@k2b/cloud 0.6.0-rc.0

package/src/services/auth-flows/magic-link.ts

@@ -0,0 +1,185 @@
+import { redis, sql } from "bun";
+import { accountCategory } from "../../contracts/account-categories";
+import type { User } from "../../contracts/shared";
+import { createAuthLoginUrl } from "../../shared/redirect";
+import { isAccountCategoryAllowed } from "../account-category-policy";
+import { accounts } from "../accounts";
+import { logger } from "../logging";
+import { providers } from "../providers";
+import * as settings from "../settings";
+import type { AuthNotificationSender } from "./notification-sender";
+
+const log = logger("auth:magic-link");
+const IPA_HINT_COOLDOWN_SECONDS = 300;
+
+const normalizeEmail = (email: string): string => email.trim().toLowerCase();
+const ipaHintCooldownKey = (email: string): string => `ipa-email-login-hint-cooldown:${email}`;
+
+const getAppUrl = async (): Promise<string> => {
+  const rawAppUrl = await settings.get<string>("app.url");
+  return rawAppUrl.startsWith("http") ? rawAppUrl : `https://${rawAppUrl}`;
+};
+
+const hasIpaAccountForEmail = async (email: string): Promise<boolean> => {
+  const rows = await sql<{ exists: boolean }[]>`
+    SELECT EXISTS (
+      SELECT 1
+      FROM auth.users
+      WHERE provider = 'ipa'
+        AND lower(btrim(mail)) = ${email}
+    ) AS exists
+  `;
+  return Boolean(rows[0]?.exists);
+};
+
+const claimIpaHintCooldown = async (email: string): Promise<boolean> => {
+  const result = await redis.send("SET", [ipaHintCooldownKey(email), "1", "EX", String(IPA_HINT_COOLDOWN_SECONDS), "NX"]);
+  return result === "OK";
+};
+
+const sendIpaEmailLoginHint = async (
+  params: { email: string; redirectTo?: string; locale?: string },
+  notificationSender: AuthNotificationSender,
+): Promise<void> => {
+  const appUrl = await getAppUrl();
+  const loginUrl = createAuthLoginUrl(appUrl, {
+    method: "ipa",
+    redirectTo: params.redirectTo,
+  });
+  const result = await notificationSender.sendIpaLoginHint({ email: params.email, loginUrl, locale: params.locale });
+  if (result.status === "error") log.error("FreeIPA login hint delivery failed", { notificationId: result.id });
+};
+
+export const request = async (
+  params: { email: string; redirectTo?: string; locale?: string; category?: "guest" | "login" },
+  notificationSender: AuthNotificationSender,
+): Promise<{ ok: true } | { ok: false; status: 400; message: string }> => {
+  const email = normalizeEmail(params.email);
+  const hasIpaUser = await hasIpaAccountForEmail(email);
+  const userRows = hasIpaUser
+    ? []
+    : await sql<
+        { provider: "local" | "ipa"; profile: "guest" | "user" }[]
+      >`SELECT provider, profile FROM auth.users WHERE lower(btrim(mail)) = ${email}`;
+  const localUser = userRows.find((row) => row.provider === "local");
+  const allowSelfRegistration = await settings.get<boolean>("user.allow_self_registration");
+
+  if (hasIpaUser) {
+    if (!(await isAccountCategoryAllowed({ provider: "ipa", profile: "user" }))) return { ok: true };
+    if (await claimIpaHintCooldown(email)) {
+      void sendIpaEmailLoginHint({ email, redirectTo: params.redirectTo, locale: params.locale }, notificationSender).catch((error) => {
+        log.warn("Failed to send FreeIPA email-login hint", {
+          email,
+          error: error instanceof Error ? error.message : String(error),
+        });
+      });
+    }
+    return { ok: true };
+  }
+
+  if (localUser && ((params.category && accountCategory(localUser) !== params.category) || !(await isAccountCategoryAllowed(localUser))))
+    return { ok: true };
+  if (
+    !localUser &&
+    (!allowSelfRegistration || params.category === "login" || !(await isAccountCategoryAllowed({ provider: "local", profile: "guest" })))
+  ) {
+    return { ok: true };
+  }
+
+  const token = await providers.local.auth.createMagicLinkToken({ email, category: params.category, ttlSeconds: 300 });
+  const appUrl = await getAppUrl();
+  const magicLink = createAuthLoginUrl(appUrl, { token, redirectTo: params.redirectTo });
+
+  try {
+    const result = await notificationSender.sendMagicLink({ email, token, magicLink, locale: params.locale });
+    if (result.status === "error") log.error("Magic link delivery failed", { notificationId: result.id });
+  } catch (error) {
+    // Keep the response generic to prevent account enumeration. The durable
+    // sender records accepted delivery failures; pre-persistence failures land here.
