@rubytech/create-maxy-code 0.1.458 → 0.1.460

package/payload/server/server.js

@@ -9,6 +9,7 @@ import {
   CLAUDE_CREDENTIALS_FILE,
   COMMERCIAL_MODE,
   GREETING_DIRECTIVE,
+  HTTPException,
   Hono,
   HtmlEscapedCallbackPhase,
   INSTALL_OWNER_FILE,
@@ -110,14 +111,21 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-F4D35LKL.js";
+} from "./chunk-POBXIHOF.js";
 import {
+  D1_MAX_SQL_STATEMENT_BYTES,
+  D1_QUERY_MAX_BODY_BYTES,
+  R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
+  STORAGE_RESOURCE_NAME_MAX_BODY_BYTES,
   authorizeAccess,
   listResources,
   makeHouseCfExec,
   registerResource,
-  resolveOwner
-} from "./chunk-64FGYKNZ.js";
+  resolveOwner,
+  tooLargeMessage
+} from "./chunk-JXWFVE5X.js";
 import {
   __commonJS,
   __toESM
@@ -8664,6 +8672,65 @@ app2.get("/group-info", async (c) => {
 });
 var whatsapp_default = app2;
 
+// node_modules/hono/dist/middleware/body-limit/index.js
+var ERROR_MESSAGE = "Payload Too Large";
+var BodyLimitError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BodyLimitError";
+  }
+};
+var bodyLimit = (options) => {
+  const onError = options.onError || (() => {
+    const res = new Response(ERROR_MESSAGE, {
+      status: 413
+    });
+    throw new HTTPException(413, { res });
+  });
+  const maxSize = options.maxSize;
+  return async function bodyLimit2(c, next) {
+    if (!c.req.raw.body) {
+      return next();
+    }
+    const hasTransferEncoding = c.req.raw.headers.has("transfer-encoding");
+    const hasContentLength = c.req.raw.headers.has("content-length");
+    if (hasTransferEncoding && hasContentLength) {
+    }
+    if (hasContentLength && !hasTransferEncoding) {
+      const contentLength = parseInt(c.req.raw.headers.get("content-length") || "0", 10);
+      return contentLength > maxSize ? onError(c) : next();
+    }
+    let size = 0;
+    const rawReader = c.req.raw.body.getReader();
+    const reader = new ReadableStream({
+      async start(controller) {
+        try {
+          for (; ; ) {
+            const { done, value } = await rawReader.read();
+            if (done) {
+              break;
+            }
+            size += value.length;
+            if (size > maxSize) {
+              controller.error(new BodyLimitError(ERROR_MESSAGE));
+              break;
+            }
+            controller.enqueue(value);
+          }
+        } finally {
+          controller.close();
+        }
+      }
+    });
+    const requestInit = { body: reader, duplex: "half" };
+    c.req.raw = new Request(c.req.raw, requestInit);
+    await next();
+    if (c.error instanceof BodyLimitError) {
+      c.res = await onError(c);
+    }
+  };
+};
+
 // server/routes/storage-broker.ts
 import { join as join11, resolve as resolve11 } from "path";
 import { readdirSync as readdirSync6, readFileSync as readFileSync13, existsSync as existsSync8 } from "fs";
@@ -8674,14 +8741,57 @@ function platformRoot() {
 function caller(c) {
   return c.req.header("x-maxy-caller-account")?.trim() || null;
 }
-function log(action, kind, account, target, owner, result) {
+function log(action, kind, account, target, owner, result, reason) {
   console.error(
-    `[storage-broker] op=storage-broker resource=${kind} action=${action} account=${account} target=${target} owner=${owner ?? "none"} result=${result}`
+    `[storage-broker] op=storage-broker resource=${kind} action=${action} account=${account} target=${target} owner=${owner ?? "none"} result=${result}${reason ? ` reason=${reason}` : ""}`
   );
 }
 function cfExec() {
   return makeHouseCfExec(platformRoot());
 }
+async function readJsonBody(c) {
+  let parsed;
+  try {
+    parsed = await c.req.json();
+  } catch (err) {
+    if (err instanceof Error && err.name === "BodyLimitError") throw err;
+    return { ok: false, res: c.json({ error: "invalid-json" }, 400) };
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { ok: false, res: c.json({ error: "invalid-json" }, 400) };
+  }
+  return { ok: true, body: parsed };
+}
