@arcadiasystems/morse-uploader 0.3.0 → 0.4.1

package/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 All notable changes to `@arcadiasystems/morse-uploader` will be documented in this file. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.1] - 2026-10-30
+
+Accepts `@arcadiasystems/morse-sdk` 0.10. No code changed: none of 0.10's breaking changes reach this package, and the Mysten peer ranges are the same as 0.4.0's.
+
+### Changed
+
+- **Peer dependency.** `@arcadiasystems/morse-sdk` `>=0.9.0 <0.11.0` (was `>=0.9.0 <0.10.0`), so an app can install SDK 0.10 next to this package without a peer conflict, and an app on 0.9.x can take this release without moving the SDK. The README peer install now names `@arcadiasystems/morse-sdk@~0.10.0`.
+- **On SDK 0.10, download and upload errors read the way the SDK now words them.** `downloadErrorMessage` and `uploadErrorMessage` hand every SDK error to `formatUserMessage`, so the copy follows the SDK the app installed. A missing blob is still titled "Content unavailable", but its description is now "Walrus has no stored copy of this content. (id: ...)" with the bare blob id, instead of 0.9's "The Walrus blob is not retrievable. The storage operator may be having issues, or the blob expired. (id: Walrus aggregator: blob ... not found)". A `BlobExpiredError` is titled "Content expired" and names both epochs. The download hooks read through `walrusRead.readBlob`, never `readBlobByObjectId`, so the default aggregator adapter never raises one; only a custom `walrusRead` that raises it shows that message.
+- **Nothing else 0.10 broke reaches this package.** It implements no `PublicationReader`, so the new required `isPublisherCapRevoked` does not apply. It never tests a Walrus read failure's class (`NoBlobMetadataReceivedError` is now a `TransportError`, `BlobNotCertifiedError` a `NotFoundError`) and never reads `NotFoundError.identifier`. It does not import `BlobExpiredError`, which 0.9 does not export.
+- **The dev dependency and the example** pin `@arcadiasystems/morse-sdk` 0.10.0, so CI tests the newest version the range admits. 0.9.0, the lower bound, was checked locally: lint, typecheck, the test suite, build and `check:exports` pass, and the built entries load in Node.
+
+## [0.4.0] - 2026-10-20
+
+Downloads now tell an encrypted file from a public one by its on-chain Seal prefix instead of trusting the share link, and uploads refuse a file too large for the relay's tip cap before reading it. Peer dependencies are unchanged. This is a minor bump because it adds public exports and narrows `walrusWriteConfig.uploadRelay.sendTip` from `unknown`, so a value `@mysten/walrus` would not accept no longer type-checks.
+
+### Fixed
+
+- **A share link that lost its Seal material served an encrypted file as if it were public.** `useFileDownload` decided whether to decrypt from the link alone, so a link that arrived without its `p` and `n` parameters (a chat client trimming the fragment, a URL copied by hand, a link rebuilt from the file id) read the bytes straight from Walrus and handed back ciphertext as the file, with no error anywhere. `load` and `download` now first read the file's Seal prefix from chain with the SDK's `getRecipientFileSealPrefix`, the only reliable sign that a file is encrypted (`members` is not one, because the owner is always a member). A file with an on-chain prefix opened from a link without Seal material now fails with a `ShareLinkSealError` and serves nothing, and `MorseFileDownloader` shows "Link is incomplete" with "This file is encrypted, and the link is missing the details needed to decrypt it. Ask the sender for the full link."
