@rubytech/create-maxy-code 0.1.457 → 0.1.459

package/payload/platform/lib/storage-broker/dist/__tests__/object-limits.test.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const object_limits_js_1 = require("../object-limits.js");
+(0, node_test_1.default)("the cap is 100 MiB", () => {
+    strict_1.default.equal(object_limits_js_1.R2_OBJECT_MAX_BYTES, 100 * 1024 * 1024);
+});
+// The cap is set independently of email's 25 MiB. This pins that they are not
+// the same number, so a future edit that "unifies" them fails here and has to
+// read the design note rather than silently coupling two unrelated limits.
+(0, node_test_1.default)("the cap is not email's attachment cap", () => {
+    strict_1.default.notEqual(object_limits_js_1.R2_OBJECT_MAX_BYTES, 25 * 1024 * 1024);
+});
+(0, node_test_1.default)("base64Ceiling matches base64's 4-out-per-3-in expansion, rounded up", () => {
+    strict_1.default.equal((0, object_limits_js_1.base64Ceiling)(0), 0);
+    strict_1.default.equal((0, object_limits_js_1.base64Ceiling)(1), 4);
+    strict_1.default.equal((0, object_limits_js_1.base64Ceiling)(3), 4);
+    strict_1.default.equal((0, object_limits_js_1.base64Ceiling)(4), 8);
+    strict_1.default.equal((0, object_limits_js_1.base64Ceiling)(6), 8);
+});
+// The ceiling must never sit below what a legal at-cap object actually encodes
+// to, or a legitimate put would be rejected by its own encoding.
+(0, node_test_1.default)("base64Ceiling is never below Node's own base64 length", () => {
+    for (const n of [0, 1, 2, 3, 4, 5, 100, 1023, 4096]) {
+        const encoded = Buffer.alloc(n).toString("base64").length;
+        strict_1.default.ok((0, object_limits_js_1.base64Ceiling)(n) >= encoded, `base64Ceiling(${n}) = ${(0, object_limits_js_1.base64Ceiling)(n)} < ${encoded}`);
+    }
+});
+(0, node_test_1.default)("the put body ceiling admits a cap-sized object plus an envelope allowance", () => {
+    strict_1.default.equal(object_limits_js_1.R2_OBJECT_PUT_MAX_BODY_BYTES, (0, object_limits_js_1.base64Ceiling)(object_limits_js_1.R2_OBJECT_MAX_BYTES) + 64 * 1024);
+    strict_1.default.ok(object_limits_js_1.R2_OBJECT_PUT_MAX_BODY_BYTES > (0, object_limits_js_1.base64Ceiling)(object_limits_js_1.R2_OBJECT_MAX_BYTES));
+});
+// The allowance is for a key and JSON punctuation, not for smuggling a bigger
+// object: it must stay far below the cap it guards.
+(0, node_test_1.default)("the envelope allowance is negligible against the cap", () => {
+    const allowance = object_limits_js_1.R2_OBJECT_PUT_MAX_BODY_BYTES - (0, object_limits_js_1.base64Ceiling)(object_limits_js_1.R2_OBJECT_MAX_BYTES);
+    strict_1.default.ok(allowance < object_limits_js_1.R2_OBJECT_MAX_BYTES / 1000);
+});
+(0, node_test_1.default)("the over-cap message names the object and the limit", () => {
+    const msg = (0, object_limits_js_1.tooLargeMessage)("photo.jpg", 150 * 1024 * 1024);
+    strict_1.default.match(msg, /photo\.jpg/);
+    strict_1.default.match(msg, /150\.0 MiB/);
+    strict_1.default.match(msg, /100\.0 MiB/);
+});
+// Code review — MiB alone rounds, so an object one byte over the cap rendered as
+// "100.0 MiB, which exceeds the 100.0 MiB limit": a message that contradicts
+// itself and reads as a bug rather than a rejection. The exact bytes are what
+// disambiguate it, so they are pinned rather than left to formatting taste.
+(0, node_test_1.default)("the message stays legible for an object one byte over the cap", () => {
+    const msg = (0, object_limits_js_1.tooLargeMessage)("photo.jpg", object_limits_js_1.R2_OBJECT_MAX_BYTES + 1);
+    strict_1.default.match(msg, /104857601 bytes/);
+    strict_1.default.match(msg, /104857600 bytes/);
+    strict_1.default.notEqual(msg.match(/100\.0 MiB \(104857601 bytes\)/), null, "the actual size must carry its exact byte count");
+});
+//# sourceMappingURL=object-limits.test.js.map

