@taskforcehq/taskforce 0.3.304 → 0.3.305

package/dist/server/routes/primitives.js

@@ -0,0 +1,73 @@
+const DEFAULT_MAX_JSON_BODY_BYTES = 1024 * 1024; // 1MB
+function createHttpError(message, statusCode) {
+    const error = new Error(message);
+    error.statusCode = statusCode;
+    return error;
+}
+export async function parseJsonBody(req, maxBytes = DEFAULT_MAX_JSON_BODY_BYTES) {
+    const safeMaxBytes = Number.isFinite(maxBytes) && maxBytes > 0
+        ? Math.floor(maxBytes)
+        : DEFAULT_MAX_JSON_BODY_BYTES;
+    return new Promise((resolve, reject) => {
+        let body = '';
+        let receivedBytes = 0;
+        req.on('data', chunk => {
+            receivedBytes += chunk.length;
+            if (receivedBytes > safeMaxBytes) {
+                req.pause();
+                reject(createHttpError(`Payload too large (max ${safeMaxBytes} bytes)`, 413));
+                return;
+            }
+            body += chunk;
+        });
+        req.on('end', () => {
+            try {
+                resolve(body ? JSON.parse(body) : {});
+            }
+            catch {
+                reject(createHttpError('Invalid JSON', 400));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+export async function parseFormBody(req, maxBytes = DEFAULT_MAX_JSON_BODY_BYTES) {
+    const safeMaxBytes = Number.isFinite(maxBytes) && maxBytes > 0
+        ? Math.floor(maxBytes)
+        : DEFAULT_MAX_JSON_BODY_BYTES;
+    return new Promise((resolve, reject) => {
+        let body = '';
+        let receivedBytes = 0;
+        req.on('data', chunk => {
+            receivedBytes += chunk.length;
+            if (receivedBytes > safeMaxBytes) {
+                req.pause();
+                reject(createHttpError(`Payload too large (max ${safeMaxBytes} bytes)`, 413));
+                return;
+            }
+            body += chunk;
+        });
+        req.on('end', () => {
+            try {
+                const params = new URLSearchParams(body);
+                const parsed = {};
+                params.forEach((value, key) => {
+                    parsed[String(key)] = String(value);
+                });
+                resolve(parsed);
+            }
+            catch {
+                reject(createHttpError('Invalid form body', 400));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+export function escapeHtml(value) {
+    return String(value || '')
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}

package/dist/server/routes/resources.d.ts

@@ -17,7 +17,7 @@
  *   GET  /api/taskforce/environments
  */
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import { type RouteHandler } from '../routes.js';
+import { type RouteHandler } from './primitives.js';
 export interface ResourceRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;

package/dist/server/routes/resources.js

@@ -19,7 +19,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { execFileSync } from 'child_process';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 const WORKFLOW_EDITOR_LOCKED_FIELDS = {
     do: ['aliasesText', 'dispatchDefault', 'criticalToolsText', 'contentDefault'],
     execute: ['aliasesText', 'dispatchDefault', 'criticalToolsText', 'contentDefault']

package/dist/server/routes/shared.d.ts

@@ -8,7 +8,7 @@
 import { IncomingMessage, ServerResponse } from 'http';
 import { TaskforceCore } from '../../core/Taskforce.js';
 import type { McpAccessTokenAuthResult, McpOAuthAccessTokenAuthResult, McpAccessTokenScope } from '../../core/Taskforce.js';
-import type { RouteContext } from '../routes.js';
+import type { RouteContext } from './primitives.js';
 import type { AiProfileBootstrapConfig } from '../../mcp/aiProfileBootstrap.js';
 export declare function resolveErrorStatusCode(error: unknown, fallback?: number): number;
 export declare function buildCloudMcpRuntimeAuth(input: {