+- **A link whose Seal prefix is not the file's is refused before the wallet is asked to sign.** Such a link cannot decrypt the file, but it used to cost a SessionKey signature and then fail at the key servers with what reads as a permissions error, blaming the wallet for a damaged link. It now fails with `ShareLinkSealError` reason `"mismatch"`, shown as "Link does not match this file". The on-chain prefix is deliberately not substituted for the link's: the nonce is not on chain, so a link with one damaged field cannot be told apart from a link to a different file, and the uploader already refuses half-damaged links rather than guessing (see 0.2.0's `parseShareLink` fix).
+
+  A file with no on-chain prefix behaves as before. Files encrypted before the prefix was stored on chain have none, and their links still carry the Seal material, so a missing prefix does not prove a file is public and the link still decides.
+
+  The prefix is read only when the bytes are fetched, so a page that renders just the metadata pays nothing extra; a public download costs one more round trip and an encrypted one two. The read is aborted when the component unmounts, and an aborted fetch stops before reading bytes or prompting the wallet.
+- **A file too large for the relay's tip cap was read, encrypted and encoded before the upload failed, and the failure read as a network issue.** The Walrus Mainnet relay's tip grows with the blob's encoded size, so `sendTip.max` also caps the file size: 10,000,000 MIST, the cap the README and the example use, allows 42,327,820 bytes (40.37 MiB). `@mysten/walrus` enforces the cap only when it builds the register transaction, after encoding the whole file, and the SDK passed its "Tip amount (N) exceeds the maximum allowed tip (M)" on as a `TransportError`, which `uploadErrorMessage` titled "Network issue". `useFileUpload` now reads the relay's `/v1/tip-config` first, derives the largest file the cap allows with the SDK's encoded-size formula, and refuses a larger file with a `FileTooLargeError` before reading it. `MorseFileUploader` shows "File too large" with the file's size, the limit and the cap.
+
+  An encrypted file that fits, but that Seal's envelope takes over the limit, is refused after encryption and before Walrus encodes it, since the envelope's size depends on the key servers. A cap below the tip for even the smallest file (the example's 1,000,000 MIST before 0.2.0) now fails with a `ConfigurationError` saying so. Testnet's relay charges a flat 105 MIST, so there the cap sets no size limit. Each upload through a relay with a `sendTip.max` costs one extra request for the tip config; without a relay or a cap, nothing is requested.
+
+### Added
+
+- **`downloadErrorMessage(error)`**, used by `MorseFileDownloader` and exported for custom UIs built on `useFileDownload`. It titles a `ShareLinkSealError` by its reason and defers everything else to the SDK's `formatUserMessage`, which would title it "Unexpected error".
+- **`ShareLinkSealError`**, with `reason: ShareLinkSealErrorReason` (`"missing" | "mismatch"`). `useFileDownload` sets it as `error` when the link cannot open an encrypted file.
+- **`FileTooLargeError`**, with `sizeBytes`, `afterEncryption` and `limit: UploadSizeLimit` (`maxBytes`, `maxTipMist`). `useFileUpload` throws it when a file is too large for the relay's tip cap, and `uploadErrorMessage` titles it "File too large".
+- **`uploadRelay` on `MorseFilesHandles`**, the relay `walrusWrite` sends blobs through. `useMorseFiles` sets it from `walrusWriteConfig.uploadRelay` when it builds the write adapter. It stays unset for a prebuilt `walrusWrite`, whose relay the package cannot see, so the size check is skipped and the SDK's own tip check still applies. Hand-built handles can set it to get the check.
+
+### Changed
+
+- **`walrusWriteConfig.uploadRelay.sendTip` is typed** as `@mysten/walrus`'s `UploadRelayConfig["sendTip"]` instead of `unknown`, and the relay options are exported as `UploadRelayOptions`. Every value `@mysten/walrus` accepts still type-checks; the package now reads `max` from it.
+
 ## [0.3.0] - 2026-10-18
 
