fix: cap Base64 media transfers at 10 MB, upload limit at most 32 MB

src/Limits.php

@@ -11,7 +11,14 @@ final class Limits
 {
     public const OPTION = 'lit_mcp_limits';
     public const DEFAULTS = ['upload_mb' => 5, 'log_retention_days' => 90, 'snapshot_count' => 20];
-    private const BOUNDS = ['upload_mb' => [1, 100], 'log_retention_days' => [1, 3650], 'snapshot_count' => [1, 100]];
+    /**
+     * Hard cap for transfers held in memory as a whole and passed through the MCP response or
+     * request as Base64 (lit-media-download, lit/media-upload): above it, PHP memory and the
+     * JSON payload become the problem, whatever upload_mb says. URL imports stream to disk
+     * and only use upload_mb.
+     */
+    public const INLINE_MAX_MB = 10;
+    private const BOUNDS = ['upload_mb' => [1, 32], 'log_retention_days' => [1, 3650], 'snapshot_count' => [1, 100]];
 
     public function uploadBytes(): int
     {
@@ -23,6 +30,17 @@ final class Limits
         return $this->all()['upload_mb'];
     }
 
+    /** Limit for Base64 transfers: the upload limit, at most INLINE_MAX_MB. */
+    public function inlineBytes(): int
+    {
+        return $this->inlineMegabytes() * 1024 * 1024;
+    }
+
+    public function inlineMegabytes(): int
+    {
+        return min($this->uploadMegabytes(), self::INLINE_MAX_MB);
+    }
+
     public function logRetentionDays(): int
     {
         return $this->all()['log_retention_days'];