@@ -1,3 +1,6 @@
+// Leave room for a 64 MiB Worker, base64 expansion, and JSON metadata.
+export const CF_VERSION_SOURCE_MAX_OUTPUT_BYTES: number = 128 * 1024 * 1024;
+
 /** Accept a cf positional only when it cannot be read as a flag or carry control characters. */
 export function safePositional(value: unknown): value is string {
   return (
 
@@ -12,7 +12,11 @@ import type {
 import { isRecord as record } from '@void/deploy-core';
 import { dirname, join } from 'pathslash';
 import type { CfBuildOutput } from './cf-build-output.ts';
-import { readCfUploadOutput, safePositional } from './cf-command-values.ts';
+import {
+  CF_VERSION_SOURCE_MAX_OUTPUT_BYTES,
+  readCfUploadOutput,
+  safePositional,
+} from './cf-command-values.ts';
 import { migrateBuiltWranglerConfig } from './cf-config-migrate.ts';
 import { getCfCliVersion } from './cf-user-agent.ts';
 import {
@@ -577,7 +581,7 @@ export function createCfVersionRunner(options: {
             cwd: output.directory,
             capture: true,
             timeoutMs: 30_000,
-            maxOutputBytes: 1024 * 1024,
+            maxOutputBytes: CF_VERSION_SOURCE_MAX_OUTPUT_BYTES,
           })
         : await run(args, true);
       const result = { ...called, data: called.data ?? parseJson(called.stdout) };
 
@@ -14,7 +14,12 @@ import type {
 } from '@void/deploy-cloudflare';
 import { parse } from 'jsonc-parser';
 import { dirname, join, resolve } from 'pathslash';
-import { isD1Bookmark, readCfUploadOutput, safePositional } from './cf-command-values.ts';
+import {
+  CF_VERSION_SOURCE_MAX_OUTPUT_BYTES,
+  isD1Bookmark,
+  readCfUploadOutput,
+  safePositional,
+} from './cf-command-values.ts';
 import { persistCfKeyringPreference, readCfSessionCredential } from './cf-session.ts';
 import { getCfCliVersion, getVoidUserAgent } from './cf-user-agent.ts';
 import { publishCloudflareObservability } from './cf-worker-settings.ts';
@@ -962,7 +967,9 @@ async function workerHistory(): Promise<Result> {
           ...(operation.includeSource ? ['--include', 'modules'] : []),
         ],
         process.cwd(),
-        operation.includeSource ? { timeoutMs: 30_000, maxOutputBytes: 1024 * 1024 } : undefined,
+        operation.includeSource
+          ? { timeoutMs: 30_000, maxOutputBytes: CF_VERSION_SOURCE_MAX_OUTPUT_BYTES }
+          : undefined,
       );
       if (called.status !== 0) {
         return called;
 
@@ -1,5 +1,6 @@
 import { spawnSync } from 'node:child_process';
 import type { CloudflareCommandResult, CloudflareOperation } from '@void/deploy-cloudflare';
+import { CF_VERSION_SOURCE_MAX_OUTPUT_BYTES } from './cf-command-values.ts';
 import { resolveCloudflareOperationArgv } from './preset.ts';
 
 /** Operations contain public targets only. Secret values travel through stdin. */
@@ -133,7 +134,10 @@ export function createCloudflareProcessRunner(options: {
       encoding: 'utf8',
       shell: false,
       windowsHide: true,
-      maxBuffer: 32 * 1024 * 1024,
+      maxBuffer:
+        operation.type === 'versions.view' && operation.includeSource
+          ? CF_VERSION_SOURCE_MAX_OUTPUT_BYTES
+          : 32 * 1024 * 1024,
       timeout: options.timeoutMs,
       stdio: streaming ? ['inherit', 'inherit', 'inherit'] : ['pipe', 'pipe', 'pipe'],
     });
 
@@ -100,11 +100,16 @@ function pinnedCf(apiBaseUrl: string, accountId = 'account-id', env: NodeJS.Proc
   });
 }
 