 Moves to `@arcadiasystems/morse-sdk` 0.9 and the Mysten lines it requires. The public API is unchanged. This is a minor bump because the new peer ranges exclude every version 0.2.x accepted, so upgrading means upgrading the SDK and all three Mysten packages with it.

package/README.md

@@ -1,6 +1,6 @@
 # @arcadiasystems/morse-uploader
 
-Headless-first React components and hooks for encrypted file sharing on Sui and Walrus, built on [`@arcadiasystems/morse-sdk`](https://github.com/arcadiasystems/morse-dcms) 0.9. Upload a file to Walrus, optionally encrypt it for a set of recipient wallets so only they can decrypt, and share a link. The connected wallet pays for and signs everything.
+Headless-first React components and hooks for encrypted file sharing on Sui and Walrus, built on [`@arcadiasystems/morse-sdk`](https://github.com/arcadiasystems/morse-dcms) 0.9 or 0.10. Upload a file to Walrus, optionally encrypt it for a set of recipient wallets so only they can decrypt, and share a link. The connected wallet pays for and signs everything.
 
 - **Headless-first**: composable hooks for every step (`useMorseFiles`, `useFileUpload`, `useFileDownload`, `useFileDecrypt`, `useRecipientFile`), plus an optional styled component set.
 - **Recipient-scoped encryption**: each file carries its own recipient set; an encrypted upload to N recipients is **2 wallet popups**, regardless of N. The connected wallet is always a recipient, so the owner can always decrypt. Public (unencrypted) uploads need no recipients.
@@ -16,9 +16,11 @@ npm install @arcadiasystems/morse-uploader
 Peer dependencies (install in your app, pinned to the same ranges as `@arcadiasystems/morse-sdk` so you do not end up with duplicate Sui/Walrus/Seal instances):
 
 ```sh
-npm install react react-dom @arcadiasystems/morse-sdk@~0.9.0 @mysten/sui@~2.36.0 @mysten/walrus@~1.2.35 @mysten/seal@~1.5.0
+npm install react react-dom @arcadiasystems/morse-sdk@~0.10.0 @mysten/sui@~2.36.0 @mysten/walrus@~1.2.35 @mysten/seal@~1.5.0
 ```
 
+The `@arcadiasystems/morse-sdk` peer range is `>=0.9.0 <0.11.0`, so an app already on 0.9.x can keep it.
+
 ## Quick start
 
 ### 1. Build the handles from your wallet
@@ -60,6 +62,7 @@ function FilesApp({ account }) {
       uploadRelay: {
         host: "https://upload-relay.testnet.walrus.space",
         // Caps the per-upload tip the Walrus Mainnet relay charges, in MIST (0.01 SUI).
+        // The tip grows with file size, so this also caps the file: see "Notes on Walrus".
         sendTip: { max: 10_000_000 },
       },
     },
@@ -113,8 +116,8 @@ All hooks must be used inside `MorseFilesProvider`.
 | Hook | Purpose |
 |---|---|
 | `useMorseFiles(options)` | Build the handles from a connected wallet. Used once, above the provider. |
-| `useFileUpload()` | Upload one file: `upload({ file, epochs, recipients?, encrypt? })`. Encrypted when `encrypt` is set. Returns `{ fileId, blobId, encrypted, sealIdPrefix, sealNonce, shareLink }` and exposes a phase stepper. |
-| `useFileDownload(fileId, seal)` | Drive a download page: loads metadata, then `load()` / `download()` reads (public, `seal` null) or decrypts (encrypted, `seal` = `{ sealIdPrefix, sealNonce }`). |
+| `useFileUpload()` | Upload one file: `upload({ file, epochs, recipients?, encrypt? })`. Encrypted when `encrypt` is set. Returns `{ fileId, blobId, encrypted, sealIdPrefix, sealNonce, shareLink }` and exposes a phase stepper. Refuses a file too large for the relay's tip cap with `FileTooLargeError` before reading it. |
+| `useFileDownload(fileId, seal)` | Drive a download page: loads metadata, then `load()` / `download()` reads (public, `seal` null) or decrypts (encrypted, `seal` = `{ sealIdPrefix, sealNonce }`). It first reads the file's Seal prefix from chain, so a file that has one, opened with `seal` null or with another file's prefix, fails with `ShareLinkSealError` instead of serving ciphertext. |
 | `useFileDecrypt()` | Lower-level decrypt: `decrypt({ file, sealIdPrefix, sealNonce })` returns plaintext bytes (one SessionKey signature, reused across files). |
 | `useRecipientFile(fileId)` | Load a `RecipientFile`'s on-chain metadata (name, contentType, size, members, blobId). |
 | `useStorageCostEstimate({ sizeBytes, epochs, encrypt })` | USD storage-cost estimate using Walrus [predictable pricing](https://blog.walrus.xyz/announcing-predictable-pricing-in-usd-on-walrus/) ($0.023/GB/month). |
@@ -123,7 +126,11 @@ All hooks must be used inside `MorseFilesProvider`.
 
