From b8164e479d317714bb88296b47014af3adf6ee74 Mon Sep 17 00:00:00 2001
From: Fadhlan Ridhwanallah <fridhwanallah@gmail.com>
Date: Thu, 15 Jan 2026 23:21:31 +0700
Subject: [PATCH 1/5] Prevent large amounts of data from getting into cards

---
 .../host/app/commands/check-correctness.ts    |  9 ++
 .../components/operator-mode/code-editor.gts  | 27 +++++-
 .../components/operator-mode/code-submode.gts |  8 ++
 .../code-submode/editor-indicator.gts         | 21 +++-
 packages/host/app/services/card-service.ts    | 97 ++++++++++++++++++-
 .../host/app/services/environment-service.ts  |  4 +-
 packages/host/app/services/store.ts           |  1 +
 packages/host/config/environment.js           |  6 ++
 .../tests/acceptance/code-submode-test.ts     | 32 ++++++
 .../acceptance/interact-submode-test.gts      | 45 +++++++++
 packages/host/tests/helpers/index.gts         |  3 +
 .../commands/check-correctness-test.gts       | 94 ++++++++++++++++++
 packages/realm-server/main.ts                 |  3 +
 .../realm-server/prerender/manager-server.ts  |  2 +-
 .../scripts/wait-for-prerender.sh             |  2 +-
 packages/realm-server/server.ts               |  8 ++
 packages/realm-server/tests/helpers/index.ts  |  3 +
 packages/runtime-common/index.ts              |  1 +
 packages/runtime-common/realm.ts              | 17 +++-
 .../runtime-common/write-size-validation.ts   | 12 +++
 20 files changed, 379 insertions(+), 16 deletions(-)
 create mode 100644 packages/runtime-common/write-size-validation.ts

diff --git a/packages/host/app/commands/check-correctness.ts b/packages/host/app/commands/check-correctness.ts
index 324ff21aa5..69488008cd 100644
--- a/packages/host/app/commands/check-correctness.ts
+++ b/packages/host/app/commands/check-correctness.ts
@@ -78,6 +78,15 @@ export default class CheckCorrectnessCommand extends HostBaseCommand<
     let errors: string[] = [];
     let lintIssues: string[] = [];
 
+    let writeError = this.cardService.peekWriteError(input.targetRef);
+    if (writeError) {
+      return new CorrectnessResultCard({
+        correct: false,
+        errors: [this.describeCardError(input.targetRef, writeError)],
+        warnings: [],
+      });
+    }
+
     if (
       targetType === 'file' &&
       (await this.isEmptyFileContent(input.targetRef))
diff --git a/packages/host/app/components/operator-mode/code-editor.gts b/packages/host/app/components/operator-mode/code-editor.gts
index c8c29bbbe3..f4ae4b0927 100644
--- a/packages/host/app/components/operator-mode/code-editor.gts
+++ b/packages/host/app/components/operator-mode/code-editor.gts
@@ -64,6 +64,7 @@ interface Signature {
     onSetup: (
       updateCursorByName: (name: string, fieldName?: string) => void,
     ) => void;
+    onWriteError?: (message: string | undefined) => void;
   };
 }
 
@@ -350,6 +351,7 @@ export default class CodeEditor extends Component<Signature> {
     this.syncWithStore.perform(content);
 
     await timeout(this.environmentService.autoSaveDelayMs);
+    this.args.onWriteError?.(undefined);
     this.writeSourceCodeToFile(
       this.args.file,
       content,
@@ -433,7 +435,11 @@ export default class CodeEditor extends Component<Signature> {
   private waitForSourceCodeWrite = restartableTask(async () => {
     if (isReady(this.args.file)) {
       this.args.onFileSave('started');
-      await all([this.args.file.writing, timeout(500)]);
+      try {
+        await all([this.args.file.writing, timeout(500)]);
+      } catch {
+        // Errors are surfaced via writeError banners, so don't rethrow.
+      }
       this.args.onFileSave('finished');
     }
   });
@@ -459,10 +465,21 @@ export default class CodeEditor extends Component<Signature> {
 
     // flush the loader so that the preview (when card instance data is shown),
     // or schema editor (when module code is shown) gets refreshed on save
-    return file.write(content, {
-      flushLoader: hasExecutableExtension(file.name),
-      saveType,
-    });
+    return file
+      .write(content, {
+        flushLoader: hasExecutableExtension(file.name),
+        saveType,
+      })
+      .catch((error) => {
+        if (error?.status === 413 && error?.title) {
+          this.args.onWriteError?.(error.title);
+          return;
+        }
+        let message =
+          error?.message ??
+          (error?.title ? `${error.title}: ${error.message ?? ''}` : undefined);
+        this.args.onWriteError?.(message ? message.trim() : String(error));
+      });
   }
 
   private safeJSONParse(content: string) {
diff --git a/packages/host/app/components/operator-mode/code-submode.gts b/packages/host/app/components/operator-mode/code-submode.gts
index e13f4a404e..2a418a9aeb 100644
--- a/packages/host/app/components/operator-mode/code-submode.gts
+++ b/packages/host/app/components/operator-mode/code-submode.gts
@@ -147,6 +147,7 @@ export default class CodeSubmode extends Component<Signature> {
   @tracked private loadFileError: string | null = null;
   @tracked private userHasDismissedURLError = false;
   @tracked private sourceFileIsSaving = false;
+  @tracked private writeError: string | undefined;
   @tracked private isCreateModalOpen = false;
   @tracked private itemToDelete: CardDef | URL | null | undefined;
   @tracked private cardResource: ReturnType<getCard> | undefined;
@@ -373,6 +374,11 @@ export default class CodeSubmode extends Component<Signature> {
     this.sourceFileIsSaving = status === 'started';
   }
 
+  @action
+  private onWriteError(message: string | undefined) {
+    this.writeError = message;
+  }
+
   @action
   private onHorizontalLayoutChange(layout: number[]) {
     if (layout.length > 2) {
@@ -731,6 +737,7 @@ export default class CodeSubmode extends Component<Signature> {
                       @saveSourceOnClose={{@saveSourceOnClose}}
                       @selectDeclaration={{this.selectDeclaration}}
                       @onFileSave={{this.onSourceFileSave}}
+                      @onWriteError={{this.onWriteError}}
                       @onSetup={{this.setupCodeEditor}}
                       @isReadOnly={{this.isReadOnly}}
                     />
@@ -738,6 +745,7 @@ export default class CodeSubmode extends Component<Signature> {
                     <CodeSubmodeEditorIndicator
                       @isSaving={{this.isSaving}}
                       @isReadOnly={{this.isReadOnly}}
+                      @errorMessage={{this.writeError}}
                     />
                   {{else if this.isLoading}}
                     <LoadingIndicator
diff --git a/packages/host/app/components/operator-mode/code-submode/editor-indicator.gts b/packages/host/app/components/operator-mode/code-submode/editor-indicator.gts
index 59cea206db..73dd97696d 100644
--- a/packages/host/app/components/operator-mode/code-submode/editor-indicator.gts
+++ b/packages/host/app/components/operator-mode/code-submode/editor-indicator.gts
@@ -2,6 +2,7 @@ import type { TemplateOnlyComponent } from '@ember/component/template-only';
 
 import { LoadingIndicator } from '@cardstack/boxel-ui/components';
 
+import { bool, or } from '@cardstack/boxel-ui/helpers';
 import { CheckMark, IconPencilCrossedOut } from '@cardstack/boxel-ui/icons';
 
 interface Signature {
@@ -12,6 +13,7 @@ interface Signature {
   Args: {
     isReadOnly: boolean;
     isSaving: boolean;
+    errorMessage?: string;
   };
 }
 
@@ -50,6 +52,12 @@ const CodeSubmodeEditorIndicator: TemplateOnlyComponent<Signature> = <template>
       background-color: #ffd73c;
     }
 
+    .indicator-error {
+      --icon-color: #fff;
+      background-color: rgba(220, 53, 69, 0.9);
+      color: #fff;
+    }
+
     .indicator.visible {
       transform: translateX(0px);
       transition-delay: 0s;
@@ -88,8 +96,17 @@ const CodeSubmodeEditorIndicator: TemplateOnlyComponent<Signature> = <template>
       </span>
     </div>
   {{else}}
-    <div class='indicator indicator-saving {{if @isSaving "visible"}}'>
-      {{#if @isSaving}}
+    <div
+      class='indicator
+        {{if @errorMessage "indicator-error" "indicator-saving"}}
+        {{if (or @isSaving (bool @errorMessage)) "visible"}}'
+      data-test-save-error={{if @errorMessage 'true'}}
+    >
+      {{#if @errorMessage}}
+        <span class='indicator-msg'>
+          {{@errorMessage}}
+        </span>
+      {{else if @isSaving}}
         <span class='indicator-msg'>
           Now Saving
         </span>
diff --git a/packages/host/app/services/card-service.ts b/packages/host/app/services/card-service.ts
index be13e64c6e..173826585d 100644
--- a/packages/host/app/services/card-service.ts
+++ b/packages/host/app/services/card-service.ts
@@ -7,14 +7,15 @@ import {
   formattedError,
   SupportedMimeType,
   type CardDocument,
+  type CardErrorJSONAPI,
   type SingleCardDocument,
   type LooseSingleCardDocument,
   type RealmInfo,
   type Loader,
 } from '@cardstack/runtime-common';
-
 import type { AtomicOperation } from '@cardstack/runtime-common/atomic-document';
 import { createAtomicDocument } from '@cardstack/runtime-common/atomic-document';
+import { validateWriteSize } from '@cardstack/runtime-common/write-size-validation';
 
 import type {
   BaseDef,
@@ -27,6 +28,7 @@ import type * as CardAPI from 'https://cardstack.com/base/card-api';
 
 import LimitedSet from '../lib/limited-set';
 