package/payload/platform/lib/storage-broker/dist/__tests__/object-limits.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-limits.test.js","sourceRoot":"","sources":["../../src/__tests__/object-limits.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,0DAK6B;AAE7B,IAAA,mBAAI,EAAC,oBAAoB,EAAE,GAAG,EAAE;IAC9B,gBAAM,CAAC,KAAK,CAAC,sCAAmB,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,IAAA,mBAAI,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACjD,gBAAM,CAAC,QAAQ,CAAC,sCAAmB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAa,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAa,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAa,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAa,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAa,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,iEAAiE;AACjE,IAAA,mBAAI,EAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAC1D,gBAAM,CAAC,EAAE,CACP,IAAA,gCAAa,EAAC,CAAC,CAAC,IAAI,OAAO,EAC3B,iBAAiB,CAAC,OAAO,IAAA,gCAAa,EAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CACzD,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,gBAAM,CAAC,KAAK,CACV,+CAA4B,EAC5B,IAAA,gCAAa,EAAC,sCAAmB,CAAC,GAAG,EAAE,GAAG,IAAI,CAC/C,CAAC;IACF,gBAAM,CAAC,EAAE,CAAC,+CAA4B,GAAG,IAAA,gCAAa,EAAC,sCAAmB,CAAC,CAAC,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,oDAAoD;AACpD,IAAA,mBAAI,EAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,MAAM,SAAS,GAAG,+CAA4B,GAAG,IAAA,gCAAa,EAAC,sCAAmB,CAAC,CAAC;IACpF,gBAAM,CAAC,EAAE,CAAC,SAAS,GAAG,sCAAmB,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,qDAAqD,EAAE,GAAG,EAAE;IAC/D,MAAM,GAAG,GAAG,IAAA,kCAAe,EAAC,WAAW,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC5D,gBAAM,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChC,gBAAM,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChC,gBAAM,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,IAAA,mBAAI,EAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,GAAG,GAAG,IAAA,kCAAe,EAAC,WAAW,EAAE,sCAAmB,GAAG,CAAC,CAAC,CAAC;IAClE,gBAAM,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACrC,gBAAM,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACrC,gBAAM,CAAC,QAAQ,CACb,GAAG,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAC3C,IAAI,EACJ,iDAAiD,CAClD,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/payload/platform/lib/storage-broker/dist/cf-exec.d.ts

@@ -5,12 +5,19 @@ export type RunFn = (cmd: string, args: string[], env: Record<string, string>) =
 export type FetchFn = (url: string, init: {
     method: string;
     headers: Record<string, string>;
-    body?: string;
+    body?: string | Uint8Array;
 }) => Promise<{
     ok: boolean;
     status: number;
     text(): Promise<string>;
+    arrayBuffer(): Promise<ArrayBuffer>;
 }>;
+export interface R2Object {
+    key: string;
+    size: number;
+    etag: string;
+    lastModified: string;
+}
 export interface CfExec {
     d1List(): Promise<{
         name: string;
@@ -24,6 +31,10 @@ export interface CfExec {
         name: string;
     }[]>;
     r2Create(name: string): Promise<void>;
+    r2ObjectList(bucket: string, prefix?: string): Promise<R2Object[]>;
+    r2ObjectGet(bucket: string, key: string): Promise<Uint8Array>;
+    r2ObjectPut(bucket: string, key: string, body: Uint8Array): Promise<void>;
+    r2ObjectDelete(bucket: string, key: string): Promise<void>;
 }
 export declare function makeCfExec(cred: HouseCredential, run?: RunFn, fetchFn?: FetchFn): CfExec;
 export declare function makeHouseCfExec(platformRoot: string, run?: RunFn, fetchFn?: FetchFn): Promise<CfExec>;

package/payload/platform/lib/storage-broker/dist/cf-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cf-exec.d.ts","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,MAAM,MAAM,KAAK,GAAG,CAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAMjC,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACrE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEvE,MAAM,WAAW,MAAM;IACrB,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAuBD,wBAAgB,UAAU,CACxB,IAAI,EAAE,eAAe,EACrB,GAAG,GAAE,KAAkB,EACvB,OAAO,GAAE,OAAsB,GAC9B,MAAM,CAmFR;AASD,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,GAAG,GAAE,KAAkB,EACvB,OAAO,GAAE,OAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAMjB"}
+{"version":3,"file":"cf-exec.d.ts","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,MAAM,MAAM,KAAK,GAAG,CAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAYjC,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,KAClF,OAAO,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,MAAM;IACrB,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAuED,wBAAgB,UAAU,CACxB,IAAI,EAAE,eAAe,EACrB,GAAG,GAAE,KAAkB,EACvB,OAAO,GAAE,OAAsB,GAC9B,MAAM,CAuMR;AASD,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,GAAG,GAAE,KAAkB,EACvB,OAAO,GAAE,OAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAMjB"}

package/payload/platform/lib/storage-broker/dist/cf-exec.js

@@ -9,6 +9,24 @@ const node_child_process_1 = require("node:child_process");
 const node_path_1 = require("node:path");
 const house_credential_js_1 = require("./house-credential.js");
 const house_scoped_token_js_1 = require("./house-scoped-token.js");
+// An object key carries `/` as a real path separator (the data portal's
+// per-person prefixes), so it is encoded segment-wise rather than whole:
+// separators stay separators, and spaces and specials are escaped. This
+// encoding is not doc-confirmed; it is chosen so that a wrong guess surfaces as
+// a 404 carrying its body, never as a silently misfiled object.
+function encodeObjectKey(key) {
+    return key.split("/").map(encodeURIComponent).join("/");
+}
+// The single-object endpoint, shared by get/put/delete so the three cannot drift
+// apart on encoding.
+function objectUrl(accountId, bucket, key) {
+    return `https://api.cloudflare.com/client/v4/accounts/${accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects/${encodeObjectKey(key)}`;
+}
+// The cast is confined to this adapter. A Uint8Array is a valid fetch body at
+// runtime, but the DOM lib's BodyInit does not admit TypeScript's generic
+// Uint8Array<ArrayBufferLike>, so consumers compiled against DOM typings (the
+// ui server) reject the call the Node typings accept. Casting here keeps the
+// seam's own type honest for every caller and test.
 const defaultFetch = (url, init) => fetch(url, init);
 const defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
     (0, node_child_process_1.execFile)(cmd, args, { env }, (err, stdout, stderr) => {
@@ -27,6 +45,28 @@ function parseJson(raw, context) {
         throw new Error(`storage-broker: ${context} returned non-JSON output: ${raw}`);
     }
 }
+// The Cloudflare-API envelope, in one place. Both API-backed methods (r2List,
+// d1Create) share it: read the body exactly once, surface a non-2xx with its
+// body, parse, then require an explicit `success:true`. A 2xx whose body is not
+// a well-formed success envelope is an anomaly to surface with its body, never
+// a silently empty/uuid-less result. The raw `body` is returned alongside the
+// parsed value so callers can raise their own shaping errors on the original
+// bytes rather than a re-serialised copy.
+async function cfApiJson(fetchFn, url, init, context) {
+    const res = await fetchFn(url, init);
+    const body = await res.text();
+    if (!res.ok) {
+        throw new Error(`storage-broker: ${context} failed: ${res.status}\n${body}`);
+    }
+    // `null` is valid JSON and survives parseJson, so the guard is optional-
+    // chained: a null parsed value must surface its body like any other malformed
+    // 2xx shape, never a bare TypeError with the body dropped.
+    const parsed = parseJson(body, context);
+    if (parsed?.success !== true) {
+        throw new Error(`storage-broker: ${context} API error: ${body}`);
+    }
+    return { parsed, body };
+}
 function makeCfExec(cred, run = defaultRun, fetchFn = defaultFetch) {
     const env = {
         ...process.env,
@@ -46,26 +86,21 @@ function makeCfExec(cred, run = defaultRun, fetchFn = defaultFetch) {
             // so shelling it with --json is always rejected. The D1 API creates the
             // database and returns its record — incl. the uuid — as JSON directly.
             const url = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/d1/database`;
-            const res = await fetchFn(url, {
+            const { parsed, body } = await cfApiJson(fetchFn, url, {
                 method: "POST",
                 headers: {
                     Authorization: `Bearer ${cred.apiToken}`,
                     "Content-Type": "application/json",
                 },
                 body: JSON.stringify({ name }),
-            });
-            const body = await res.text();
-            if (!res.ok) {
-                throw new Error(`storage-broker: d1 create failed: ${res.status}\n${body}`);
-            }
-            const parsed = parseJson(body, "d1 create");
-            // Require an explicit success envelope with a uuid. A 2xx whose body is
-            // not a well-formed `success:true` response is an anomaly to surface with
-            // its body, never a silently uuid-less create.
-            if (parsed.success !== true || typeof parsed.result?.uuid !== "string") {
+            }, "d1 create");
+            // The envelope guard lives in cfApiJson; a uuid-less 2xx success envelope
+            // is still an anomaly to surface with its body, never a silent create.
+            const uuid = parsed.result?.uuid;
+            if (typeof uuid !== "string") {
                 throw new Error(`storage-broker: d1 create API error: ${body}`);
             }
-            return { uuid: parsed.result.uuid };
+            return { uuid };
         },
         async d1Query(name, sql) {
             const { stdout } = await run("npx", ["wrangler", "d1", "execute", name, "--remote", "--json", "--command", sql], env);
@@ -75,26 +110,121 @@ function makeCfExec(cred, run = defaultRun, fetchFn = defaultFetch) {
             // `wrangler r2 bucket list` has no --json flag and emits human prose, so
             // it can neither be parsed nor honour the "never grep a CLI's prose"
             // doctrine. The R2 API returns the bucket set as JSON directly.
-            const url = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets`;
-            const res = await fetchFn(url, {
+            //
+            // The endpoint paginates: a single request returns only the first page,
+            // and the audit reads the missing remainder as "absent", under-reporting
+            // strays. Follow result_info.cursor to exhaustion instead. per_page is
+            // deliberately never sent — its default and maximum are unconfirmed, and
+            // omitting it takes whatever page size Cloudflare serves, so the loop is
+            // complete without guessing a value that could 400 the request.
+            const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets`;
+            const buckets = [];
+            const seen = new Set();
+            let cursor;
+            for (;;) {
+                const url = cursor === undefined ? base : `${base}?cursor=${encodeURIComponent(cursor)}`;
+                const { parsed } = await cfApiJson(fetchFn, url, { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } }, "r2 bucket list");
+                const page = parsed;
+                for (const b of page.result?.buckets ?? [])
+                    buckets.push({ name: b.name });
+                // A missing, null, or empty cursor all mean "last page" — accept every