+function nameBodyLimit(kind) {
+  return bodyLimit({
+    maxSize: STORAGE_RESOURCE_NAME_MAX_BODY_BYTES,
+    onError: (c) => {
+      log("write", kind, caller(c) ?? "none", "*", null, "deny", "name-body-too-large");
+      return c.json(
+        {
+          error: `request body exceeds the ${(STORAGE_RESOURCE_NAME_MAX_BODY_BYTES / 1024).toFixed(
+            1
+          )} KiB (${STORAGE_RESOURCE_NAME_MAX_BODY_BYTES} bytes) limit for a storage resource create, which carries only a name.`
+        },
+        413
+      );
+    }
+  });
+}
+var d1QueryBodyLimit = bodyLimit({
+  maxSize: D1_QUERY_MAX_BODY_BYTES,
+  onError: (c) => {
+    log("read", "d1", caller(c) ?? "none", "*", null, "deny", "sql-body-too-large");
+    return c.json(
+      {
+        error: `request body exceeds the ${(D1_QUERY_MAX_BODY_BYTES / 1024 / 1024).toFixed(
+          1
+        )} MiB (${D1_QUERY_MAX_BODY_BYTES} bytes) limit for a D1 query, which carries a database name and a SQL statement of at most ${D1_MAX_SQL_STATEMENT_BYTES} bytes.`
+      },
+      413
+    );
+  }
+});
 app3.get("/d1/list", async (c) => {
   const account = caller(c);
   if (!account) return c.json({ error: "no-caller" }, 403);
@@ -8696,10 +8806,12 @@ app3.get("/d1/list", async (c) => {
     await session.close();
   }
 });
-app3.post("/d1/create", async (c) => {
+app3.post("/d1/create", nameBodyLimit("d1"), async (c) => {
   const account = caller(c);
   if (!account) return c.json({ error: "no-caller" }, 403);
-  const { name } = await c.req.json();
+  const parsed = await readJsonBody(c);
+  if (!parsed.ok) return parsed.res;
+  const { name } = parsed.body;
   if (!name || typeof name !== "string") return c.json({ error: "name-required" }, 400);
   const session = getSession();
   try {
@@ -8718,10 +8830,12 @@ app3.post("/d1/create", async (c) => {
     await session.close();
   }
 });
-app3.post("/d1/query", async (c) => {
+app3.post("/d1/query", d1QueryBodyLimit, async (c) => {
   const account = caller(c);
   if (!account) return c.json({ error: "no-caller" }, 403);
-  const { name, sql } = await c.req.json();
+  const parsed = await readJsonBody(c);
+  if (!parsed.ok) return parsed.res;
+  const { name, sql } = parsed.body;
   if (!name || typeof name !== "string") return c.json({ error: "name-required" }, 400);
   if (!sql || typeof sql !== "string") return c.json({ error: "sql-required" }, 400);
   const session = getSession();
@@ -8752,10 +8866,12 @@ app3.get("/r2/list", async (c) => {
     await session.close();
   }
 });
-app3.post("/r2/create", async (c) => {
+app3.post("/r2/create", nameBodyLimit("r2"), async (c) => {
   const account = caller(c);
   if (!account) return c.json({ error: "no-caller" }, 403);
-  const { name } = await c.req.json();
+  const parsed = await readJsonBody(c);
+  if (!parsed.ok) return parsed.res;
+  const { name } = parsed.body;
   if (!name || typeof name !== "string") return c.json({ error: "name-required" }, 400);
   const session = getSession();
   try {
@@ -8774,9 +8890,178 @@ app3.post("/r2/create", async (c) => {
     await session.close();
   }
 });
+async function objectGate(c, action) {
+  const account = caller(c);
+  if (!account) return { ok: false, res: c.json({ error: "no-caller" }, 403) };
+  let body;
+  try {
+    body = await c.req.json();
+  } catch (err) {
+    if (err instanceof Error && err.name === "BodyLimitError") throw err;
+    return { ok: false, res: c.json({ error: "invalid-json" }, 400) };
+  }
+  const bucket = body.bucket;
+  if (!bucket || typeof bucket !== "string") {
+    return { ok: false, res: c.json({ error: "bucket-required" }, 400) };
+  }
+  const session = getSession();
+  let owner;
+  try {
+    owner = await resolveOwner(session, "r2", bucket);
+  } catch (err) {
+    return { ok: false, res: c.json({ error: String(err) }, 500) };
+  } finally {
+    await session.close();
+  }
+  const decision = authorizeAccess({ caller: account, owner, action });
+  log(action, "r2", account, bucket, owner, decision.allow ? "allow" : "deny");
