castrum 0.7.0

package/rust/batch.rs

@@ -0,0 +1,195 @@
+// rust/batch.rs — v2: DIRECT WRITE, NO INTERMEDIATE Vec<Vec<u8>>
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+
+use crate::json_ops::{json_sum_ids_bytes, json_valid_bytes};
+use crate::util::{
+    count_batch, should_parallelize, sum_batch_i64, total_bytes, unpack,
+};
+use crate::validation::{
+    validate_email_bytes, validate_ipv4_bytes, validate_ipv6_bytes, validate_uuid_bytes,
+};
+
+// ── Internal helpers (direct-write variants) ──
+
+/// Direct-write JSON sum batch — eliminates intermediate Vec<i64>.
+#[inline]
+fn json_sum_batch_direct(items: &[&[u8]], out: &mut Vec<u8>) {
+    let n = items.len();
+    out.reserve(4 + n * 8);
+    out.extend_from_slice(&(n as u32).to_le_bytes());
+    let start = out.len();
+    out.resize(start + n * 8, 0);
+
+    // Slice the output buffer to write directly into it.
+    let out_slice = &mut out[start..];
+    
+    if should_parallelize(items.len(), total_bytes(items)) {
+        use rayon::prelude::*;
+        let chunk_size = 256;
+        
+        // Use par_chunks_mut to get mutable disjoint slices of the output buffer.
+        out_slice.par_chunks_mut(chunk_size * 8).enumerate().for_each(|(ci, out_chunk)| {
+            let num_items = out_chunk.len() / 8;
+            let item_start = ci * chunk_size;
+            let item_end = (item_start + num_items).min(items.len());
+            
+            for (i, item) in items[item_start..item_end].iter().enumerate() {
+                let sum = json_sum_ids_bytes(item).unwrap_or(0);
+                out_chunk[i * 8..(i + 1) * 8].copy_from_slice(&sum.to_le_bytes());
+            }
+        });
+    } else {
+        for (i, item) in items.iter().enumerate() {
+            let sum = json_sum_ids_bytes(item).unwrap_or(0);
+            out_slice[i * 8..(i + 1) * 8].copy_from_slice(&sum.to_le_bytes());
+        }
+    }
+}
+
+/// Direct-write parse batch — eliminates intermediate Vec<Vec<u8>>.
+#[inline]
+fn parse_batch_direct<F>(items: &[&[u8]], out: &mut Vec<u8>, f: F)
+where
+    F: Fn(&[u8]) -> Result<Vec<u8>> + Sync,
+{
+    let n = items.len();
+    out.reserve(4 + n * 32);
+    out.extend_from_slice(&(n as u32).to_le_bytes());
+    for item in items {
+        let r = f(item).unwrap_or_default();
+        out.extend_from_slice(&(r.len() as u32).to_le_bytes());
+        out.extend_from_slice(&r);
+    }
+}
+
+#[inline]
+fn query_parse_packed_vec(input: &[u8]) -> Result<Vec<u8>> {
+    crate::query_parser::query_parse_packed_vec(input)
+}
+
+#[inline]
+fn cookie_parse_packed_vec(input: &[u8]) -> Vec<u8> {
+    crate::cookie_parser::cookie_parse_packed_vec(input)
+}
+
+#[inline]
+fn http_parse_request_packed_vec(input: &[u8]) -> Result<Vec<u8>> {
+    crate::http_parser::http_parse_request_packed_vec(input)
+}
+
+#[inline]
+fn count_batch_data(data: &[u8], f: impl Fn(&[u8]) -> bool + Sync, chunk_items: usize) -> Result<u32> {
+    let items = unpack(data)?;
+    Ok(count_batch(&items, f, chunk_items) as u32)