package/dist/server/routes/sync.d.ts

@@ -1,6 +1,6 @@
 import { IncomingMessage } from 'http';
 import { TaskforceCore, TaskforceSyncCapable } from '../../core/Taskforce.js';
-import { RouteHandler, RouteContext } from '../routes.js';
+import { type RouteContext, type RouteHandler } from './primitives.js';
 import { resolveRequestAccess, createSessionTokenCookie } from '../auth.js';
 import { isReservedWorkspaceId } from '../../utils/workspaceIdentity.js';
 export interface SyncRouteDependencies {

package/dist/server/routes/sync.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { normalizeTaskDataRelativePath, ObjectStorageClient } from '../../storage/objectStorageClient.js';
 import { WorkspaceAssetStore, } from '../../storage/workspaceAssetStore.js';
 import { resolveSessionCookieAttributesForRequest } from '../auth.js';

package/dist/server/routes/tasks.d.ts

@@ -52,7 +52,7 @@
 import { IncomingMessage, ServerResponse } from 'http';
 import { TaskforceCore } from '../../core/Taskforce.js';
 import { type ResolvedObjectStorageConfig } from '../../storage/objectStorage.js';
-import { type RouteHandler, type RouteContext } from '../routes.js';
+import { type RouteHandler, type RouteContext } from './primitives.js';
 export interface TaskRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;

package/dist/server/routes/tasks.js

@@ -54,7 +54,7 @@ import { toPublicObjectStorageConfig } from '../../storage/objectStorage.js';
 import { getRuntimeCapabilities } from '../../runtime/capabilities.js';
 import { resolveBuildInfo } from '../buildInfo.js';
 import { resolveRealtimeSyncFlag } from '../../sync/realtimeFeature.js';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { resolveRequestAccess } from '../auth.js';
 import { resolveErrorStatusCode, requestHeader, requestRuntimeMode } from './shared.js';
 import { listBuiltInCustomTaxonomyLibraryPacks } from '../../shared/customTaxonomyLibrary.js';

package/dist/server/routes/workspaces.d.ts

@@ -13,7 +13,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteHandler, RouteContext } from '../routes.js';
+import { type RouteHandler, type RouteContext } from './primitives.js';
 import { ObjectStorageClient } from '../../storage/objectStorageClient.js';
 export interface WorkspaceRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;

package/dist/server/routes/workspaces.js

@@ -13,7 +13,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { resolveRequestAccess, createSessionTokenCookie, resolveSessionCookieAttributesForRequest, } from '../auth.js';
 import { isWorkspaceSwitchingEnabledForRuntime } from '../../shared/runtimeContract.js';
 import { resolveErrorStatusCode } from './shared.js';

package/dist/server/routes.d.ts

@@ -4,17 +4,14 @@
  * Extracted from vite.ts plugin to be reusable in both Vite plugin and standalone server.
  * This is a minimal implementation with core routes - additional routes can be added incrementally.
  */
-import { IncomingMessage, ServerResponse } from 'http';
 import { TaskforceCore } from '../core/Taskforce.js';
-import { type TaskforceAuthConfig } from './auth.js';
-import { type ResolvedObjectStorageConfig } from '../storage/objectStorage.js';
-export type RouteHandler = (req: IncomingMessage, res: ServerResponse, params: Record<string, string>) => Promise<void>;
+import { type RouteContext, type RouteHandler } from './routes/primitives.js';
+export { parseJsonBody } from './routes/primitives.js';
 export interface Route {
     pattern: RegExp;
     keys: string[];
     handler: RouteHandler;
 }
-export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number): Promise<any>;
 /**
  * Create API routes for Taskforce
  *
@@ -60,10 +57,6 @@ export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number):
  * - POST /api/taskforce/export-resources
  * - GET /api/taskforce/health
  */
-export interface RouteContext {
-    authConfig?: TaskforceAuthConfig;
-    objectStorage?: ResolvedObjectStorageConfig;
-}
 export declare function createRoutes(core: TaskforceCore, context?: RouteContext): Route[];
 export declare function matchRoute(method: string, pathname: string, routes: Route[]): {
     handler: RouteHandler;