+    log.error("Magic link notification could not be accepted", {
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+
+  return { ok: true };
+};
+
+export const verify = async (params: {
+  token: string;
+}): Promise<
+  | { ok: true; userId: string; user: User; email: string; createdGuest: boolean }
+  | { ok: false; status: 401; message: string }
+  | { ok: false; status: number; message: string }
+> => {
+  const payload = await providers.local.auth.consumeMagicLinkToken(params.token);
+  if (!payload) {
+    return { ok: false, status: 401, message: "Invalid or expired token" };
+  }
+
+  const { email, category } = payload;
+  const normalizedEmail = normalizeEmail(email);
+  if (await hasIpaAccountForEmail(normalizedEmail)) {
+    return {
+      ok: false,
+      status: 401,
+      message: "This email address belongs to a FreeIPA-managed account. Sign in with FreeIPA.",
+    };
+  }
+
+  // Reject expired accounts at login time, not just during cleanup. Without
+  // this, an expired local user / guest could still authenticate in the
+  // window between expiry and the next lifecycle run.
+  const userRows = await sql`
+    SELECT id, account_expires
+    FROM auth.users
+    WHERE lower(btrim(mail)) = ${normalizedEmail} AND provider = 'local'
+      AND (account_expires IS NULL OR account_expires > now())
+    ORDER BY profile = 'user' DESC
+    LIMIT 1
+  `;
+
+  let userId: string;
+  let createdGuest = false;
+  if (userRows.length > 0) {
+    userId = userRows[0]!.id as string;
+  } else {
+    // Distinguish "no account" from "account expired" for a better error.
+    const expiredRows = await sql`
+      SELECT id
+      FROM auth.users
+      WHERE lower(btrim(mail)) = ${normalizedEmail} AND provider = 'local'
+        AND account_expires IS NOT NULL AND account_expires <= now()
+      LIMIT 1
+    `;
+    if (expiredRows.length > 0) {
+      return {
+        ok: false,
+        status: 403,
+        message: "Your account has expired. Contact an administrator.",
+      };
+    }
+    const allowSelfRegistration = await settings.get<boolean>("user.allow_self_registration");
+    if (!allowSelfRegistration || category === "login" || !(await isAccountCategoryAllowed({ provider: "local", profile: "guest" }))) {
+      return {
+        ok: false,
+        status: 401,
+        message: "Only existing local accounts can sign in with email. Contact an administrator if you need access.",
+      };
+    }
+    const guest = await providers.local.users.createGuest({ email });
+    if (!guest.ok) {
+      return { ok: false, status: guest.status, message: guest.error };
+    }
+    userId = guest.data.id;
+    createdGuest = true;
+  }
+
+  const user = await accounts.users.get({ id: userId });
+  if (!user) {
+    return { ok: false, status: 401, message: "User not found" };
+  }
+  if (!(await isAccountCategoryAllowed(user)) || (category && accountCategory(user) !== category))
+    return { ok: false, status: 403, message: "This account cannot sign in through this category. Contact an administrator." };
+
+  return { ok: true, userId, user, email, createdGuest };
+};

package/src/services/auth-flows/notification-sender.ts

@@ -0,0 +1,10 @@
+export type AuthNotificationDeliveryResult = {
+  id: string;
+  status: "queued" | "delivered" | "suppressed" | "error";
+};
+
+export type AuthNotificationSender = {
+  sendMagicLink: (input: { email: string; token: string; magicLink: string; locale?: string }) => Promise<AuthNotificationDeliveryResult>;
+  sendIpaLoginHint: (input: { email: string; loginUrl: string; locale?: string }) => Promise<AuthNotificationDeliveryResult>;
+  sendPasswordReset: (input: { email: string; resetLink: string; locale?: string }) => Promise<AuthNotificationDeliveryResult>;
+};

package/src/services/auth-flows/password-reset.ts

@@ -0,0 +1,268 @@
+import { redis, sql } from "bun";
