@rubytech/create-maxy-code 0.1.457 → 0.1.459

package/payload/server/{chunk-SDYRKIYY.js → chunk-Q6W4U6HL.js}

@@ -8,6 +8,22 @@ function authorizeAccess(params) {
   return { allow: true, reason: "owner" };
 }
 
+// ../lib/storage-broker/src/object-limits.ts
+var R2_OBJECT_MAX_BYTES = 100 * 1024 * 1024;
+function base64Ceiling(bytes) {
+  return 4 * Math.ceil(bytes / 3);
+}
+var PUT_ENVELOPE_ALLOWANCE_BYTES = 64 * 1024;
+var R2_OBJECT_PUT_MAX_BODY_BYTES = base64Ceiling(R2_OBJECT_MAX_BYTES) + PUT_ENVELOPE_ALLOWANCE_BYTES;
+function formatMiB(bytes) {
+  return (bytes / 1024 / 1024).toFixed(1);
+}
+function tooLargeMessage(what, actualBytes) {
+  return `${what} is ${formatMiB(actualBytes)} MiB (${actualBytes} bytes), which exceeds the ${formatMiB(
+    R2_OBJECT_MAX_BYTES
+  )} MiB (${R2_OBJECT_MAX_BYTES} bytes) R2 object limit.`;
+}
+
 // ../lib/storage-broker/src/registry.ts
 async function registerResource(session, r) {
   await session.run(
@@ -120,6 +136,12 @@ function keyForScope(scope) {
 }
 