package/dist/server/routes.js

@@ -14,7 +14,7 @@ import { parseAiProfileBootstrapHeaders } from '../mcp/aiProfileBootstrap.js';
 import { createTaskforceMcpServer, isMcpWriteToolName } from '../mcp/runtime.js';
 import { applyPrefixedRateLimitHeaders } from './rateLimit.js';
 import { createSessionTokenCookie, resolveRequestAccess } from './auth.js';
-import { resolveEffectiveEmailConfig, sendEmail } from './email.js';
+import { sendEmail } from './email.js';
 import { normalizeTaskDataRelativePath, ObjectStorageClient } from '../storage/objectStorageClient.js';
 import { DocumentRegistry, createDocumentHash } from '../storage/documentRegistry.js';
 import { TaskAssetStore } from '../storage/taskAssetStore.js';
@@ -34,12 +34,14 @@ import { registerResourceRoutes } from './routes/resources.js';
 import { registerDocumentRoutes } from './routes/documents.js';
 import { registerDocumentReviewRoutes } from './routes/documentReviews.js';
 import { registerAnnotatedAttachmentRoutes } from './routes/annotatedAttachments.js';
+import { escapeHtml, parseJsonBody } from './routes/primitives.js';
+import { getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl } from './routes/authSupport.js';
 import { buildCloudMcpRuntimeAuth, requestHeader, requestRole, requestRuntimeMode, requestUserId, makeAuditAdminAction, makeAuditAuthAction, makeEnsureAdminRole, makeEnsureAppAccess, makeEnsureAuthenticatedUser, makeEnsureCloudPlanData, makeRequestWorkspaceId, makeRequireCloudRuntime, makeResolveAdminRequestActor, makeResolveAuthenticatedUserId, makeResolveAuthenticatedMutationUserId, ensureWorkspaceAdminRole, } from './routes/shared.js';
 import { resolveDeploymentConfig } from '../config/deployment.js';
 import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl } from '../config/cloudEnvironment.js';
 import { getCanonicalDocumentName } from '../utils/documentNames.js';
 import { MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS } from '../mcp/toolRegistry.js';
-const DEFAULT_MAX_JSON_BODY_BYTES = 1024 * 1024; // 1MB
+export { parseJsonBody } from './routes/primitives.js';
 const DEFAULT_DOCUMENT_RETENTION_DAYS = 7;
 const STORAGE_INTEGRITY_HISTORY_LIMIT = 50;
 const MCP_TOKEN_SCOPE_VALUES = new Set(['tasks:read', 'tasks:write', 'workspace:read']);
@@ -70,20 +72,6 @@ function readPositiveInteger(value, fallback) {
         return fallback;
     return parsed;
 }
-function resolveBooleanSetting(value, fallback) {
-    if (typeof value === 'boolean')
-        return value;
-    if (typeof value === 'number')
-        return value !== 0;
-    const normalized = String(value || '').trim().toLowerCase();
-    if (!normalized)
-        return fallback;
-    if (['1', 'true', 'yes', 'on'].includes(normalized))
-        return true;
-    if (['0', 'false', 'no', 'off'].includes(normalized))
-        return false;
-    return fallback;
-}
 // Convert route pattern like '/api/taskforce/tasks/:id' to regex
 function createRoutePattern(path) {
     const keys = [];
@@ -93,74 +81,6 @@ function createRoutePattern(path) {
     });
     return { pattern: new RegExp(`^${pattern}$`), keys };
 }
-// Helper to parse JSON body from request with size guard.
-export async function parseJsonBody(req, maxBytes = DEFAULT_MAX_JSON_BODY_BYTES) {
-    const safeMaxBytes = Number.isFinite(maxBytes) && maxBytes > 0
-        ? Math.floor(maxBytes)
-        : DEFAULT_MAX_JSON_BODY_BYTES;
-    return new Promise((resolve, reject) => {
-        let body = '';
-        let receivedBytes = 0;
-        req.on('data', chunk => {
-            receivedBytes += chunk.length;
-            if (receivedBytes > safeMaxBytes) {
-                req.pause();
-                reject(createHttpError(`Payload too large (max ${safeMaxBytes} bytes)`, 413));
-                return;
-            }
-            body += chunk;
-        });
-        req.on('end', () => {
-            try {
-                resolve(body ? JSON.parse(body) : {});
-            }
-            catch (e) {
-                reject(createHttpError('Invalid JSON', 400));
