@rubytech/create-maxy-code 0.1.458 → 0.1.460

package/payload/platform/lib/storage-broker/dist/resource-limits.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * The bounds on the request bodies the resource-level routes will buffer:
+ * /d1/create, /d1/query and /r2/create (Task 1702).
+ *
+ * Parallel to object-limits.ts, which bounds the object routes. Kept separate
+ * because the facts differ: an object envelope is dominated by R2's 1,024-byte
+ * object key limit, and these routes carry no key at all. Coupling them would tie
+ * a D1 database name to R2's key limit, so a revision to either would move a bound
+ * that has no reason to move.
+ *
+ * These are bounds on house memory. They do not adjudicate the last byte of a name
+ * or a statement — the same stance object-limits.ts takes, for the same reason. The
+ * house process holds the account-wide credential, so an out-of-memory kill there
+ * takes the brand server down, and on the target hardware that is a hard freeze
+ * that emits nothing.
+ *
+ * Deliberately dependency-free, like object-limits.ts: the ui route reads these
+ * through the barrel, and nothing here needs the rest of the lib.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.D1_QUERY_MAX_BODY_BYTES = exports.STORAGE_RESOURCE_NAME_MAX_BODY_BYTES = exports.JSON_STRING_WORST_CASE_EXPANSION = exports.D1_MAX_SQL_STATEMENT_BYTES = void 0;
+/**
+ * Cloudflare's documented maximum SQL statement length.
+ *
+ * "Maximum SQL statement length | 100,000 bytes (100 KB)"
+ * https://developers.cloudflare.com/d1/platform/limits/
+ *
+ * Recorded because it is what governs a legitimate `sql`, and because
+ * D1_QUERY_MAX_BODY_BYTES below is only knowable as safe by way of it.
+ *
+ * A second, independent bound applies to the same string on the way out, and is
+ * recorded here so nobody rediscovers it as a bug: cf-exec's d1Query shells
+ * `execFile("npx", ["wrangler", "d1", "execute", ..., "--command", sql])`, so the
+ * decoded statement travels as a single argv element. Linux caps one such element
+ * at MAX_ARG_STRLEN = 131,072 bytes and fails execve with E2BIG above it
+ * (https://man7.org/linux/man-pages/man2/execve.2.html). That is a property of the
+ * spawn path, not of D1. It does not bind first: 100,000 < 131,072, so a statement
+ * D1 would accept always fits the spawn.
+ */
+exports.D1_MAX_SQL_STATEMENT_BYTES = 100_000;
+/**
+ * The worst-case expansion of a byte when it is serialized into a JSON string.
+ *
+ * A single ASCII control byte becomes the six characters \uXXXX. Multi-byte
+ * characters are cheaper per byte — a 3-byte UTF-8 character also becomes six
+ * characters (2x), and a non-BMP character becomes a 12-character surrogate pair
+ * for 4 bytes (3x) — so 6 is a true ceiling over bytes, reached by ASCII.
+ *
+ * This is why a body limit is not simply the statement limit: the cap bounds the
+ * wire body, and escaping moves the two apart.
+ */
+exports.JSON_STRING_WORST_CASE_EXPANSION = 6;
+/**
+ * The largest JSON body /d1/create or /r2/create can legitimately carry: a single
+ * resource name and JSON punctuation. No payload term, and no key term.
+ *
+ * Sized on headroom rather than a tight derivation, because only one of the two
+ * names it bounds has a documented hard limit:
+ *
+ * - R2 bucket name: 3-63 characters, lowercase letters, digits and hyphens.
+ *   https://developers.cloudflare.com/r2/buckets/create-buckets/
+ * - D1 database name: no documented limit. The API reference states only
+ *   `name: string`, "D1 database name" — no maxLength, pattern or charset.
+ *   https://developers.cloudflare.com/api/resources/d1/subresources/database/
+ *   The get-started guide gives guidance, not a limit: names "should use a
+ *   combination of ASCII characters, shorter than 32 characters".
+ *
+ * So a real body is under ~100 bytes and 64 KiB clears it by roughly 650x, while
+ * sitting ~2,100x below put's body limit: far above anything a real caller sends,
+ * far below anything that threatens house memory. Nothing here depends on either
+ * figure being exact. An undocumented D1 name limit cannot plausibly approach 64
+ * KiB, and a request body is the wrong place to discover that it had.