-it(
-  'reads the exact immutable SDK draft source through the real pinned cf HTTP transport',
-  async () => {
+it.each([false, true])(
+  'reads immutable version source through the real pinned cf HTTP transport (large=%s)',
+  async (large) => {
     const prepared = await output();
     const draft = voidSecretDraftVersion();
+    if (large) {
+      draft.modules[0]!.content_base64 = Buffer.from(
+        `/* ${'x'.repeat(1024 * 1024)} */\nexport default { fetch() { return new Response("ok"); } };`,
+      ).toString('base64');
+    }
     const requests: Array<string> = [];
     const userAgents: Array<string | undefined> = [];
     const apiBaseUrl = await listen(
@@ -141,14 +146,18 @@ it(
         },
         { capture: true },
       );
-      expect(result.status).toBe(0);
-      expect(isVoidSecretOnlyDraft(result.data as Record<string, unknown>)).toBe(true);
+      expect(result.status, result.stderr).toBe(0);
+      expect(result.data).toMatchObject(draft);
+      expect(isVoidSecretOnlyDraft(result.data as Record<string, unknown>)).toBe(!large);
       expect(requests).toEqual([
         `/client/v4/accounts/test-account/workers/workers/void-test/versions/${draft.id}?include=modules`,
       ]);
       expect(commands).toHaveLength(1);
       expect(userAgents).toEqual([cfUserAgent]);
-      expect(commands[0]!.bounds).toMatchObject({ timeoutMs: 30_000, maxOutputBytes: 1024 * 1024 });
+      expect(commands[0]!.bounds).toMatchObject({
+        timeoutMs: 30_000,
+        maxOutputBytes: 128 * 1024 * 1024,
+      });
       expect(JSON.stringify(result)).not.toContain('synthetic-token');
     } finally {
       await prepared.dispose();
 
@@ -98,7 +98,7 @@ function runOperation(
     execFile(
       command!,
       [...(preload ? ['--import', pathToFileURL(preload).href] : []), ...prefix, ...args],
-      { cwd, encoding: 'utf8', timeout: 20_000, env },
+      { cwd, encoding: 'utf8', timeout: 20_000, maxBuffer: 128 * 1024 * 1024, env },
       (error, stdout, stderr) =>
         resolve({ status: error ? Number(error.code) || 1 : 0, stdout, stderr }),
     );
@@ -166,43 +166,56 @@ it.each([true, false])(
   15_000,
 );
 
-it('requests immutable version source explicitly without loading or provisioning build output', async () => {
-  const directory = temporaryDirectory('void-cf-secret-source-');
-  const draft = voidSecretDraftVersion();
-  const requests: Array<string> = [];
-  const userAgents: Array<string | undefined> = [];
-  const api = await listen(
-    createServer((request, response) => {
-      requests.push(request.url ?? '');
-      userAgents.push(request.headers['user-agent']);
-      request.resume();
-      response.writeHead(200, { 'Content-Type': 'application/json' });
-      response.end(JSON.stringify({ success: true, errors: [], messages: [], result: draft }));
-    }),
-  );
-  const configPath = join(directory, 'wrangler.json');
-  writeFileSync(configPath, JSON.stringify({ name: 'test-worker', account_id: 'test-account' }));
-  const output = await runOperation(
-    directory,
-    {
-      type: 'versions.view',
-      versionId: draft.id,
-      includeSource: true,
-      configPath,
-      workerName: 'test-worker',
-    },
-    { ...tokenEnv(api), CLI_VERSION: 'inherited-version void/stale' },
-  );
-  expect(output.status, output.stderr).toBe(0);
-  const result = decodeCloudflareOperationResult({ status: 0, stdout: output.stdout, stderr: '' });
-  expect(result.status).toBe(0);
-  expect(isVoidSecretOnlyDraft(result.data as Record<string, unknown>)).toBe(true);
-  expect(requests).toEqual([
-    `/client/v4/accounts/test-account/workers/workers/test-worker/versions/${draft.id}?include=modules`,
-  ]);
-  expect(output.stdout).not.toContain('synthetic-token');
-  expect(userAgents).toEqual([`cf-cli/${cfVersion} void/${voidVersion}`]);
-});
+it.each([false, true])(
+  'requests immutable version source without provisioning (large=%s)',
+  async (large) => {
+    const directory = temporaryDirectory('void-cf-secret-source-');
+    const draft = voidSecretDraftVersion();
+    if (large) {
+      draft.modules[0]!.content_base64 = Buffer.from(
+        `/* ${'x'.repeat(1024 * 1024)} */\nexport default { fetch() { return new Response("ok"); } };`,
+      ).toString('base64');
+    }
+    const requests: Array<string> = [];
+    const userAgents: Array<string | undefined> = [];
+    const api = await listen(
+      createServer((request, response) => {
+        requests.push(request.url ?? '');
+        userAgents.push(request.headers['user-agent']);
+        request.resume();
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({ success: true, errors: [], messages: [], result: draft }));
+      }),
+    );
+    const configPath = join(directory, 'wrangler.json');
+    writeFileSync(configPath, JSON.stringify({ name: 'test-worker', account_id: 'test-account' }));
+    const output = await runOperation(
+      directory,
+      {
+        type: 'versions.view',
+        versionId: draft.id,
+        includeSource: true,
+        configPath,
+        workerName: 'test-worker',
+      },
+      { ...tokenEnv(api), CLI_VERSION: 'inherited-version void/stale' },
+    );
+    expect(output.status, output.stderr).toBe(0);
+    const result = decodeCloudflareOperationResult({
+      status: 0,
+      stdout: output.stdout,
+      stderr: '',
+    });
+    expect(result.status, result.stderr).toBe(0);
+    expect(result.data).toEqual(draft);
+    expect(isVoidSecretOnlyDraft(result.data as Record<string, unknown>)).toBe(!large);
+    expect(requests).toEqual([
+      `/client/v4/accounts/test-account/workers/workers/test-worker/versions/${draft.id}?include=modules`,
+    ]);
+    expect(output.stdout).not.toContain('synthetic-token');
+    expect(userAgents).toEqual([`cf-cli/${cfVersion} void/${voidVersion}`]);
+  },
+);
 