-            }
-        });
-        req.on('error', reject);
-    });
-}
-async function parseFormBody(req, maxBytes = DEFAULT_MAX_JSON_BODY_BYTES) {
-    const safeMaxBytes = Number.isFinite(maxBytes) && maxBytes > 0
-        ? Math.floor(maxBytes)
-        : DEFAULT_MAX_JSON_BODY_BYTES;
-    return new Promise((resolve, reject) => {
-        let body = '';
-        let receivedBytes = 0;
-        req.on('data', chunk => {
-            receivedBytes += chunk.length;
-            if (receivedBytes > safeMaxBytes) {
-                req.pause();
-                reject(createHttpError(`Payload too large (max ${safeMaxBytes} bytes)`, 413));
-                return;
-            }
-            body += chunk;
-        });
-        req.on('end', () => {
-            try {
-                const params = new URLSearchParams(body);
-                const parsed = {};
-                params.forEach((value, key) => {
-                    parsed[String(key)] = String(value);
-                });
-                resolve(parsed);
-            }
-            catch {
-                reject(createHttpError('Invalid form body', 400));
-            }
-        });
-        req.on('error', reject);
-    });
-}
-function escapeHtml(value) {
-    return String(value || '')
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;');
-}
 function resolveErrorStatusCode(error, fallback = 400) {
     if (error instanceof TaskforceRuleError)
         return error.statusCode;
@@ -206,6 +126,51 @@ function inferMcpOauthProviderFromRedirectUris(redirectUris) {
     }
     return MCP_OAUTH_DEFAULT_PROVIDER;
 }
+/**
+ * Create API routes for Taskforce
+ *
+ * Core routes (29 total):
+ *
+ * **Task Management (12 routes)**
+ * - GET /api/taskforce/config
+ * - GET /api/taskforce/tasks
+ * - POST /api/taskforce/task
+ * - PATCH /api/taskforce/task/:id
+ * - DELETE /api/taskforce/task/:id
+ * - GET /api/taskforce/archive
+ * - POST /api/taskforce/task/:id/complete
+ * - POST /api/taskforce/task/:id/cancel
+ * - POST /api/taskforce/task/:id/comment
+ * - POST /api/taskforce/task/:id/unarchive
+ * - POST /api/taskforce/bulk-create
+ * - POST /api/taskforce/bulk-archive
+ * - POST /api/taskforce/bulk-update-fields
+ * - POST /api/taskforce/bulk-update-fields/preview
+ *
+ * **Configuration Management**
+ * - GET /api/taskforce/categories
+ * - POST /api/taskforce/categories
+ * - GET /api/taskforce/types
+ * - POST /api/taskforce/types
+ * - GET /api/taskforce/priorities
+ * - POST /api/taskforce/priorities
+ * - GET /api/taskforce/taxonomies
+ * - POST /api/taskforce/taxonomies
+ *
+ * **Workflow Settings**
+ * - GET /api/taskforce/approaches
+ * - POST /api/taskforce/approaches
+ *
+ * **Templates & Setup**
+ * - GET /api/taskforce/initiative-templates
+ * - POST /api/taskforce/initiative-templates/create
+ *
+ * **Advanced Features (3 routes)**
+ * - GET /api/taskforce/folders
+ * - POST /api/taskforce/validate-paths
+ * - POST /api/taskforce/export-resources
+ * - GET /api/taskforce/health
+ */
 export function createRoutes(core, context = {}) {
     const routes = [];
     const uiStateCache = new Map();
@@ -299,33 +264,6 @@ export function createRoutes(core, context = {}) {
             return null;
         return resolved;
     };
-    const shouldExposeDevAuthTokens = () => {
-        const explicit = String(process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS || '').trim().toLowerCase();
-        if (explicit === '1' || explicit === 'true' || explicit === 'yes')
-            return true;
-        if (explicit === '0' || explicit === 'false' || explicit === 'no')
-            return false;
-        return String(process.env.NODE_ENV || '').trim().toLowerCase() !== 'production';
-    };
-    const resolveRuntimeConfigBaseUrl = (req) => {
-        const host = String(req.headers['x-forwarded-host'] || req.headers.host || '').trim();
-        if (!host)
-            return '';
-        const proto = String(req.headers['x-forwarded-proto'] || '').trim().toLowerCase() === 'https'