+ *
+ * Deliberately not R2_OBJECT_ENVELOPE_MAX_BODY_BYTES, which happens to hold the
+ * same value. That constant is governed by R2's object key limit; this one is not,
+ * and the two must be free to drift. Couple what is one fact; separate what merely
+ * matches today.
+ */
+exports.STORAGE_RESOURCE_NAME_MAX_BODY_BYTES = 64 * 1024;
+/**
+ * The largest JSON body /d1/query can legitimately carry: a database name and a
+ * SQL statement.
+ *
+ * The envelope reasoning behind the object routes' bound does not govern this. A
+ * large but entirely legal migration or batch statement is not a 1,024-byte object
+ * key, so applying that constant here would reject correct queries.
+ *
+ * The bound is on the wire body, not the decoded statement, and JSON escaping moves
+ * those apart. The largest legal statement (D1_MAX_SQL_STATEMENT_BYTES) can present
+ * a wire body of up to
+ *
+ *   JSON_STRING_WORST_CASE_EXPANSION * 100,000 + 65,536 = 665,536 bytes
+ *
+ * so capping at 100,000 would 413 a statement D1 would have accepted. 1 MiB clears
+ * the worst case by about 1.6x and sits ~133x below put's body limit.
+ *
+ * It is a flat number rather than that expression, for legibility at the call site.
+ * The arithmetic is not decoration: it is the only thing that makes 1 MiB knowable
+ * as safe, so resource-limits.test.ts asserts the relationship. If D1 ever raises
+ * its statement limit above 163,840 bytes, that test fails rather than this route
+ * quietly beginning to refuse legal SQL.
+ */
+exports.D1_QUERY_MAX_BODY_BYTES = 1024 * 1024;
+//# sourceMappingURL=resource-limits.js.map

package/payload/platform/lib/storage-broker/dist/resource-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-limits.js","sourceRoot":"","sources":["../src/resource-limits.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,0BAA0B,GAAG,OAAO,CAAC;AAElD;;;;;;;;;;GAUG;AACU,QAAA,gCAAgC,GAAG,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACU,QAAA,oCAAoC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACU,QAAA,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC"}

package/payload/platform/lib/storage-broker/src/__tests__/cf-exec.test.ts

@@ -26,11 +26,18 @@ const throwingRun: RunFn = async () => {
 function recordingFetch(response: { ok: boolean; status: number; body: string }) {
   const calls: Array<{
     url: string;
-    init: { method: string; headers: Record<string, string>; body?: string };
+    init: { method: string; headers: Record<string, string>; body?: string | Uint8Array };
   }> = [];
   const fetchFn: FetchFn = async (url, init) => {
     calls.push({ url, init });
-    return { ok: response.ok, status: response.status, text: async () => response.body };
+    return {
+      ok: response.ok,
+      status: response.status,
+      text: async () => response.body,
+      // Task 1691 — r2ObjectGet reads the raw object body, so the seam carries
+      // arrayBuffer alongside text. The fake derives it from the same body.
+      arrayBuffer: async () => new TextEncoder().encode(response.body).buffer as ArrayBuffer,
+    };
   };
   return { fetchFn, calls };
 }
@@ -41,13 +48,18 @@ function recordingFetch(response: { ok: boolean; status: number; body: string })
 function sequenceFetch(responses: Array<{ ok: boolean; status: number; body: string }>) {
   const calls: Array<{
     url: string;
-    init: { method: string; headers: Record<string, string>; body?: string };
+    init: { method: string; headers: Record<string, string>; body?: string | Uint8Array };
   }> = [];
   const fetchFn: FetchFn = async (url, init) => {
     calls.push({ url, init });
     const r = responses[calls.length - 1];
     if (!r) throw new Error(`unexpected fetch call #${calls.length} to ${url}`);
-    return { ok: r.ok, status: r.status, text: async () => r.body };
+    return {
+      ok: r.ok,
+      status: r.status,
+      text: async () => r.body,
+      arrayBuffer: async () => new TextEncoder().encode(r.body).buffer as ArrayBuffer,
+    };
   };
   return { fetchFn, calls };
 }
@@ -99,7 +111,9 @@ test("d1Create creates the database via the D1 API with the house token, never w
   assert.equal(calls[0].init.method, "POST");
   assert.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
   assert.equal(calls[0].init.headers["Content-Type"], "application/json");
-  assert.deepEqual(JSON.parse(calls[0].init.body ?? ""), { name: "gls-new" });
+  // init.body widened to string | Uint8Array for the object-put path (Task
+  // 1691); d1Create still sends a JSON string.