+import type { User } from "../../contracts/shared";
+import { createAuthPasswordResetUrl } from "../../shared/redirect";
+import { isAccountCategoryAllowed } from "../account-category-policy";
+import { getFreeIpaConfig } from "../freeipa-config";
+import { getServiceIpaSession } from "../ipa/service-account";
+import { logger } from "../logging";
+import { providers } from "../providers";
+import { session } from "../session";
+import * as settings from "../settings";
+import * as ipaFlow from "./ipa";
+import type { AuthNotificationDeliveryResult, AuthNotificationSender } from "./notification-sender";
+
+const log = logger("auth:password-reset");
+
+const REQUEST_TTL_SECONDS = 900;
+const REQUEST_COOLDOWN_SECONDS = 60;
+const GENERIC_MESSAGE = "If this account can reset a password, a reset link has been sent.";
+
+type ResetTarget = {
+  userId: string;
+  uid: string;
+  email: string;
+};
+
+type ResetAttemptSuccess = {
+  ok: true;
+  userId: string;
+  user: User;
+};
+
+type ResetAttemptFailure =
+  | {
+      ok: false;
+      status: 400;
+      reason: "policy_failed";
+      message: string;
+    }
+  | {
+      ok: false;
+      status: 400 | 401;
+      reason: "invalid_or_expired";
+      message: string;
+    }
+  | {
+      ok: false;
+      status: number;
+      reason: "reset_failed" | "login_failed";
+      message: string;
+    };
+
+const normalizeEmail = (email: string): string => email.trim().toLowerCase();
+const cooldownKey = (email: string) => `password-reset-cooldown:${email}`;
+
+const isInCooldown = async (email: string): Promise<boolean> => {
+  if (await redis.get(cooldownKey(email))) return true;
+  await redis.set(cooldownKey(email), "1", "EX", REQUEST_COOLDOWN_SECONDS);
+  return false;
+};
+
+const buildTarget = (row: { id: string; uid: string; mail: string }): ResetTarget => ({
+  userId: row.id,
+  uid: row.uid,
+  email: row.mail,
+});
+
+const resolveResetTarget = async (email: string): Promise<ResetTarget | null> => {
+  const rows = await sql<{ id: string; uid: string; mail: string }[]>`
+    SELECT id, uid, btrim(mail) AS mail
+    FROM auth.users
+    WHERE provider = 'ipa'
+      AND profile = 'user'
+      AND lower(btrim(mail)) = ${email}
+      AND (account_expires IS NULL OR account_expires > now())
+  `;
+
+  if (rows.length !== 1) {
+    if (rows.length > 1) {
+      log.warn("Password reset skipped: ambiguous IPA email", {
+        email,
+        matches: rows.length,
+      });
+    }
+    return null;
+  }
+
+  return buildTarget(rows[0]!);
+};
+
+const resolveResetTargetForToken = async (params: { userId: string; email: string }): Promise<ResetTarget | null> => {
+  const rows = await sql<{ id: string; uid: string; mail: string }[]>`
+    SELECT id, uid, btrim(mail) AS mail
+    FROM auth.users
+    WHERE id = ${params.userId}
+      AND provider = 'ipa'
+      AND profile = 'user'
+      AND lower(btrim(mail)) = ${params.email}
+      AND (account_expires IS NULL OR account_expires > now())
+    LIMIT 1
+  `;
+
+  return rows.length === 1 ? buildTarget(rows[0]!) : null;
+};
+
+const sendResetEmail = async (
+  params: ResetTarget & { redirectTo?: string; locale?: string },
+  notificationSender: AuthNotificationSender,
+): Promise<AuthNotificationDeliveryResult> => {
+  const token = await providers.local.auth.createPasswordResetToken({
+    userId: params.userId,
+    uid: params.uid,
+    email: params.email,
+    ttlSeconds: REQUEST_TTL_SECONDS,
+  });
+  const rawAppUrl = await settings.get<string>("app.url");
+  const appUrl = rawAppUrl.startsWith("http") ? rawAppUrl : `https://${rawAppUrl}`;
+  const resetLink = createAuthPasswordResetUrl(appUrl, {
+    token,
+    redirectTo: params.redirectTo,
+  });
+  return notificationSender.sendPasswordReset({ email: params.email, resetLink, locale: params.locale });
+};
+
+const changeTemporaryPassword = async (params: {