+  if (!decision.allow) return { ok: false, res: c.json({ error: decision.reason }, 403) };
+  return { ok: true, bucket, body };
+}
+function readKey(body) {
+  const key = body.key;
+  return typeof key === "string" && key.length > 0 ? key : null;
+}
+function envelopeBodyLimit(action) {
+  return bodyLimit({
+    maxSize: R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
+    // Names the limit rather than the object: the body is deliberately unparsed
+    // here, which is the whole point of the middleware, so the key is genuinely
+    // unknown — as recorded for put in 1695. Stated in KiB with exact bytes rather
+    // than the MiB the object messages use: 64 KiB renders as "0.1 MiB", which is
+    // less legible, not more. The exact bytes are there for the same reason
+    // tooLargeMessage carries them.
+    //
+    // The {error} body is the routes' convention, which the default's bare text
+    // is not. On the content-length branch no body is read and no handler runs, so
+    // this log line is the only trace the request ever existed.
+    //
+    // reason distinguishes this from put's body-too-large rather than reusing it.
+    // They are different events refusing bodies ~2,100x apart, and put and delete
+    // both log action=write, so a shared slug would make a 140 MB put denial and a
+    // 65 KiB delete denial byte-identical — the same conflation the reason field
+    // exists to prevent for ownership-vs-size.
+    onError: (c) => {
+      log(action, "r2", caller(c) ?? "none", "*", null, "deny", "envelope-too-large");
+      return c.json(
+        {
+          error: `request body exceeds the ${(R2_OBJECT_ENVELOPE_MAX_BODY_BYTES / 1024).toFixed(
+            1
+          )} KiB (${R2_OBJECT_ENVELOPE_MAX_BODY_BYTES} bytes) limit for an R2 object metadata envelope, which carries only a bucket and a key or prefix.`
+        },
+        413
+      );
+    }
+  });
+}
+app3.post("/r2/object/list", envelopeBodyLimit("list"), async (c) => {
+  const gate = await objectGate(c, "list");
+  if (!gate.ok) return gate.res;
+  const prefix = gate.body.prefix;
+  if (prefix !== void 0 && typeof prefix !== "string") {
+    return c.json({ error: "prefix-must-be-string" }, 400);
+  }
+  try {
+    const objects = await (await cfExec()).r2ObjectList(gate.bucket, prefix);
+    return c.json({ objects });
+  } catch (err) {
+    return c.json({ error: String(err) }, 500);
+  }
+});
+app3.post("/r2/object/get", envelopeBodyLimit("read"), async (c) => {
+  const gate = await objectGate(c, "read");
+  if (!gate.ok) return gate.res;
+  const key = readKey(gate.body);
+  if (!key) return c.json({ error: "key-required" }, 400);
+  try {
+    const cf = await cfExec();
+    const found = await cf.r2ObjectFind(gate.bucket, key);
+    const size = found?.size;
+    if (typeof size !== "number" || !Number.isFinite(size) || size < 0) {
+      log("read", "r2", caller(c) ?? "none", key, caller(c), "deny", "size-unknown");
+      return c.json(
+        {
+          error: `${key} has no recorded size in ${gate.bucket}; refusing to transfer an object that cannot be bounded.`
+        },
+        409
+      );
+    }
+    if (size > R2_OBJECT_MAX_BYTES) {
+      log("read", "r2", caller(c) ?? "none", key, caller(c), "deny", "object-too-large");
+      return c.json({ error: tooLargeMessage(key, size) }, 413);
+    }
+    const bytes = await cf.r2ObjectGet(gate.bucket, key);
+    return c.json({ contentBase64: Buffer.from(bytes).toString("base64") });
+  } catch (err) {
+    return c.json({ error: String(err) }, 500);
+  }
+});
+app3.post(
+  "/r2/object/put",
+  // Task 1695 — before the body is buffered, not after. This process runs
+  // house-level and holds the account-wide credential, so an over-cap body
+  // buffered here is an OOM kill of the brand server. The handler cannot do this
+  // itself: objectGate's c.req.json() has already read the whole body by the time
+  // any handler code runs.