+  assert.deepEqual(JSON.parse(String(calls[0].init.body ?? "")), { name: "gls-new" });
 });
 
 test("d1Create throws with the API error body on a non-2xx response", async () => {
@@ -338,3 +352,318 @@ test("makeHouseCfExec runs wrangler with the scoped token, not the minter", asyn
   await cf.d1List();
   assert.equal(sawToken, "scoped_tok", "wrangler saw the scoped token, not the minter");
 });
+
+// ---------------------------------------------------------------------------
+// Task 1691 — R2 object operations. Same discipline as r2List/d1Create: the
+// Cloudflare API behind an injectable fetch, wrangler never shelled (throwingRun
+// proves it), and every failure keeps its body.
+// ---------------------------------------------------------------------------
+
+function objectPage(
+  keys: Array<string | { key: string; size: number }>,
+  opts: { cursor?: string; truncated?: boolean } = {},
+) {
+  return JSON.stringify({
+    success: true,
+    errors: [],
+    messages: [],
+    result: keys.map((k) => {
+      const entry = typeof k === "string" ? { key: k, size: 10 } : k;
+      return {
+        key: entry.key,
+        size: entry.size,
+        etag: "e1",
+        last_modified: "2026-01-01T00:00:00Z",
+      };
+    }),
+    result_info: { cursor: opts.cursor ?? "", is_truncated: opts.truncated ?? false },
+  });
+}
+
+test("r2ObjectList returns a single page and never shells wrangler", async () => {
+  const { fetchFn, calls } = recordingFetch({ ok: true, status: 200, body: objectPage(["a.jpg"]) });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual(await cf.r2ObjectList("acc-a-portal"), [
+    { key: "a.jpg", size: 10, etag: "e1", lastModified: "2026-01-01T00:00:00Z" },
+  ]);
+  assert.equal(calls.length, 1);
+  assert.equal(
+    calls[0].url,
+    "https://api.cloudflare.com/client/v4/accounts/acc-h/r2/buckets/acc-a-portal/objects",
+  );
+  assert.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
+});
+
+test("r2ObjectList never sends per_page", async () => {
+  const { fetchFn, calls } = recordingFetch({ ok: true, status: 200, body: objectPage([]) });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2ObjectList("b");
+  assert.equal(calls[0].url.includes("per_page"), false);
+});
+
+test("r2ObjectList passes prefix through, encoded", async () => {
+  const { fetchFn, calls } = recordingFetch({ ok: true, status: 200, body: objectPage([]) });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2ObjectList("b", "person a/");
+  assert.ok(calls[0].url.endsWith("/objects?prefix=person+a%2F"), calls[0].url);
+});
+
+test("r2ObjectList follows the cursor to exhaustion", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: objectPage(["a.jpg"], { cursor: "c1", truncated: true }) },
+    { ok: true, status: 200, body: objectPage(["b.jpg"]) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual((await cf.r2ObjectList("b")).map((o) => o.key), ["a.jpg", "b.jpg"]);
+  assert.equal(calls.length, 2);
+  assert.ok(calls[1].url.includes("cursor=c1"));
+});
+
+// is_truncated is the authoritative continuation signal, not the presence of a
+// cursor: a last page may still carry one.
+test("r2ObjectList stops when is_truncated is false even if a cursor is present", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: objectPage(["a.jpg"], { cursor: "c1", truncated: false }) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2ObjectList("b");
+  assert.equal(calls.length, 1);
+});
+
+// The response shape is doc-confirmed but never measured against a live account.
+// If it is not what we understand, that must be loud: a partial list is exactly
+// the bug this loop exists to prevent.