+import type EnvironmentService from './environment-service';
 import type LoaderService from './loader-service';
 import type MessageService from './message-service';
 import type NetworkService from './network';
@@ -57,10 +59,12 @@ export default class CardService extends Service {
   @service declare private loaderService: LoaderService;
   @service declare private messageService: MessageService;
   @service declare private network: NetworkService;
+  @service declare private environmentService: EnvironmentService;
   @service declare private realm: Realm;
   @service declare private reset: ResetService;
 
   private subscriber: CardSaveSubscriber | undefined;
+  private writeErrors = new Map<string, CardErrorJSONAPI>();
   // For tracking requests during the duration of this service. Used for being able to tell when to ignore an incremental indexing realm event.
   // We want to ignore it when it is a result of our own request so that we don't reload the card and overwrite any unsaved changes made during auto save request and realm event.
   declare private loaderToCardAPILoadingCache: WeakMap<
@@ -103,6 +107,18 @@ export default class CardService extends Service {
     this.subscriber = undefined;
   }
 
+  peekWriteError(url: string): CardErrorJSONAPI | undefined {
+    return this.writeErrors.get(url);
+  }
+
+  private storeWriteError(url: string, error: CardErrorJSONAPI) {
+    this.writeErrors.set(url, error);
+  }
+
+  private clearWriteError(url: string) {
+    this.writeErrors.delete(url);
+  }
+
   async fetchJSON(
     url: string | URL,
     args?: CardServiceRequestInit,
@@ -140,22 +156,75 @@ export default class CardService extends Service {
       requestInit.method = 'POST';
       requestHeaders.set('X-HTTP-Method-Override', 'QUERY');
     }
+    let urlString = url instanceof URL ? url.href : url;
+    let method = requestInit.method?.toUpperCase?.();
+    if (
+      !isReadOperation &&
+      (method === 'POST' || method === 'PATCH') &&
+      requestInit.body
+    ) {
+      let jsonString =
+        typeof requestInit.body === 'string'
+          ? requestInit.body
+          : JSON.stringify(requestInit.body, null, 2);
+      validateWriteSize(
+        jsonString,
+        this.environmentService.maxCardWriteSizeBytes,
+        'card',
+      );
+    }
+
     let response = await this.network.authedFetch(url, requestInit);
     if (!response.ok) {
       let responseText = await response.text();
+      let parsedError: CardErrorJSONAPI | undefined;
+      try {
+        let parsed = JSON.parse(responseText);
+        let candidate = parsed?.errors?.[0];
+        if (candidate) {
+          if (typeof candidate.status === 'string') {
+            let parsedStatus = Number(candidate.status);
+            candidate.status = Number.isNaN(parsedStatus)
+              ? candidate.status
+              : parsedStatus;
+          }
+          parsedError = candidate as CardErrorJSONAPI;
+        }
+      } catch {
+        parsedError = undefined;
+      }
+      if (parsedError) {
+        if (!isReadOperation) {
+          this.storeWriteError(urlString, parsedError);
+        }
+        throw parsedError;
+      }
+
       let err = new Error(
         `status: ${response.status} -
           ${response.statusText}. ${responseText}`,
       ) as any;
-
       err.status = response.status;
       err.responseText = responseText;
       err.responseHeaders = response.headers;
-
+      if (!isReadOperation) {
+        let error = formattedError(urlString, err)?.errors?.[0];
+        if (error) {
+          this.storeWriteError(urlString, error);
+          throw error;
+        }
+      }
       throw err;
     }
     if (response.status !== 204) {
-      return await response.json();
+      let json = await response.json();
+      if (!isReadOperation) {
+        this.clearWriteError(urlString);
+      }
+      return json;
+    }
+    if (!isReadOperation) {
+      this.clearWriteError(urlString);
     }
     return;
   }
@@ -191,6 +260,11 @@ export default class CardService extends Service {
     options?: SaveSourceOptions,
   ) {
     try {
+      validateWriteSize(
+        content,
+        this.environmentService.maxCardWriteSizeBytes,
+        'file',
+      );
       let clientRequestId = options?.clientRequestId ?? `${type}:${uuidv4()}`;
       this.clientRequestIds.add(clientRequestId);
 
@@ -210,6 +284,7 @@ export default class CardService extends Service {
         console.error(errorMessage);
         throw new Error(errorMessage);
       }
+      this.clearWriteError(url.href);
       this.subscriber?.(url, content);
 
       if (options?.resetLoader) {
@@ -220,8 +295,10 @@ export default class CardService extends Service {
     } catch (e: any) {
       let error = formattedError(undefined, e)?.errors?.[0];
       if (error) {
+        this.storeWriteError(url.href, error);
         throw error;
       }
+      this.storeWriteError(url.href, e);
       throw new Error(e);
     }
   }
@@ -294,6 +371,18 @@ export default class CardService extends Service {
   }
 
   async executeAtomicOperations(operations: AtomicOperation[], realmURL: URL) {
+    let maxSizeBytes = this.environmentService.maxCardWriteSizeBytes;
+    for (let operation of operations) {
+      if (operation.data?.type === 'source') {
+        let content = operation.data.attributes?.content;
+        if (typeof content === 'string') {
+          validateWriteSize(content, maxSizeBytes, 'file');
+        }
+      } else if (operation.data?.type === 'card') {
+        let jsonString = JSON.stringify(operation.data, null, 2);
+        validateWriteSize(jsonString, maxSizeBytes, 'card');
+      }
+    }
     let doc = createAtomicDocument(operations);
     let response = await this.network.authedFetch(`${realmURL.href}_atomic`, {
       method: 'POST',
diff --git a/packages/host/app/services/environment-service.ts b/packages/host/app/services/environment-service.ts
index b85899c8ea..282c9e79dd 100644
--- a/packages/host/app/services/environment-service.ts
+++ b/packages/host/app/services/environment-service.ts
@@ -3,15 +3,17 @@ import Service from '@ember/service';
 
 import config from '@cardstack/host/config/environment';
 
-const { autoSaveDelayMs } = config;
+const { autoSaveDelayMs, maxCardWriteSizeBytes } = config;
 
 // we use this service to help instrument environment settings in tests
 export default class EnvironmentService extends Service {
   autoSaveDelayMs: number;
+  maxCardWriteSizeBytes: number;
 
   constructor(owner: Owner) {
     super(owner);
     this.autoSaveDelayMs = autoSaveDelayMs;
+    this.maxCardWriteSizeBytes = maxCardWriteSizeBytes;
   }
 }
 
diff --git a/packages/host/app/services/store.ts b/packages/host/app/services/store.ts
index 9397196d4c..26a926ae48 100644
--- a/packages/host/app/services/store.ts
+++ b/packages/host/app/services/store.ts
@@ -1245,6 +1245,7 @@ export default class StoreService extends Service implements StoreInterface {
   private calculateLastSavedMsg(autoSaveState: AutoSaveState) {
     let savedMessage: string | undefined;
     if (autoSaveState.lastSaveError) {
+      console.log(autoSaveState.lastSaveError);
       savedMessage = `Failed to save: ${this.getErrorMessage(
         autoSaveState.lastSaveError,
       )}`;
diff --git a/packages/host/config/environment.js b/packages/host/config/environment.js
index 97af98b107..60436e2bbd 100644
--- a/packages/host/config/environment.js
+++ b/packages/host/config/environment.js
@@ -40,6 +40,9 @@ module.exports = function (environment) {
     cardRenderTimeout: Number(
       process.env.RENDER_TIMEOUT_MS ?? DEFAULT_CARD_RENDER_TIMEOUT_MS,
     ),
+    maxCardWriteSizeBytes: Number(
+      process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 64 * 1024,
+    ),
     iconsURL: process.env.ICONS_URL || 'https://boxel-icons.boxel.ai',
     publishedRealmBoxelSpaceDomain:
       process.env.PUBLISHED_REALM_BOXEL_SPACE_DOMAIN || 'localhost:4201',
@@ -89,6 +92,9 @@ module.exports = function (environment) {
     ENV.serverEchoDebounceMs = 0;
     ENV.loginMessageTimeoutMs = 0;
     ENV.minSaveTaskDurationMs = 0;
+    ENV.maxCardWriteSizeBytes = Number(
+      process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 1024,
+    );
     ENV.sqlSchema = sqlSchema;
     ENV.featureFlags = {
       SHOW_ASK_AI: true,
diff --git a/packages/host/tests/acceptance/code-submode-test.ts b/packages/host/tests/acceptance/code-submode-test.ts
index 46fc5fabcf..9153897e22 100644
--- a/packages/host/tests/acceptance/code-submode-test.ts
+++ b/packages/host/tests/acceptance/code-submode-test.ts
@@ -1965,6 +1965,38 @@ module('Acceptance | code submode tests', function (_hooks) {
       );
     });
 
