@anteros/core 0.0.44 → 0.0.47

package/lib/zip.ts

@@ -23,9 +23,17 @@ const SIGNATURE = {
 /** Zip entries are never larger than this in a document we read — sanity guard. */
 const MAX_EOCD_SCAN = 65_535 + 22; // the folder comment cap + the record itself
 
+/**
+ * Decompressed-entry ceiling (#41) — mirrors `MAX_FILE_BYTES` (attachment.ts) and
+ * stops a deflate bomb: a 20 KB archive can otherwise expand to gigabytes.
+ */
+const MAX_ENTRY_BYTES = 10 * 1024 * 1024;
+
 type Entry = {
     method: number;
     compressedSize: number;
+    /** Declared size after inflation — checked before we allocate anything. */
+    uncompressedSize: number;
     localOffset: number;
 };
 
@@ -67,17 +75,18 @@ function openZip(buffer: Uint8Array): ZipArchive {
 
         const method = view.getUint16(offset + 10, true);
         const compressedSize = view.getUint32(offset + 20, true);
+        const uncompressedSize = view.getUint32(offset + 24, true);
         const nameLength = view.getUint16(offset + 28, true);
         const extraLength = view.getUint16(offset + 30, true);
         const commentLength = view.getUint16(offset + 32, true);
         const localOffset = view.getUint32(offset + 42, true);
 
-        if (compressedSize === 0xffffffff || localOffset === 0xffffffff) {
+        if (compressedSize === 0xffffffff || uncompressedSize === 0xffffffff || localOffset === 0xffffffff) {
             throw bad("ZIP64 archives are not supported");
         }
 
         const name = new TextDecoder().decode(buffer.subarray(offset + 46, offset + 46 + nameLength));
-        entries.set(name, { method, compressedSize, localOffset });
+        entries.set(name, { method, compressedSize, uncompressedSize, localOffset });
         offset += 46 + nameLength + extraLength + commentLength;
     }
 
@@ -98,9 +107,20 @@ function openZip(buffer: Uint8Array): ZipArchive {
             const data = buffer.subarray(start, start + entry.compressedSize);
             if (start + entry.compressedSize > buffer.length) throw bad(`truncated entry '${name}'`);
 
+            // The declared size is a first guard — before inflating anything.
+            if (entry.uncompressedSize > MAX_ENTRY_BYTES) {
+                throw bad(`entry '${name}' expands beyond the ${MAX_ENTRY_BYTES / 1024 / 1024}MB limit`);
+            }
+
             // 0 = stored, 8 = deflate — the only two methods Office writes
             if (entry.method === 0) return data;
-            if (entry.method === 8) return new Uint8Array(inflateRawSync(data));
+            if (entry.method === 8) {
+                try {
+                    return new Uint8Array(inflateRawSync(data, { maxOutputLength: MAX_ENTRY_BYTES }));
+                } catch {
+                    throw bad(`entry '${name}' expands beyond the ${MAX_ENTRY_BYTES / 1024 / 1024}MB limit`);
+                }
+            }
             throw bad(`unsupported compression method ${entry.method} for '${name}'`);
         },
     };

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.44",
+  "version": "0.0.47",
   "type": "module",
   "description": "Anteros Core",
+  "license": "MIT",
   "private": false,
   "packageManager": "bun",
   "engines": {
@@ -22,16 +23,14 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@socket.io/bun-engine": "0.1.1",
     "bentocache": "1.6.1",
-    "boxen": "^8.0.1",
-    "dayjs": "1.11.21",
+    "boxen": "^9.0.0",
     "hono": "^4.13.1",
     "ioredis": "6.0.0",
-    "joi": "18.2.3",
+    "joi": "^18.3.0",
     "jose": "6.2.8",
     "mongodb": "7.5.0",
     "socket.io": "4.8.3",
     "tcp-port-used": "^1.0.3",
-    "ufo": "1.6.4",
     "zod": "^4.4.3"
   }
 }

