );
+  }
   const replaced = replacesKey === null ? 0 : (await bucket.head(replacesKey))?.size ?? 0;
   const used = stored - replaced;
   if (used + incomingBytes <= limit) return null;
@@ -6456,7 +6472,11 @@ async function admitAssembledObject(bucket, storage, key, objectBytes) {
     console.error("[files:quota] limit unavailable at complete; keeping", key);
     return null;
   }
-  const stored = await allocationUsage(bucket, storage.prefix);
+  const stored = await allocationUsage(bucket, storage);
+  if (stored === null) {
+    console.error("[files:quota] account usage unmeasurable at complete; keeping", key);
+    return null;
+  }
   if (stored <= limit) return null;
   await bucket.delete(key).catch(() => void 0);
   return fail(
@@ -6853,9 +6873,10 @@ async function handleList(bucket, prefix, url, scope, auth) {
   });
   let storage;
   if (auth.storage) {
-    storage = { usedBytes: await allocationUsage(bucket, auth.storage.prefix) };
+    const usedBytes = await allocationUsage(bucket, auth.storage);
+    if (usedBytes !== null) storage = { usedBytes };
     const limitBytes = await auth.storage.limitBytes();
-    if (limitBytes !== null) storage.limitBytes = limitBytes;
+    if (storage && limitBytes !== null) storage.limitBytes = limitBytes;
   }
   return Response.json(
     { files, truncated: listed.truncated, ...storage ? { storage } : {} },
@@ -9462,13 +9483,13 @@ var APP_LOG_EVENT_KEYS = [
   "exception"
 ];
 export {
+  ACCOUNT_STORAGE_LIMIT_BYTES,
   AI_CHATS_SCHEMA,
   AI_MESSAGES_SCHEMA,
   ALLOWED_BINDING_TYPES,
   APP_ID_RE,
   APP_LOG_EVENT_KEYS,
   APP_NAME_RULES,
-  APP_STORAGE_LIMIT_BYTES,
   ASSET_NOT_FOUND_HANDLING_VALUES,
   AUTO_PROVISIONABLE_TYPES,
   AUTO_PROVISION_SENTINEL,
@@ -9520,6 +9541,7 @@ export {
   READ_RECEIPTS_SCHEMA,
   REGISTRY_INSTANCE,
   RELEASE_STAMP_PATH,
+  REPO_STORE_LIMIT_BYTES,
   REQUIRED_COMPATIBILITY_FLAGS,
   RESERVED_BINDING_NAMES,
   RESERVED_COLLECTION_NAMES,