cursedbelt-core 1.0.0

package/dist/ctgr/codec.d.ts

@@ -0,0 +1,44 @@
+import { type CtgrDecoded, type CtgrMethod, type EncodedRequest, type EncodeOpts, type UploadedFile } from './types';
+/**
+ * Encode a mutating request into one or more `/ctgr<XX>` GET-twin chunks. Small
+ * bodies become a single chunk; large bodies gzip (when over the threshold) and split
+ * into `chunkSizeBytes` pieces. Each chunk carries a crc32; the last carries the
+ * full-payload sha256.
+ */
+export declare function encodeRequest(method: CtgrMethod, url: string, body: unknown, opts?: EncodeOpts): Promise<EncodedRequest>;
+/** A validated, crc-verified single chunk — ready to buffer or decode. */
+export interface ParsedChunk {
+    method: CtgrMethod;
+    gzip: boolean;
+    index: number;
+    total: number;
+    /** Declared full-payload length in bytes (post-gzip, pre-base64). */
+    payloadLength: number;
+    cid: string;
+    /** Full-payload sha256 (hex) — present on the last chunk only. */
+    sha?: string;
+    bytes: Uint8Array;
+}
+/**
+ * Parse + crc-verify ONE chunk's params. Throws on an unknown version, a bad method
+ * abbrev, malformed index/total/length, or a crc mismatch — callers that must not
+ * throw (the chunk store, the middleware) catch and map to an Error/400.
+ */
+export declare function parseChunk(params: Record<string, string> | URLSearchParams): ParsedChunk;
+/**
+ * Split an `__files` array out of a decoded body into multer-shaped uploads. The
+ * `__files` data is standard base64 (what the client's FormData serializer emits);
+ * everything else stays on the returned `body`.
+ */
+export declare function extractFiles(parsed: unknown): {
+    body: unknown;
+    files?: UploadedFile[];
+};
+/** Decode an assembled payload (gunzip when flagged) → method + body (+ files). */
+export declare function decodePayload(payload: Uint8Array, gzipped: boolean, method: CtgrMethod): Promise<CtgrDecoded>;
+/**
+ * Decode a single set of chunk params. For the common single-chunk request this
+ * fully decodes (verifying the payload sha256); for one chunk of a multi-chunk
+ * payload it returns `'partial'` — those reassemble through {@link ChunkStore}.
+ */
+export declare function decodeRequest(params: Record<string, string> | URLSearchParams): Promise<CtgrDecoded | 'partial'>;