package/server/agents.ts

@@ -167,6 +167,9 @@ function presentResult(result: AgentGenerateResult) {
         ...(result.reasoning ? { reasoning: result.reasoning } : {}),
         toolCalls: result.toolCalls,
         toolResults: result.toolResults,
+        toolStats: result.toolStats,
+        ...(result.model ? { model: result.model } : {}),
+        ...(result.budget ? { budget: result.budget } : {}),
         steps: result.steps,
         usage: result.usage,
         finishReason: result.finishReason,
@@ -256,6 +259,9 @@ function streamResponse(
                     object: await stream.object,
                     toolCalls: await stream.toolCalls,
                     toolResults: await stream.toolResults,
+                    toolStats: await stream.toolStats,
+                    model: await stream.model,
+                    budget: await stream.budget,
                     steps: await stream.steps,
                     usage: await stream.usage,
                     finishReason: await stream.finishReason,
@@ -299,6 +305,62 @@ function streamResponse(
     });
 }
 
+/** A file a caller may attach over HTTP — content only, never a server path. */
+type HttpAttachment = {
+    name?: string;
+    mimeType?: string;
+    data: string;
+    encoding?: "base64" | "utf8";
+};
+
+/**
+ * Validate the `files` field of the HTTP body (issue #29).
+ *
+ * Over HTTP a file is **content** — `{ name?, mimeType?, data, encoding? }`, base64
+ * or UTF-8 — never a server path. Path attachments are a server-side/in-process
+ * feature: accepting one here let any caller read a file the process could read
+ * (`files: ["../../../.env"]`), whose content then went to the model provider.
+ */
+function httpAttachments(input: unknown): HttpAttachment[] | undefined {
+    if (input === undefined) return undefined;
+    if (!Array.isArray(input)) {
+        throw new AppError("`files` must be an array of { name, data, encoding } objects", {
+            status: 400, code: "AGENT_FILES_INVALID",
+        });
+    }
+
+    return input.map((entry) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+            throw new AppError("Each `files` entry must be an object — a server path is not accepted over HTTP", {
+                status: 400, code: "AGENT_FILES_INVALID",
+            });
+        }
+
+        const { name, mimeType, data, encoding } = entry as Record<string, unknown>;
+        if (typeof data !== "string") {
+            throw new AppError("Each `files` entry needs a `data` string (base64, or UTF-8 with `encoding: 'utf8'`)", {
+                status: 400, code: "AGENT_FILES_INVALID",
+            });
+        }
+        if (name !== undefined && typeof name !== "string") {
+            throw new AppError("A `files` entry `name` must be a string", { status: 400, code: "AGENT_FILES_INVALID" });
+        }
+        if (mimeType !== undefined && typeof mimeType !== "string") {
+            throw new AppError("A `files` entry `mimeType` must be a string", { status: 400, code: "AGENT_FILES_INVALID" });
+        }
+        if (encoding !== undefined && encoding !== "base64" && encoding !== "utf8") {
+            throw new AppError("A `files` entry `encoding` must be 'base64' or 'utf8'", { status: 400, code: "AGENT_FILES_INVALID" });
+        }
+
+        return {
+            ...(name !== undefined ? { name } : {}),
+            ...(mimeType !== undefined ? { mimeType } : {}),
+            data,
+            ...(encoding !== undefined ? { encoding } : {}),
+        } as HttpAttachment;
+    });
+}
+
 function initializeAgents(app: Hono<{ Variables: HonoVariables }>) {
     app.post(AGENT_PREFIX, async (c) => {
         const started = Date.now();
@@ -347,6 +409,8 @@ function initializeAgents(app: Hono<{ Variables: HonoVariables }>) {
             // A resume carries its own conversation: no input to ask for
             const needsInput = (action === 'generate' || action === 'stream' || action === 'object') && !body?.resume;
             const input = needsInput ? normalizeInput(body) : undefined;
+            // Files are content over HTTP — a server path is refused before the run
+            const files = httpAttachments(body?.files);
             // `memory: { thread, resource }` or the flat `thread` / `resource`
             const thread = resolveThread(body);
             const resource = resolveResource(body);
@@ -360,6 +424,7 @@ function initializeAgents(app: Hono<{ Variables: HonoVariables }>) {
                 thread,
                 // The deprecated alias, so a rule written against it keeps working
                 threadId: thread,
+                tenant: tenant_id,
             });
 
             const callOptions: AgentCallOptions = {
@@ -372,7 +437,7 @@ function initializeAgents(app: Hono<{ Variables: HonoVariables }>) {
                 ...(body?.messages ? { messages: body.messages as AgentInput } : {}),
                 // Stop the run when the client disconnects (no tokens past the wire)
                 signal: c.req.raw.signal,
-                ...(body?.files?.length ? { files: body.files } : {}),
+                ...(files?.length ? { files } : {}),
                 ...(body?.resume ? { resume: body.resume } : {}),
                 ...(readOnly ? { memory: { readOnly: true } } : {}),
             };

package/server/api.ts

@@ -130,6 +130,235 @@ function omitAtPath(node: any, path: string[], keys: (string | RegExp)[]): any {
     return { ...node, [head]: rest.length ? omitAtPath(node[head], rest, keys) : func.omit(node[head], keys) };
 }
 
+// ─── External-API guards (issues #31, #32, #33) ───────────────────────────
+//
+// The internal `rest` keeps its full surface (scripts and services may compute,
+// replace, etc.); these checks only protect what a **client** sends to the HTTP
+// API.
+
+const RESERVED_UPLOAD_FIELDS = new Set(["_id", "_file", "createdAt", "updatedAt"]);
+
+/** Framework-managed upload metadata cannot be named by the client (#31). */
+function assertUploadMetadata(data: Record<string, any>): void {
+    for (const key of Object.keys(data)) {
+        if (RESERVED_UPLOAD_FIELDS.has(key) || key.startsWith("$")) {
+            throw new AppError(`Metadata field '${key}' is reserved`, { status: 400, code: "UPLOAD_FIELD_RESERVED" });
+        }
+    }
+}
+
+/** A plain object (not an array, not null) — used to validate client bodies (#24). */
+function requirePlainObject(value: unknown, label: string): void {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new AppError(`\`${label}\` must be an object`, { status: 400, code: "INVALID_BODY" });
+    }
+}
+
+function requireStringArray(value: unknown, label: string): void {
+    if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || !id.trim())) {
+        throw new AppError(`\`${label}\` must be an array of ids`, { status: 400, code: "INVALID_BODY" });
+    }
+}
+
+/** A client `id`/`_id` must be a string — an operator object (`$ne`) would match anything (#47). */
+function requireId(body: any): void {
+    const id = body?.id ?? body?._id;
+    if (typeof id !== "string" || !id.trim() || id.startsWith("$")) {
+        throw new AppError("`id` must be a string", { status: 400, code: "INVALID_ID" });
+    }
+}
+
+/** Safe cookie defaults (overridable) — the doc promises HttpOnly/SameSite; enforce them (#48). */
+function cookieDefaults(options: any = {}): Record<string, any> {
+    const base: Record<string, any> = { httpOnly: true, sameSite: "lax", path: "/" };
+    if ((Bun.env.NODE_ENV ?? process.env.NODE_ENV) === "production") base.secure = true;
+    return { ...base, ...(options ?? {}) };
+}
+
+/** Update operators a client may use (external API). `$rename` is deliberately absent (see #43). */
+const CLIENT_UPDATE_OPERATORS = new Set([
+    "$set", "$unset", "$inc", "$mul", "$min", "$max", "$currentDate",
+    "$push", "$addToSet", "$pull", "$pullAll", "$pop",
+]);
+
+/**
+ * External mutations must be an allow-listed operator document (#32):
+ * MongoDB refuses replacement documents in `findAndModify` (500 today), and the
+ * operators other than `$set` escaped Joi validation and `readOnlyFields`.
+ */
+function assertOperatorUpdate(update: unknown, col: any): void {
+    if (!update || typeof update !== "object" || Array.isArray(update)) {
+        throw new AppError("`update` must be a MongoDB update document", { status: 400, code: "INVALID_UPDATE" });
+    }
+    const operators = Object.keys(update);
+    if (!operators.length || !operators.every((operator) => CLIENT_UPDATE_OPERATORS.has(operator))) {