+test("r2ObjectList throws when truncated but no cursor is given, never a partial list", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: objectPage(["a.jpg"], { truncated: true }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectList("b"), /truncated but gave no pagination cursor/);
+});
+
+test("r2ObjectList throws on a repeated cursor", async () => {
+  const { fetchFn } = sequenceFetch([
+    { ok: true, status: 200, body: objectPage(["a"], { cursor: "c1", truncated: true }) },
+    { ok: true, status: 200, body: objectPage(["b"], { cursor: "c1", truncated: true }) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectList("b"), /repeated pagination cursor/);
+});
+
+test("r2ObjectList retains the body on a non-2xx", async () => {
+  const { fetchFn } = recordingFetch({ ok: false, status: 403, body: '{"errors":[{"code":10000}]}' });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectList("b"), /10000/);
+});
+
+test("r2ObjectGet returns exact bytes and encodes the key segment-wise", async () => {
+  // Binary that is not valid UTF-8: proves the body never round-trips through
+  // text(), which would corrupt it.
+  const bytes = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x00, 0xff]);
+  const calls: string[] = [];
+  const fetchFn: FetchFn = async (url) => {
+    calls.push(url);
+    return {
+      ok: true,
+      status: 200,
+      text: async () => "unused",
+      arrayBuffer: async () => bytes.buffer.slice(0) as ArrayBuffer,
+    };
+  };
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  const got = await cf.r2ObjectGet("b", "person a/photo 1.jpg");
+  assert.deepEqual(Array.from(got), Array.from(bytes));
+  // Separators stay separators; spaces are escaped.
+  assert.ok(calls[0].endsWith("/objects/person%20a/photo%201.jpg"), calls[0]);
+});
+
+test("r2ObjectGet retains the body on a non-2xx", async () => {
+  const { fetchFn } = recordingFetch({ ok: false, status: 404, body: "no such key" });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectGet("b", "k"), /no such key/);
+});
+
+test("r2ObjectPut sends the bytes as the request body", async () => {
+  const { fetchFn, calls } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: JSON.stringify({ success: true, errors: [], messages: [], result: {} }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  const bytes = new Uint8Array([1, 2, 3]);
+  await cf.r2ObjectPut("b", "k.bin", bytes);
+  assert.equal(calls[0].init.method, "PUT");
+  assert.deepEqual(calls[0].init.body, bytes);
+  assert.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
+});
+
+test("r2ObjectPut retains the body on a non-success envelope", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: '{"success":false,"errors":[{"code":10001}]}',
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectPut("b", "k", new Uint8Array([1])), /10001/);
+});
+
+test("r2ObjectDelete issues a DELETE", async () => {
+  const { fetchFn, calls } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: JSON.stringify({ success: true, errors: [], messages: [], result: {} }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2ObjectDelete("b", "k");
+  assert.equal(calls[0].init.method, "DELETE");
+  assert.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
+});
+
+test("r2ObjectDelete retains the body on a non-2xx", async () => {
+  const { fetchFn } = recordingFetch({ ok: false, status: 500, body: "boom" });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectDelete("b", "k"), /boom/);
+});
+
+// Code review — is_truncated is itself an unmeasured fact (no live credential
+// exists to confirm the envelope). Driving the loop solely on it means a
+// response that omits it while still paginating truncates SILENTLY, which is
+// the exact failure this loop exists to prevent, and it would also make
+// r2ObjectList disagree with r2List directly above it, which drives the same
+// envelope on cursor presence alone.
+test("r2ObjectList follows a cursor when is_truncated is absent, rather than truncating silently", async () => {
+  const pageWithoutTruncatedFlag = (keys: string[], cursor: string | null) =>
+    JSON.stringify({
+      success: true,
+      errors: [],
+      messages: [],
+      result: keys.map((key) => ({ key, size: 1, etag: "e", last_modified: "t" })),
+      result_info: cursor === null ? {} : { cursor },
+    });
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: pageWithoutTruncatedFlag(["a.jpg"], "c1") },
+    { ok: true, status: 200, body: pageWithoutTruncatedFlag(["b.jpg"], null) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual((await cf.r2ObjectList("b")).map((o) => o.key), ["a.jpg", "b.jpg"]);
+  assert.equal(calls.length, 2);
+});
+
+// --- r2ObjectFind (Task 1697) ---------------------------------------------
+//
+// Sizing a get needs one record, not the prefix. These tests pin the two
+// properties that make the early exit safe: it matches the exact key, and it
+// stops at the page carrying it.