 // ../lib/storage-broker/src/cf-exec.ts
+function encodeObjectKey(key) {
+  return key.split("/").map(encodeURIComponent).join("/");
+}
+function objectUrl(accountId, bucket, key) {
+  return `https://api.cloudflare.com/client/v4/accounts/${accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects/${encodeObjectKey(key)}`;
+}
 var defaultFetch = (url, init) => fetch(url, init);
 var defaultRun2 = (cmd, args, env) => new Promise((resolve, reject) => {
   execFile2(cmd, args, { env }, (err, stdout, stderr) => {
@@ -138,6 +160,19 @@ function parseJson(raw, context) {
     throw new Error(`storage-broker: ${context} returned non-JSON output: ${raw}`);
   }
 }
+async function cfApiJson(fetchFn, url, init, context) {
+  const res = await fetchFn(url, init);
+  const body = await res.text();
+  if (!res.ok) {
+    throw new Error(`storage-broker: ${context} failed: ${res.status}
+${body}`);
+  }
+  const parsed = parseJson(body, context);
+  if (parsed?.success !== true) {
+    throw new Error(`storage-broker: ${context} API error: ${body}`);
+  }
+  return { parsed, body };
+}
 function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
   const env = {
     ...process.env,
@@ -151,24 +186,24 @@ function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
     },
     async d1Create(name) {
       const url = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/d1/database`;
-      const res = await fetchFn(url, {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${cred.apiToken}`,
-          "Content-Type": "application/json"
+      const { parsed, body } = await cfApiJson(
+        fetchFn,
+        url,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${cred.apiToken}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({ name })
         },
-        body: JSON.stringify({ name })
-      });
-      const body = await res.text();
-      if (!res.ok) {
-        throw new Error(`storage-broker: d1 create failed: ${res.status}
-${body}`);
-      }
-      const parsed = parseJson(body, "d1 create");
-      if (parsed.success !== true || typeof parsed.result?.uuid !== "string") {
+        "d1 create"
+      );
+      const uuid = parsed.result?.uuid;
+      if (typeof uuid !== "string") {
         throw new Error(`storage-broker: d1 create API error: ${body}`);
       }
-      return { uuid: parsed.result.uuid };
+      return { uuid };
     },
     async d1Query(name, sql) {
       const { stdout } = await run(
@@ -179,24 +214,111 @@ ${body}`);
       return parseJson(stdout, "d1 execute");
     },
     async r2List() {
-      const url = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets`;
-      const res = await fetchFn(url, {
+      const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets`;
+      const buckets = [];
+      const seen = /* @__PURE__ */ new Set();
+      let cursor;
+      for (; ; ) {
+        const url = cursor === void 0 ? base : `${base}?cursor=${encodeURIComponent(cursor)}`;
+        const { parsed } = await cfApiJson(
+          fetchFn,
+          url,
+          { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } },
+          "r2 bucket list"
+        );
+        const page = parsed;
+        for (const b of page.result?.buckets ?? []) buckets.push({ name: b.name });
+        const next = page.result_info?.cursor;
+        if (!next) return buckets;
+        if (seen.has(next)) {
+          throw new Error(
+            `storage-broker: r2 bucket list returned a repeated pagination cursor: ${next}`
+          );
+        }
+        seen.add(next);
+        cursor = next;
+      }
+    },
+    async r2Create(name) {
+      await run("npx", ["wrangler", "r2", "bucket", "create", name], env);
+    },
+    // --- R2 objects (Task 1691) -------------------------------------------
+    //
+    // The v4 REST API exposes the object surface under
+    // /accounts/{id}/r2/buckets/{bucket}/objects and accepts the same Bearer
+    // token as the bucket endpoints (account-level Workers R2 Storage Write).
+    // The r2/api/tokens/ note that "Object Read & Write" is S3-only constrains
+    // the bucket-item-scoped *permission types*, not these endpoints.
+    //
+    // Doc-confirmed, never measured: no house Cloudflare credential exists on
+    // the dev machine. The design keeps the unmeasured facts unable to affect
+    // correctness — per_page is never sent, and nothing fails silently.
+    async r2ObjectList(bucket, prefix) {
+      const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects`;
+      const objects = [];
+      const seen = /* @__PURE__ */ new Set();
+      let cursor;
+      for (; ; ) {
+        const params = new URLSearchParams();
+        if (prefix !== void 0) params.set("prefix", prefix);
+        if (cursor !== void 0) params.set("cursor", cursor);
+        const qs = params.toString();
+        const { parsed, body } = await cfApiJson(
+          fetchFn,
+          qs ? `${base}?${qs}` : base,
+          { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } },
+          "r2 object list"
+        );
+        const page = parsed;
+        for (const o of page.result ?? []) {
+          objects.push({ key: o.key, size: o.size, etag: o.etag, lastModified: o.last_modified });
+        }
+        const truncated = page.result_info?.is_truncated;
+        const next = page.result_info?.cursor;
+        if (truncated === false) return objects;
+        if (truncated === true && !next) {
+          throw new Error(
+            `storage-broker: r2 object list reported truncated but gave no pagination cursor: ${body}`
+          );
+        }
+        if (!next) return objects;
+        if (seen.has(next)) {
+          throw new Error(
+            `storage-broker: r2 object list returned a repeated pagination cursor: ${next}`
+          );
+        }
+        seen.add(next);
+        cursor = next;
+      }
+    },
+    async r2ObjectGet(bucket, key) {
+      const res = await fetchFn(objectUrl(cred.accountId, bucket, key), {
         method: "GET",
         headers: { Authorization: `Bearer ${cred.apiToken}` }
       });
-      const body = await res.text();
       if (!res.ok) {
-        throw new Error(`storage-broker: r2 bucket list failed: ${res.status}
-${body}`);
-      }
-      const parsed = parseJson(body, "r2 bucket list");
-      if (parsed.success !== true) {
-        throw new Error(`storage-broker: r2 bucket list API error: ${body}`);
+        throw new Error(
+          `storage-broker: r2 object get failed: ${res.status}
+${await res.text()}`
+        );
       }
-      return (parsed.result?.buckets ?? []).map((b) => ({ name: b.name }));
+      return new Uint8Array(await res.arrayBuffer());
     },
-    async r2Create(name) {
-      await run("npx", ["wrangler", "r2", "bucket", "create", name], env);
+    async r2ObjectPut(bucket, key, body) {
+      await cfApiJson(
+        fetchFn,
+        objectUrl(cred.accountId, bucket, key),
+        { method: "PUT", headers: { Authorization: `Bearer ${cred.apiToken}` }, body },
+        "r2 object put"
+      );
+    },
+    async r2ObjectDelete(bucket, key) {
+      await cfApiJson(
+        fetchFn,
+        objectUrl(cred.accountId, bucket, key),
+        { method: "DELETE", headers: { Authorization: `Bearer ${cred.apiToken}` } },
+        "r2 object delete"
+      );
     }
   };
 }
@@ -260,6 +382,10 @@ function stripAccountWideTokens(contents) {
 