+  userId: string;
+  uid: string;
+  email: string;
+  temporaryPassword: string;
+  newPassword: string;
+}): Promise<ResetAttemptSuccess | ResetAttemptFailure> => {
+  const changeResult = await ipaFlow.changeExpiredPassword({
+    username: params.uid,
+    currentPassword: params.temporaryPassword,
+    newPassword: params.newPassword,
+  });
+
+  if (!changeResult.ok) {
+    if (changeResult.reason === "change_failed") {
+      return {
+        ok: false,
+        status: 400,
+        reason: "policy_failed",
+        message: `${changeResult.message} Request a new reset link and choose a stronger password.`,
+      };
+    }
+
+    return {
+      ok: false,
+      status: changeResult.status,
+      reason: "login_failed",
+      message: changeResult.message,
+    };
+  }
+
+  await session.revokeAllForUser(changeResult.userId);
+
+  return {
+    ok: true,
+    userId: changeResult.userId,
+    user: changeResult.user,
+  };
+};
+
+export const request = async (
+  params: { email: string; redirectTo?: string; locale?: string },
+  notificationSender: AuthNotificationSender,
+): Promise<{ ok: true; message: string }> => {
+  if (!(await isAccountCategoryAllowed({ provider: "ipa", profile: "user" }))) return { ok: true, message: GENERIC_MESSAGE };
+  const email = normalizeEmail(params.email);
+  if (await isInCooldown(email)) {
+    log.info("Password reset request ignored during cooldown");
+    return { ok: true, message: GENERIC_MESSAGE };
+  }
+
+  const freeIpaConfig = await getFreeIpaConfig();
+  if (!freeIpaConfig.enabled || !freeIpaConfig.configured) {
+    log.info("Password reset request accepted while FreeIPA is unavailable");
+    return { ok: true, message: GENERIC_MESSAGE };
+  }
+
+  const target = await resolveResetTarget(email);
+  if (!target) {
+    log.info("Password reset request accepted without eligible target");
+    return { ok: true, message: GENERIC_MESSAGE };
+  }
+
+  try {
+    const result = await sendResetEmail({ ...target, redirectTo: params.redirectTo, locale: params.locale }, notificationSender);
+    if (result.status === "error") log.error("Password reset delivery failed", { notificationId: result.id, uid: target.uid });
+    else log.info("Password reset notification accepted", { notificationId: result.id, uid: target.uid, status: result.status });
+  } catch (error) {
+    log.error("Password reset notification could not be accepted", {
+      uid: target.uid,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+  return { ok: true, message: GENERIC_MESSAGE };
+};
+
+export const complete = async (params: { token?: string; newPassword: string }): Promise<ResetAttemptSuccess | ResetAttemptFailure> => {
+  if (!(await isAccountCategoryAllowed({ provider: "ipa", profile: "user" })))
+    return { ok: false, status: 403, reason: "reset_failed", message: "FreeIPA accounts are disabled. Contact an administrator." };
+  if (!params.token) {
+    return {
+      ok: false,
+      status: 400,
+      reason: "invalid_or_expired",
+      message: "Missing password reset token.",
+    };
+  }
+
+  const payload = await providers.local.auth.consumePasswordResetToken(params.token);
+  if (!payload) {
+    return {
+      ok: false,
+      status: 401,
+      reason: "invalid_or_expired",
+      message: "This password reset link has expired. Request a new reset link.",
+    };
+  }
+
+  const target = await resolveResetTargetForToken({
+    userId: payload.userId,
+    email: payload.email,
+  });
+  if (!target) {
+    return {
+      ok: false,
+      status: 401,
+      reason: "invalid_or_expired",
+      message: "This password reset link has expired. Request a new reset link.",
+    };
+  }
+
+  const serviceSession = await getServiceIpaSession();
+  if (!serviceSession.ok) {
+    return {
+      ok: false,
+      status: serviceSession.status,
+      reason: "reset_failed",