+
+test("r2ObjectFind returns the exact key when a prefix neighbour is listed first", async () => {
+  // Not hypothetical. Measured 2026-07-16 against the live v4 API: prefix=
+  // a/photo.jpg really does return a/photo.jpg.bak BEFORE a/photo.jpg, because
+  // the listing is not in ascending UTF-8 binary order. Taking the first element
+  // would size the neighbour, which either rejects a legal get or admits an
+  // oversized one.
+  const { fetchFn } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: objectPage([
+      { key: "a/photo.jpg.bak", size: 999 },
+      { key: "a/photo.jpg", size: 3 },
+    ]),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  const found = await cf.r2ObjectFind("b", "a/photo.jpg");
+  assert.equal(found?.key, "a/photo.jpg");
+  assert.equal(found?.size, 3);
+});
+
+test("r2ObjectFind sends the key as the prefix, encoded", async () => {
+  const { fetchFn, calls } = recordingFetch({ ok: true, status: 200, body: objectPage([]) });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2ObjectFind("b", "person a/x.jpg");
+  assert.ok(calls[0].url.endsWith("/objects?prefix=person+a%2Fx.jpg"), calls[0].url);
+});
+
+test("r2ObjectFind stops at the page carrying the match and fetches no further page", async () => {
+  // The page says truncated with a cursor, so r2ObjectList would fetch page 2.
+  // sequenceFetch throws on an unexpected call, so a second fetch fails here.
+  const { fetchFn, calls } = sequenceFetch([
+    {
+      ok: true,
+      status: 200,
+      body: objectPage([{ key: "k", size: 7 }], { cursor: "c1", truncated: true }),
+    },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  const found = await cf.r2ObjectFind("b", "k");
+  assert.equal(found?.size, 7);
+  assert.equal(calls.length, 1);
+});
+
+test("r2ObjectFind finds a match on a later page, never assuming position", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: objectPage(["x.jpg"], { cursor: "c1", truncated: true }) },
+    { ok: true, status: 200, body: objectPage([{ key: "k", size: 5 }], { truncated: false }) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  const found = await cf.r2ObjectFind("b", "k");
+  assert.equal(found?.size, 5);
+  assert.equal(calls.length, 2);
+});
+
+test("r2ObjectFind returns null when the key is absent after exhausting pages", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: objectPage(["k.bak"], { cursor: "c1", truncated: true }) },
+    { ok: true, status: 200, body: objectPage(["k.zzz"], { truncated: false }) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.equal(await cf.r2ObjectFind("b", "k"), null);
+  assert.equal(calls.length, 2);
+});
+
+test("r2ObjectFind throws on a repeated cursor instead of looping forever", async () => {
+  const { fetchFn } = sequenceFetch([
+    { ok: true, status: 200, body: objectPage(["x"], { cursor: "c1", truncated: true }) },
+    { ok: true, status: 200, body: objectPage(["y"], { cursor: "c1", truncated: true }) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectFind("b", "k"), /repeated pagination cursor/);
+});
+
+test("r2ObjectFind throws when truncated but no cursor is given", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: objectPage(["x"], { cursor: "", truncated: true }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectFind("b", "k"), /truncated but gave no pagination cursor/);
+});
+
+test("r2ObjectFind retains the body on a non-2xx", async () => {
+  const { fetchFn } = recordingFetch({ ok: false, status: 403, body: '{"errors":[{"code":10000}]}' });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectFind("b", "k"), /10000/);
+});
+
+// Code review — the early exit changes observable behaviour on an anomalous
+// page, and an unpinned behaviour change is how a regression starts. Pinned as a
+// decision rather than left implicit.
+//
+// A page that reports truncated with no cursor is an anomaly r2ObjectList throws
+// on, because a partial listing would corrupt the audit. r2ObjectFind returns at
+// the match and never reaches that check, so the same response yields the size
+// instead of an error. That is correct: the size is Cloudflare's own record for
+// the exact key, the cap is enforced on it, and the anomaly concerns pages the
+// sizing does not need. The audit's behaviour on the same response is unchanged
+// and is pinned by "r2ObjectList throws when truncated but no cursor is given".