-            ? 'https'
-            : (req.socket?.encrypted ? 'https' : 'http');
-        return `${proto}://${host}`.replace(/\/+$/, '');
-    };
-    const resolvePublicAuthBaseUrl = (req) => {
-        const configured = String(process.env.TASKFORCE_AUTH_PUBLIC_BASE_URL || '').trim().replace(/\/+$/, '');
-        if (configured)
-            return configured;
-        const host = String(req.headers['x-forwarded-host'] || req.headers.host || '').trim();
-        const proto = String(req.headers['x-forwarded-proto'] || '').trim().toLowerCase() === 'http' ? 'http' : 'https';
-        if (!host)
-            return resolveDeploymentConfig(process.env).cloudBaseUrl || 'https://app.taskforcehq.ai';
-        return `${proto}://${host}`;
-    };
     const logAuthLink = (kind, email, token, req) => {
         const base = resolvePublicAuthBaseUrl(req);
         const path = kind === 'verify-email'
@@ -333,34 +271,6 @@ export function createRoutes(core, context = {}) {
             : `/login?mode=reset&token=${encodeURIComponent(token)}`;
         console.info(`[Taskforce Auth] ${kind} email=${email} link=${base}${path}`);
     };
-    const getEmailConfig = () => {
-        if (context.authConfig?.runtimeMode !== 'cloud') {
-            return resolveEffectiveEmailConfig(process.env, { provider: 'console' });
-        }
-        const globalSettings = core.getGlobalSettings();
-        return resolveEffectiveEmailConfig(process.env, globalSettings.email || null);
-    };
-    const getAuthBehavior = () => {
-        const globalSettings = core.getGlobalSettings();
-        const authSettings = globalSettings.auth || {};
-        const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
-        const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const onboardingPolicy = core.getOnboardingPolicy();
-        return {
-            allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
-            requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
-            defaultNewUserBetaAccess: resolveBooleanSetting(authSettings.defaultNewUserBetaAccess, false),
-            authRateLimitEnabled: resolveBooleanSetting(authSettings.authRateLimitEnabled, true),
-            authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
-                ? Math.floor(authRateLimitMaxRequestsRaw)
-                : 10,
-            authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
-                ? Math.floor(authRateLimitWindowMsRaw)
-                : 15 * 60_000,
-            onboardingPolicyMode: onboardingPolicy.mode,
-            onboardingPlanVersionId: onboardingPolicy.planVersionId
-        };
-    };
     const deliverAuthEmail = async (kind, email, token, req) => {
         const base = resolvePublicAuthBaseUrl(req);
         const path = kind === 'verify-email'
@@ -378,7 +288,7 @@ export function createRoutes(core, context = {}) {
             to: email,
             subject,
             text
-        }, getEmailConfig());
+        }, getRouteEmailConfig(core, context));
         if (result.ok) {
             console.info(`[Taskforce Auth Email] kind=${kind} provider=${result.provider} to=${email} messageId=${result.messageId || '-'}`);
         }
@@ -396,7 +306,7 @@ export function createRoutes(core, context = {}) {
             to: email,
             subject,
             text
-        }, getEmailConfig());
+        }, getRouteEmailConfig(core, context));
         if (result.ok) {
             console.info(`[Taskforce Auth Email] kind=invite provider=${result.provider} to=${email} messageId=${result.messageId || '-'}`);
         }
@@ -799,7 +709,10 @@ export function createRoutes(core, context = {}) {
         const contentDisposition = params.forceDownload
             ? `attachment; filename="${resolvedDownloadName.replace(/"/g, '')}"`
             : 'inline';
-        if (params.asset.storageProvider === 'r2' && objectStorageClient && resolvedObjectStorage.provider === 'r2' && resolvedObjectStorage.r2) {
+        const readFromObjectStorage = async () => {