+                // documented last-page signal rather than depend on which one is sent.
+                const next = page.result_info?.cursor;
+                if (!next)
+                    return buckets;
+                // Any cursor seen before means the API is cycling rather than advancing,
+                // which would loop forever and re-append the same buckets each pass.
+                // Tracking every cursor (not just the last) also catches a cycle of
+                // period >= 2, which never repeats consecutively. Surface it instead of
+                // hanging the broker on an unbounded wait.
+                if (seen.has(next)) {
+                    throw new Error(`storage-broker: r2 bucket list returned a repeated pagination cursor: ${next}`);
+                }
+                seen.add(next);
+                cursor = next;
+            }
+        },
+        async r2Create(name) {
+            await run("npx", ["wrangler", "r2", "bucket", "create", name], env);
+        },
+        // --- R2 objects (Task 1691) -------------------------------------------
+        //
+        // The v4 REST API exposes the object surface under
+        // /accounts/{id}/r2/buckets/{bucket}/objects and accepts the same Bearer
+        // token as the bucket endpoints (account-level Workers R2 Storage Write).
+        // The r2/api/tokens/ note that "Object Read & Write" is S3-only constrains
+        // the bucket-item-scoped *permission types*, not these endpoints.
+        //
+        // Doc-confirmed, never measured: no house Cloudflare credential exists on
+        // the dev machine. The design keeps the unmeasured facts unable to affect
+        // correctness — per_page is never sent, and nothing fails silently.
+        async r2ObjectList(bucket, prefix) {
+            // Mirrors r2List: follow the cursor to exhaustion, never send per_page.
+            // A truncated object listing reads as "those objects are absent" to the
+            // data portal's standing audit, producing false phantom rows and hiding
+            // real orphans — the same bug r2List had, one endpoint over.
+            const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects`;
+            const objects = [];
+            const seen = new Set();
+            let cursor;
+            for (;;) {
+                const params = new URLSearchParams();
+                if (prefix !== undefined)
+                    params.set("prefix", prefix);
+                if (cursor !== undefined)
+                    params.set("cursor", cursor);
+                const qs = params.toString();
+                const { parsed, body } = await cfApiJson(fetchFn, qs ? `${base}?${qs}` : base, { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } }, "r2 object list");
+                const page = parsed;
+                for (const o of page.result ?? []) {
+                    objects.push({ key: o.key, size: o.size, etag: o.etag, lastModified: o.last_modified });
+                }
+                const truncated = page.result_info?.is_truncated;
+                const next = page.result_info?.cursor;
+                // is_truncated is authoritative *when present*: a last page may still
+                // carry a cursor, and following it would issue a pointless request or
+                // trip the cycle guard below on a healthy response.
+                if (truncated === false)
+                    return objects;
+                // The API says there is more but names no cursor: the response is not
+                // the shape we understand. Surface it rather than return a partial
+                // list, which is the failure this loop exists to prevent.
+                if (truncated === true && !next) {
+                    throw new Error(`storage-broker: r2 object list reported truncated but gave no pagination cursor: ${body}`);
+                }
+                // is_truncated absent: it is itself an unmeasured fact, so it must not
+                // be what decides correctness. Fall back to cursor presence — the rule
+                // r2List uses on the same envelope — so an envelope without the flag
+                // paginates rather than truncating silently.
+                if (!next)
+                    return objects;
+                // A cursor seen before means the API is cycling rather than advancing:
+                // it would loop forever, re-appending the same objects each pass.
+                if (seen.has(next)) {
+                    throw new Error(`storage-broker: r2 object list returned a repeated pagination cursor: ${next}`);
+                }
+                seen.add(next);
+                cursor = next;
+            }
+        },
+        async r2ObjectGet(bucket, key) {
+            // The one method cfApiJson cannot wrap: get returns the raw object body,
+            // not a success envelope, so there is nothing to parse or assert
+            // success:true on. The error body is still retained on a non-2xx.
+            const res = await fetchFn(objectUrl(cred.accountId, bucket, key), {
                 method: "GET",
                 headers: { Authorization: `Bearer ${cred.apiToken}` },
             });
-            const body = await res.text();
             if (!res.ok) {
-                throw new Error(`storage-broker: r2 bucket list failed: ${res.status}\n${body}`);
+                throw new Error(`storage-broker: r2 object get failed: ${res.status}\n${await res.text()}`);
             }
-            const parsed = parseJson(body, "r2 bucket list");
-            // Require an explicit success envelope. A 2xx whose body is not a
-            // well-formed `success:true` response is an anomaly to surface with its
-            // body, never a silent empty bucket set.
-            if (parsed.success !== true) {
-                throw new Error(`storage-broker: r2 bucket list API error: ${body}`);
-            }
-            return (parsed.result?.buckets ?? []).map((b) => ({ name: b.name }));
+            return new Uint8Array(await res.arrayBuffer());
         },
-        async r2Create(name) {
-            await run("npx", ["wrangler", "r2", "bucket", "create", name], env);
+        async r2ObjectPut(bucket, key, body) {
+            await cfApiJson(fetchFn, objectUrl(cred.accountId, bucket, key), { method: "PUT", headers: { Authorization: `Bearer ${cred.apiToken}` }, body }, "r2 object put");
+        },
+        async r2ObjectDelete(bucket, key) {
+            await cfApiJson(fetchFn, objectUrl(cred.accountId, bucket, key), { method: "DELETE", headers: { Authorization: `Bearer ${cred.apiToken}` } }, "r2 object delete");
         },
     };
 }