+}
+
+#[inline]
+fn sum_ids_batch_data(data: &[u8], chunk_items: usize) -> Result<i64> {
+    let items = unpack(data)?;
+    Ok(sum_batch_i64(&items, |item| json_sum_ids_bytes(item).unwrap_or(0), chunk_items))
+}
+
+#[inline]
+fn total_len_batch_data(data: &[u8], f: impl Fn(&[u8]) -> Result<Vec<u8>> + Sync, chunk_items: usize) -> Result<u32> {
+    let items = unpack(data)?;
+    let chunk_items = chunk_items.max(64);
+    let total: usize = if should_parallelize(items.len(), total_bytes(&items)) {
+        use rayon::prelude::*;
+        items.par_chunks(chunk_items)
+            .map(|chunk| chunk.iter().map(|item| f(item).map(|v| v.len()).unwrap_or(0)).sum::<usize>())
+            .sum()
+    } else {
+        items.iter().map(|item| f(item).map(|v| v.len()).unwrap_or(0)).sum()
+    };
+    Ok(total as u32)
+}
+
+// ── Packed input → packed output ──
+
+#[inline]
+fn json_valid_batch_bytes(data: &[u8]) -> Result<Vec<u8>> {
+    let items = unpack(data)?;
+    Ok(crate::util::validation_bitset_chunked(&items, json_valid_bytes, 512))
+}
+
+#[inline]
+fn validate_email_batch_bytes(data: &[u8]) -> Result<Vec<u8>> {
+    let items = unpack(data)?;
+    Ok(crate::util::validation_bitset_chunked(&items, validate_email_bytes, 4096))
+}
+
+#[inline]
+fn validate_uuid_batch_bytes(data: &[u8]) -> Result<Vec<u8>> {
+    let items = unpack(data)?;
+    Ok(crate::util::validation_bitset_chunked(&items, validate_uuid_bytes, 4096))
+}
+
+#[inline]
+fn validate_ipv4_batch_bytes(data: &[u8]) -> Result<Vec<u8>> {
+    let items = unpack(data)?;
+    Ok(crate::util::validation_bitset_chunked(&items, validate_ipv4_bytes, 4096))
+}
+
+#[inline]
+fn validate_ipv6_batch_bytes(data: &[u8]) -> Result<Vec<u8>> {
+    let items = unpack(data)?;
+    Ok(crate::util::validation_bitset_chunked(&items, validate_ipv6_bytes, 4096))
+}
+
+#[inline]
+fn json_sum_batch_bytes(data: &[u8]) -> Result<Vec<u8>> {
+    let items = unpack(data)?;
+    let mut out = Vec::with_capacity(4 + items.len() * 8);
+    json_sum_batch_direct(&items, &mut out);
+    Ok(out)
+}
+
+#[inline]
+fn query_parse_batch_bytes(data: &[u8]) -> Result<Vec<u8>> {
+    let items = unpack(data)?;
+    let mut out = Vec::with_capacity(items.len() * 32);
+    parse_batch_direct(&items, &mut out, query_parse_packed_vec);
+    Ok(out)
+}
+
+#[inline]
+fn cookie_parse_batch_bytes(data: &[u8]) -> Result<Vec<u8>> {
+    let items = unpack(data)?;
+    let mut out = Vec::with_capacity(items.len() * 32);
+    parse_batch_direct(&items, &mut out, |i| Ok(cookie_parse_packed_vec(i)));
+    Ok(out)
+}
+
+#[inline]
+fn http_parse_request_batch_bytes(data: &[u8]) -> Result<Vec<u8>> {
+    let items = unpack(data)?;
+    let mut out = Vec::with_capacity(items.len() * 64);
+    parse_batch_direct(&items, &mut out, http_parse_request_packed_vec);
+    Ok(out)
+}
+
+// ── Sync packed batch APIs ──
+
+#[napi] pub fn json_valid_batch_packed(input: Uint8Array) -> Result<Buffer> { Ok(Buffer::from(json_valid_batch_bytes(input.as_ref())?)) }