+            if (!objectStorageClient || resolvedObjectStorage.provider !== 'r2' || !resolvedObjectStorage.r2) {
+                return { statusCode: 404 };
+            }
             if (!params.forceDownload) {
                 const object = await objectStorageClient.getObject(params.asset.storageKey);
                 if (!object) {
@@ -820,19 +733,22 @@ export function createRoutes(core, context = {}) {
                     Location: objectStorageClient.createSignedGetUrl(params.asset.storageKey, resolvedObjectStorage.r2.signedDownloadTtlSeconds, { responseContentDisposition: contentDisposition })
                 }
             };
+        };
+        if (params.asset.storageProvider === 'r2' && objectStorageClient && resolvedObjectStorage.provider === 'r2' && resolvedObjectStorage.r2) {
+            return readFromObjectStorage();
         }
         const filePath = ensureWithinDir(path.join(basePath, params.asset.storageKey), basePath);
-        if (!filePath || !fs.existsSync(filePath)) {
-            return { statusCode: 404 };
+        if (filePath && fs.existsSync(filePath)) {
+            return {
+                statusCode: 200,
+                headers: {
+                    'Content-Type': params.asset.mimeType || contentTypeForExt(ext),
+                    'Content-Disposition': contentDisposition
+                },
+                body: fs.readFileSync(filePath)
+            };
         }
-        return {
-            statusCode: 200,
-            headers: {
-                'Content-Type': params.asset.mimeType || contentTypeForExt(ext),
-                'Content-Disposition': contentDisposition
-            },
-            body: fs.readFileSync(filePath)
-        };
+        return readFromObjectStorage();
     };
     const getAssetMetadata = (pathValue) => {
         const canonical = getCanonicalAssetMetadata(pathValue);
@@ -1109,7 +1025,7 @@ export function createRoutes(core, context = {}) {
             return null;
         return workspaceId;
     };
-    const ensureContextUploadAllowed = (req, res, workspaceId) => {
+    const ensureContextUploadAllowed = (req, res, workspaceId, options) => {
         if (requestRuntimeMode(req) !== 'cloud')
             return true;
         if (!ensureAuthenticatedUser(req)) {
@@ -1120,12 +1036,17 @@ export function createRoutes(core, context = {}) {
         const gate = core.evaluateFeatureAccess({
             userId: requestUserId(req),
             workspaceId,
-            featureKey: 'context.uploads'
+            featureKey: 'context.uploads',
+            context: {
+                requestedBytes: options?.requestedBytes
+            }
         });
         if (!gate.allowed) {
             res.writeHead(403, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
-                error: 'Document cloud storage is unavailable for this account entitlement.',
+                error: gate.reasonCode === 'UPLOAD_STORAGE_LIMIT_REACHED'
+                    ? 'This upload exceeds the document cloud storage limit for the current plan.'
+                    : 'Document cloud storage is unavailable for this account entitlement.',
                 code: gate.reasonCode
             }));
             return false;
@@ -1551,9 +1472,6 @@ export function createRoutes(core, context = {}) {
         requireCloudRuntime,
         auditAuthAction,
         resolveAdminRequestActor,
-        shouldExposeDevAuthTokens,
-        resolveRuntimeConfigBaseUrl,
-        resolvePublicAuthBaseUrl,
         resolveEffectiveObjectStorageConfig,
         getObjectStorageClient,
     });
@@ -1604,10 +1522,6 @@ export function createRoutes(core, context = {}) {
         appendDocumentPurgeHistory,
         getCollaborationTelemetry,
         isCollaborationPolicyEnabled,
-        resolveRuntimeConfigBaseUrl,
-        resolvePublicAuthBaseUrl,
-        parseFormBody,
-        escapeHtml,
         normalizeMcpOauthScopeString,
         MCP_TOKEN_SCOPE_VALUES,
         MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS,