fix(media): validate upload limit config

lib/media.ts

@@ -10,7 +10,16 @@ const DATA_DIR = process.env.DATA_DIR || path.join(process.cwd(), ".data");
 const MEDIA_DIR = path.join(DATA_DIR, "media");
 
 /** Cap per upload. Reels are short; keep them small enough to stream cheaply. */
-export const MAX_UPLOAD_BYTES = Number(process.env.MEDIA_MAX_BYTES || 100 * 1024 * 1024); // 100 MB
+export const DEFAULT_MAX_UPLOAD_BYTES = 100 * 1024 * 1024; // 100 MB
+
+export function parseMaxUploadBytes(value: string | undefined): number {
+  const trimmed = value?.trim();
+  if (!trimmed || !/^\d+$/.test(trimmed)) return DEFAULT_MAX_UPLOAD_BYTES;
+  const bytes = Number(trimmed);
+  return Number.isSafeInteger(bytes) && bytes > 0 ? bytes : DEFAULT_MAX_UPLOAD_BYTES;
+}
+
+export const MAX_UPLOAD_BYTES = parseMaxUploadBytes(process.env.MEDIA_MAX_BYTES);
 
 /** Accepted video mime types → file extension. mp4 is the primary target. */
 export const ALLOWED_TYPES: Record<string, string> = {

tests/media-upload-type.test.mjs

@@ -1,7 +1,33 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { mediaTypeForUpload } from "../lib/media.ts";
+import {
+  DEFAULT_MAX_UPLOAD_BYTES,
+  mediaTypeForUpload,
+  parseMaxUploadBytes,
+} from "../lib/media.ts";
+
+test("media upload limit accepts positive decimal byte values", () => {
+  assert.equal(parseMaxUploadBytes("1048576"), 1_048_576);
+  assert.equal(parseMaxUploadBytes(" 2048 "), 2_048);
+});
+
+test("media upload limit falls back for unsafe values", () => {
+  const unsafeValues = [
+    undefined,
+    "",
+    "0",
+    "-1",
+    "1.5",
+    "1e6",
+    "Infinity",
+    "invalid",
+    "9007199254740992",
+  ];
+  for (const value of unsafeValues) {
+    assert.equal(parseMaxUploadBytes(value), DEFAULT_MAX_UPLOAD_BYTES);
+  }
+});
 
 test("media upload type accepts explicit allowed video MIME types", () => {
   assert.equal(mediaTypeForUpload("clip.mp4", "video/mp4"), "video/mp4");