 ### Rendering an upload error
 
-`uploadErrorMessage(error, network)` returns the SDK's `{ title, description, cause }` for any failure, with one rewrite: an insufficient-balance failure arrives as raw `@mysten/sui` text (a coin type, an address, two unscaled integers) that the SDK can only classify as a network problem. This restates it as "Not enough WAL", with the amounts in whole coins and the network's way of topping up. `MorseFileUploader` already uses it; call it directly if you render your own errors.
+`uploadErrorMessage(error, network)` returns the SDK's `{ title, description, cause }` for any failure, with two exceptions. An insufficient-balance failure arrives as raw `@mysten/sui` text (a coin type, an address, two unscaled integers) that the SDK can only classify as a network problem. This restates it as "Not enough WAL", with the amounts in whole coins and the network's way of topping up. A `FileTooLargeError` (see [Notes on Walrus](#notes-on-walrus)) is titled "File too large", with the file's size, the limit and the tip cap. `MorseFileUploader` already uses it; call it directly if you render your own errors.
+
+### Rendering a download error
+
+`downloadErrorMessage(error)` does the same for `useFileDownload`'s `error`. A `ShareLinkSealError` means the file is encrypted and the link cannot open it: `reason` is `"missing"` when the link has no Seal material and `"mismatch"` when its prefix is not the file's. These are titled "Link is incomplete" and "Link does not match this file", and both ask the reader to get the full link from the sender. Everything else goes to the SDK's `formatUserMessage`. `MorseFileDownloader` already uses it.
 
 ## How encryption works
 
@@ -152,6 +159,7 @@ const parsed = parseShareLink(window.location.href);
 
 - Storage is a **lease**, capped at 53 epochs ahead on both networks. An epoch is ~1 day on testnet and ~2 weeks on mainnet.
 - Blobs are raw bytes with no filename or MIME type; this package stores the name and content type in the on-chain file record so downloads come back correctly named and typed.
+- **The relay's tip cap is also a file-size cap.** The Walrus Mainnet relay charges a tip that grows with the blob's encoded size (its `/v1/tip-config` asks for 40 MIST per encoded KiB), and `@mysten/walrus` refuses a tip above `sendTip.max`. At the 10,000,000 MIST cap above, the largest file is 42,327,820 bytes (40.37 MiB). `useFileUpload` reads the relay's tip config before each upload and refuses a larger file with a `FileTooLargeError` before reading it, rather than letting the SDK encode the whole file first. An encrypted file is checked again after encryption, since Seal's envelope adds a few hundred bytes. Raise `sendTip.max` to allow larger files. Testnet's relay charges a flat 105 MIST, so there the cap sets no size limit. Handles built around a prebuilt `walrusWrite` have no `uploadRelay`, so this check is skipped, and the SDK's own check still refuses the tip before anything is signed.
 
 ## Seal on mainnet
 

package/dist/{chunk-K2J3ZILI.js → chunk-ZV3GFXNW.js}

@@ -1,4 +1,4 @@
-import { formatUserMessage, buildRecipientFileSealId, SealError, uploadEncryptedRecipientFileFromBytes, uploadRecipientFileFromBytes } from '@arcadiasystems/morse-sdk';
+import { formatUserMessage, buildRecipientFileSealId, SealError, uploadEncryptedRecipientFileFromBytes, uploadRecipientFileFromBytes, ConfigurationError, TransportError } from '@arcadiasystems/morse-sdk';
 import { createContext, useContext, useState, useRef, useCallback, useEffect, useMemo } from 'react';
 import { SessionKey, UserError } from '@mysten/seal';
 import { normalizeSuiAddress } from '@mysten/sui/utils';
@@ -49,6 +49,34 @@ function buildShareLink(args) {
   return `${base}${path}${query}`;
 }
 