+#[napi] pub fn validate_email_batch_packed(input: Uint8Array) -> Result<Buffer> { Ok(Buffer::from(validate_email_batch_bytes(input.as_ref())?)) }
+#[napi] pub fn validate_uuid_batch_packed(input: Uint8Array) -> Result<Buffer> { Ok(Buffer::from(validate_uuid_batch_bytes(input.as_ref())?)) }
+#[napi] pub fn validate_ipv4_batch_packed(input: Uint8Array) -> Result<Buffer> { Ok(Buffer::from(validate_ipv4_batch_bytes(input.as_ref())?)) }
+#[napi] pub fn validate_ipv6_batch_packed(input: Uint8Array) -> Result<Buffer> { Ok(Buffer::from(validate_ipv6_batch_bytes(input.as_ref())?)) }
+#[napi] pub fn json_sum_batch_packed(input: Uint8Array) -> Result<Buffer> { Ok(Buffer::from(json_sum_batch_bytes(input.as_ref())?)) }
+#[napi] pub fn query_parse_batch_packed(input: Uint8Array) -> Result<Buffer> { Ok(Buffer::from(query_parse_batch_bytes(input.as_ref())?)) }
+#[napi] pub fn cookie_parse_batch_packed(input: Uint8Array) -> Result<Buffer> { Ok(Buffer::from(cookie_parse_batch_bytes(input.as_ref())?)) }
+#[napi] pub fn http_parse_request_batch_packed(input: Uint8Array) -> Result<Buffer> { Ok(Buffer::from(http_parse_request_batch_bytes(input.as_ref())?)) }
+
+// ── Aggregate sync packed batch APIs ──
+
+#[napi] pub fn json_valid_batch_count_packed(input: Uint8Array) -> Result<u32> { count_batch_data(input.as_ref(), json_valid_bytes, 512) }
+#[napi] pub fn validate_email_batch_count_packed(input: Uint8Array) -> Result<u32> { count_batch_data(input.as_ref(), validate_email_bytes, 4096) }
+#[napi] pub fn validate_uuid_batch_count_packed(input: Uint8Array) -> Result<u32> { count_batch_data(input.as_ref(), validate_uuid_bytes, 4096) }
+#[napi] pub fn validate_ipv4_batch_count_packed(input: Uint8Array) -> Result<u32> { count_batch_data(input.as_ref(), validate_ipv4_bytes, 4096) }
+#[napi] pub fn validate_ipv6_batch_count_packed(input: Uint8Array) -> Result<u32> { count_batch_data(input.as_ref(), validate_ipv6_bytes, 4096) }
+#[napi] pub fn json_sum_batch_total_packed(input: Uint8Array) -> Result<i64> { sum_ids_batch_data(input.as_ref(), 512) }
+#[napi] pub fn query_parse_batch_total_len_packed(input: Uint8Array) -> Result<u32> { total_len_batch_data(input.as_ref(), query_parse_packed_vec, 256) }
+#[napi] pub fn cookie_parse_batch_total_len_packed(input: Uint8Array) -> Result<u32> { total_len_batch_data(input.as_ref(), |i| Ok(cookie_parse_packed_vec(i)), 256) }
+#[napi] pub fn http_parse_request_batch_total_len_packed(input: Uint8Array) -> Result<u32> { total_len_batch_data(input.as_ref(), http_parse_request_packed_vec, 256) }
+

package/rust/cookie_parser.rs

@@ -0,0 +1,70 @@
+// rust/cookie_parser.rs — Unified zero-alloc cookie parser
+// Eliminated the _vec variant; all callers use the single _into_slice path.
+// Upper-bound pre-allocation for callers that need a Vec.
+
+use crate::util::{trim_ascii_whitespace, write_bytes, write_u32_le};
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+
+/// Parse cookies into a caller-provided slice (zero-alloc).