package/payload/platform/lib/storage-broker/dist/cf-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"cf-exec.js","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,iFAAiF;AACjF,iFAAiF;;AAoDjF,gCAuFC;AASD,0CAUC;AA5JD,2DAA8C;AAC9C,yCAAiC;AAEjC,+DAA4D;AAC5D,mEAAkE;AAyBlE,MAAM,YAAY,GAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAE9D,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CACxB,IAAqB,EACrB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,CAAC,GAAG;QACd,oBAAoB,EAAE,IAAI,CAAC,QAAQ;QACnC,qBAAqB,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;IAE5B,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAqC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,2EAA2E;YAC3E,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,cAAc,CAAC;YAC1F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC/B,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,WAAW,CAIzC,CAAC;YACF,wEAAwE;YACxE,0EAA0E;YAC1E,+CAA+C;YAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,KAAK,EACL,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAC3E,GAAG,CACJ,CAAC;YACF,OAAO,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,yEAAyE;YACzE,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,aAAa,CAAC;YACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAI9C,CAAC;YACF,kEAAkE;YAClE,wEAAwE;YACxE,yCAAyC;YACzC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,wEAAwE;AACxE,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,yDAAyD;AAClD,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,IAAI,GAAG,IAAA,yCAAmB,EAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAA,+CAAuB,EAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC"}
+{"version":3,"file":"cf-exec.js","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,iFAAiF;AACjF,iFAAiF;;AA0HjF,gCA2MC;AASD,0CAUC;AAtVD,2DAA8C;AAC9C,yCAAiC;AAEjC,+DAA4D;AAC5D,mEAAkE;AA+ClE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,gFAAgF;AAChF,gEAAgE;AAChE,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,iFAAiF;AACjF,qBAAqB;AACrB,SAAS,SAAS,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC/D,OAAO,iDAAiD,SAAS,eAAe,kBAAkB,CAAC,MAAM,CAAC,YAAY,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/I,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,oDAAoD;AACpD,MAAM,YAAY,GAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAC,CAAC;AAE7E,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,0CAA0C;AAC1C,KAAK,UAAU,SAAS,CACtB,OAAgB,EAChB,GAAW,EACX,IAAqF,EACrF,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,YAAY,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,yEAAyE;IACzE,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAiC,CAAC;IACxE,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,eAAe,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAgB,UAAU,CACxB,IAAqB,EACrB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,CAAC,GAAG;QACd,oBAAoB,EAAE,IAAI,CAAC,QAAQ;QACnC,qBAAqB,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;IAE5B,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAqC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,2EAA2E;YAC3E,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,cAAc,CAAC;YAC1F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACtC,OAAO,EACP,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC/B,EACD,WAAW,CACZ,CAAC;YACF,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,IAAI,GAAI,MAAyC,CAAC,MAAM,EAAE,IAAI,CAAC;YACrE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,KAAK,EACL,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAC3E,GAAG,CACJ,CAAC;YACF,OAAO,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,yEAAyE;YACzE,qEAAqE;YACrE,gEAAgE;YAChE,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,MAAM,IAAI,GAAG,iDAAiD,IAAI,CAAC,SAAS,aAAa,CAAC;YAC1F,MAAM,OAAO,GAAuB,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,IAAI,MAA0B,CAAC;YAC/B,SAAS,CAAC;gBACR,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,OAAO,EACP,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EACxE,gBAAgB,CACjB,CAAC;gBACF,MAAM,IAAI,GAAG,MAGZ,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3E,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;gBACtC,IAAI,CAAC,IAAI;oBAAE,OAAO,OAAO,CAAC;gBAC1B,yEAAyE;gBACzE,qEAAqE;gBACrE,oEAAoE;gBACpE,wEAAwE;gBACxE,2CAA2C;gBAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,EAAE,CAChF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,yEAAyE;QACzE,EAAE;QACF,mDAAmD;QACnD,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,kEAAkE;QAClE,EAAE;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM;YAC/B,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,6DAA6D;YAC7D,MAAM,IAAI,GAAG,iDAAiD,IAAI,CAAC,SAAS,eAAe,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC;YAChI,MAAM,OAAO,GAAe,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,IAAI,MAA0B,CAAC;YAC/B,SAAS,CAAC;gBACR,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;gBACrC,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACvD,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACvD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACtC,OAAO,EACP,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAC3B,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EACxE,gBAAgB,CACjB,CAAC;gBACF,MAAM,IAAI,GAAG,MAGZ,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;oBAClC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;gBAC1F,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC;gBACjD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;gBACtC,sEAAsE;gBACtE,sEAAsE;gBACtE,oDAAoD;gBACpD,IAAI,SAAS,KAAK,KAAK;oBAAE,OAAO,OAAO,CAAC;gBACxC,sEAAsE;gBACtE,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CACb,oFAAoF,IAAI,EAAE,CAC3F,CAAC;gBACJ,CAAC;gBACD,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,6CAA6C;gBAC7C,IAAI,CAAC,IAAI;oBAAE,OAAO,OAAO,CAAC;gBAC1B,uEAAuE;gBACvE,kEAAkE;gBAClE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,EAAE,CAChF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG;YAC3B,yEAAyE;YACzE,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;gBAChE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAC3E,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI;YACjC,MAAM,SAAS,CACb,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EACtC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAC9E,eAAe,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG;YAC9B,MAAM,SAAS,CACb,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAC3E,kBAAkB,CACnB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,wEAAwE;AACxE,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,yDAAyD;AAClD,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,IAAI,GAAG,IAAA,yCAAmB,EAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAA,+CAAuB,EAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC"}