+// src/files/share-link-seal-error.ts
+var MESSAGES = {
+  missing: "This file is encrypted, and the link is missing the details needed to decrypt it. Ask the sender for the full link.",
+  mismatch: "This file is encrypted, and the link's decryption details are for a different file. The link may have been damaged or mixed up with another one. Ask the sender for the full link."
+};
+var ShareLinkSealError = class extends Error {
+  reason;
+  constructor(reason) {
+    super(MESSAGES[reason]);
+    this.name = "ShareLinkSealError";
+    this.reason = reason;
+  }
+};
+var TITLES = {
+  missing: "Link is incomplete",
+  mismatch: "Link does not match this file"
+};
+function downloadErrorMessage(error) {
+  if (!(error instanceof ShareLinkSealError)) {
+    return formatUserMessage(error);
+  }
+  return {
+    title: TITLES[error.reason],
+    description: error.message,
+    cause: error
+  };
+}
+
 // src/files/epoch-duration-ms.ts
 var ONE_DAY_MS = 24 * 60 * 60 * 1e3;
 var EPOCH_DURATION_MS = {
@@ -73,7 +101,53 @@ function estimateStorageUsd(args) {
   const rate = args.usdPerGbPerMonth ?? DEFAULT_USD_PER_GB_PER_MONTH;
   return { usd: gb * months * rate, gb, months, days, sizeBytes };
 }
+
+// src/utils/format-bytes.ts
+var UNITS = ["B", "KB", "MB", "GB", "TB", "PB"];
+var BASE = 1024;
+function formatBytes(bytes, fractionDigits = 2) {
+  if (!Number.isFinite(bytes) || bytes <= 0) {
+    return "0 B";
+  }
+  const exponent = Math.min(
+    Math.floor(Math.log(bytes) / Math.log(BASE)),
+    UNITS.length - 1
+  );
+  const value = bytes / BASE ** exponent;
+  const unit = UNITS[exponent] ?? "B";
+  if (exponent === 0) {
+    return `${value} ${unit}`;
+  }
+  return `${value.toFixed(fractionDigits)} ${unit}`;
+}
+
+// src/files/file-too-large-error.ts
+var FileTooLargeError = class extends Error {
+  sizeBytes;
+  afterEncryption;
+  limit;
+  constructor(args) {
+    const subject = args.afterEncryption ? "Encrypted, this file is" : "This file is";
+    super(
+      `${subject} ${describeBytes(args.sizeBytes)}, over the ${describeBytes(args.limit.maxBytes)} limit for one upload. The Walrus upload relay's tip grows with file size, and this app caps it at ${args.limit.maxTipMist.toLocaleString("en-US")} MIST.`
+    );
+    this.name = "FileTooLargeError";
+    this.sizeBytes = args.sizeBytes;
+    this.afterEncryption = args.afterEncryption;
+    this.limit = args.limit;
+  }
+};
+function describeBytes(bytes) {
+  return `${formatBytes(bytes)} (${bytes.toLocaleString("en-US")} bytes)`;
+}
 function uploadErrorMessage(error, network) {
+  if (error instanceof FileTooLargeError) {
+    return {
+      title: "File too large",
+      description: error.message,
+      cause: error
+    };
+  }
   const shortfall = parseInsufficientBalance(errorText(error));
   if (shortfall === null) {
     return formatUserMessage(error);
@@ -334,29 +408,65 @@ function useRecipientFile(fileId) {
   }, [refresh, fileId]);
   return { status, file, error, refresh };
 }
+
+// src/utils/bytes-equal.ts
+function bytesEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  return a.every((byte, index) => byte === b[index]);
+}
+
+// src/files/assert-share-link-opens-file.ts
+function assertShareLinkOpensFile(onChainPrefix, seal) {
+  if (onChainPrefix === null) {
+    return;
+  }
+  if (seal === null) {
+    throw new ShareLinkSealError("missing");
+  }
+  if (!bytesEqual(seal.sealIdPrefix, onChainPrefix)) {
+    throw new ShareLinkSealError("mismatch");
+  }
+}
+
+// src/files/use-file-download.ts
 function useFileDownload(fileId, seal) {
-  const { walrusRead } = useMorseFilesContext();
+  const { reader, walrusRead } = useMorseFilesContext();
   const { status: metaStatus, file } = useRecipientFile(fileId);
   const { decrypt } = useFileDecrypt();
   const [status, setStatus] = useState("idle");
   const [objectUrl, setObjectUrl] = useState(null);
   const [error, setError] = useState(null);
   const urlRef = useRef(null);