 export {
   authorizeAccess,
+  R2_OBJECT_MAX_BYTES,
+  base64Ceiling,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
+  tooLargeMessage,
   registerResource,
   resolveOwner,
   listResources,

package/payload/server/maxy-edge.js

@@ -16,7 +16,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-F4D35LKL.js";
+} from "./chunk-POBXIHOF.js";
 import "./chunk-PFF6I7KP.js";
 
 // server/edge.ts

package/payload/server/server.js

@@ -9,6 +9,7 @@ import {
   CLAUDE_CREDENTIALS_FILE,
   COMMERCIAL_MODE,
   GREETING_DIRECTIVE,
+  HTTPException,
   Hono,
   HtmlEscapedCallbackPhase,
   INSTALL_OWNER_FILE,
@@ -110,14 +111,17 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-F4D35LKL.js";
+} from "./chunk-POBXIHOF.js";
 import {
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
   authorizeAccess,
   listResources,
   makeHouseCfExec,
   registerResource,
-  resolveOwner
-} from "./chunk-SDYRKIYY.js";
+  resolveOwner,
+  tooLargeMessage
+} from "./chunk-Q6W4U6HL.js";
 import {
   __commonJS,
   __toESM
@@ -8664,6 +8668,65 @@ app2.get("/group-info", async (c) => {
 });
 var whatsapp_default = app2;
 