+  //
+  // Not redundant with the MCP's statSync check. Every account shares one unix
+  // user and the agent holds Bash, so these routes are reachable by curl with the
+  // MCP nowhere in the path; a cap enforced only there is bypassed by one
+  // command. The MCP check gives the precise, file-naming error; this one is what
+  // actually bounds house memory.
+  bodyLimit({
+    maxSize: R2_OBJECT_PUT_MAX_BODY_BYTES,
+    // The key is unknown here — the body is deliberately unparsed — so this names
+    // the limit rather than the object. The MCP names the file. The limit is
+    // stated in MiB like every other over-cap message, so an operator reading a
+    // route rejection and an MCP rejection can see they are one rule rather than
+    // two unrelated numbers.
+    //
+    // It logs, because a task filed on "the OOM emits nothing" must not ship a
+    // rejection that also emits nothing. On the content-length branch — the shape
+    // every real caller sends — no body is read and no handler runs, so this line
+    // is the only trace the request ever existed.
+    onError: (c) => {
+      log("write", "r2", caller(c) ?? "none", "*", null, "deny", "body-too-large");
+      return c.json(
+        {
+          error: `request body exceeds the ${(R2_OBJECT_PUT_MAX_BODY_BYTES / 1024 / 1024).toFixed(1)} MiB limit for an R2 object put (a base64-encoded ${(R2_OBJECT_MAX_BYTES / 1024 / 1024).toFixed(1)} MiB object plus its envelope).`
+        },
+        413
+      );
+    }
+  }),
+  async (c) => {
+    const gate = await objectGate(c, "write");
+    if (!gate.ok) return gate.res;
+    const key = readKey(gate.body);
+    if (!key) return c.json({ error: "key-required" }, 400);
+    const contentBase64 = gate.body.contentBase64;
+    if (typeof contentBase64 !== "string") return c.json({ error: "contentBase64-required" }, 400);
+    try {
+      const bytes = new Uint8Array(Buffer.from(contentBase64, "base64"));
+      await (await cfExec()).r2ObjectPut(gate.bucket, key, bytes);
+      return c.json({ ok: true });
+    } catch (err) {
+      return c.json({ error: String(err) }, 500);
+    }
+  }
+);
+app3.post("/r2/object/delete", envelopeBodyLimit("write"), async (c) => {
+  const gate = await objectGate(c, "write");
+  if (!gate.ok) return gate.res;
+  const key = readKey(gate.body);
+  if (!key) return c.json({ error: "key-required" }, 400);
+  try {
+    await (await cfExec()).r2ObjectDelete(gate.bucket, key);
+    return c.json({ ok: true });
+  } catch (err) {
+    return c.json({ error: String(err) }, 500);
+  }
+});
 var storage_broker_default = app3;
 async function runStorageAudit(root) {
-  const { reconcileStorage } = await import("./src-S7C4P6TT.js");
+  const { reconcileStorage } = await import("./src-4F37OHLK.js");
   const session = getSession();
   try {
     const cf = await makeHouseCfExec(root);
@@ -9701,6 +9986,78 @@ function pickActivity(entries, grown, nowMs, concurrencyWindowMs) {
   return { hex: newest.hex, lastEmitAt: newest.mtimeMs, count };
 }
 
+// server/routes/stream-lifecycle.ts
+var GAUGE_INTERVAL_MS = 6e4;
+function isArmed(timer2) {
+  return timer2._destroyed !== true;
+}
+var Registration = class {
+  constructor(connId, channel, startedAt) {
+    this.connId = connId;
+    this.channel = channel;
+    this.startedAt = startedAt;
+  }
+  timers = [];
+  closed = false;
+  arm(timer2) {
+    this.timers.push(timer2);
+    return timer2;
+  }
+  teardown(reason) {
+    if (this.closed) return false;
+    this.closed = true;
+    for (const t of this.timers) clearInterval(t);
+    const stillArmed = this.timers.filter(isArmed).length;