+        throw new AppError("`update` must only use supported MongoDB update operators", { status: 400, code: "INVALID_UPDATE" });
+    }
+
+    const readOnly = (col?.api?.readOnlyFields ?? []).map((field: string | RegExp) =>
+        typeof field === "string" ? (name: string) => name === field : (name: string) => field.test(name),
+    );
+    const required = new Set((col?.fields ?? []).filter((field: any) => field.required).map((field: any) => field.name));
+
+    for (const operator of operators) {
+        const value = (update as Record<string, any>)[operator];
+        if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+        for (const target of Object.keys(value)) {
+            if (readOnly.some((match) => match(target))) {
+                throw new AppError(`Field '${target}' is read-only`, { status: 400, code: "READONLY_FIELD" });
+            }
+            if (operator === "$unset" && required.has(target)) {
+                throw new AppError(`Field '${target}' is required`, { status: 400, code: "INVALID_UPDATE" });
+            }
+        }
+    }
+}
+
+type PrivateMatcher = (name: string) => boolean;
+
+/** `privateFields` (`string` | `RegExp`) as name matchers. */
+function privateMatchers(col: any): PrivateMatcher[] {
+    return (col?.api?.privateFields ?? []).map((field: string | RegExp) =>
+        typeof field === "string"
+            ? (name: string) => name === field
+            : (name: string) => {
+                field.lastIndex = 0; // a `g`/`y` regex would otherwise keep state between calls
+                return field.test(name);
+            },
+    );
+}
+
+/** The join aliases a read may embed, with the private fields of their target. */
+function collectJoinAliases(col: any, action: string, body: any): Array<{ alias: string; from: string; matchers: PrivateMatcher[] }> {
+    const joins: Array<{ alias: string; from: string; matchers: PrivateMatcher[] }> = [];
+    const targetMatchers = (slug: string) =>
+        privateMatchers(cfg.collections?.find((c) => c.slug === slug && c._tenant_ === col._tenant_));
+
+    if (action === "find" || action === "findOne") {
+        for (const inc of body?.params?.$include ?? []) {
+            if (typeof inc === "string") {
+                const field = col.fields?.find((f: any) => f.name === inc);
+                if (field?.relation?.to) joins.push({ alias: inc, from: field.relation.to, matchers: targetMatchers(field.relation.to) });
+            } else if (inc?.from) {
+                joins.push({ alias: inc.as || inc.localField, from: inc.from, matchers: targetMatchers(inc.from) });
+            }
+        }
+    }
+
+    const walk = (stages: any): void => {
+        if (!Array.isArray(stages)) return;
+        for (const stage of stages) {
+            if (!stage || typeof stage !== "object") continue;
+            const lookup = stage.$lookup ?? stage.$graphLookup;
+            if (lookup?.from && typeof lookup.as === "string") {
+                joins.push({ alias: lookup.as, from: lookup.from, matchers: targetMatchers(lookup.from) });
+            }
+            if (lookup?.pipeline) walk(lookup.pipeline);
+            if (stage.$facet && typeof stage.$facet === "object") {
+                for (const branch of Object.values(stage.$facet)) walk(branch);
+            }
+        }
+    };
+    walk(body?.pipeline);
+    return joins;
+}
+
+/**
+ * A client read may only join collections it could read itself (#36): the target's
+ * `api.access` rule is evaluated for the same caller, exactly like a `find` on it.
+ * Internal collections (`_audit_`, `_workflows_`, `_locks_`) are not declared and
+ * are therefore refused. The in-process `rest` is untouched.
+ */
+async function assertJoinedCollectionsAllowed(
+    col: any,
+    action: string,