+/// Output format: [u32 count] repeated { [u32 name_len] [name] [u32 value_len] [value] }
+#[inline]
+pub fn cookie_parse_packed_into_slice(input: &[u8], out: &mut [u8]) -> Result<usize> {
+    let mut pos = 0usize;
+    write_u32_le(out, &mut pos, 0)?;
+
+    let mut count = 0u32;
+
+    for pair in input.split(|&b| b == b';') {
+        let pair = trim_ascii_whitespace(pair);
+        if pair.is_empty() { continue; }
+
+        let (name, value) = match pair.iter().position(|&b| b == b'=') {
+            Some(eq) => (&pair[..eq], &pair[eq + 1..]),
+            None => (pair, &[][..]),
+        };
+
+        let name = trim_ascii_whitespace(name);
+        let value = trim_ascii_whitespace(value);
+
+        if name.is_empty() { continue; }
+
+        write_u32_le(out, &mut pos, name.len() as u32)?;
+        write_bytes(out, &mut pos, name)?;
+
+        write_u32_le(out, &mut pos, value.len() as u32)?;
+        write_bytes(out, &mut pos, value)?;
+
+        count += 1;
+    }
+
+    out[0..4].copy_from_slice(&count.to_le_bytes());
+    Ok(pos)
+}
+
+/// Allocate and parse cookies. Uses conservative upper bound to avoid a pre-scan.
+#[inline]
+pub fn cookie_parse_packed_vec(input: &[u8]) -> Vec<u8> {
+    let upper_bound = input.len().saturating_mul(9).saturating_add(16);
+    let mut out = vec![0u8; upper_bound];
+    match cookie_parse_packed_into_slice(input, &mut out) {
+        Ok(written) => {
+            out.truncate(written);
+            out
+        }
+        Err(_) => {
+            // Fall back to VecWriter if slice is too small (rare).
+            vec![0u8; 4] // empty result
+        }
+    }
+}
+
+#[napi]
+pub fn cookie_parse_packed(input: Uint8Array) -> Result<Buffer> {
+    Ok(Buffer::from(cookie_parse_packed_vec(input.as_ref())))
+}
+
+#[napi]
+pub fn cookie_parse_packed_into(input: Uint8Array, mut output: Uint8Array) -> Result<u32> {
+    crate::util::run_packed_into(&input, &mut output, cookie_parse_packed_into_slice)
+}

package/rust/cors.rs

@@ -0,0 +1,263 @@
+// rust/cors.rs — CORS engine extracted from ingress.rs
+// Pre-computes method bitmask for O(1) method matching
+
+use crate::headers::HeaderRefs;
+use crate::method::MethodKind;
+use crate::util::trim_ascii_whitespace;
+use napi::{Error, Result, Status};
+use napi_derive::napi;
+
+// ── CORS engine ───────────────────────────────────────────────────
+#[derive(Clone)]
+pub enum CorsMode {
+    Disabled,
+    Wildcard,
+    Allowlist(Vec<Box<[u8]>>),
+}
+
+#[derive(Clone)]
+pub struct CorsEngine {
+    mode: CorsMode,
+    credentials: bool,
+    methods_wildcard: bool,
+    // Bitmask of allowed methods for O(1) lookup
+    method_bits: u16,
+    headers_wildcard: bool,
+    headers: Vec<Box<[u8]>>,
+}
+
+pub struct CorsEvaluation {
+    pub allowed: bool,
+    pub preflight: bool,
+}
+
+impl CorsEngine {
+    pub fn disabled() -> Self {
+        Self {
+            mode: CorsMode::Disabled,
+            credentials: false,
+            methods_wildcard: false,
+            method_bits: 0,
+            headers_wildcard: false,
+            headers: Vec::new(),
+        }
+    }
+
+    pub fn from_options(opts: Option<CorsOptions>) -> Result<Self> {
+        let Some(opts) = opts else {
+            return Ok(Self::disabled());
+        };
+
+        let credentials = opts.allow_credentials.unwrap_or(false);
+
+        let mode = match opts.allow_origin {
+            Some(list) if !list.is_empty() => {
+                if list.iter().any(|o| o == "*") {
+                    if credentials {
+                        return Err(Error::new(
+                            Status::InvalidArg,