+  const lifetimeRef = useRef(null);
   useEffect(() => {
     if (objectUrl === null) {
       return;
     }
     return () => URL.revokeObjectURL(objectUrl);
   }, [objectUrl]);
+  useEffect(() => {
+    const controller = new AbortController();
+    lifetimeRef.current = controller;
+    return () => controller.abort();
+  }, []);
   const encrypted = seal !== null;
   const isImage = file === null ? false : isPreviewableImage(file.contentType);
   const fetchToUrl = useCallback(async () => {
     if (file === null) {
       return null;
     }
+    const signal = lifetimeRef.current?.signal;
     setStatus("loading");
     setError(null);
     try {
+      const onChainPrefix = await reader.getRecipientFileSealPrefix(
+        file.id,
+        signal
+      );
+      signal?.throwIfAborted();
+      assertShareLinkOpensFile(onChainPrefix, seal);
       let bytes;
       if (seal !== null) {
         bytes = await decrypt({
@@ -375,11 +485,14 @@ function useFileDownload(fileId, seal) {
       setStatus("ready");
       return url;
     } catch (err) {
+      if (signal?.aborted === true) {
+        return null;
+      }
       setError(err);
       setStatus("error");
       return null;
     }
-  }, [file, seal, decrypt, walrusRead]);
+  }, [file, seal, reader, decrypt, walrusRead]);
   const load = useCallback(async () => {
     await fetchToUrl();
   }, [fetchToUrl]);
@@ -407,10 +520,145 @@ function useFileDownload(fileId, seal) {
     download
   };
 }
+var OPERATION = "walrus.relay.tipConfig";
+var TIMEOUT_MS = 3e4;
+async function fetchRelayTipStrategy(host) {
+  let response;
+  try {
+    response = await fetch(`${host}/v1/tip-config`, {
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+  } catch (cause) {
+    throw new TransportError(
+      `Could not reach the upload relay at ${host} to read its tip config.`,
+      { cause, operation: OPERATION }
+    );
+  }
+  if (!response.ok) {
+    throw new TransportError(
+      `The upload relay at ${host} answered HTTP ${response.status} when asked for its tip config.`,
+      { operation: OPERATION }
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (cause) {
+    throw unreadable(host, cause);
+  }
+  if (typeof body === "string") {
+    return null;
+  }
+  const kind = field(field(body, "send_tip"), "kind");
+  const constant = field(kind, "const");
+  if (isMist(constant)) {
+    return { const: constant };
+  }
+  const linear = field(kind, "linear");
+  const base = field(linear, "base");
+  const perEncodedKib = field(linear, "encoded_size_mul_per_kib");
+  if (isMist(base) && isMist(perEncodedKib)) {
+    return { linear: { base, perEncodedKib } };
+  }
+  throw unreadable(host);
+}
+function field(value, key) {
+  if (typeof value !== "object" || value === null) {
+    return void 0;
+  }
+  return value[key];
+}
+function isMist(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function unreadable(host, cause) {
+  return new TransportError(
+    `The upload relay at ${host} sent a tip config this version cannot read.`,
+    cause === void 0 ? { operation: OPERATION } : { cause, operation: OPERATION }
+  );
+}
+
+// src/files/max-blob-bytes-for-tip.ts
+var N_SHARDS = 1e3;
+var MAX_FAULTY_SHARDS = Math.floor((N_SHARDS - 1) / 3);
+var PRIMARY_SYMBOLS = N_SHARDS - 2 * MAX_FAULTY_SHARDS;
+var SECONDARY_SYMBOLS = N_SHARDS - MAX_FAULTY_SHARDS;
+var BYTES_PER_SYMBOL = BigInt(PRIMARY_SYMBOLS * SECONDARY_SYMBOLS);
+var ENCODED_BYTES_PER_SYMBOL = BigInt(
+  (PRIMARY_SYMBOLS + SECONDARY_SYMBOLS) * N_SHARDS
+);
+var METADATA_BYTES = BigInt(N_SHARDS * (N_SHARDS * 32 * 2 + 32));
+var BYTES_PER_KIB = 1024n;
+function maxBlobBytesForTip(strategy, maxTipMist) {
+  if ("const" in strategy) {
+    return BigInt(strategy.const) <= maxTipMist ? null : 0;
+  }
+  const base = BigInt(strategy.linear.base);
+  const perEncodedKib = BigInt(strategy.linear.perEncodedKib);
+  if (perEncodedKib === 0n) {
+    return base <= maxTipMist ? null : 0;
+  }