+      message: serviceSession.error,
+    };
+  }
+
+  const resetResult = await providers.ipa.users.resetPassword({
+    ipaSession: serviceSession.data,
+    id: target.userId,
+  });
+  if (!resetResult.ok) {
+    return {
+      ok: false,
+      status: resetResult.status,
+      reason: "reset_failed",
+      message: resetResult.error,
+    };
+  }
+
+  return changeTemporaryPassword({
+    ...target,
+    temporaryPassword: resetResult.data.password,
+    newPassword: params.newPassword,
+  });
+};
+
+export const passwordReset = {
+  request,
+  complete,
+} as const;

package/src/services/auth-flows/proxy-return.ts

@@ -0,0 +1,49 @@
+import { redis } from "bun";
+
+const KEY_PREFIX = "auth:proxy-return:";
+const DEFAULT_TTL_SECONDS = 300;
+
+type ProxyReturnPayload = {
+  clientId: string;
+  url: string;
+};
+
+const key = (token: string) => `${KEY_PREFIX}${token}`;
+
+const normalizeReturnUrl = (value: string): string | null => {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+    return url.toString();
+  } catch {
+    return null;
+  }
+};
+
+export const create = async (params: { clientId: string; url: string; ttlSeconds?: number }): Promise<string | null> => {
+  const url = normalizeReturnUrl(params.url);
+  if (!url) return null;
+
+  const token = crypto.randomUUID();
+  const payload: ProxyReturnPayload = {
+    clientId: params.clientId,
+    url,
+  };
+  await redis.set(key(token), JSON.stringify(payload), "EX", params.ttlSeconds ?? DEFAULT_TTL_SECONDS);
+  return token;
+};
+
+export const consume = async (params: { token: string }): Promise<ProxyReturnPayload | null> => {
+  const raw = await redis.getdel(key(params.token));
+  if (!raw) return null;
+
+  try {
+    const payload = JSON.parse(raw) as Partial<ProxyReturnPayload>;
+    if (typeof payload.clientId !== "string" || typeof payload.url !== "string") return null;
+    const url = normalizeReturnUrl(payload.url);
+    if (!url) return null;
+    return { clientId: payload.clientId, url };
+  } catch {
+    return null;
+  }
+};

package/src/services/document-extraction.ts

@@ -0,0 +1,148 @@
+import type { Format as AnyDocFormat } from "@firecrawl/anydoc";
+import {
+  formatFromBytes as anydocFormatFromBytes,
+  formatFromExtension as anydocFormatFromExtension,
+  toMarkdownBytes,
+} from "@firecrawl/anydoc";
+
+export const DOCUMENT_EXTRACTION_MAX_INPUT_BYTES = 20 * 1024 * 1024;
+export const DOCUMENT_EXTRACTION_MAX_OUTPUT_BYTES = 1024 * 1024;
+
+export type DocumentFormat = "doc" | "docx" | "odt" | "pdf" | "ppt" | "pptx" | "rtf" | "epub" | "xlsx" | "ods" | "odp" | "csv";
+
+export type DocumentExtractionErrorCode =
+  | "cancelled"
+  | "encrypted"
+  | "internal"
+  | "input_too_large"
+  | "malformed"
+  | "ocr_required"
+  | "resource_limit"
+  | "unsupported";
+
+export class DocumentExtractionError extends Error {
+  constructor(
+    readonly code: DocumentExtractionErrorCode,
+    message: string,
+  ) {
+    super(message);
+    this.name = "DocumentExtractionError";
+  }
+}
+
+export type ExtractDocumentMarkdownInput = {
+  bytes: Uint8Array;
+  filename?: string | null;
+  signal?: AbortSignal;
+};
+
+export type ExtractDocumentMarkdownResult = {
+  format: DocumentFormat;
+  markdown: string;
+  inputBytes: number;
+  outputBytes: number;
+  truncated: boolean;
+};
+
+const anydocErrorCode = (error: unknown): string | null => {
+  if (!error || typeof error !== "object" || !("code" in error)) return null;
+  return typeof error.code === "string" ? error.code : null;
+};
+
+const cancelled = (): DocumentExtractionError => new DocumentExtractionError("cancelled", "Document extraction was cancelled.");
+
+const assertNotCancelled = (signal: AbortSignal | undefined): void => {
+  if (signal?.aborted) throw cancelled();
+};
+
+const filenameExtension = (filename: string | null | undefined): string | null => {
+  const name = filename?.trim();