+test("r2ObjectFind returns a match found before an anomalous page's guard is reached", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: objectPage([{ key: "k", size: 4 }], { cursor: "", truncated: true }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  const found = await cf.r2ObjectFind("b", "k");
+  assert.equal(found?.size, 4);
+});

package/payload/platform/lib/storage-broker/src/__tests__/object-limits.test.ts

@@ -0,0 +1,106 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
+  base64Ceiling,
+  tooLargeMessage,
+} from "../object-limits.js";
+
+test("the cap is 100 MiB", () => {
+  assert.equal(R2_OBJECT_MAX_BYTES, 100 * 1024 * 1024);
+});
+
+// The cap is set independently of email's 25 MiB. This pins that they are not
+// the same number, so a future edit that "unifies" them fails here and has to
+// read the design note rather than silently coupling two unrelated limits.
+test("the cap is not email's attachment cap", () => {
+  assert.notEqual(R2_OBJECT_MAX_BYTES, 25 * 1024 * 1024);
+});
+
+test("base64Ceiling matches base64's 4-out-per-3-in expansion, rounded up", () => {
+  assert.equal(base64Ceiling(0), 0);
+  assert.equal(base64Ceiling(1), 4);
+  assert.equal(base64Ceiling(3), 4);
+  assert.equal(base64Ceiling(4), 8);
+  assert.equal(base64Ceiling(6), 8);
+});
+
+// The ceiling must never sit below what a legal at-cap object actually encodes
+// to, or a legitimate put would be rejected by its own encoding.
+test("base64Ceiling is never below Node's own base64 length", () => {
+  for (const n of [0, 1, 2, 3, 4, 5, 100, 1023, 4096]) {
+    const encoded = Buffer.alloc(n).toString("base64").length;
+    assert.ok(
+      base64Ceiling(n) >= encoded,
+      `base64Ceiling(${n}) = ${base64Ceiling(n)} < ${encoded}`,
+    );
+  }
+});
+
+test("the put body ceiling admits a cap-sized object plus an envelope allowance", () => {
+  assert.equal(
+    R2_OBJECT_PUT_MAX_BODY_BYTES,
+    base64Ceiling(R2_OBJECT_MAX_BYTES) + 64 * 1024,
+  );
+  assert.ok(R2_OBJECT_PUT_MAX_BODY_BYTES > base64Ceiling(R2_OBJECT_MAX_BYTES));
+});
+
+// The allowance is for a key and JSON punctuation, not for smuggling a bigger
+// object: it must stay far below the cap it guards.
+test("the envelope allowance is negligible against the cap", () => {
+  const allowance = R2_OBJECT_PUT_MAX_BODY_BYTES - base64Ceiling(R2_OBJECT_MAX_BYTES);
+  assert.ok(allowance < R2_OBJECT_MAX_BYTES / 1000);
+});
+
+test("the envelope limit is 64 KiB", () => {
+  assert.equal(R2_OBJECT_ENVELOPE_MAX_BODY_BYTES, 64 * 1024);
+});
+
+// The sizing rationale, pinned rather than left in prose. An object key is at
+// most 1,024 bytes and a bucket name at most 63 characters, so even a key whose
+// every byte takes a six-character \uXXXX escape leaves an order of magnitude of
+// headroom. A future edit that shrinks this toward a real envelope fails here.
+test("the envelope limit clears a worst-case escaped envelope with headroom", () => {
+  const worstCase = 63 + 1024 * 6 + 64; // bucket + fully escaped key + punctuation
+  assert.ok(
+    R2_OBJECT_ENVELOPE_MAX_BODY_BYTES > worstCase * 5,
+    `${R2_OBJECT_ENVELOPE_MAX_BODY_BYTES} leaves too little headroom over ${worstCase}`,
+  );
+});
+
+// The counterpart to "the cap is not email's attachment cap" above, and the
+// opposite ruling for the opposite reason. That pair must stay apart because the
+// two numbers track different constraints and would drift for different reasons.
+// These two are one fact — how large can an envelope legitimately get — asked once
+// by put's allowance and once by the metadata routes' whole body, so they must
+// move together. This pins the composition; the test above pins the value.