+  const maxEncodedBytes = (maxTipMist - base) / perEncodedKib * BYTES_PER_KIB;
+  if (maxEncodedBytes < METADATA_BYTES) {
+    return 0;
+  }
+  const symbols = (maxEncodedBytes - METADATA_BYTES) / ENCODED_BYTES_PER_SYMBOL;
+  const evenSymbols = symbols - symbols % 2n;
+  return Number(evenSymbols * BYTES_PER_SYMBOL);
+}
+
+// src/files/resolve-upload-size-limit.ts
+async function resolveUploadSizeLimit(relay) {
+  if (relay === void 0) {
+    return null;
+  }
+  const { sendTip } = relay;
+  if (sendTip === void 0 || sendTip === null) {
+    return null;
+  }
+  if (sendTip.max === void 0 || !Number.isFinite(sendTip.max)) {
+    return null;
+  }
+  const maxTipMist = BigInt(Math.floor(sendTip.max));
+  const strategy = "kind" in sendTip ? sendTip.kind : await fetchRelayTipStrategy(relay.host);
+  if (strategy === null) {
+    return null;
+  }
+  const maxBytes = maxBlobBytesForTip(strategy, maxTipMist);
+  if (maxBytes === null) {
+    return null;
+  }
+  if (maxBytes === 0) {
+    throw new ConfigurationError(
+      `sendTip.max is ${maxTipMist.toLocaleString("en-US")} MIST, below the tip the upload relay at ${relay.host} charges for even the smallest file, so it would refuse every upload. Raise sendTip.max in walrusWriteConfig.uploadRelay.`
+    );
+  }
+  return { maxBytes, maxTipMist };
+}
+
+// src/files/with-ciphertext-size-limit.ts
+function withCiphertextSizeLimit(walrus, limit) {
+  return {
+    uploadBlob: (data, options) => walrus.uploadBlob(data, options),
+    uploadQuilt: (patches, options) => walrus.uploadQuilt(patches, options),
+    startBlobUpload: async (data, options) => {
+      if (data.length > limit.maxBytes) {
+        throw new FileTooLargeError({
+          sizeBytes: data.length,
+          afterEncryption: true,
+          limit
+        });
+      }
+      return walrus.startBlobUpload(data, options);
+    }
+  };
+}
+
+// src/files/use-file-upload.ts
 var SEAL_UNAVAILABLE2 = "No Seal key servers are configured, so encrypted files are unavailable. Testnet pins an open set; mainnet pins none, because every operator there is commercial. Pass `sealKeyServers` to MorseFilesProvider, starting from the SDK's MAINNET_SEAL_COMMITTEE with the apiKeyName and apiKey your operator issues.";
 var FALLBACK_CONTENT_TYPE = "application/octet-stream";
 function useFileUpload() {
-  const { adapter, config, walrusWrite, seal, network } = useMorseFilesContext();
+  const { adapter, config, walrusWrite, uploadRelay, seal, network } = useMorseFilesContext();
   const [status, setStatus] = useState("idle");
   const [phase, setPhase] = useState(null);
   const [data, setData] = useState(null);
@@ -428,6 +676,14 @@ function useFileUpload() {
       setData(null);
       setError(null);
       try {
+        const sizeLimit = await resolveUploadSizeLimit(uploadRelay);
+        if (sizeLimit !== null && input.file.size > sizeLimit.maxBytes) {
+          throw new FileTooLargeError({
+            sizeBytes: input.file.size,
+            afterEncryption: false,
+            limit: sizeLimit
+          });
+        }
         const bytes = new Uint8Array(await input.file.arrayBuffer());
         const contentType = input.file.type || FALLBACK_CONTENT_TYPE;
         const recipients = input.recipients ?? [];
@@ -445,7 +701,7 @@ function useFileUpload() {
             adapter,
             config,
             {
-              walrus: walrusWrite,
+              walrus: sizeLimit === null ? walrusWrite : withCiphertextSizeLimit(walrusWrite, sizeLimit),
               seal,
               plaintext: bytes,
               recipients,
@@ -496,7 +752,7 @@ function useFileUpload() {
         throw err;
       }
     },
-    [adapter, config, walrusWrite, seal, network]
+    [adapter, config, walrusWrite, uploadRelay, seal, network]
   );
   return { status, phase, data, error, upload, reset };
 }
@@ -628,25 +884,6 @@ function useDropzone(options) {
   return { isDragging, open, getRootProps, getInputProps, inputRef };
 }
 