+    test('code editor shows size limit error when json save exceeds limit', async function (assert) {
+      let environmentService = getService('environment-service') as any;
+      let originalMaxSize = environmentService.maxCardWriteSizeBytes;
+
+      try {
+        await visitOperatorMode({
+          submode: 'code',
+          codePath: `${testRealmURL}person-entry.json`,
+        });
+
+        await waitFor('[data-test-editor]');
+
+        let content = getMonacoContent();
+        let encoder = new TextEncoder();
+        let currentSize = encoder.encode(content).length;
+        environmentService.maxCardWriteSizeBytes = currentSize + 50;
+
+        let doc = JSON.parse(content);
+        doc.data.attributes = {
+          ...(doc.data.attributes ?? {}),
+          title: 'x'.repeat(currentSize + 200),
+        };
+        setMonacoContent(JSON.stringify(doc, null, 2));
+        await waitFor('[data-test-save-error]');
+        assert
+          .dom('[data-test-save-error]')
+          .includesText('exceeds maximum allowed size (270 bytes)');
+      } finally {
+        environmentService.maxCardWriteSizeBytes = originalMaxSize;
+      }
+    });
+
     test('card preview live updates when index changes', async function (assert) {
       await visitOperatorMode({
         stacks: [
diff --git a/packages/host/tests/acceptance/interact-submode-test.gts b/packages/host/tests/acceptance/interact-submode-test.gts
index 142e302e31..3505967648 100644
--- a/packages/host/tests/acceptance/interact-submode-test.gts
+++ b/packages/host/tests/acceptance/interact-submode-test.gts
@@ -6,6 +6,7 @@ import {
   typeIn,
   triggerKeyEvent,
   settled,
+  waitUntil,
 } from '@ember/test-helpers';
 
 import { triggerEvent } from '@ember/test-helpers';
@@ -1160,4 +1161,48 @@ module('Acceptance | interact submode tests', function (hooks) {
       await assertFocusPreserved(withLinksSelector, `With Pet${typedText}`);
     });
   });
+
+  module('size limit errors', function () {
+    test('edit view shows size limit error when save exceeds limit', async function (assert) {
+      let environmentService = getService('environment-service') as any;
+      let originalMaxSize = environmentService.maxCardWriteSizeBytes;
+      environmentService.maxCardWriteSizeBytes = 1000;
+
+      try {
+        await visitOperatorMode({
+          stacks: [
+            [
+              {
+                id: `${testRealmURL}Pet/mango`,
+                format: 'edit',
+              },
+            ],
+          ],
+        });
+
+        await fillIn(
+          `[data-test-stack-card="${testRealmURL}Pet/mango"] [data-test-field="name"] input`,
+          'x'.repeat(5000),
+        );
+
+        await waitUntil(() =>
+          Boolean(
+            !find(
+              `[data-test-stack-card="${testRealmURL}Pet/mango"] [data-test-auto-save-indicator]`,
+            )?.textContent?.includes('Saving'),
+          ),
+        );
+
+        assert
+          .dom(
+            `[data-test-stack-card="${testRealmURL}Pet/mango"] [data-test-auto-save-indicator]`,
+          )
+          .includesText(
+            `exceeds maximum allowed size (${environmentService.maxCardWriteSizeBytes} bytes)`,
+          );
+      } finally {
+        environmentService.maxCardWriteSizeBytes = originalMaxSize;
+      }
+    });
+  });
 });
diff --git a/packages/host/tests/helpers/index.gts b/packages/host/tests/helpers/index.gts
index 28632ac215..570c088424 100644
--- a/packages/host/tests/helpers/index.gts
+++ b/packages/host/tests/helpers/index.gts
@@ -794,6 +794,9 @@ async function setupTestRealm({
     }),
     realmServerURL: ensureTrailingSlash(ENV.realmServerURL),
     definitionLookup,
+    maxCardWriteSizeBytes: Number(
+      process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 64 * 1024,
+    ),
   });
 
   // we use this to run cards that were added to the test filesystem
diff --git a/packages/host/tests/integration/commands/check-correctness-test.gts b/packages/host/tests/integration/commands/check-correctness-test.gts
index bf989e5a6e..834f0daf50 100644
--- a/packages/host/tests/integration/commands/check-correctness-test.gts
+++ b/packages/host/tests/integration/commands/check-correctness-test.gts
@@ -128,6 +128,7 @@ module('Integration | commands | check-correctness', function (hooks) {
       secondResult.correct,
       'second run reports errors after invalid change',
     );
+    console.log(secondResult.errors);
     assert.ok(
       secondResult.errors.some((e: string) =>
         e.includes('Name cannot be "Bill"'),
@@ -283,4 +284,97 @@ ${REPLACE_MARKER}`;
     assert.true(result.correct, 'empty file reports as correct');
     assert.deepEqual(result.errors, [], 'no errors are reported');
   });
+
+  test('reports size limit errors for file writes', async function (assert) {
+    let commandService = getService('command-service') as {
+      commandContext: CommandContext;
+    };
+    let environmentService = getService('environment-service') as any;
+    let cardService = getService('card-service');
+    let patchCodeCommand = new PatchCodeCommand(commandService.commandContext);
+    let command = new CheckCorrectnessCommand(commandService.commandContext);
+    let roomId = '!room:example.com';
+    let fileUrl = `${testRealmURL}pet.gts`;
+
+    let originalMaxSize = environmentService.maxCardWriteSizeBytes;
+    environmentService.maxCardWriteSizeBytes = 20;
+
+    try {
+      let { content } = await cardService.getSource(new URL(fileUrl));
+      const codeBlock = `${SEARCH_MARKER}
+${content}
+${SEPARATOR_MARKER}
+${'x'.repeat(21)}
+${REPLACE_MARKER}`;
+      await patchCodeCommand.execute({
+        fileUrl,
+        codeBlocks: [codeBlock],
+        roomId,
+      });
+
+      let result = await command.execute({
+        targetType: 'file',
+        targetRef: fileUrl,
+        roomId,
+      });
+
+      assert.false(result.correct, 'size limit error reports incorrect');
+      assert.ok(
+        result.errors[0]?.includes('exceeds maximum allowed size (20 bytes)'),
+        'error mentions size limit',
+      );
+    } finally {
+      environmentService.maxCardWriteSizeBytes = originalMaxSize;
+    }
+  });
+
+  test('reports size limit errors for card writes via PatchCardInstanceCommand', async function (assert) {
+    let commandService = getService('command-service') as {
+      commandContext: CommandContext;
+    };
+    let environmentService = getService('environment-service') as any;
+    let loader = getService('loader-service').loader as any;
+    let store = getService('store') as any;
+    let command = new CheckCorrectnessCommand(commandService.commandContext);
+    let roomId = '!room:example.com';
+    let { Pet } = await loader.import(`${testRealmURL}pet`);
+    let cardId = `${testRealmURL}Pet/billy`;
+
+    store.addReference(cardId);
+    await store.waitForCardLoad(cardId);
+
+    let originalMaxSize = environmentService.maxCardWriteSizeBytes;
+    environmentService.maxCardWriteSizeBytes = 1000;
+
+    try {
+      let patchCommand = new PatchCardInstanceCommand(
+        commandService.commandContext,
+        { cardType: Pet },
+      );
+
+      await patchCommand.execute({
+        cardId,
+        patch: {
+          attributes: {
+            name: 'x'.repeat(2000),
+          },
+        },
+        roomId,
+      });
+
+      let result = await command.execute({
+        targetType: 'card',
+        targetRef: cardId,
+        roomId,
+      });
+      console.log(result.errors);
+      assert.false(result.correct, 'size limit error reports incorrect');
+      assert.ok(
+        result.errors[0]?.includes('exceeds maximum allowed size (20 bytes)'),
+        'error mentions size limit',
+      );
+    } finally {
+      environmentService.maxCardWriteSizeBytes = originalMaxSize;
+    }
+  });
 });
diff --git a/packages/realm-server/main.ts b/packages/realm-server/main.ts
index df4c418b6a..ffa27a77a2 100644
--- a/packages/realm-server/main.ts
+++ b/packages/realm-server/main.ts
@@ -272,6 +272,9 @@ const getIndexHTML = async () => {
         realmServerMatrixClient,
         realmServerURL: serverURL,
         definitionLookup,
+        maxCardWriteSizeBytes: Number(
+          process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 64 * 1024,
+        ),
       },
       {
         fullIndexOnStartup: true,
diff --git a/packages/realm-server/prerender/manager-server.ts b/packages/realm-server/prerender/manager-server.ts
index 70fe81449d..19bf09557e 100644
--- a/packages/realm-server/prerender/manager-server.ts
+++ b/packages/realm-server/prerender/manager-server.ts
@@ -25,7 +25,7 @@ let { port, exitOnSignal, forceExitTimeoutMs } = yargs(process.argv.slice(2))
     forceExitTimeoutMs: {
       description:
         'When exitOnSignal is true, force the process to exit after this timeout (ms)',
-      default: 1000,
+      default: 150000,
       type: 'number',
     },
   })
diff --git a/packages/realm-server/scripts/wait-for-prerender.sh b/packages/realm-server/scripts/wait-for-prerender.sh
index 465572dd25..47c1a6090f 100755
--- a/packages/realm-server/scripts/wait-for-prerender.sh
+++ b/packages/realm-server/scripts/wait-for-prerender.sh
@@ -3,7 +3,7 @@
 wait_for_prerender() {
   local url="${1:-${PRERENDER_HEALTH_URL:-http://localhost:4221/}}"
   local trimmed_url="${url%/}/"
-  TIMEOUT_SECONDS=30
+  TIMEOUT_SECONDS=150
   START_TIME=$(date +%s)
 
   echo "Waiting for prerender server at ${trimmed_url}"
diff --git a/packages/realm-server/server.ts b/packages/realm-server/server.ts
index 33ef59387e..9a6ef21cfe 100644
--- a/packages/realm-server/server.ts
+++ b/packages/realm-server/server.ts
@@ -79,6 +79,7 @@ export class RealmServer {
     | (() => Promise<string | undefined>)
     | undefined;
   private enableFileWatcher: boolean;
+  private maxCardWriteSizeBytes: number;
   private domainsForPublishedRealms:
     | {
         boxelSpace?: string;
@@ -138,6 +139,9 @@ export class RealmServer {
     ensureDirSync(realmsRootPath);
 
     this.serverURL = serverURL;
+    this.maxCardWriteSizeBytes = Number(
+      process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 64 * 1024,
+    );
     this.virtualNetwork = virtualNetwork;
     this.matrixClient = matrixClient;
 