+                            "CORS allowCredentials cannot be used with allowOrigin ['*']",
+                        ));
+                    }
+                    CorsMode::Wildcard
+                } else {
+                    CorsMode::Allowlist(
+                        list.iter()
+                            .map(|s| s.as_bytes().to_vec().into_boxed_slice())
+                            .collect(),
+                    )
+                }
+            }
+            _ => {
+                if credentials {
+                    return Err(Error::new(
+                        Status::InvalidArg,
+                        "CORS allowCredentials requires an explicit allowOrigin list",
+                    ));
+                }
+                CorsMode::Wildcard
+            }
+        };
+
+        let (methods_wildcard, method_bits) = parse_allowed_methods_bitset(opts.allow_methods);
+        let (headers_wildcard, headers) = parse_allowed_headers(opts.allow_headers);
+
+        Ok(Self {
+            mode,
+            credentials,
+            methods_wildcard,
+            method_bits,
+            headers_wildcard,
+            headers,
+        })
+    }
+
+    #[inline]
+    pub fn evaluate(&self, method: MethodKind, headers: &HeaderRefs) -> CorsEvaluation {
+        let origin = match headers.origin() {
+            Some(o) => o,
+            None => {
+                return CorsEvaluation {
+                    allowed: false,
+                    preflight: false,
+                }
+            }
+        };
+
+        let preflight = method == MethodKind::Options && headers.has_acrm();
+
+        let mut allowed = match &self.mode {
+            CorsMode::Disabled => false,
+            CorsMode::Wildcard => !self.credentials,
+            CorsMode::Allowlist(list) => {
+                let origin_trim = trim_ascii_whitespace(origin);
+                list.iter().any(|allowed| &**allowed == origin_trim)
+            }
+        };
+
+        if allowed {
+            if preflight {
+                allowed = self.preflight_method_allowed(headers.acrm())
+                    && self.headers_allowed(headers.acrh());
+            } else {
+                allowed = self.method_allowed_kind(method);
+            }
+        }
+
+        CorsEvaluation { allowed, preflight }
+    }
+
+    #[inline(always)]
+    fn method_allowed_kind(&self, kind: MethodKind) -> bool {
+        if self.methods_wildcard {
+            return true;
+        }
+
+        if self.method_bits == 0 {
+            return matches!(kind, MethodKind::Get | MethodKind::Head | MethodKind::Post);
+        }
+
+        (self.method_bits & kind.bit()) != 0
+    }
+
+    #[inline]
+    fn preflight_method_allowed(&self, acrm: Option<&[u8]>) -> bool {
+        let Some(acrm) = acrm else {
+            return false;
+        };
+
+        let trimmed = trim_ascii_whitespace(acrm);
+        if trimmed.is_empty() {
+            return false;
+        }
+
+        let kind = MethodKind::from_bytes_ignore_case(trimmed);
+        self.method_allowed_kind(kind)
+    }
+
+    #[inline]
+    fn headers_allowed(&self, acrh: Option<&[u8]>) -> bool {
+        let Some(acrh) = acrh else {
+            return true;
+        };
+
+        if self.headers_wildcard {
+            return true;
+        }
+
+        for requested in acrh.split(|&b| b == b',') {
+            let name = trim_ascii_whitespace(requested);
+            if name.is_empty() {
+                continue;
+            }
+
+            let lower = name.to_ascii_lowercase();
+
+            if self.headers.is_empty() {
+                if !is_cors_safelisted_request_header(lower.as_slice()) {