+test("put's body ceiling is composed of the same envelope constant", () => {
+  assert.equal(
+    R2_OBJECT_PUT_MAX_BODY_BYTES,
+    base64Ceiling(R2_OBJECT_MAX_BYTES) + R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
+  );
+});
+
+test("the over-cap message names the object and the limit", () => {
+  const msg = tooLargeMessage("photo.jpg", 150 * 1024 * 1024);
+  assert.match(msg, /photo\.jpg/);
+  assert.match(msg, /150\.0 MiB/);
+  assert.match(msg, /100\.0 MiB/);
+});
+
+// Code review — MiB alone rounds, so an object one byte over the cap rendered as
+// "100.0 MiB, which exceeds the 100.0 MiB limit": a message that contradicts
+// itself and reads as a bug rather than a rejection. The exact bytes are what
+// disambiguate it, so they are pinned rather than left to formatting taste.
+test("the message stays legible for an object one byte over the cap", () => {
+  const msg = tooLargeMessage("photo.jpg", R2_OBJECT_MAX_BYTES + 1);
+  assert.match(msg, /104857601 bytes/);
+  assert.match(msg, /104857600 bytes/);
+  assert.notEqual(
+    msg.match(/100\.0 MiB \(104857601 bytes\)/),
+    null,
+    "the actual size must carry its exact byte count",
+  );
+});

package/payload/platform/lib/storage-broker/src/__tests__/resource-limits.test.ts

@@ -0,0 +1,49 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  D1_MAX_SQL_STATEMENT_BYTES,
+  D1_QUERY_MAX_BODY_BYTES,
+  JSON_STRING_WORST_CASE_EXPANSION,
+  STORAGE_RESOURCE_NAME_MAX_BODY_BYTES,
+} from "../resource-limits.js";
+
+test("the recorded D1 statement limit is Cloudflare's documented 100,000 bytes", () => {
+  assert.equal(D1_MAX_SQL_STATEMENT_BYTES, 100_000);
+});
+
+test("a resource-name body is bounded at 64 KiB", () => {
+  assert.equal(STORAGE_RESOURCE_NAME_MAX_BODY_BYTES, 64 * 1024);
+});
+
+test("a D1 query body is bounded at 1 MiB", () => {
+  assert.equal(D1_QUERY_MAX_BODY_BYTES, 1024 * 1024);
+});
+
+// The guard. D1_QUERY_MAX_BODY_BYTES is a flat number rather than a computed
+// expression, so nothing but this test holds it to the arithmetic that makes it
+// safe. If D1 ever raises its statement limit above 163,840 bytes, the worst-case
+// wire form of a legal statement exceeds 1 MiB and the route would begin rejecting
+// correct queries with nothing to signal why. This fails first instead.
+test("the D1 query body limit clears the worst-case wire form of a legal statement", () => {
+  const worstCaseLegalBody =
+    JSON_STRING_WORST_CASE_EXPANSION * D1_MAX_SQL_STATEMENT_BYTES +
+    STORAGE_RESOURCE_NAME_MAX_BODY_BYTES;
+  assert.ok(
+    D1_QUERY_MAX_BODY_BYTES > worstCaseLegalBody,
+    `D1_QUERY_MAX_BODY_BYTES (${D1_QUERY_MAX_BODY_BYTES}) must exceed the largest legal wire body (${worstCaseLegalBody}), or legal queries are rejected`,
+  );
+});
+
+// The escape ceiling is the reason the bound is not simply D1's 100,000. Pin the
+// factor against the runtime rather than restating the literal: a single ASCII
+// control byte serializes to the six characters \uXXXX, which is the worst ratio a
+// JSON string can reach over bytes.
+test("the JSON worst-case expansion is the six-character \\uXXXX escape", () => {
+  assert.equal(JSON_STRING_WORST_CASE_EXPANSION, 6);
+  // Written as an escape rather than a literal control byte: a raw 0x01 in source
+  // is invisible in most editors and diffs.
+  const oneControlByte = "\u0001";
+  assert.equal(Buffer.byteLength(oneControlByte), 1);
+  // minus the two quotes JSON.stringify wraps the string in
+  assert.equal(JSON.stringify(oneControlByte).length - 2, JSON_STRING_WORST_CASE_EXPANSION);
+});