+    if (stillArmed > 0) {
+      console.error(
+        `[wa-stream] op=teardown-defect conn=${this.connId} channel=${this.channel} stillArmed=${stillArmed} reason=${reason}`
+      );
+      return true;
+    }
+    registry.delete(this);
+    if (registry.size === 0) emitGauge();
+    return true;
+  }
+};
+var registry = /* @__PURE__ */ new Set();
+var gaugeTimer = null;
+function emitGauge() {
+  const now = Date.now();
+  const counts = { reader: 0, store: 0 };
+  let oldestMs = 0;
+  let stale = 0;
+  for (const reg of [...registry]) {
+    if (!reg.timers.some(isArmed)) {
+      stale++;
+      registry.delete(reg);
+      continue;
+    }
+    counts[reg.channel]++;
+    oldestMs = Math.max(oldestMs, now - reg.startedAt);
+  }
+  const armed = counts.reader + counts.store;
+  console.log(
+    `[wa-stream] op=gauge armed=${armed} reader=${counts.reader} store=${counts.store} oldestSec=${Math.floor(oldestMs / 1e3)} stale=${stale}`
+  );
+  if (armed === 0) stopGauge();
+}
+function startGauge() {
+  if (gaugeTimer) return;
+  gaugeTimer = setInterval(emitGauge, GAUGE_INTERVAL_MS);
+  gaugeTimer.unref();
+}
+function stopGauge() {
+  if (!gaugeTimer) return;
+  clearInterval(gaugeTimer);
+  gaugeTimer = null;
+}
+function openStream(connId, channel, startedAt) {
+  const reg = new Registration(connId, channel, startedAt);
+  registry.add(reg);
+  startGauge();
+  return reg;
+}
+
 // app/admin-types.ts
 var ACCEPT_MIME = "image/jpeg,image/png,image/gif,image/webp,application/pdf,text/plain,text/markdown,text/csv,text/html,text/calendar,application/zip,application/x-zip-compressed,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.oasis.opendocument.text,text/rtf,application/rtf,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,application/vnd.ms-excel,application/vnd.oasis.opendocument.spreadsheet,application/vnd.openxmlformats-officedocument.presentationml.presentation,application/vnd.ms-powerpoint,application/vnd.oasis.opendocument.presentation,audio/ogg,audio/opus,audio/mp4,audio/x-m4a,audio/mpeg,audio/webm,audio/wav,video/mp4,.docx,.odt,.rtf,.xlsx,.xls,.ods,.pptx,.ppt,.odp,.opus,.ogg,.m4a,.mp4,.mp3,.wav,.webm";
 var SUPPORTED_MIME_SET = new Set(ACCEPT_MIME.split(",").filter((t) => !t.startsWith(".")));
@@ -10009,6 +10366,8 @@ data: ${JSON.stringify(turn)}
   const connId = `${sessionId.slice(0, 8)}-${process.hrtime.bigint().toString(36).slice(-6)}`;
   const startedAt = Date.now();
   const lastEventId = c.req.header("Last-Event-ID");
+  let teardown = () => {
+  };
   const readable = new ReadableStream({
     start(controller) {
       const fileEnd0 = (() => {
@@ -10093,27 +10452,34 @@ data: ${JSON.stringify(obj)}
         actx.now = Date.now();
         runActivityTick(actx);
       };
-      const poll = setInterval(tick, 1e3);
-      const heartbeat = setInterval(() => {
-        try {
-          controller.enqueue(encoder.encode(": ping\n\n"));
-          console.log(`[wa-stream] op=heartbeat conn=${connId}`);
-        } catch {
-        }
-      }, 2e4);
-      c.req.raw.signal.addEventListener("abort", () => {
+      const lifecycle = openStream(connId, "reader", startedAt);
+      lifecycle.arm(setInterval(tick, 1e3));
+      lifecycle.arm(
+        setInterval(() => {
+          try {
+            controller.enqueue(encoder.encode(": ping\n\n"));
+            console.log(`[wa-stream] op=heartbeat conn=${connId}`);
+          } catch {
+            teardown("heartbeat-dead-controller");
+          }
+        }, 2e4)
+      );
+      teardown = (reason) => {
+        if (!lifecycle.teardown(reason)) return;
         watcher?.close();