+                    return false;
+                }
+            } else if !self
+                .headers
+                .iter()
+                .any(|allowed| allowed.as_ref() == lower.as_slice())
+            {
+                return false;
+            }
+        }
+
+        true
+    }
+}
+
+fn is_cors_safelisted_request_header(name: &[u8]) -> bool {
+    matches!(
+        name,
+        b"accept" | b"accept-language" | b"content-language" | b"content-type"
+    )
+}
+
+fn parse_allowed_methods_bitset(list: Option<Vec<String>>) -> (bool, u16) {
+    let Some(list) = list else {
+        return (false, 0);
+    };
+
+    let mut bits = 0u16;
+
+    for raw in list {
+        let trimmed = raw.trim();
+
+        if trimmed == "*" {
+            return (true, 0);
+        }
+
+        if trimmed.is_empty() {
+            continue;
+        }
+
+        let upper = trimmed.to_ascii_uppercase();
+        let kind = MethodKind::from_str(&upper);
+
+        if kind != MethodKind::Other {
+            bits |= kind.bit();
+        }
+    }
+
+    (false, bits)
+}
+
+fn parse_allowed_headers(list: Option<Vec<String>>) -> (bool, Vec<Box<[u8]>>) {
+    let Some(list) = list else {
+        return (false, Vec::new());
+    };
+
+    let mut headers = Vec::new();
+
+    for raw in list {
+        let trimmed = raw.trim();
+
+        if trimmed == "*" {
+            return (true, Vec::new());
+        }
+
+        if trimmed.is_empty() {
+            continue;
+        }
+
+        headers.push(trimmed.to_ascii_lowercase().into_bytes().into_boxed_slice());
+    }
+
+    (false, headers)
+}
+
+// ── NAPI option struct ───────────────────────────────────────────
+#[napi(object)]
+#[derive(Clone)]
+pub struct CorsOptions {
+    pub allow_origin: Option<Vec<String>>,
+    pub allow_methods: Option<Vec<String>>,
+    pub allow_headers: Option<Vec<String>>,
+    pub expose_headers: Option<Vec<String>>,
+    pub allow_credentials: Option<bool>,
+    pub max_age: Option<u32>,
+}

package/rust/hashing.rs

@@ -0,0 +1,164 @@
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+
+use crate::util::should_parallelize;
+use xxhash_rust::xxh3::{xxh3_64, xxh3_64_with_seed, Xxh3};
+
+pub const FNV_OFFSET_BASIS: u64 = 0xcbf2_9ce4_8422_2325;
+pub const FNV_PRIME: u64 = 0x0000_0100_0000_01b3;
+
+// ── FNV-1a (byte-by-byte, correct per spec) ──────────────────────
+
+/// FNV-1a in the "continue" style. FNV-1a is inherently byte-serial,
+/// so we process each byte individually (this is the correct algorithm).
+#[inline]
+pub fn fnv1a64_continue(mut hash: u64, input: &[u8]) -> u64 {
+    for &b in input {
+        hash ^= u64::from(b);
+        hash = hash.wrapping_mul(FNV_PRIME);
+    }
+    hash
+}
+
+/// FNV-1a on a full byte slice, with fast path for small inputs.
+#[inline]
+pub fn fnv1a64_bytes(input: &[u8]) -> u64 {
+    fnv1a64_continue(FNV_OFFSET_BASIS, input)
+}
+
+// ── XXHash wrappers ────────────────────────────────────────────────
+
+#[inline]
+pub fn fast_hash_bytes(input: &[u8]) -> u64 {
+    xxh3_64(input)
+}
+
+#[inline]
+pub fn fast_hash_seeded(input: &[u8], seed: u64) -> u64 {
+    xxh3_64_with_seed(input, seed)
+}
+
+/// Compute a composite cache key from method+path+query.
+#[inline]
+pub fn fast_hash_cache_key(method: &[u8], path: &[u8], query: &[u8]) -> u64 {
+    let mut h = Xxh3::with_seed(0x9E37_79B9_7F4A_7C15);
+    h.update(method);
+    h.update(&[0]);
+    h.update(path);
+    h.update(&[0]);
+    h.update(query);
+    h.digest()
+}
+
+// ── Cow helpers for lazy / cached hashing ──────────────────────────
+
+/// A lazy hash value that can be computed once and cached.