@@ -430,6 +434,7 @@ export class RealmServer {
           hostsOwnAssets: false,
           assetsURL: this.assetsURL.href,
           realmServerURL: this.serverURL.href,
+          maxCardWriteSizeBytes: this.maxCardWriteSizeBytes,
         });
         return `${g1}${encodeURIComponent(JSON.stringify(config))}${g3}`;
       },
@@ -753,6 +758,7 @@ export class RealmServer {
         realmServerMatrixClient: this.matrixClient,
         realmServerURL: this.serverURL.href,
         definitionLookup: this.definitionLookup,
+        maxCardWriteSizeBytes: this.maxCardWriteSizeBytes,
       },
       Object.keys(realmOptions).length ? realmOptions : undefined,
     );
@@ -822,6 +828,7 @@ export class RealmServer {
             realmServerMatrixClient: this.matrixClient,
             realmServerURL: this.serverURL.href,
             definitionLookup: this.definitionLookup,
+            maxCardWriteSizeBytes: this.maxCardWriteSizeBytes,
           });
           this.virtualNetwork.mount(realm.handle);
           realms.push(realm);
@@ -952,6 +959,7 @@ export class RealmServer {
             realmServerMatrixClient: this.matrixClient,
             realmServerURL: this.serverURL.href,
             definitionLookup: this.definitionLookup,
+            maxCardWriteSizeBytes: this.maxCardWriteSizeBytes,
           });
 
           this.virtualNetwork.mount(realm.handle);
diff --git a/packages/realm-server/tests/helpers/index.ts b/packages/realm-server/tests/helpers/index.ts
index fe6d5c71d1..d228012448 100644
--- a/packages/realm-server/tests/helpers/index.ts
+++ b/packages/realm-server/tests/helpers/index.ts
@@ -463,6 +463,9 @@ export async function createRealm({
     realmServerMatrixClient,
     realmServerURL: new URL(new URL(realmURL).origin).href,
     definitionLookup,
+    maxCardWriteSizeBytes: Number(
+      process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 64 * 1024,
+    ),
   });
   if (worker) {
     virtualNetwork.mount(realm.handle);
diff --git a/packages/runtime-common/index.ts b/packages/runtime-common/index.ts
index f70ea1d2d4..e530278bc0 100644
--- a/packages/runtime-common/index.ts
+++ b/packages/runtime-common/index.ts
@@ -104,6 +104,7 @@ export {
   type CardErrorsJSONAPI,
   isCardErrorJSONAPI,
 } from './error';
+export { validateWriteSize } from './write-size-validation';
 
 export interface ResourceObject {
   type: string;
diff --git a/packages/runtime-common/realm.ts b/packages/runtime-common/realm.ts
index 0cb373944b..0136687739 100644
--- a/packages/runtime-common/realm.ts
+++ b/packages/runtime-common/realm.ts
@@ -118,6 +118,7 @@ import { fetcher } from './fetcher';
 import { RealmIndexQueryEngine } from './realm-index-query-engine';
 import { RealmIndexUpdater } from './realm-index-updater';
 import serialize from './file-serializer';
+import { validateWriteSize } from './write-size-validation';
 import { md5 } from 'super-fast-md5';
 
 import type { Utils } from './matrix-backend-authentication';
@@ -358,6 +359,8 @@ interface Options {
   fromScratchIndexPriority?: number;
 }
 
+const DEFAULT_MAX_CARD_WRITE_SIZE_BYTES = 64 * 1024;
+
 interface UpdateItem {
   operation: 'add' | 'update' | 'removed';
   url: URL;
@@ -393,6 +396,7 @@ export class Realm {
   #copiedFromRealm: URL | undefined;
   #sourceCache = new AliasCache<SourceCacheEntry>();
   #moduleCache = new AliasCache<ModuleCacheEntry>();
+  #maxCardWriteSizeBytes: number;
 
   #publicEndpoints: RouteTable<true> = new Map([
     [
@@ -434,6 +438,7 @@ export class Realm {
       realmServerMatrixClient,
       realmServerURL,
       definitionLookup,
+      maxCardWriteSizeBytes,
     }: {
       url: string;
       adapter: RealmAdapter;
@@ -445,6 +450,7 @@ export class Realm {
       realmServerMatrixClient: MatrixClient;
       realmServerURL: string;
       definitionLookup: DefinitionLookup;
+      maxCardWriteSizeBytes?: number;
     },
     opts?: Options,
   ) {
@@ -459,6 +465,8 @@ export class Realm {
       opts?.fromScratchIndexPriority ?? systemInitiatedPriority;
     this.#realmServerMatrixClient = realmServerMatrixClient;
     this.#realmServerURL = ensureTrailingSlash(realmServerURL);
+    this.#maxCardWriteSizeBytes =
+      maxCardWriteSizeBytes ?? DEFAULT_MAX_CARD_WRITE_SIZE_BYTES;
     this.#realmServerMatrixUserId = userIdFromUsername(
       realmServerMatrixClient.username,
       realmServerMatrixClient.matrixURL.href,
@@ -783,6 +791,7 @@ export class Realm {
           throw e;
         }
       }
+      validateWriteSize(content, this.#maxCardWriteSizeBytes, 'file');
       let existingFile = await readFileAsText(path, (p) =>
         this.#adapter.openFile(p),
       );
@@ -1051,12 +1060,16 @@ export class Realm {
         });
       }
       if (isModuleResource(resource)) {
-        files.set(localPath, resource.attributes?.content ?? '');
+        let content = resource.attributes?.content ?? '';
+        validateWriteSize(content, this.#maxCardWriteSizeBytes, 'file');
+        files.set(localPath, content);
       } else if (isCardResource(resource)) {
         let doc = {
           data: resource,
         };
-        files.set(localPath, JSON.stringify(doc, null, 2));
+        let jsonString = JSON.stringify(doc, null, 2);
+        validateWriteSize(jsonString, this.#maxCardWriteSizeBytes, 'card');
+        files.set(localPath, jsonString);
       } else {
         return createResponse({
           body: JSON.stringify({
diff --git a/packages/runtime-common/write-size-validation.ts b/packages/runtime-common/write-size-validation.ts
new file mode 100644
index 0000000000..a82b5eed5a
--- /dev/null
+++ b/packages/runtime-common/write-size-validation.ts
@@ -0,0 +1,12 @@
+export function validateWriteSize(
+  content: string,
+  maxSizeBytes: number,
+  type: 'card' | 'file',
+): void {
+  const actualSize = new TextEncoder().encode(content).length;
+  if (actualSize > maxSizeBytes) {
+    throw new Error(
+      `${type === 'card' ? 'Card' : 'File'} size (${actualSize} bytes) exceeds maximum allowed size (${maxSizeBytes} bytes)`,
+    );
+  }
+}

From 0978e4cec2a9ff9243eb1292e4f319f322567693 Mon Sep 17 00:00:00 2001
From: Fadhlan Ridhwanallah <fridhwanallah@gmail.com>
Date: Mon, 19 Jan 2026 14:01:55 +0700
Subject: [PATCH 2/5] Fix host tests

---
 .../host/app/commands/check-correctness.ts    |  6 +-
 packages/host/app/config/environment.d.ts     |  1 +
 packages/host/app/services/card-service.ts    | 92 ++++++-------------
 .../host/app/services/environment-service.ts  |  6 +-
 packages/host/app/services/store.ts           |  1 -
 packages/host/config/environment.js           |  7 +-
 .../tests/acceptance/code-submode-test.ts     |  6 +-
 .../acceptance/interact-submode-test.gts      |  8 +-
 packages/host/tests/helpers/index.gts         |  4 +-
 .../commands/check-correctness-test.gts       | 16 ++--
 packages/realm-server/main.ts                 |  4 +-
 packages/realm-server/server.ts               | 14 ++-
 packages/realm-server/tests/helpers/index.ts  |  4 +-
 packages/runtime-common/realm.ts              | 17 ++--
 14 files changed, 65 insertions(+), 121 deletions(-)

diff --git a/packages/host/app/commands/check-correctness.ts b/packages/host/app/commands/check-correctness.ts
index 69488008cd..7be3b0c545 100644
--- a/packages/host/app/commands/check-correctness.ts
+++ b/packages/host/app/commands/check-correctness.ts
@@ -78,11 +78,11 @@ export default class CheckCorrectnessCommand extends HostBaseCommand<
     let errors: string[] = [];
     let lintIssues: string[] = [];
 
-    let writeError = this.cardService.peekWriteError(input.targetRef);
-    if (writeError) {
+    let sizeLimitError = this.cardService.getSizeLimitError(input.targetRef);
+    if (sizeLimitError) {
       return new CorrectnessResultCard({
         correct: false,
-        errors: [this.describeCardError(input.targetRef, writeError)],
+        errors: [sizeLimitError.message],
         warnings: [],
       });
     }
diff --git a/packages/host/app/config/environment.d.ts b/packages/host/app/config/environment.d.ts
index 41d62d4acc..4f1c4df332 100644
--- a/packages/host/app/config/environment.d.ts
+++ b/packages/host/app/config/environment.d.ts
@@ -39,4 +39,5 @@ declare const config: {
   publishedRealmBoxelSpaceDomain: string;
   publishedRealmBoxelSiteDomain: string;
   defaultSystemCardId: string;
+  cardSizeLimit: number;
 };
diff --git a/packages/host/app/services/card-service.ts b/packages/host/app/services/card-service.ts
index 173826585d..aea65ed8c8 100644
--- a/packages/host/app/services/card-service.ts
+++ b/packages/host/app/services/card-service.ts
@@ -7,7 +7,6 @@ import {
   formattedError,
   SupportedMimeType,
   type CardDocument,
-  type CardErrorJSONAPI,
   type SingleCardDocument,
   type LooseSingleCardDocument,
   type RealmInfo,
@@ -64,7 +63,8 @@ export default class CardService extends Service {
   @service declare private reset: ResetService;
 
   private subscriber: CardSaveSubscriber | undefined;
-  private writeErrors = new Map<string, CardErrorJSONAPI>();
+  // This error will be used by check-correctness command to report size limit errors
+  private sizeLimitError = new Map<string, Error>();
   // For tracking requests during the duration of this service. Used for being able to tell when to ignore an incremental indexing realm event.
   // We want to ignore it when it is a result of our own request so that we don't reload the card and overwrite any unsaved changes made during auto save request and realm event.
   declare private loaderToCardAPILoadingCache: WeakMap<
@@ -107,16 +107,8 @@ export default class CardService extends Service {
     this.subscriber = undefined;
   }
 
-  peekWriteError(url: string): CardErrorJSONAPI | undefined {
-    return this.writeErrors.get(url);
-  }
-
-  private storeWriteError(url: string, error: CardErrorJSONAPI) {
-    this.writeErrors.set(url, error);
-  }
-
-  private clearWriteError(url: string) {
-    this.writeErrors.delete(url);
+  getSizeLimitError(url: string): Error | undefined {
+    return this.sizeLimitError.get(url);
   }
 
   async fetchJSON(
@@ -167,64 +159,25 @@ export default class CardService extends Service {
         typeof requestInit.body === 'string'
           ? requestInit.body
           : JSON.stringify(requestInit.body, null, 2);
-      validateWriteSize(
-        jsonString,
-        this.environmentService.maxCardWriteSizeBytes,
-        'card',
-      );
+      this.validateSizeLimit(urlString, jsonString, 'card');
     }
 
     let response = await this.network.authedFetch(url, requestInit);
     if (!response.ok) {
       let responseText = await response.text();
-      let parsedError: CardErrorJSONAPI | undefined;
-      try {
-        let parsed = JSON.parse(responseText);
-        let candidate = parsed?.errors?.[0];
-        if (candidate) {
-          if (typeof candidate.status === 'string') {
-            let parsedStatus = Number(candidate.status);
-            candidate.status = Number.isNaN(parsedStatus)
-              ? candidate.status
-              : parsedStatus;
-          }
-          parsedError = candidate as CardErrorJSONAPI;
-        }
-      } catch {
-        parsedError = undefined;
-      }
-      if (parsedError) {
-        if (!isReadOperation) {
-          this.storeWriteError(urlString, parsedError);
-        }
-        throw parsedError;
-      }
-
       let err = new Error(
         `status: ${response.status} -
           ${response.statusText}. ${responseText}`,
       ) as any;
+
       err.status = response.status;
       err.responseText = responseText;
       err.responseHeaders = response.headers;
-      if (!isReadOperation) {
-        let error = formattedError(urlString, err)?.errors?.[0];
-        if (error) {
-          this.storeWriteError(urlString, error);
-          throw error;
-        }
-      }
+
       throw err;
     }
     if (response.status !== 204) {
-      let json = await response.json();
-      if (!isReadOperation) {
-        this.clearWriteError(urlString);
-      }
-      return json;
-    }
-    if (!isReadOperation) {
-      this.clearWriteError(urlString);
+      return await response.json();
     }
     return;
   }
@@ -260,11 +213,7 @@ export default class CardService extends Service {
     options?: SaveSourceOptions,
   ) {
     try {
-      validateWriteSize(
-        content,
-        this.environmentService.maxCardWriteSizeBytes,
-        'file',
-      );
+      this.validateSizeLimit(url.href, content, 'file');
       let clientRequestId = options?.clientRequestId ?? `${type}:${uuidv4()}`;
       this.clientRequestIds.add(clientRequestId);
 
@@ -284,7 +233,6 @@ export default class CardService extends Service {
         console.error(errorMessage);
         throw new Error(errorMessage);
       }
-      this.clearWriteError(url.href);
       this.subscriber?.(url, content);
 
       if (options?.resetLoader) {
@@ -295,10 +243,8 @@ export default class CardService extends Service {
     } catch (e: any) {
       let error = formattedError(undefined, e)?.errors?.[0];
       if (error) {
-        this.storeWriteError(url.href, error);
         throw error;
       }
-      this.storeWriteError(url.href, e);
       throw new Error(e);
     }
   }
@@ -371,16 +317,15 @@ export default class CardService extends Service {
   }
 
   async executeAtomicOperations(operations: AtomicOperation[], realmURL: URL) {
-    let maxSizeBytes = this.environmentService.maxCardWriteSizeBytes;
     for (let operation of operations) {
       if (operation.data?.type === 'source') {
         let content = operation.data.attributes?.content;
         if (typeof content === 'string') {
-          validateWriteSize(content, maxSizeBytes, 'file');
+          this.validateSizeLimit(operation.href, content, 'file');
         }
       } else if (operation.data?.type === 'card') {
         let jsonString = JSON.stringify(operation.data, null, 2);
-        validateWriteSize(jsonString, maxSizeBytes, 'card');
+        this.validateSizeLimit(operation.href, jsonString, 'card');
       }
     }
     let doc = createAtomicDocument(operations);
@@ -393,6 +338,21 @@ export default class CardService extends Service {
     });
     return response.json();
   }
+
+  private validateSizeLimit(
+    url: string,
+    content: string,
+    type: 'card' | 'file',
+  ) {
+    let maxSizeBytes = this.environmentService.cardSizeLimit;
+    try {
+      this.sizeLimitError.delete(url);
+      validateWriteSize(content, maxSizeBytes, type);
+    } catch (e: any) {
+      this.sizeLimitError.set(url, e);
+      throw new Error(e);
+    }
+  }
 }
 
 declare module '@ember/service' {
diff --git a/packages/host/app/services/environment-service.ts b/packages/host/app/services/environment-service.ts
index 282c9e79dd..1c63788237 100644
--- a/packages/host/app/services/environment-service.ts
+++ b/packages/host/app/services/environment-service.ts
@@ -3,17 +3,17 @@ import Service from '@ember/service';
 
 import config from '@cardstack/host/config/environment';
 
-const { autoSaveDelayMs, maxCardWriteSizeBytes } = config;
+const { autoSaveDelayMs, cardSizeLimit } = config;
 
 // we use this service to help instrument environment settings in tests
 export default class EnvironmentService extends Service {
   autoSaveDelayMs: number;
-  maxCardWriteSizeBytes: number;
+  cardSizeLimit: number;
 
   constructor(owner: Owner) {
     super(owner);
     this.autoSaveDelayMs = autoSaveDelayMs;
-    this.maxCardWriteSizeBytes = maxCardWriteSizeBytes;
+    this.cardSizeLimit = cardSizeLimit;
   }
 }
 
diff --git a/packages/host/app/services/store.ts b/packages/host/app/services/store.ts
index 26a926ae48..9397196d4c 100644
--- a/packages/host/app/services/store.ts
+++ b/packages/host/app/services/store.ts
@@ -1245,7 +1245,6 @@ export default class StoreService extends Service implements StoreInterface {
   private calculateLastSavedMsg(autoSaveState: AutoSaveState) {
     let savedMessage: string | undefined;
     if (autoSaveState.lastSaveError) {
-      console.log(autoSaveState.lastSaveError);
       savedMessage = `Failed to save: ${this.getErrorMessage(
         autoSaveState.lastSaveError,
       )}`;
diff --git a/packages/host/config/environment.js b/packages/host/config/environment.js
index 60436e2bbd..473dc5a467 100644
--- a/packages/host/config/environment.js
+++ b/packages/host/config/environment.js
@@ -40,9 +40,7 @@ module.exports = function (environment) {
     cardRenderTimeout: Number(
       process.env.RENDER_TIMEOUT_MS ?? DEFAULT_CARD_RENDER_TIMEOUT_MS,
     ),
-    maxCardWriteSizeBytes: Number(
-      process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 64 * 1024,
-    ),
+    cardSizeLimit: Number(process.env.CARD_SIZE_LIMIT ?? 64 * 1024),
     iconsURL: process.env.ICONS_URL || 'https://boxel-icons.boxel.ai',
     publishedRealmBoxelSpaceDomain:
       process.env.PUBLISHED_REALM_BOXEL_SPACE_DOMAIN || 'localhost:4201',
@@ -92,9 +90,6 @@ module.exports = function (environment) {
     ENV.serverEchoDebounceMs = 0;
     ENV.loginMessageTimeoutMs = 0;
     ENV.minSaveTaskDurationMs = 0;
-    ENV.maxCardWriteSizeBytes = Number(
-      process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 1024,
-    );
     ENV.sqlSchema = sqlSchema;
     ENV.featureFlags = {
       SHOW_ASK_AI: true,
diff --git a/packages/host/tests/acceptance/code-submode-test.ts b/packages/host/tests/acceptance/code-submode-test.ts
index 9153897e22..7397b6f246 100644
--- a/packages/host/tests/acceptance/code-submode-test.ts
+++ b/packages/host/tests/acceptance/code-submode-test.ts
@@ -1967,7 +1967,7 @@ module('Acceptance | code submode tests', function (_hooks) {
 
     test('code editor shows size limit error when json save exceeds limit', async function (assert) {
       let environmentService = getService('environment-service') as any;
-      let originalMaxSize = environmentService.maxCardWriteSizeBytes;
+      let originalMaxSize = environmentService.cardSizeLimit;
 
       try {
         await visitOperatorMode({
@@ -1980,7 +1980,7 @@ module('Acceptance | code submode tests', function (_hooks) {
         let content = getMonacoContent();
         let encoder = new TextEncoder();
         let currentSize = encoder.encode(content).length;
-        environmentService.maxCardWriteSizeBytes = currentSize + 50;
+        environmentService.cardSizeLimit = currentSize + 50;
 
         let doc = JSON.parse(content);
         doc.data.attributes = {
@@ -1993,7 +1993,7 @@ module('Acceptance | code submode tests', function (_hooks) {
           .dom('[data-test-save-error]')
           .includesText('exceeds maximum allowed size (270 bytes)');
       } finally {
-        environmentService.maxCardWriteSizeBytes = originalMaxSize;
+        environmentService.cardSizeLimit = originalMaxSize;
       }
     });
 
diff --git a/packages/host/tests/acceptance/interact-submode-test.gts b/packages/host/tests/acceptance/interact-submode-test.gts
index 3505967648..90b64e7d6a 100644
--- a/packages/host/tests/acceptance/interact-submode-test.gts
+++ b/packages/host/tests/acceptance/interact-submode-test.gts
@@ -1165,8 +1165,8 @@ module('Acceptance | interact submode tests', function (hooks) {
   module('size limit errors', function () {
     test('edit view shows size limit error when save exceeds limit', async function (assert) {
       let environmentService = getService('environment-service') as any;
-      let originalMaxSize = environmentService.maxCardWriteSizeBytes;
-      environmentService.maxCardWriteSizeBytes = 1000;
+      let originalMaxSize = environmentService.cardSizeLimit;
+      environmentService.cardSizeLimit = 1000;
 
       try {
         await visitOperatorMode({
@@ -1198,10 +1198,10 @@ module('Acceptance | interact submode tests', function (hooks) {
             `[data-test-stack-card="${testRealmURL}Pet/mango"] [data-test-auto-save-indicator]`,
           )
           .includesText(
-            `exceeds maximum allowed size (${environmentService.maxCardWriteSizeBytes} bytes)`,
+            `exceeds maximum allowed size (${environmentService.cardSizeLimit} bytes)`,
           );
       } finally {
-        environmentService.maxCardWriteSizeBytes = originalMaxSize;
+        environmentService.cardSizeLimit = originalMaxSize;
       }
     });
   });
diff --git a/packages/host/tests/helpers/index.gts b/packages/host/tests/helpers/index.gts
index 570c088424..507064f725 100644
--- a/packages/host/tests/helpers/index.gts
+++ b/packages/host/tests/helpers/index.gts
@@ -794,9 +794,7 @@ async function setupTestRealm({
     }),
     realmServerURL: ensureTrailingSlash(ENV.realmServerURL),
     definitionLookup,
-    maxCardWriteSizeBytes: Number(
-      process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 64 * 1024,
-    ),
+    cardSizeLimit: Number(process.env.CARD_SIZE_LIMIT ?? 64 * 1024),
   });
 
   // we use this to run cards that were added to the test filesystem
diff --git a/packages/host/tests/integration/commands/check-correctness-test.gts b/packages/host/tests/integration/commands/check-correctness-test.gts
index 834f0daf50..0cbb160613 100644
--- a/packages/host/tests/integration/commands/check-correctness-test.gts
+++ b/packages/host/tests/integration/commands/check-correctness-test.gts
@@ -128,7 +128,6 @@ module('Integration | commands | check-correctness', function (hooks) {
       secondResult.correct,
       'second run reports errors after invalid change',
     );
-    console.log(secondResult.errors);
     assert.ok(
       secondResult.errors.some((e: string) =>
         e.includes('Name cannot be "Bill"'),
@@ -296,8 +295,8 @@ ${REPLACE_MARKER}`;
     let roomId = '!room:example.com';
     let fileUrl = `${testRealmURL}pet.gts`;
 
-    let originalMaxSize = environmentService.maxCardWriteSizeBytes;
-    environmentService.maxCardWriteSizeBytes = 20;
+    let originalMaxSize = environmentService.cardSizeLimit;
+    environmentService.cardSizeLimit = 20;
 
     try {
       let { content } = await cardService.getSource(new URL(fileUrl));
@@ -324,7 +323,7 @@ ${REPLACE_MARKER}`;
         'error mentions size limit',
       );
     } finally {
-      environmentService.maxCardWriteSizeBytes = originalMaxSize;
+      environmentService.cardSizeLimit = originalMaxSize;
     }
   });
 
@@ -343,8 +342,8 @@ ${REPLACE_MARKER}`;
     store.addReference(cardId);
     await store.waitForCardLoad(cardId);
 
-    let originalMaxSize = environmentService.maxCardWriteSizeBytes;
-    environmentService.maxCardWriteSizeBytes = 1000;
+    let originalMaxSize = environmentService.cardSizeLimit;
+    environmentService.cardSizeLimit = 1000;
 
     try {
       let patchCommand = new PatchCardInstanceCommand(
@@ -367,14 +366,13 @@ ${REPLACE_MARKER}`;
         targetRef: cardId,
         roomId,
       });
-      console.log(result.errors);
       assert.false(result.correct, 'size limit error reports incorrect');
       assert.ok(
-        result.errors[0]?.includes('exceeds maximum allowed size (20 bytes)'),
+        result.errors[0]?.includes('exceeds maximum allowed size (1000 bytes)'),
         'error mentions size limit',
       );
     } finally {
-      environmentService.maxCardWriteSizeBytes = originalMaxSize;
+      environmentService.cardSizeLimit = originalMaxSize;
     }
   });
 });
diff --git a/packages/realm-server/main.ts b/packages/realm-server/main.ts
index ffa27a77a2..f258e45594 100644
--- a/packages/realm-server/main.ts
+++ b/packages/realm-server/main.ts
@@ -272,9 +272,7 @@ const getIndexHTML = async () => {
         realmServerMatrixClient,
         realmServerURL: serverURL,
         definitionLookup,
-        maxCardWriteSizeBytes: Number(
-          process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 64 * 1024,
-        ),
+        cardSizeLimit: Number(process.env.CARD_SIZE_LIMIT ?? 64 * 1024),
       },
       {
         fullIndexOnStartup: true,
diff --git a/packages/realm-server/server.ts b/packages/realm-server/server.ts
index 9a6ef21cfe..33f508f031 100644
--- a/packages/realm-server/server.ts
+++ b/packages/realm-server/server.ts
@@ -79,7 +79,7 @@ export class RealmServer {
     | (() => Promise<string | undefined>)
     | undefined;
   private enableFileWatcher: boolean;
-  private maxCardWriteSizeBytes: number;
+  private cardSizeLimit: number;
   private domainsForPublishedRealms:
     | {
         boxelSpace?: string;
@@ -139,9 +139,7 @@ export class RealmServer {
     ensureDirSync(realmsRootPath);
 
     this.serverURL = serverURL;
-    this.maxCardWriteSizeBytes = Number(
-      process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 64 * 1024,
-    );
+    this.cardSizeLimit = Number(process.env.CARD_SIZE_LIMIT ?? 64 * 1024);
     this.virtualNetwork = virtualNetwork;
     this.matrixClient = matrixClient;
 
@@ -434,7 +432,7 @@ export class RealmServer {
           hostsOwnAssets: false,
           assetsURL: this.assetsURL.href,
           realmServerURL: this.serverURL.href,
-          maxCardWriteSizeBytes: this.maxCardWriteSizeBytes,
+          cardSizeLimit: this.cardSizeLimit,
         });
         return `${g1}${encodeURIComponent(JSON.stringify(config))}${g3}`;
       },
@@ -758,7 +756,7 @@ export class RealmServer {
         realmServerMatrixClient: this.matrixClient,
         realmServerURL: this.serverURL.href,
         definitionLookup: this.definitionLookup,
-        maxCardWriteSizeBytes: this.maxCardWriteSizeBytes,
+        cardSizeLimit: this.cardSizeLimit,
       },
       Object.keys(realmOptions).length ? realmOptions : undefined,
     );
@@ -828,7 +826,7 @@ export class RealmServer {
             realmServerMatrixClient: this.matrixClient,
             realmServerURL: this.serverURL.href,
             definitionLookup: this.definitionLookup,
-            maxCardWriteSizeBytes: this.maxCardWriteSizeBytes,
+            cardSizeLimit: this.cardSizeLimit,
           });
           this.virtualNetwork.mount(realm.handle);
           realms.push(realm);
@@ -959,7 +957,7 @@ export class RealmServer {
             realmServerMatrixClient: this.matrixClient,
             realmServerURL: this.serverURL.href,
             definitionLookup: this.definitionLookup,
-            maxCardWriteSizeBytes: this.maxCardWriteSizeBytes,
+            cardSizeLimit: this.cardSizeLimit,
           });
 
           this.virtualNetwork.mount(realm.handle);
diff --git a/packages/realm-server/tests/helpers/index.ts b/packages/realm-server/tests/helpers/index.ts
index d228012448..cbef1376fd 100644
--- a/packages/realm-server/tests/helpers/index.ts
+++ b/packages/realm-server/tests/helpers/index.ts
@@ -463,9 +463,7 @@ export async function createRealm({
     realmServerMatrixClient,
     realmServerURL: new URL(new URL(realmURL).origin).href,
     definitionLookup,
-    maxCardWriteSizeBytes: Number(
-      process.env.MAX_CARD_WRITE_SIZE_BYTES ?? 64 * 1024,
-    ),
+    cardSizeLimit: Number(process.env.CARD_SIZE_LIMIT ?? 64 * 1024),
   });
   if (worker) {
     virtualNetwork.mount(realm.handle);
diff --git a/packages/runtime-common/realm.ts b/packages/runtime-common/realm.ts
index 0136687739..2832c9d4ce 100644
--- a/packages/runtime-common/realm.ts
+++ b/packages/runtime-common/realm.ts
@@ -359,7 +359,7 @@ interface Options {
   fromScratchIndexPriority?: number;
 }
 
-const DEFAULT_MAX_CARD_WRITE_SIZE_BYTES = 64 * 1024;
+const DEFAULT_CARD_SIZE_LIMIT = 64 * 1024;
 
 interface UpdateItem {
   operation: 'add' | 'update' | 'removed';
@@ -396,7 +396,7 @@ export class Realm {
   #copiedFromRealm: URL | undefined;
   #sourceCache = new AliasCache<SourceCacheEntry>();
   #moduleCache = new AliasCache<ModuleCacheEntry>();
-  #maxCardWriteSizeBytes: number;
+  #cardSizeLimit: number;
 
   #publicEndpoints: RouteTable<true> = new Map([
     [
@@ -438,7 +438,7 @@ export class Realm {
       realmServerMatrixClient,
       realmServerURL,
       definitionLookup,
-      maxCardWriteSizeBytes,
+      cardSizeLimit,
     }: {
       url: string;
       adapter: RealmAdapter;
@@ -450,7 +450,7 @@ export class Realm {
       realmServerMatrixClient: MatrixClient;
       realmServerURL: string;
       definitionLookup: DefinitionLookup;
-      maxCardWriteSizeBytes?: number;
+      cardSizeLimit?: number;
     },
     opts?: Options,
   ) {
@@ -465,8 +465,7 @@ export class Realm {
       opts?.fromScratchIndexPriority ?? systemInitiatedPriority;
     this.#realmServerMatrixClient = realmServerMatrixClient;
     this.#realmServerURL = ensureTrailingSlash(realmServerURL);
-    this.#maxCardWriteSizeBytes =
-      maxCardWriteSizeBytes ?? DEFAULT_MAX_CARD_WRITE_SIZE_BYTES;
+    this.#cardSizeLimit = cardSizeLimit ?? DEFAULT_CARD_SIZE_LIMIT;
     this.#realmServerMatrixUserId = userIdFromUsername(
       realmServerMatrixClient.username,
       realmServerMatrixClient.matrixURL.href,
@@ -791,7 +790,7 @@ export class Realm {
           throw e;
         }
       }
-      validateWriteSize(content, this.#maxCardWriteSizeBytes, 'file');
+      validateWriteSize(content, this.#cardSizeLimit, 'file');
       let existingFile = await readFileAsText(path, (p) =>
         this.#adapter.openFile(p),
       );
@@ -1061,14 +1060,14 @@ export class Realm {
       }
       if (isModuleResource(resource)) {
         let content = resource.attributes?.content ?? '';
-        validateWriteSize(content, this.#maxCardWriteSizeBytes, 'file');
+        validateWriteSize(content, this.#cardSizeLimit, 'file');
         files.set(localPath, content);
       } else if (isCardResource(resource)) {
         let doc = {
           data: resource,
         };
         let jsonString = JSON.stringify(doc, null, 2);
-        validateWriteSize(jsonString, this.#maxCardWriteSizeBytes, 'card');
+        validateWriteSize(jsonString, this.#cardSizeLimit, 'card');
         files.set(localPath, jsonString);
       } else {
         return createResponse({

From b7373dbbcd50c9f7a3ae26f63fd2f01eb5418c62 Mon Sep 17 00:00:00 2001
From: Fadhlan Ridhwanallah <fridhwanallah@gmail.com>
Date: Mon, 19 Jan 2026 14:34:51 +0700
Subject: [PATCH 3/5] Add realm server test

---
 .../realm-server/prerender/manager-server.ts  |  2 +-
 .../scripts/wait-for-prerender.sh             |  2 +-
 .../realm-server/tests/card-endpoints-test.ts | 47 +++++++++++++++++++
 .../tests/card-source-endpoints-test.ts       | 34 ++++++++++++++
 packages/realm-server/tests/helpers/index.ts  | 10 +++-
 packages/runtime-common/realm.ts              | 47 +++++++++++++------
 6 files changed, 125 insertions(+), 17 deletions(-)

diff --git a/packages/realm-server/prerender/manager-server.ts b/packages/realm-server/prerender/manager-server.ts
index 19bf09557e..70fe81449d 100644
--- a/packages/realm-server/prerender/manager-server.ts
+++ b/packages/realm-server/prerender/manager-server.ts
@@ -25,7 +25,7 @@ let { port, exitOnSignal, forceExitTimeoutMs } = yargs(process.argv.slice(2))
     forceExitTimeoutMs: {
       description:
         'When exitOnSignal is true, force the process to exit after this timeout (ms)',
-      default: 150000,
+      default: 1000,
       type: 'number',
     },
   })
diff --git a/packages/realm-server/scripts/wait-for-prerender.sh b/packages/realm-server/scripts/wait-for-prerender.sh
index 47c1a6090f..465572dd25 100755
--- a/packages/realm-server/scripts/wait-for-prerender.sh
+++ b/packages/realm-server/scripts/wait-for-prerender.sh
@@ -3,7 +3,7 @@
 wait_for_prerender() {
   local url="${1:-${PRERENDER_HEALTH_URL:-http://localhost:4221/}}"
   local trimmed_url="${url%/}/"
-  TIMEOUT_SECONDS=150
+  TIMEOUT_SECONDS=30
   START_TIME=$(date +%s)
 
   echo "Waiting for prerender server at ${trimmed_url}"
diff --git a/packages/realm-server/tests/card-endpoints-test.ts b/packages/realm-server/tests/card-endpoints-test.ts
index c275059bdb..2474fa415e 100644
--- a/packages/realm-server/tests/card-endpoints-test.ts
+++ b/packages/realm-server/tests/card-endpoints-test.ts
@@ -3215,6 +3215,53 @@ module(basename(__filename), function () {
         });
       });
 
+      module('public writable realm with size limit', function (hooks) {
+        setupPermissionedRealm(hooks, {
+          permissions: {
+            '*': ['read', 'write'],
+          },
+          cardSizeLimit: 512,
+          onRealmSetup,
+        });
+
+        test('returns 413 when card payload exceeds size limit', async function (assert) {
+          let oversized = 'a'.repeat(2048);
+          let response = await request
+            .patch('/person-1')
+            .send({
+              data: {
+                type: 'card',
+                attributes: {
+                  firstName: oversized,
+                },
+                meta: {
+                  adoptsFrom: {
+                    module: './person.gts',
+                    name: 'Person',
+                  },
+                },
+              },
+            })
+            .set('Accept', 'application/vnd.card+json');
+
+          assert.strictEqual(response.status, 413, 'HTTP 413 status');
+          assert.strictEqual(
+            response.body.errors[0].title,
+            'Payload Too Large',
+            'error title is correct',
+          );
+          assert.strictEqual(
+            response.body.errors[0].status,
+            413,
+            'error status is correct',
+          );
+          assert.ok(
+            response.body.errors[0].message.includes('Card size'),
+            'error message mentions card size',
+          );
+        });
+      });
+
       module('permissioned realm', function (hooks) {
         setupPermissionedRealm(hooks, {
           permissions: {
diff --git a/packages/realm-server/tests/card-source-endpoints-test.ts b/packages/realm-server/tests/card-source-endpoints-test.ts
index 1a07b398a3..c16a593185 100644
--- a/packages/realm-server/tests/card-source-endpoints-test.ts
+++ b/packages/realm-server/tests/card-source-endpoints-test.ts
@@ -939,6 +939,40 @@ module(basename(__filename), function () {
         });
       });
 
+      module('public writable realm with size limit', function (hooks) {
+        setupPermissionedRealm(hooks, {
+          permissions: {
+            '*': ['read', 'write'],
+          },
+          cardSizeLimit: 512,
+          onRealmSetup,
+        });
+
+        test('returns 413 when source payload exceeds size limit', async function (assert) {
+          let oversized = 'a'.repeat(2048);
+          let response = await request
+            .post('/too-large.gts')
+            .set('Accept', 'application/vnd.card+source')
+            .send(oversized);
+
+          assert.strictEqual(response.status, 413, 'HTTP 413 status');
+          assert.strictEqual(
+            response.body.errors[0].title,
+            'Payload Too Large',
+            'error title is correct',
+          );
+          assert.strictEqual(
+            response.body.errors[0].status,
+            413,
+            'error status is correct',
+          );
+          assert.ok(
+            response.body.errors[0].message.includes('File size'),
+            'error message mentions file size',
+          );
+        });
+      });
+
       module('permissioned realm', function (hooks) {
         setupPermissionedRealm(hooks, {
           permissions: {
diff --git a/packages/realm-server/tests/helpers/index.ts b/packages/realm-server/tests/helpers/index.ts
index cbef1376fd..e421fcfd0f 100644
--- a/packages/realm-server/tests/helpers/index.ts
+++ b/packages/realm-server/tests/helpers/index.ts
@@ -400,6 +400,7 @@ export async function createRealm({
   matrixConfig = testMatrix,
   withWorker,
   enableFileWatcher = false,
+  cardSizeLimit,
 }: {
   dir: string;
   definitionLookup: DefinitionLookup;
@@ -413,6 +414,7 @@ export async function createRealm({
   dbAdapter: PgAdapter;
   deferStartUp?: true;
   enableFileWatcher?: boolean;
+  cardSizeLimit?: number;
   // if you are creating a realm  to test it directly without a server, you can
   // also specify `withWorker: true` to also include a worker with your realm
   withWorker?: true;
@@ -463,7 +465,7 @@ export async function createRealm({
     realmServerMatrixClient,
     realmServerURL: new URL(new URL(realmURL).origin).href,
     definitionLookup,
-    cardSizeLimit: Number(process.env.CARD_SIZE_LIMIT ?? 64 * 1024),
+    cardSizeLimit: cardSizeLimit ?? Number(process.env.CARD_SIZE_LIMIT ?? 64 * 1024),
   });
   if (worker) {
     virtualNetwork.mount(realm.handle);
@@ -485,6 +487,7 @@ export async function runTestRealmServer({
   matrixURL,
   permissions = { '*': ['read'] },
   enableFileWatcher = false,
+  cardSizeLimit,
   domainsForPublishedRealms = {
     boxelSpace: 'localhost',
     boxelSite: 'localhost',
@@ -502,6 +505,7 @@ export async function runTestRealmServer({
   matrixURL: URL;
   matrixConfig?: MatrixConfig;
   enableFileWatcher?: boolean;
+  cardSizeLimit?: number;
   domainsForPublishedRealms?: {
     boxelSpace?: string;
     boxelSite?: string;
@@ -538,6 +542,7 @@ export async function runTestRealmServer({
     dbAdapter,
     enableFileWatcher,
     definitionLookup,
+    cardSizeLimit,
   });
 