+    body: any,
+    c: any,
+    rest: InstanceType<typeof useRest>,
+    tenant_id: string,
+): Promise<void> {
+    const seen = new Set<string>();
+    for (const join of collectJoinAliases(col, action, body)) {
+        if (!join.from || seen.has(join.from)) continue;
+        seen.add(join.from);
+
+        const target = cfg.collections?.find((candidate) => candidate.slug === join.from && candidate._tenant_ === col._tenant_);
+        if (target) {
+            await evaluateAccess(target.api?.access as any, 'find', rest, `lookup:${join.from}`, c, {
+                collection: join.from,
+                tenant: tenant_id,
+                lookup: true,
+            });
+            continue;
+        }
+
+        const fileTarget = cfg.fileCollections?.find((candidate) => candidate.slug === join.from && candidate._tenant_ === col._tenant_);
+        if (fileTarget) {
+            await evaluateAccess(fileTarget.api?.access as any, 'read', rest, `lookup:${join.from}`, c, {
+                collection: join.from,
+                tenant: tenant_id,
+                lookup: true,
+            });
+            continue;
+        }
+
+        throw new AppError(`Joining '${join.from}' is not allowed`, { status: 403, code: "LOOKUP_TARGET_FORBIDDEN" });
+    }
+}
+
+/** Expression operators that can move a field value under another name without a `$path`. */
+const PRIVATE_MOVING_OPERATORS = new Set(["$getField", "$objectToArray", "$arrayToObject"]);
+
+/**
+ * A client read may not reach a private field **under another name** (#33):
+ * masking is by key name, so `$addFields: { leak: "$password" }` would slip
+ * through. A reference to a private field — own or through a join alias — is
+ * refused, as are the operators that can move a field without an explicit path.
+ * Internal `rest` calls are untouched.
+ */
+function assertNoPrivateFieldAliasing(col: any, action: string, body: any): void {
+    const own = privateMatchers(col);
+    const joins = collectJoinAliases(col, action, body);
+    const guarded = own.length > 0 || joins.some((join) => join.matchers.length > 0);
+    if (!guarded) return;
+
+    const fail = () => {
+        throw new AppError("The request references a private field", { status: 400, code: "PRIVATE_FIELD_REFERENCE" });
+    };
+
+    const isPrivatePath = (path: string): boolean => {
+        const segments = path.split(".");
+        const head = segments[0] ?? "";
+        if (own.some((match) => match(head))) return true;
+        const join = joins.find((candidate) => candidate.alias === head);
+        return !!join && segments.length > 1 && join.matchers.some((match) => match(segments[1]!));
+    };
+
+    const walk = (node: any): void => {
+        if (typeof node === "string") {
+            if (node.startsWith("$") && !node.startsWith("$$")) {
+                if (isPrivatePath(node.slice(1))) fail();
+            } else if (node.startsWith("$$ROOT.") && isPrivatePath(node.slice(7))) {
+                fail();
+            } else if (node.startsWith("$$CURRENT.") && isPrivatePath(node.slice(10))) {
+                fail();
+            }
+            return;
+        }
+        if (!node || typeof node !== "object") return;
+        if (Array.isArray(node)) {
+            for (const value of node) walk(value);
+            return;
+        }
+        for (const [key, value] of Object.entries(node)) {
+            if (PRIVATE_MOVING_OPERATORS.has(key)) fail();
+            walk(value);
+        }
+    };
+
+    walk(action === "aggregate" ? body?.pipeline : body?.params);
+}
+
 // ─── Access control ─────────────────────────────────────────────────────────
 // `evaluateAccess` / `errorResponse` / `getAccessToken` live in `./access`
 // (shared with the agents API).
@@ -284,7 +513,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
 