+#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
+pub struct LazyHash(u64);
+
+impl LazyHash {
+    #[inline(always)]
+    pub fn new(value: u64) -> Self {
+        Self(value)
+    }
+
+    #[inline(always)]
+    pub fn get(&self) -> u64 {
+        self.0
+    }
+}
+
+// ── Napi exports ───────────────────────────────────────────────────
+
+#[napi]
+pub fn crc32(input: Uint8Array) -> u32 {
+    crc32fast::hash(input.as_ref())
+}
+
+#[napi(js_name = "fnv1a64")]
+pub fn fnv1a64(input: Uint8Array) -> u64 {
+    fnv1a64_bytes(input.as_ref())
+}
+
+/// CRC32 batch — zero-alloc inline iteration (no Vec allocation from unpack).
+#[napi]
+pub fn crc32_batch_packed(input: Uint8Array) -> Result<Buffer> {
+    let data = input.as_ref();
+    if data.len() < 4 {
+        return Err(Error::from_reason("packed buffer: missing count"));
+    }
+
+    let count = u32::from_le_bytes([data[0], data[1], data[2], data[3]]) as usize;
+
+    // Validate count early
+    let max_possible = (data.len() - 4) / 4;
+    if count > max_possible {
+        return Err(Error::from_reason("packed buffer: impossible item count"));
+    }
+
+    let mut out = Vec::with_capacity(4 + count * 4);
+    out.extend_from_slice(&(count as u32).to_le_bytes());
+    out.resize(4 + count * 4, 0);
+
+    let out_slice = &mut out[4..];
+
+    if should_parallelize(count, data.len().saturating_sub(4)) {
+        use rayon::prelude::*;
+
+        // Pre-compute offsets so we can iterate in parallel without allocations
+        let offsets: Vec<(usize, usize)> = {
+            let mut offsets = Vec::with_capacity(count);
+            let mut offset = 4usize;
+            for _ in 0..count {
+                if offset + 4 > data.len() {
+                    return Err(Error::from_reason("packed buffer: truncated length"));
+                }
+                let len = u32::from_le_bytes([
+                    data[offset], data[offset + 1], data[offset + 2], data[offset + 3],
+                ]) as usize;
+                offset += 4;
+                let end = offset + len;
+                if end > data.len() {
+                    return Err(Error::from_reason("packed buffer: truncated item"));
+                }
+                offsets.push((offset, len));
+                offset = end;
+            }
+            offsets
+        };
+
+        const CHUNK_ITEMS: usize = 256;
+
+        out_slice
+            .par_chunks_mut(CHUNK_ITEMS * 4)
+            .enumerate()
+            .for_each(|(ci, chunk)| {
+                let num_items = chunk.len() / 4;
+                let start = ci * CHUNK_ITEMS;
+                for (i, item) in offsets[start..start + num_items].iter().enumerate() {
+                    let crc = crc32fast::hash(&data[item.0..item.0 + item.1]);
+                    chunk[i * 4..(i + 1) * 4].copy_from_slice(&crc.to_le_bytes());
+                }
+            });
+    } else {
+        let mut offset = 4usize;
+        for i in 0..count {
+            if offset + 4 > data.len() {
+                return Err(Error::from_reason("packed buffer: truncated length"));
+            }
+            let len = u32::from_le_bytes([
+                data[offset], data[offset + 1], data[offset + 2], data[offset + 3],
+            ]) as usize;
+            offset += 4;
+            let end = offset + len;
+            if end > data.len() {
+                return Err(Error::from_reason("packed buffer: truncated item"));
+            }
+            let crc = crc32fast::hash(&data[offset..end]);
+            out_slice[i * 4..(i + 1) * 4].copy_from_slice(&crc.to_le_bytes());
+            offset = end;
+        }
+    }
+
+    Ok(Buffer::from(out))
+}