   await testRealm.logInToMatrix();
@@ -1085,6 +1090,7 @@ export function setupPermissionedRealm(
     subscribeToRealmEvents = false,
     mode = 'beforeEach',
     published = false,
+    cardSizeLimit,
   }: {
     permissions: RealmPermissions;
     realmURL?: URL;
@@ -1101,6 +1107,7 @@ export function setupPermissionedRealm(
     subscribeToRealmEvents?: boolean;
     mode?: 'beforeEach' | 'before';
     published?: boolean;
+    cardSizeLimit?: number;
   },
 ) {
   let testRealmServer: Awaited<ReturnType<typeof runTestRealmServer>>;
@@ -1165,6 +1172,7 @@ export function setupPermissionedRealm(
         matrixURL,
         fileSystem,
         enableFileWatcher: subscribeToRealmEvents,
+        cardSizeLimit,
       });
 
       let request = supertest(testRealmServer.testRealmHttpServer);
diff --git a/packages/runtime-common/realm.ts b/packages/runtime-common/realm.ts
index 2832c9d4ce..e7da999941 100644
--- a/packages/runtime-common/realm.ts
+++ b/packages/runtime-common/realm.ts
@@ -22,6 +22,7 @@ import {
   methodNotAllowed,
   badRequest,
   CardError,
+  responseWithError,
   formattedError,
 } from './error';
 import { v4 as uuidV4 } from 'uuid';
@@ -790,7 +791,11 @@ export class Realm {
           throw e;
         }
       }
-      validateWriteSize(content, this.#cardSizeLimit, 'file');
+      let sizeType: 'card' | 'file' =
+        path.endsWith('.json') && isCardDocumentString(content)
+          ? 'card'
+          : 'file';
+      this.assertWriteSize(content, sizeType);
       let existingFile = await readFileAsText(path, (p) =>
         this.#adapter.openFile(p),
       );
@@ -1060,14 +1065,14 @@ export class Realm {
       }
       if (isModuleResource(resource)) {
         let content = resource.attributes?.content ?? '';
-        validateWriteSize(content, this.#cardSizeLimit, 'file');
+        this.assertWriteSize(content, 'file');
         files.set(localPath, content);
       } else if (isCardResource(resource)) {
         let doc = {
           data: resource,
         };
         let jsonString = JSON.stringify(doc, null, 2);
-        validateWriteSize(jsonString, this.#cardSizeLimit, 'card');
+        this.assertWriteSize(jsonString, 'card');
         files.set(localPath, jsonString);
       } else {
         return createResponse({
@@ -1089,17 +1094,20 @@ export class Realm {
       }
     }
 
-    if (files.size > 0) {
-      try {
-        writeResults = await this.writeMany(files, {
-          clientRequestId: request.headers.get('X-Boxel-Client-Request-Id'),
-          serializeFile: true,
-        });
-      } catch (e: any) {
-        return createResponse({
-          body: JSON.stringify({
-            errors: [{ title: 'Write Error', detail: e.message }],
-          }),
+      if (files.size > 0) {
+        try {
+          writeResults = await this.writeMany(files, {
+            clientRequestId: request.headers.get('X-Boxel-Client-Request-Id'),
+            serializeFile: true,
+          });
+        } catch (e: any) {
+          if (e instanceof CardError) {
+            return responseWithError(e, requestContext);
+          }
+          return createResponse({
+            body: JSON.stringify({
+              errors: [{ title: 'Write Error', detail: e.message }],
+            }),
           init: {
             status: 500,
             headers: { 'content-type': SupportedMimeType.JSONAPI },
@@ -1908,6 +1916,17 @@ export class Realm {
     });
   }
 
+  private assertWriteSize(content: string, type: 'card' | 'file') {
+    try {
+      validateWriteSize(content, this.#cardSizeLimit, type);
+    } catch (error: any) {
+      throw new CardError(error?.message ?? 'Payload too large', {
+        status: 413,
+        title: 'Payload Too Large',
+      });
+    }
+  }
+
   private async getSourceOrRedirect(
     request: Request,
     requestContext: RequestContext,

From bb414d59f3d914827594904c69b41d9e07a10368 Mon Sep 17 00:00:00 2001
From: Fadhlan Ridhwanallah <fridhwanallah@gmail.com>
Date: Mon, 19 Jan 2026 14:51:47 +0700
Subject: [PATCH 4/5] merge resolve

---
 packages/realm-server/tests/card-endpoints-test.ts        | 2 +-
 packages/realm-server/tests/card-source-endpoints-test.ts | 2 +-
 packages/realm-server/tests/helpers/index.ts              | 3 ++-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/packages/realm-server/tests/card-endpoints-test.ts b/packages/realm-server/tests/card-endpoints-test.ts
index c1c34393d8..635f044ef4 100644
--- a/packages/realm-server/tests/card-endpoints-test.ts
+++ b/packages/realm-server/tests/card-endpoints-test.ts
@@ -3347,7 +3347,7 @@ module(basename(__filename), function () {
       });
 
       module('public writable realm with size limit', function (hooks) {
-        setupPermissionedRealm(hooks, {
+        setupPermissionedRealmAtURL(hooks, realmURL, {
           permissions: {
             '*': ['read', 'write'],
           },
diff --git a/packages/realm-server/tests/card-source-endpoints-test.ts b/packages/realm-server/tests/card-source-endpoints-test.ts
index 9065689842..771bf9f4b1 100644
--- a/packages/realm-server/tests/card-source-endpoints-test.ts
+++ b/packages/realm-server/tests/card-source-endpoints-test.ts
@@ -958,7 +958,7 @@ module(basename(__filename), function () {
       });
 
       module('public writable realm with size limit', function (hooks) {
-        setupPermissionedRealm(hooks, {
+        setupPermissionedRealmAtURL(hooks, realmURL, {
           permissions: {
             '*': ['read', 'write'],
           },
diff --git a/packages/realm-server/tests/helpers/index.ts b/packages/realm-server/tests/helpers/index.ts
index 9a7d977217..23b931f929 100644
--- a/packages/realm-server/tests/helpers/index.ts
+++ b/packages/realm-server/tests/helpers/index.ts
@@ -516,7 +516,8 @@ export async function createRealm({
     realmServerMatrixClient,
     realmServerURL: new URL(new URL(realmURL).origin).href,
     definitionLookup,
-    cardSizeLimit: cardSizeLimit ?? Number(process.env.CARD_SIZE_LIMIT ?? 64 * 1024),
+    cardSizeLimit:
+      cardSizeLimit ?? Number(process.env.CARD_SIZE_LIMIT ?? 64 * 1024),
   });
   if (worker) {
     virtualNetwork.mount(realm.handle);

From a3ddefa2471ee22478d17023cce1743bfcf7d07c Mon Sep 17 00:00:00 2001
From: Fadhlan Ridhwanallah <fridhwanallah@gmail.com>
Date: Mon, 19 Jan 2026 15:42:42 +0700
Subject: [PATCH 5/5] lint fix

---
 packages/runtime-common/realm.ts | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/packages/runtime-common/realm.ts b/packages/runtime-common/realm.ts
index 5db8a14d4a..eeaa380b21 100644
--- a/packages/runtime-common/realm.ts
+++ b/packages/runtime-common/realm.ts
@@ -1105,20 +1105,20 @@ export class Realm {
       }
     }
 
-      if (files.size > 0) {
-        try {
-          writeResults = await this.writeMany(files, {
-            clientRequestId: request.headers.get('X-Boxel-Client-Request-Id'),
-            serializeFile: true,
-          });
-        } catch (e: any) {
-          if (e instanceof CardError) {
-            return responseWithError(e, requestContext);
-          }
-          return createResponse({
-            body: JSON.stringify({
-              errors: [{ title: 'Write Error', detail: e.message }],
-            }),
+    if (files.size > 0) {
+      try {
+        writeResults = await this.writeMany(files, {
+          clientRequestId: request.headers.get('X-Boxel-Client-Request-Id'),
+          serializeFile: true,
+        });
+      } catch (e: any) {
+        if (e instanceof CardError) {
+          return responseWithError(e, requestContext);
+        }
+        return createResponse({
+          body: JSON.stringify({
+            errors: [{ title: 'Write Error', detail: e.message }],
+          }),
           init: {
             status: 500,
             headers: { 'content-type': SupportedMimeType.JSONAPI },