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
-                throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
+                throw new AppError('Resource not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
 
             // Store tenant in request context so nested useRest() calls (hooks, actions) resolve it
@@ -292,11 +521,11 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
 
             const col = getCollection(collection, tenant_id)
             if (!col) {
-                throw new AppError('Collection `' + collection + '` not found', { status: 400, code: 'COLLECTION_NOT_FOUND' });
+                throw new AppError('Resource not found', { status: 400, code: 'COLLECTION_NOT_FOUND' });
             }
 
             if (!ActionsValues.includes(action as (typeof ActionsValues)[number]) && !Object.hasOwn(col?.actions ?? {}, action)) {
-                throw new AppError('Action `' + action + '` not found', { status: 400, code: 'ACTION_NOT_FOUND' });
+                throw new AppError('Resource not found', { status: 400, code: 'ACTION_NOT_FOUND' });
             }
 
             const fieldOrder = ['_id', ...col.fields.map(f => f.name)];
@@ -314,7 +543,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
 
                     await col.api.auth.onLogout({
                         rest, payload: body?.payload, error: fn.error, jwt: func.jwt,
-                        cookies: { delete: (name: string) => cookie.deleteCookie(c, name) },
+                        cookies: { delete: (name: string, opts?: any) => cookie.deleteCookie(c, name, cookieDefaults(opts)) },
                     });
 
                     await logActivity({ rest, tenant_id, action: 'logout', collection, status: 'success', input: { payload: body?.payload }, duration: Date.now() - logStart });
@@ -332,12 +561,19 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                     if (!col?.api?.auth?.enabled) throw new AppError('Auth is not enabled', { status: 400, code: 'AUTH_NOT_ENABLED' });
                     if (!col?.api?.auth?.onLogin) throw new AppError('Auth onLogin is not defined', { status: 400, code: 'AUTH_HANDLER_NOT_DEFINED' });
 
+                    // Tenant-bound tokens (#35): the claim is signed by the framework, so a
+                    // token can never open another tenant's routes.
+                    const loginJwt = {
+                        ...func.jwt,
+                        sign: (payload: Record<string, unknown>, options?: any) =>
+                            func.jwt.sign({ ...payload, tenant: tenant_id }, options),
+                    };
                     const authResult = await col.api.auth.onLogin({
-                        rest, payload: body?.payload, error: fn.error, jwt: func.jwt,
+                        rest, payload: body?.payload, error: fn.error, jwt: loginJwt,
                         cookies: {
-                            set: (name: string, value: string, opts?: any) => cookie.setCookie(c, name, value, opts),
+                            set: (name: string, value: string, opts?: any) => cookie.setCookie(c, name, value, cookieDefaults(opts)),
                             get: (name: string) => cookie.getCookie(c, name),
-                            delete: (name: string) => cookie.deleteCookie(c, name),
+                            delete: (name: string, opts?: any) => cookie.deleteCookie(c, name, cookieDefaults(opts)),
                         },
                     });
 
@@ -361,7 +597,15 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
 
             // ── Access control ──
             // Flaw 7: single implementation via evaluateAccess (checks expired/forged tokens)
-            await evaluateAccess(col?.api?.access as any, action, rest, 'Action', c);
+            await evaluateAccess(col?.api?.access as any, action, rest, 'Action', c, { collection, tenant: tenant_id, body });
+
+            // ── External-API guards (issues #31–#33) ──
+            if (action === 'updateOne' || action === 'updateMany') {
+                assertOperatorUpdate(body?.update, col);
+            } else if (action === 'find' || action === 'findOne' || action === 'aggregate') {
+                assertNoPrivateFieldAliasing(col, action, body);
+                await assertJoinedCollectionsAllowed(col, action, body, c, rest, tenant_id);
+            }
 
