@rubytech/create-maxy-code 0.1.459 → 0.1.461

package/payload/server/{chunk-Q6W4U6HL.js → chunk-JXWFVE5X.js}

@@ -13,8 +13,8 @@ var R2_OBJECT_MAX_BYTES = 100 * 1024 * 1024;
 function base64Ceiling(bytes) {
   return 4 * Math.ceil(bytes / 3);
 }
-var PUT_ENVELOPE_ALLOWANCE_BYTES = 64 * 1024;
-var R2_OBJECT_PUT_MAX_BODY_BYTES = base64Ceiling(R2_OBJECT_MAX_BYTES) + PUT_ENVELOPE_ALLOWANCE_BYTES;
+var R2_OBJECT_ENVELOPE_MAX_BODY_BYTES = 64 * 1024;
+var R2_OBJECT_PUT_MAX_BODY_BYTES = base64Ceiling(R2_OBJECT_MAX_BYTES) + R2_OBJECT_ENVELOPE_MAX_BODY_BYTES;
 function formatMiB(bytes) {
   return (bytes / 1024 / 1024).toFixed(1);
 }
@@ -59,6 +59,12 @@ async function listResources(session, accountId, kind) {
   }));
 }
 
+// ../lib/storage-broker/src/resource-limits.ts
+var D1_MAX_SQL_STATEMENT_BYTES = 1e5;
+var JSON_STRING_WORST_CASE_EXPANSION = 6;
+var STORAGE_RESOURCE_NAME_MAX_BODY_BYTES = 64 * 1024;
+var D1_QUERY_MAX_BODY_BYTES = 1024 * 1024;
+
 // ../lib/storage-broker/src/house-credential.ts
 import { readFileSync } from "fs";
 import { join } from "path";
@@ -173,6 +179,45 @@ ${body}`);
   }
   return { parsed, body };
 }
+async function* r2ObjectPages(fetchFn, cred, bucket, prefix) {
+  const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects`;
+  const seen = /* @__PURE__ */ new Set();
+  let cursor;
+  for (; ; ) {
+    const params = new URLSearchParams();
+    if (prefix !== void 0) params.set("prefix", prefix);
+    if (cursor !== void 0) params.set("cursor", cursor);
+    const qs = params.toString();
+    const { parsed, body } = await cfApiJson(
+      fetchFn,
+      qs ? `${base}?${qs}` : base,
+      { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } },
+      "r2 object list"
+    );
+    const page = parsed;
+    const objects = [];
+    for (const o of page.result ?? []) {
+      objects.push({ key: o.key, size: o.size, etag: o.etag, lastModified: o.last_modified });
+    }
+    yield objects;
+    const truncated = page.result_info?.is_truncated;
+    const next = page.result_info?.cursor;
+    if (truncated === false) return;
+    if (truncated === true && !next) {
+      throw new Error(
+        `storage-broker: r2 object list reported truncated but gave no pagination cursor: ${body}`
+      );
+    }
+    if (!next) return;
+    if (seen.has(next)) {
+      throw new Error(
+        `storage-broker: r2 object list returned a repeated pagination cursor: ${next}`
+      );
+    }
+    seen.add(next);
+    cursor = next;
+  }
+}
 function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
   const env = {
     ...process.env,
@@ -250,46 +295,40 @@ function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
     // The r2/api/tokens/ note that "Object Read & Write" is S3-only constrains
     // the bucket-item-scoped *permission types*, not these endpoints.
     //
-    // Doc-confirmed, never measured: no house Cloudflare credential exists on
-    // the dev machine. The design keeps the unmeasured facts unable to affect
-    // correctness — per_page is never sent, and nothing fails silently.
+    // The endpoint's existence and token class are doc-confirmed. Its behaviour
+    // was unmeasured until Task 1697, which probed the live v4 API on 2026-07-16
+    // from the laptop's own maxy-code install (no house Cloudflare credential
+    // exists on the dev Mac, which is why the tests fake the fetch seam). What
+    // that probe established, so nobody re-guesses it:
+    //
+    // - The listing is NOT in ascending UTF-8 binary order. `prefix=a/photo.jpg`
+    //   returns `a/photo.jpg.bak` before `a/photo.jpg`, so the exact key is not
+    //   the first element and `per_page=1` returns a neighbour. S3's
+    //   ListObjectsV2 ordering guarantee does not transfer to this endpoint.
+    // - HEAD is routed only for single-segment keys: any key containing "/"
+    //   returns 405 while GET on the identical URL returns 404.
+    // - A ranged GET is honoured at 2 MB and ignored at 12 B, so it cannot size
+    //   an object without an undocumented size threshold deciding correctness.
+    // - per_page is bounded 0..1000 (error 10029), and per_page=0 returns zero
+    //   objects with is_truncated:true — a loop trap. It is still never sent.
+    //
+    // The design keeps every unmeasured fact unable to affect correctness:
+    // per_page is never sent, order is never assumed, and nothing fails
+    // silently. Evidence:
+    // docs/superpowers/specs/2026-07-16-storage-broker-get-sizing-early-exit-design.md
     async r2ObjectList(bucket, prefix) {
-      const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects`;
       const objects = [];
-      const seen = /* @__PURE__ */ new Set();
-      let cursor;
-      for (; ; ) {
-        const params = new URLSearchParams();
-        if (prefix !== void 0) params.set("prefix", prefix);
-        if (cursor !== void 0) params.set("cursor", cursor);
-        const qs = params.toString();
-        const { parsed, body } = await cfApiJson(
-          fetchFn,
-          qs ? `${base}?${qs}` : base,
-          { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } },
-          "r2 object list"
-        );
-        const page = parsed;
-        for (const o of page.result ?? []) {
-          objects.push({ key: o.key, size: o.size, etag: o.etag, lastModified: o.last_modified });
-        }
-        const truncated = page.result_info?.is_truncated;
-        const next = page.result_info?.cursor;
-        if (truncated === false) return objects;
-        if (truncated === true && !next) {
-          throw new Error(
-            `storage-broker: r2 object list reported truncated but gave no pagination cursor: ${body}`
-          );
-        }
-        if (!next) return objects;
-        if (seen.has(next)) {
-          throw new Error(
-            `storage-broker: r2 object list returned a repeated pagination cursor: ${next}`
-          );
-        }
-        seen.add(next);
-        cursor = next;
+      for await (const page of r2ObjectPages(fetchFn, cred, bucket, prefix)) {
+        for (const o of page) objects.push(o);
+      }
+      return objects;
+    },
+    async r2ObjectFind(bucket, key) {
+      for await (const page of r2ObjectPages(fetchFn, cred, bucket, key)) {
+        const hit = page.find((o) => o.key === key);
+        if (hit) return hit;
       }
+      return null;
     },
     async r2ObjectGet(bucket, key) {
       const res = await fetchFn(objectUrl(cred.accountId, bucket, key), {
@@ -384,11 +423,16 @@ export {
   authorizeAccess,
   R2_OBJECT_MAX_BYTES,
   base64Ceiling,
+  R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
   R2_OBJECT_PUT_MAX_BODY_BYTES,
   tooLargeMessage,
   registerResource,
   resolveOwner,
   listResources,
+  D1_MAX_SQL_STATEMENT_BYTES,
+  JSON_STRING_WORST_CASE_EXPANSION,
+  STORAGE_RESOURCE_NAME_MAX_BODY_BYTES,
+  D1_QUERY_MAX_BODY_BYTES,
   readHouseCredential,
   resolveHouseScopedToken,
   makeCfExec,