# Limits and Constraints

## Function Deployment

| Limit | Value | Notes |
|  --- | --- | --- |
| Max source package size (uncompressed) | 25 MB | Enforced at upload time |
| Max files in source package | 500 | Enforced at upload time |
| Build timeout | 10 minutes | Build is polled at 5-second intervals |
| Supported runtimes | `node`, `csharp` |  |


## Runtime Execution

| Limit | Value | Notes |
|  --- | --- | --- |
| Execution timeout | No hard limit enforced | Subject to change |
| Memory allocation | 1 Gi | Per function, subject to change |


**Security restrictions (production only):**

- Outbound HTTP requests must use HTTPS. Plain HTTP to external hosts is blocked.
- Direct IP addresses are blocked (prevents access to cloud metadata endpoints).
- Internal service DNS names are blocked.
- Localhost traffic is allowed for internal cache/secrets communication only.


## Cache

| Limit | Value | Notes |
|  --- | --- | --- |
| Default TTL | 3600 seconds (1 hour) | Applied when no TTL is passed to `cache.set()` |
| Minimum TTL | No enforced minimum |  |
| Maximum TTL | No enforced maximum | Subject to change |
| Key size | No enforced limit | Subject to change |
| Value size | No enforced limit | Values are JSON-serialized before storage |


## Menu Builder

| Limit | Value | Source |
|  --- | --- | --- |
| `timeout` (milliseconds) | 1000-30000 | Enforced in `MenuBuilder.timeout()` |
| `maxDigits` | 1-20 | Enforced in `MenuBuilder.maxDigits()` |
| `repeats` | 0-5 | Enforced in `MenuBuilder.repeats()` |
| Default timeout | 8000 ms | Applied when not explicitly set |
| Default repeats | 2 | Applied when not explicitly set |
| Default maxDigits | 1 | Applied when not explicitly set |


These limits are validated at build time and throw immediately if violated.

## Webhooks (Tunnel)

| Limit | Value | Notes |
|  --- | --- | --- |
| Inbound request forwarding timeout | 30 seconds | Per-request; returns HTTP 504 on timeout |
| Tunnel idle timeout | 15 minutes | Idle tunnels are cleaned up automatically |
| Tunnel connection timeout | 60 minutes | Maximum tunnel session duration |


The tunnel gateway disconnects after 15 minutes of inactivity regardless of the overall session timeout.

## API Rate Limits

Rate limits are applied per project using a sliding window. They can be overridden on a per-project basis by platform operators.

| Endpoint group | Default limit | Window |
|  --- | --- | --- |
| Function CRUD | 100 requests | 60 seconds |
| Deployments | 10 requests | 60 seconds |
| Configuration reads | 200 requests | 60 seconds |
| Secret value reads | 10 requests | 60 seconds |
| Log streaming (concurrent connections) | 5 concurrent |  |
| Operations endpoints | 20 requests | 60 seconds |


All limits are subject to change.