+  if (!name) return null;
+  const basename = name.split(/[\\/]/u).at(-1) ?? "";
+  const dot = basename.lastIndexOf(".");
+  return dot > 0 && dot < basename.length - 1 ? basename.slice(dot + 1) : null;
+};
+
+export const documentFormatFromFilename = (filename: string | null | undefined): DocumentFormat | null => {
+  const extension = filenameExtension(filename);
+  return extension ? (anydocFormatFromExtension(extension) as DocumentFormat | null) : null;
+};
+
+export const documentFormatFromBytes = (bytes: Uint8Array): DocumentFormat | null => anydocFormatFromBytes(bytes) as DocumentFormat | null;
+
+const resolveFormat = (bytes: Uint8Array, filename: string | null | undefined): AnyDocFormat | null => {
+  const detected = anydocFormatFromBytes(bytes);
+  if (detected) return detected;
+  const extension = filenameExtension(filename);
+  const fromExtension = extension ? anydocFormatFromExtension(extension) : null;
+  return fromExtension === "csv" ? fromExtension : null;
+};
+
+const truncateUtf8 = (value: string, limit: number): { value: string; bytes: number; truncated: boolean } => {
+  const encoded = new TextEncoder().encode(value);
+  if (encoded.byteLength <= limit) return { value, bytes: encoded.byteLength, truncated: false };
+
+  for (let trim = 0; trim <= 3; trim += 1) {
+    try {
+      const slice = encoded.slice(0, limit - trim);
+      return {
+        value: new TextDecoder("utf-8", { fatal: true }).decode(slice),
+        bytes: slice.byteLength,
+        truncated: true,
+      };
+    } catch {
+      // A byte limit can split one UTF-8 code point by at most three bytes.
+    }
+  }
+  throw new DocumentExtractionError("malformed", "Extracted document text is not valid UTF-8.");
+};
+
+const mapConversionError = (error: unknown, format: DocumentFormat): DocumentExtractionError => {
+  switch (anydocErrorCode(error)) {
+    case "encrypted":
+      return new DocumentExtractionError("encrypted", "The document is encrypted or password-protected.");
+    case "resourceLimit":
+      return new DocumentExtractionError("resource_limit", "The document exceeds safe extraction limits.");
+    case "malformed":
+    case "missingPart":
+      return new DocumentExtractionError("malformed", "The document is malformed or incomplete.");
+    case "unsupported":
+      return format === "pdf"
+        ? new DocumentExtractionError("ocr_required", "The PDF has no readable text and requires OCR.")
+        : new DocumentExtractionError("unsupported", "The document format is not supported.");
+    default:
+      return new DocumentExtractionError("internal", "The document could not be extracted.");
+  }
+};
+
+export const extractDocumentMarkdown = async (input: ExtractDocumentMarkdownInput): Promise<ExtractDocumentMarkdownResult> => {
+  assertNotCancelled(input.signal);
+  if (input.bytes.byteLength === 0) throw new DocumentExtractionError("malformed", "The document is empty.");
+  if (input.bytes.byteLength > DOCUMENT_EXTRACTION_MAX_INPUT_BYTES) {
+    throw new DocumentExtractionError(
+      "input_too_large",
+      `The document exceeds the ${DOCUMENT_EXTRACTION_MAX_INPUT_BYTES}-byte extraction limit.`,
+    );
+  }
+
+  const format = resolveFormat(input.bytes, input.filename);
+  if (!format) throw new DocumentExtractionError("unsupported", "The document format is not supported.");
+  const publicFormat = format as DocumentFormat;
+
+  let markdown: string;
+  try {
+    markdown = await toMarkdownBytes(input.bytes, format);
+  } catch (error) {
+    throw mapConversionError(error, publicFormat);
+  }
+  assertNotCancelled(input.signal);
+
+  const bounded = truncateUtf8(markdown, DOCUMENT_EXTRACTION_MAX_OUTPUT_BYTES);
+  return {
+    format: publicFormat,
+    markdown: bounded.value,
+    inputBytes: input.bytes.byteLength,
+    outputBytes: bounded.bytes,
+    truncated: bounded.truncated,
+  };
+};