package/payload/platform/lib/storage-broker/dist/house-credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"house-credential.d.ts","sourceRoot":"","sources":["../src/house-credential.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,CAkBzE"}
+{"version":3,"file":"house-credential.d.ts","sourceRoot":"","sources":["../src/house-credential.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,CAkBzE"}

package/payload/platform/lib/storage-broker/dist/house-credential.js

@@ -1,8 +1,14 @@
 "use strict";
 // Reads the single account-wide Cloudflare credential from the house-only
 // config directory. This file is the one place the account-wide capability
-// lives; sub-account spawns never source it. Parses KEY=value lines without
-// polluting process.env (same discipline as reconcile-bookings' readEnvFile).
+// lives. House-only is a location convention plus the cf-token.sh caller gate,
+// NOT an OS permission: every account's session runs as the same unix user, so
+// a sub-account agent holding Bash can read this path directly. That is a
+// permanent property, not a pending gap: OS user separation was costed and
+// declined as disproportionate (Task 1690, archived undone), so nothing tracks
+// it. Do not cite this file's location or mode as a boundary. Parses
+// KEY=value lines without polluting process.env (same discipline as
+// reconcile-bookings' readEnvFile).
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readHouseCredential = readHouseCredential;
 const node_fs_1 = require("node:fs");