             // ── Execute action ──
             if (col.actions?.[action]) {
@@ -372,6 +616,19 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 const handler = crudHandlers[action];
                 if (!handler) throw new AppError('Action `' + action + '` not found', { status: 400, code: 'ACTION_NOT_FOUND' });
 
+                // Client body shape + id guards (#24, #47) — custom actions are untouched
+                if (action === 'insertOne') {
+                    requirePlainObject(body?.data, 'data');
+                } else if (action === 'insertMany') {
+                    if (!Array.isArray(body?.data)) {
+                        throw new AppError("`data` must be an array", { status: 400, code: "INVALID_BODY" });
+                    }
+                } else if (action === 'updateOne' || action === 'deleteOne' || action === 'findOne') {
+                    requireId(body);
+                } else if (action === 'updateMany' || action === 'deleteMany') {
+                    requireStringArray(body?.ids ?? body?._ids, 'ids');
+                }
+
                 // Strip readOnlyFields for mutations
                 if (action === 'insertOne' || action === 'insertMany') {
                     stripReadOnlyData(col, body);
@@ -432,10 +689,10 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             // Only namespaces declared with `define.Vars` are reachable, and their
             // `api.access` gates every action (no rules = denied).
             const definition = getVarsDefinition(tenant_id, ns);
-            if (!definition) throw new AppError(`Variables namespace '${ns}' not found`, { status: 400, code: 'NAMESPACE_NOT_FOUND' });
+            if (!definition) throw new AppError('Resource not found', { status: 400, code: 'NAMESPACE_NOT_FOUND' });
 
             rest = new useRest({ internal: false, tenant_id });
-            await evaluateAccess(definition.api?.access as any, action, rest, `vars:${ns}`, c);
+            await evaluateAccess(definition.api?.access as any, action, rest, `vars:${ns}`, c, { namespace: ns, body, tenant: tenant_id });
 
             const vars = rest.vars;
             const { key, value, meta, ttl, scope, where, entries, by } = body ?? {};
@@ -465,7 +722,6 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 collection: `_vars_:${ns}`,
                 status: 'success',
                 input: { ns, key, scope, ttl },
-                result: ['get', 'all', 'entry', 'entries'].includes(action) ? response : undefined,
                 duration: Date.now() - logStart,
                 token: { decoded: accessToken.decoded, value: null, provided: true, expired: false },
             });
@@ -513,7 +769,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
 
             const serviceInstance = cfg.services?.find(s => s.name === service && s._tenant_ === tenant_id) as Service;
             const { action } = c.req.param() as { action: string };
-            if (!serviceInstance) throw new AppError('Service `' + service + '` not found', { status: 400, code: 'SERVICE_NOT_FOUND' });
+            if (!serviceInstance) throw new AppError('Resource not found', { status: 400, code: 'SERVICE_NOT_FOUND' });
             if (!serviceInstance.enabled) throw new AppError('Service `' + service + '` is not enabled', { status: 400, code: 'SERVICE_NOT_ENABLED' });
             if (!serviceInstance.actions?.[action]) throw new AppError('Service `' + service + '` is not defined', { status: 400, code: 'SERVICE_NOT_DEFINED' });
 
@@ -521,7 +777,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
 
             // Access control (same logic as checkFileAccess)
             const serviceAccess = serviceInstance.api?.access as Record<string, boolean | Function> | undefined;
-            await evaluateAccess(serviceAccess as any, action, rest, action, c);
+            await evaluateAccess(serviceAccess as any, action, rest, action, c, { service, tenant: tenant_id, body });
 