-// src/utils/format-bytes.ts
-var UNITS = ["B", "KB", "MB", "GB", "TB", "PB"];
-var BASE = 1024;
-function formatBytes(bytes, fractionDigits = 2) {
-  if (!Number.isFinite(bytes) || bytes <= 0) {
-    return "0 B";
-  }
-  const exponent = Math.min(
-    Math.floor(Math.log(bytes) / Math.log(BASE)),
-    UNITS.length - 1
-  );
-  const value = bytes / BASE ** exponent;
-  const unit = UNITS[exponent] ?? "B";
-  if (exponent === 0) {
-    return `${value} ${unit}`;
-  }
-  return `${value.toFixed(fractionDigits)} ${unit}`;
-}
-
 // src/utils/format-usd.ts
 var TINY_FLOOR = 1e-6;
 function formatUsd(usd) {
@@ -665,6 +902,6 @@ function formatUsd(usd) {
   })}`;
 }
 
-export { DEFAULT_ENCRYPTION_OVERHEAD_BYTES, MorseFilesContext, buildShareLink, bytesToHex, epochDurationMs, estimateStorageUsd, formatBytes, formatUsd, isPreviewableImage, resolveOrigin, triggerDownload, uploadErrorMessage, uploadPhaseLabel, uploadPhases, useClipboard, useDropzone, useFileDecrypt, useFileDownload, useFileUpload, useMorseFilesContext, useRecipientFile, useStorageCostEstimate };
-//# sourceMappingURL=chunk-K2J3ZILI.js.map
-//# sourceMappingURL=chunk-K2J3ZILI.js.map
+export { DEFAULT_ENCRYPTION_OVERHEAD_BYTES, FileTooLargeError, MorseFilesContext, ShareLinkSealError, buildShareLink, bytesToHex, downloadErrorMessage, epochDurationMs, estimateStorageUsd, formatBytes, formatUsd, isPreviewableImage, resolveOrigin, triggerDownload, uploadErrorMessage, uploadPhaseLabel, uploadPhases, useClipboard, useDropzone, useFileDecrypt, useFileDownload, useFileUpload, useMorseFilesContext, useRecipientFile, useStorageCostEstimate };
+//# sourceMappingURL=chunk-ZV3GFXNW.js.map
+//# sourceMappingURL=chunk-ZV3GFXNW.js.map