package/payload/platform/lib/storage-broker/dist/house-credential.js.map

@@ -1 +1 @@
-{"version":3,"file":"house-credential.js","sourceRoot":"","sources":["../src/house-credential.ts"],"names":[],"mappings":";AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;;AAU9E,kDAkBC;AA1BD,qCAAuC;AACvC,yCAAiC;AAOjC,SAAgB,mBAAmB,CAAC,YAAoB;IACtD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAClE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"house-credential.js","sourceRoot":"","sources":["../src/house-credential.ts"],"names":[],"mappings":";AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,2EAA2E;AAC3E,+EAA+E;AAC/E,qEAAqE;AACrE,oEAAoE;AACpE,oCAAoC;;AAUpC,kDAkBC;AA1BD,qCAAuC;AACvC,yCAAiC;AAOjC,SAAgB,mBAAmB,CAAC,YAAoB;IACtD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAClE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}

package/payload/platform/lib/storage-broker/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./authorize.js";
+export * from "./object-limits.js";
 export * from "./registry.js";
 export * from "./house-credential.js";
 export * from "./cf-exec.js";

package/payload/platform/lib/storage-broker/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}

package/payload/platform/lib/storage-broker/dist/index.js

@@ -22,6 +22,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./authorize.js"), exports);
+__exportStar(require("./object-limits.js"), exports);
 __exportStar(require("./registry.js"), exports);
 __exportStar(require("./house-credential.js"), exports);
 __exportStar(require("./cf-exec.js"), exports);

package/payload/platform/lib/storage-broker/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;;;;;;;;;;;;;;;;AAE5D,iDAA+B;AAC/B,gDAA8B;AAC9B,wDAAsC;AACtC,+CAA6B;AAC7B,0DAAwC;AACxC,6CAA2B;AAC3B,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;;;;;;;;;;;;;;;;AAE5D,iDAA+B;AAC/B,qDAAmC;AACnC,gDAA8B;AAC9B,wDAAsC;AACtC,+CAA6B;AAC7B,0DAAwC;AACxC,6CAA2B;AAC3B,iDAA+B"}

package/payload/platform/lib/storage-broker/dist/object-limits.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The byte cap on R2 object transfer, and the arithmetic the routes need to
+ * enforce it before they buffer anything.
+ *
+ * One number, one home (Task 1695). The storage-broker MCP tools and the house
+ * ui routes both read the cap from here, so the process that rejects a too-large
+ * file and the process that would otherwise buffer it cannot drift apart.
+ *
+ * Deliberately dependency-free: the MCP imports this module directly, without
+ * the rest of the lib (cf-exec, registry, audit, remediate), which it has no use
+ * for. The ui route reads it through the barrel.
+ */
+/**
+ * The maximum size, in bytes, of an object moved through storage-r2-object-get
+ * or storage-r2-object-put.
+ *
+ * Set independently of the email plugin's OUTBOUND_ATTACHMENT_MAX_BYTES (25 MiB)
+ * even though the payload class is the same. The two exist for different reasons
+ * and must be free to move for different reasons: email's tracks an SMTP-side
+ * rejection threshold, this one tracks house-process memory. Do not couple them.
+ *
+ * Not bounded by R2. A single-part upload may be up to 5 GiB (doc-confirmed:
+ * developers.cloudflare.com/r2/platform/limits/), roughly fifty times this, and
+ * the v4 REST API states no separate object-size limit. This cap is the only
+ * bound on either transfer.
+ *
+ * The bound is not small: at the cap a get still leaves the house process
+ * holding the object and its base64 form, roughly 2.4x the object. That cost was
+ * weighed and accepted when the number was chosen.
+ */
+export declare const R2_OBJECT_MAX_BYTES: number;
+/** base64 emits 4 characters per 3 input bytes, padded up to the next quantum. */
+export declare function base64Ceiling(bytes: number): number;
+/**
+ * The largest JSON body /r2/object/put can legitimately carry.
+ *
+ * This bounds house memory; it does not adjudicate the last kilobyte. The exact
+ * decoded-byte rule lives in the MCP, which knows the source's size exactly.
+ */
+export declare const R2_OBJECT_PUT_MAX_BODY_BYTES: number;
+/**
+ * The over-cap message, worded once so the MCP and the routes agree. Names the
+ * offending object and the limit, which is what makes the failure actionable
+ * rather than an opaque out-of-memory kill.
+ *
+ * Exact bytes accompany the MiB figures because MiB alone rounds: an object one
+ * byte over the cap reads "100.0 MiB, which exceeds the 100.0 MiB limit", which
+ * is a message that appears to contradict itself and invites the reader to treat
+ * the rejection as a bug. The bytes are what make it legible; the MiB is what
+ * makes it quick.
+ */
+export declare function tooLargeMessage(what: string, actualBytes: number): string;
+//# sourceMappingURL=object-limits.d.ts.map

package/payload/platform/lib/storage-broker/dist/object-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-limits.d.ts","sourceRoot":"","sources":["../src/object-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mBAAmB,QAAoB,CAAC;AAErD,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAUD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,QAC0B,CAAC;AAMpE;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAIzE"}