             // No `logActivity` here: the call is delegated to `rest.runService()`, which
             // audits it once (`action: 'runService'`, `internal: false`, params only)
@@ -545,7 +801,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
 
             const colUpload = getFileCollection(collection, tenant_id);
             if (!colUpload) {
-                throw new AppError('File collection `' + collection + '` not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
+                throw new AppError('Resource not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
             }
             await checkFileAccess(colUpload?.api?.access as any, 'upload', tenant_id, c);
 
@@ -555,13 +811,13 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
 
             // Security: reject oversized bodies BEFORE parseBody buffers them in memory.
-            // `maxSize` doubles as the TOTAL request allowance → a multi-file upload must
-            // fit within it (each file is also validated individually in handleUpload).
+            // `upload.maxSize` is the per-file cap AND the upload request allowance →
+            // a multi-file upload must fit within it (each file is validated in handleUpload).
             const contentLength = Number(c.req.header('Content-Length') ?? 0);
-            const maxUploadSize = colUpload.upload?.maxSize ?? 10 * 1024 * 1024; // 10MB default
+            const maxRequestSize = colUpload.upload?.maxSize ?? 100 * 1024 * 1024; // 100MB upload default
             // multipart overhead (boundaries/headers) ≈ 64KB max
-            if (Number.isFinite(contentLength) && contentLength > 0 && contentLength > maxUploadSize + 64 * 1024) {
-                throw new AppError(`Request too large (max ${Math.round(maxUploadSize / 1024 / 1024)}MB)`, {
+            if (Number.isFinite(contentLength) && contentLength > 0 && contentLength > maxRequestSize + 64 * 1024) {
+                throw new AppError(`Request too large (max ${Math.round(maxRequestSize / 1024 / 1024)}MB)`, {
                     code: 'FILE_TOO_LARGE', status: 413,
                 });
             }
@@ -591,6 +847,23 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 data[key] = list.length === 1 ? list[0] : list;
             }
 
+            // Framework-managed fields are not client metadata (#31)
+            assertUploadMetadata(data);
+
+            // Only declared fields, and never a read-only one (#46)
+            const declared = new Set((colUpload.fields ?? []).map((field: any) => field.name));
+            const readOnlyMatchers = ((colUpload.api?.readOnlyFields ?? []) as (string | RegExp)[]).map((field) =>
+                typeof field === "string" ? (name: string) => name === field : (name: string) => field.test(name),
+            );
+            for (const key of Object.keys(data)) {
+                if (!declared.has(key)) {
+                    throw new AppError(`Unknown metadata field '${key}'`, { status: 400, code: "UPLOAD_FIELD_UNKNOWN" });
+                }
+                if (readOnlyMatchers.some((match) => match(key))) {
+                    throw new AppError(`Field '${key}' is read-only`, { status: 400, code: "READONLY_FIELD" });
+                }
+            }
+
             // One document per file (per-file validation: MIME, size, storage, replication).
             // 1 file → single object (backward compatible), N files → array (SDK contract).
             const results: FileResult[] = [];
@@ -645,7 +918,16 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
 
             c.header('Content-Type', result.mimetype);
             if (result.size) c.header('Content-Length', String(result.size));
-            c.header('Cache-Control', 'public, max-age=31536000, immutable');
+            // Public immutable caching only when the read rule is literally public (#49);
+            // a function rule (token-dependent) must never be cached by a shared proxy.
+            const fileAccess = colServe.api?.access as Record<string, any> | undefined;
+            const readRule = fileAccess?.read ?? fileAccess?.['*'];
+            if (readRule === true) {
+                c.header('Cache-Control', 'public, max-age=31536000, immutable');
+            } else {
+                c.header('Cache-Control', 'private, no-store');
+                c.header('Vary', 'Authorization, Cookie');
+            }
             // Flaw 4: SVG served as attachment (no inline execution)
             if (result.attachment) {
                 c.header('Content-Disposition', `attachment; filename="${filename}"`);