+// node_modules/hono/dist/middleware/body-limit/index.js
+var ERROR_MESSAGE = "Payload Too Large";
+var BodyLimitError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BodyLimitError";
+  }
+};
+var bodyLimit = (options) => {
+  const onError = options.onError || (() => {
+    const res = new Response(ERROR_MESSAGE, {
+      status: 413
+    });
+    throw new HTTPException(413, { res });
+  });
+  const maxSize = options.maxSize;
+  return async function bodyLimit2(c, next) {
+    if (!c.req.raw.body) {
+      return next();
+    }
+    const hasTransferEncoding = c.req.raw.headers.has("transfer-encoding");
+    const hasContentLength = c.req.raw.headers.has("content-length");
+    if (hasTransferEncoding && hasContentLength) {
+    }
+    if (hasContentLength && !hasTransferEncoding) {
+      const contentLength = parseInt(c.req.raw.headers.get("content-length") || "0", 10);
+      return contentLength > maxSize ? onError(c) : next();
+    }
+    let size = 0;
+    const rawReader = c.req.raw.body.getReader();
+    const reader = new ReadableStream({
+      async start(controller) {
+        try {
+          for (; ; ) {
+            const { done, value } = await rawReader.read();
+            if (done) {
+              break;
+            }
+            size += value.length;
+            if (size > maxSize) {
+              controller.error(new BodyLimitError(ERROR_MESSAGE));
+              break;
+            }
+            controller.enqueue(value);
+          }
+        } finally {
+          controller.close();
+        }
+      }
+    });
+    const requestInit = { body: reader, duplex: "half" };
+    c.req.raw = new Request(c.req.raw, requestInit);
+    await next();
+    if (c.error instanceof BodyLimitError) {
+      c.res = await onError(c);
+    }
+  };
+};
+
 // server/routes/storage-broker.ts
 import { join as join11, resolve as resolve11 } from "path";
 import { readdirSync as readdirSync6, readFileSync as readFileSync13, existsSync as existsSync8 } from "fs";
@@ -8674,9 +8737,9 @@ function platformRoot() {
 function caller(c) {
   return c.req.header("x-maxy-caller-account")?.trim() || null;
 }
-function log(action, kind, account, target, owner, result) {
+function log(action, kind, account, target, owner, result, reason) {
   console.error(
-    `[storage-broker] op=storage-broker resource=${kind} action=${action} account=${account} target=${target} owner=${owner ?? "none"} result=${result}`
+    `[storage-broker] op=storage-broker resource=${kind} action=${action} account=${account} target=${target} owner=${owner ?? "none"} result=${result}${reason ? ` reason=${reason}` : ""}`
   );
 }
 function cfExec() {
@@ -8774,9 +8837,146 @@ app3.post("/r2/create", async (c) => {
     await session.close();
   }
 });
+async function objectGate(c, action) {
+  const account = caller(c);
+  if (!account) return { ok: false, res: c.json({ error: "no-caller" }, 403) };
+  let body;
+  try {
+    body = await c.req.json();
+  } catch (err) {
+    if (err instanceof Error && err.name === "BodyLimitError") throw err;
+    return { ok: false, res: c.json({ error: "invalid-json" }, 400) };
+  }
+  const bucket = body.bucket;
+  if (!bucket || typeof bucket !== "string") {
+    return { ok: false, res: c.json({ error: "bucket-required" }, 400) };
+  }
+  const session = getSession();
+  let owner;
+  try {
+    owner = await resolveOwner(session, "r2", bucket);
+  } catch (err) {
+    return { ok: false, res: c.json({ error: String(err) }, 500) };
+  } finally {
+    await session.close();
+  }
+  const decision = authorizeAccess({ caller: account, owner, action });
+  log(action, "r2", account, bucket, owner, decision.allow ? "allow" : "deny");
+  if (!decision.allow) return { ok: false, res: c.json({ error: decision.reason }, 403) };
+  return { ok: true, bucket, body };
+}
+function readKey(body) {
+  const key = body.key;
+  return typeof key === "string" && key.length > 0 ? key : null;
+}
+app3.post("/r2/object/list", async (c) => {
+  const gate = await objectGate(c, "list");
+  if (!gate.ok) return gate.res;
+  const prefix = gate.body.prefix;
+  if (prefix !== void 0 && typeof prefix !== "string") {
+    return c.json({ error: "prefix-must-be-string" }, 400);
+  }
+  try {
+    const objects = await (await cfExec()).r2ObjectList(gate.bucket, prefix);
+    return c.json({ objects });
+  } catch (err) {
+    return c.json({ error: String(err) }, 500);
+  }
+});
+app3.post("/r2/object/get", async (c) => {
+  const gate = await objectGate(c, "read");
+  if (!gate.ok) return gate.res;
+  const key = readKey(gate.body);
+  if (!key) return c.json({ error: "key-required" }, 400);
+  try {
+    const cf = await cfExec();
+    const listed = await cf.r2ObjectList(gate.bucket, key);