-        clearInterval(poll);
-        clearInterval(heartbeat);
         if (actx.emittedHex !== null) {
           console.log(`[webchat-activity] op=clear key=${sessionKey} reason=stream-close`);
         }
-        console.log(`[wa-stream] op=close conn=${connId} ranMs=${Date.now() - startedAt} reason=client-abort`);
+        console.log(`[wa-stream] op=close conn=${connId} ranMs=${Date.now() - startedAt} reason=${reason}`);
         try {
           controller.close();
         } catch {
         }
-      });
+      };
+      c.req.raw.signal.addEventListener("abort", () => teardown("client-abort"));
+    },
+    cancel() {
+      teardown("client-cancel");
     }
   });
   return new Response(readable, {
@@ -10221,6 +10587,8 @@ app5.get("/store-stream", requireAdminSession, (c) => {
     }
     return turn;
   };
+  let teardown = () => {
+  };
   const readable = new ReadableStream({
     start(controller) {
       const send = (turn, id) => {
@@ -10318,23 +10686,30 @@ data: ${JSON.stringify(payload)}
         watcher = watch(file, drain);
       } catch {
       }
-      const poll = setInterval(drain, 1e3);
-      const heartbeat = setInterval(() => {
-        try {
-          controller.enqueue(encoder.encode(": ping\n\n"));
-        } catch {
-        }
-      }, 2e4);
-      c.req.raw.signal.addEventListener("abort", () => {
+      const lifecycle = openStream(connId, "store", startedAt);
+      lifecycle.arm(setInterval(drain, 1e3));
+      lifecycle.arm(
+        setInterval(() => {
+          try {
+            controller.enqueue(encoder.encode(": ping\n\n"));
+          } catch {
+            teardown("heartbeat-dead-controller");
+          }
+        }, 2e4)
+      );
+      teardown = (reason) => {
+        if (!lifecycle.teardown(reason)) return;
         watcher?.close();
-        clearInterval(poll);
-        clearInterval(heartbeat);
-        console.log(`[wa-reader] op=store-close conn=${connId} ranMs=${Date.now() - startedAt}`);
+        console.log(`[wa-reader] op=store-close conn=${connId} ranMs=${Date.now() - startedAt} reason=${reason}`);
         try {
           controller.close();
         } catch {
         }
-      });
+      };
+      c.req.raw.signal.addEventListener("abort", () => teardown("client-abort"));
+    },
+    cancel() {
+      teardown("client-cancel");
     }
   });
   return new Response(readable, {

package/payload/server/{src-S7C4P6TT.js → src-4F37OHLK.js}

@@ -1,6 +1,14 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
+  D1_MAX_SQL_STATEMENT_BYTES,
+  D1_QUERY_MAX_BODY_BYTES,
+  JSON_STRING_WORST_CASE_EXPANSION,
+  R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
+  STORAGE_RESOURCE_NAME_MAX_BODY_BYTES,
   authorizeAccess,
+  base64Ceiling,
   listResources,
   makeCfExec,
   makeHouseCfExec,
@@ -10,11 +18,20 @@ import {
   resolveHouseScopedToken,
   resolveOwner,
   stripAccountWideTokens,
+  tooLargeMessage,
   validateMapping
-} from "./chunk-64FGYKNZ.js";
+} from "./chunk-JXWFVE5X.js";
 import "./chunk-PFF6I7KP.js";
 export {
+  D1_MAX_SQL_STATEMENT_BYTES,
+  D1_QUERY_MAX_BODY_BYTES,
+  JSON_STRING_WORST_CASE_EXPANSION,
+  R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
+  STORAGE_RESOURCE_NAME_MAX_BODY_BYTES,
   authorizeAccess,
+  base64Ceiling,
   listResources,
   makeCfExec,
   makeHouseCfExec,
@@ -24,5 +41,6 @@ export {
   resolveHouseScopedToken,
   resolveOwner,
   stripAccountWideTokens,
+  tooLargeMessage,
   validateMapping
 };

package/payload/platform/plugins/outlook/mcp/dist/__tests__/pkce-flow.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=pkce-flow.test.d.ts.map