package/payload/platform/lib/storage-broker/dist/object-limits.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * The byte cap on R2 object transfer, and the arithmetic the routes need to
+ * enforce it before they buffer anything.
+ *
+ * One number, one home (Task 1695). The storage-broker MCP tools and the house
+ * ui routes both read the cap from here, so the process that rejects a too-large
+ * file and the process that would otherwise buffer it cannot drift apart.
+ *
+ * Deliberately dependency-free: the MCP imports this module directly, without
+ * the rest of the lib (cf-exec, registry, audit, remediate), which it has no use
+ * for. The ui route reads it through the barrel.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.R2_OBJECT_PUT_MAX_BODY_BYTES = exports.R2_OBJECT_MAX_BYTES = void 0;
+exports.base64Ceiling = base64Ceiling;
+exports.tooLargeMessage = tooLargeMessage;
+/**
+ * The maximum size, in bytes, of an object moved through storage-r2-object-get
+ * or storage-r2-object-put.
+ *
+ * Set independently of the email plugin's OUTBOUND_ATTACHMENT_MAX_BYTES (25 MiB)
+ * even though the payload class is the same. The two exist for different reasons
+ * and must be free to move for different reasons: email's tracks an SMTP-side
+ * rejection threshold, this one tracks house-process memory. Do not couple them.
+ *
+ * Not bounded by R2. A single-part upload may be up to 5 GiB (doc-confirmed:
+ * developers.cloudflare.com/r2/platform/limits/), roughly fifty times this, and
+ * the v4 REST API states no separate object-size limit. This cap is the only
+ * bound on either transfer.
+ *
+ * The bound is not small: at the cap a get still leaves the house process
+ * holding the object and its base64 form, roughly 2.4x the object. That cost was
+ * weighed and accepted when the number was chosen.
+ */
+exports.R2_OBJECT_MAX_BYTES = 100 * 1024 * 1024;
+/** base64 emits 4 characters per 3 input bytes, padded up to the next quantum. */
+function base64Ceiling(bytes) {
+    return 4 * Math.ceil(bytes / 3);
+}
+/**
+ * Room for the put envelope's bucket, key and JSON punctuation, so a legal
+ * at-cap put is not rejected by its own key. Far above any realistic bucket+key
+ * length and far below the cap, so it cannot smuggle a meaningfully larger
+ * object.
+ */
+const PUT_ENVELOPE_ALLOWANCE_BYTES = 64 * 1024;
+/**
+ * The largest JSON body /r2/object/put can legitimately carry.
+ *
+ * This bounds house memory; it does not adjudicate the last kilobyte. The exact
+ * decoded-byte rule lives in the MCP, which knows the source's size exactly.
+ */
+exports.R2_OBJECT_PUT_MAX_BODY_BYTES = base64Ceiling(exports.R2_OBJECT_MAX_BYTES) + PUT_ENVELOPE_ALLOWANCE_BYTES;
+function formatMiB(bytes) {
+    return (bytes / 1024 / 1024).toFixed(1);
+}
+/**
+ * The over-cap message, worded once so the MCP and the routes agree. Names the
+ * offending object and the limit, which is what makes the failure actionable
+ * rather than an opaque out-of-memory kill.
+ *
+ * Exact bytes accompany the MiB figures because MiB alone rounds: an object one
+ * byte over the cap reads "100.0 MiB, which exceeds the 100.0 MiB limit", which
+ * is a message that appears to contradict itself and invites the reader to treat
+ * the rejection as a bug. The bytes are what make it legible; the MiB is what
+ * makes it quick.
+ */
+function tooLargeMessage(what, actualBytes) {
+    return `${what} is ${formatMiB(actualBytes)} MiB (${actualBytes} bytes), which exceeds the ${formatMiB(exports.R2_OBJECT_MAX_BYTES)} MiB (${exports.R2_OBJECT_MAX_BYTES} bytes) R2 object limit.`;
+}
+//# sourceMappingURL=object-limits.js.map

package/payload/platform/lib/storage-broker/dist/object-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-limits.js","sourceRoot":"","sources":["../src/object-limits.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAuBH,sCAEC;AAkCD,0CAIC;AA7DD;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,mBAAmB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,kFAAkF;AAClF,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C;;;;;GAKG;AACU,QAAA,4BAA4B,GACvC,aAAa,CAAC,2BAAmB,CAAC,GAAG,4BAA4B,CAAC;AAEpE,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,IAAY,EAAE,WAAmB;IAC/D,OAAO,GAAG,IAAI,OAAO,SAAS,CAAC,WAAW,CAAC,SAAS,WAAW,8BAA8B,SAAS,CACpG,2BAAmB,CACpB,SAAS,2BAAmB,0BAA0B,CAAC;AAC1D,CAAC"}