 it.each([200, 503])(
   'reports HTTP %i without loading the build toolchain when domain cleanup returns non-JSON',
 
@@ -1,5 +1,10 @@
-import { describe, expect, it } from 'vite-plus/test';
-import { decodeCloudflareOperationResult } from '../../src/cli/cloudflare-process.ts';
+import childProcess from 'node:child_process';
+import { syncBuiltinESMExports } from 'node:module';
+import { describe, expect, it, vi } from 'vite-plus/test';
+import {
+  createCloudflareProcessRunner,
+  decodeCloudflareOperationResult,
+} from '../../src/cli/cloudflare-process.ts';
 
 const processResult = (envelope: unknown) => ({
   status: 0,
@@ -8,6 +13,32 @@ const processResult = (envelope: unknown) => ({
 });
 
 describe('typed Cloudflare process protocol', () => {
+  it('allows a full-size base64 Worker source through the parent capture without widening other reads', () => {
+    const spawn = vi.spyOn(childProcess, 'spawnSync').mockReturnValue({
+      pid: 1,
+      output: [],
+      status: 0,
+      signal: null,
+      stdout: JSON.stringify({ operationResult: 1, data: { id: 'version-id' } }),
+      stderr: '',
+    });
+    syncBuiltinESMExports();
+    try {
+      const runner = createCloudflareProcessRunner({ root: process.cwd() });
+      const read = { type: 'versions.view', versionId: 'version-id', workerName: 'app' } as const;
+      expect(runner({ ...read, includeSource: true }, { capture: true }).status).toBe(0);
+      // Workers allow 64 MiB of source, which grows by a third when base64-encoded.
+      const encodedWorkerBytes = Math.ceil((64 * 1024 * 1024 * 4) / 3);
+      expect(spawn.mock.calls[0]![2]!.maxBuffer).toBeGreaterThan(encodedWorkerBytes);
+
+      expect(runner(read, { capture: true }).status).toBe(0);
+      expect(spawn.mock.calls[1]![2]!.maxBuffer).toBe(32 * 1024 * 1024);
+    } finally {
+      spawn.mockRestore();
+      syncBuiltinESMExports();
+    }
+  });
+
   it('keeps structured data separate from human output', () => {
     expect(
       decodeCloudflareOperationResult(