+    const size = listed.find((o) => o.key === key)?.size;
+    if (typeof size !== "number" || !Number.isFinite(size) || size < 0) {
+      log("read", "r2", caller(c) ?? "none", key, caller(c), "deny", "size-unknown");
+      return c.json(
+        {
+          error: `${key} has no recorded size in ${gate.bucket}; refusing to transfer an object that cannot be bounded.`
+        },
+        409
+      );
+    }
+    if (size > R2_OBJECT_MAX_BYTES) {
+      log("read", "r2", caller(c) ?? "none", key, caller(c), "deny", "object-too-large");
+      return c.json({ error: tooLargeMessage(key, size) }, 413);
+    }
+    const bytes = await cf.r2ObjectGet(gate.bucket, key);
+    return c.json({ contentBase64: Buffer.from(bytes).toString("base64") });
+  } catch (err) {
+    return c.json({ error: String(err) }, 500);
+  }
+});
+app3.post(
+  "/r2/object/put",
+  // Task 1695 — before the body is buffered, not after. This process runs
+  // house-level and holds the account-wide credential, so an over-cap body
+  // buffered here is an OOM kill of the brand server. The handler cannot do this
+  // itself: objectGate's c.req.json() has already read the whole body by the time
+  // any handler code runs.
+  //
+  // Not redundant with the MCP's statSync check. Every account shares one unix
+  // user and the agent holds Bash, so these routes are reachable by curl with the
+  // MCP nowhere in the path; a cap enforced only there is bypassed by one
+  // command. The MCP check gives the precise, file-naming error; this one is what
+  // actually bounds house memory.
+  bodyLimit({
+    maxSize: R2_OBJECT_PUT_MAX_BODY_BYTES,
+    // The key is unknown here — the body is deliberately unparsed — so this names
+    // the limit rather than the object. The MCP names the file. The limit is
+    // stated in MiB like every other over-cap message, so an operator reading a
+    // route rejection and an MCP rejection can see they are one rule rather than
+    // two unrelated numbers.
+    //
+    // It logs, because a task filed on "the OOM emits nothing" must not ship a
+    // rejection that also emits nothing. On the content-length branch — the shape
+    // every real caller sends — no body is read and no handler runs, so this line
+    // is the only trace the request ever existed.
+    onError: (c) => {
+      log("write", "r2", caller(c) ?? "none", "*", null, "deny", "body-too-large");
+      return c.json(
+        {
+          error: `request body exceeds the ${(R2_OBJECT_PUT_MAX_BODY_BYTES / 1024 / 1024).toFixed(1)} MiB limit for an R2 object put (a base64-encoded ${(R2_OBJECT_MAX_BYTES / 1024 / 1024).toFixed(1)} MiB object plus its envelope).`
+        },
+        413
+      );
+    }
+  }),
+  async (c) => {
+    const gate = await objectGate(c, "write");
+    if (!gate.ok) return gate.res;
+    const key = readKey(gate.body);
+    if (!key) return c.json({ error: "key-required" }, 400);
+    const contentBase64 = gate.body.contentBase64;
+    if (typeof contentBase64 !== "string") return c.json({ error: "contentBase64-required" }, 400);
+    try {
+      const bytes = new Uint8Array(Buffer.from(contentBase64, "base64"));
+      await (await cfExec()).r2ObjectPut(gate.bucket, key, bytes);
+      return c.json({ ok: true });
+    } catch (err) {
+      return c.json({ error: String(err) }, 500);
+    }
+  }
+);
+app3.post("/r2/object/delete", async (c) => {
+  const gate = await objectGate(c, "write");
+  if (!gate.ok) return gate.res;
+  const key = readKey(gate.body);
+  if (!key) return c.json({ error: "key-required" }, 400);
+  try {
+    await (await cfExec()).r2ObjectDelete(gate.bucket, key);
+    return c.json({ ok: true });
+  } catch (err) {
+    return c.json({ error: String(err) }, 500);
+  }
+});
 var storage_broker_default = app3;
 async function runStorageAudit(root) {
-  const { reconcileStorage } = await import("./src-554BYJMN.js");
+  const { reconcileStorage } = await import("./src-3I2RYZFB.js");
   const session = getSession();
   try {
     const cf = await makeHouseCfExec(root);

package/payload/server/{src-554BYJMN.js → src-3I2RYZFB.js}

@@ -1,6 +1,9 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
   authorizeAccess,
+  base64Ceiling,
   listResources,
   makeCfExec,
   makeHouseCfExec,
@@ -10,11 +13,15 @@ import {
   resolveHouseScopedToken,
   resolveOwner,
   stripAccountWideTokens,
+  tooLargeMessage,
   validateMapping
-} from "./chunk-SDYRKIYY.js";
+} from "./chunk-Q6W4U6HL.js";
 import "./chunk-PFF6I7KP.js";
 export {
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
   authorizeAccess,
+  base64Ceiling,
   listResources,
   makeCfExec,
   makeHouseCfExec,
@@ -24,5 +31,6 @@ export {
   resolveHouseScopedToken,
   resolveOwner,
   stripAccountWideTokens,
+  tooLargeMessage,
   validateMapping
 };