package/dist/ctgr/codec.js

@@ -0,0 +1,153 @@
+/*
+ * ctgr v1 codec — pack ANY mutating request body into URL-safe GET-twin chunks, and
+ * the pure inverse. Isomorphic (browser + Bun), no runtime deps.
+ *
+ * Pipeline: JSON → UTF-8 bytes → gzip when > threshold → split into chunks → each
+ * chunk base64url-encoded with a crc32, the envelope carrying a self-describing
+ * header (version, gzip flag, method, index/total, payload length, payload id) and a
+ * full-payload sha256 on the last chunk. The decoder needs nothing but the params.
+ *
+ * This replaces the legacy `encode→reverse→swap→base64→swap` chain, which
+ * double-base64'd and whose swap/reverse was trivially-reversible obfuscation, not
+ * protection — the real protection (getOnly JWT claim + CSRF guard) is unchanged.
+ */
+import { fromBase64, fromBase64url, toBase64url } from './base64url';
+import { gunzip, gzip } from './compress';
+import { crc32 } from './crc32';
+import { sha256Hex } from './digest';
+import { ABBREV_TO_METHOD, CTGR_WIRE_VERSION, METHOD_TO_ABBREV, } from './types';
+const DEFAULT_CHUNK_SIZE = 1800;
+const DEFAULT_GZIP_THRESHOLD = 1024;
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+/**
+ * Encode a mutating request into one or more `/ctgr<XX>` GET-twin chunks. Small
+ * bodies become a single chunk; large bodies gzip (when over the threshold) and split
+ * into `chunkSizeBytes` pieces. Each chunk carries a crc32; the last carries the
+ * full-payload sha256.
+ */
+export async function encodeRequest(method, url, body, opts = {}) {
+    const chunkSize = opts.chunkSizeBytes ?? DEFAULT_CHUNK_SIZE;
+    const gzipThreshold = opts.gzipThresholdBytes ?? DEFAULT_GZIP_THRESHOLD;
+    // `JSON.stringify(undefined)` is `undefined`; coerce a missing body to `null` so a
+    // body-less mutation (e.g. DELETE) still rides the normal, single-versioned path.
+    const raw = textEncoder.encode(JSON.stringify(body ?? null));
+    const useGzip = raw.length > gzipThreshold;
+    const payload = useGzip ? await gzip(raw) : raw;
+    const sha = await sha256Hex(payload);
+    const cid = crypto.randomUUID();
+    const abbrev = METHOD_TO_ABBREV[method];
+    const totalChunks = Math.max(1, Math.ceil(payload.length / chunkSize));
+    const chunks = [];
+    for (let i = 0; i < totalChunks; i++) {
+        const slice = payload.subarray(i * chunkSize, (i + 1) * chunkSize);
+        const params = {
+            _cv: CTGR_WIRE_VERSION,
+            _cm: abbrev,
+            _cg: useGzip ? '1' : '0',
+            _ci: String(i),
+            _ct: String(totalChunks),
+            _cl: String(payload.length),
+            _cid: cid,
+            _crc: String(crc32(slice)),
+            _d: toBase64url(slice),
+        };
+        if (i === totalChunks - 1)
+            params._sha = sha;
+        const path = `/ctgr${abbrev}${url}`;
+        const separator = path.includes('?') ? '&' : '?';
+        const query = new URLSearchParams(params).toString();
+        chunks.push({ url: `${path}${separator}${query}`, params });
+    }
+    return { chunks };
+}
+function asRecord(params) {
+    return params instanceof URLSearchParams ? Object.fromEntries(params) : params;
+}
+/**
+ * Parse + crc-verify ONE chunk's params. Throws on an unknown version, a bad method
+ * abbrev, malformed index/total/length, or a crc mismatch — callers that must not
+ * throw (the chunk store, the middleware) catch and map to an Error/400.
+ */
+export function parseChunk(params) {
+    const p = asRecord(params);
+    if (p._cv !== CTGR_WIRE_VERSION) {
+        throw new Error(`ctgr: unsupported wire version "${p._cv ?? ''}"`);
+    }
+    const method = ABBREV_TO_METHOD[p._cm];
+    if (!method)
+        throw new Error(`ctgr: unknown method abbreviation "${p._cm ?? ''}"`);
+    const index = Number(p._ci);
+    const total = Number(p._ct);
+    const payloadLength = Number(p._cl);
+    if (!Number.isInteger(total) || total <= 0)
+        throw new Error('ctgr: invalid chunk total');
+    if (!Number.isInteger(index) || index < 0 || index >= total) {
+        throw new Error('ctgr: chunk index out of range');
+    }
+    if (!Number.isInteger(payloadLength) || payloadLength < 0) {
+        throw new Error('ctgr: invalid payload length');
+    }
+    const bytes = fromBase64url(p._d ?? '');
+    const expectedCrc = Number(p._crc);
+    if (!Number.isInteger(expectedCrc) || crc32(bytes) !== expectedCrc) {
+        throw new Error('ctgr: chunk crc mismatch');
+    }
+    return {
+        method,
+        gzip: p._cg === '1',
+        index,
+        total,
+        payloadLength,
+        cid: p._cid ?? '',
+        sha: p._sha,
+        bytes,
+    };
+}
+/**
+ * Split an `__files` array out of a decoded body into multer-shaped uploads. The
+ * `__files` data is standard base64 (what the client's FormData serializer emits);
+ * everything else stays on the returned `body`.
+ */
+export function extractFiles(parsed) {
+    if (parsed &&
+        typeof parsed === 'object' &&
+        Array.isArray(parsed.__files)) {
+        const source = parsed;
+        const files = source.__files.map((f) => {
+            const buffer = fromBase64(f.dataBase64 ?? '');
+            return {
+                fieldname: f.field ?? 'file',
+                originalname: f.name ?? 'file',
+                mimetype: f.type || 'application/octet-stream',
+                buffer,
+                size: buffer.length,
+            };
+        });
+        const { __files, ...body } = source;
+        return { body, files };
+    }
+    return { body: parsed };
+}
+/** Decode an assembled payload (gunzip when flagged) → method + body (+ files). */
+export async function decodePayload(payload, gzipped, method) {
+    const raw = gzipped ? await gunzip(payload) : payload;
+    const json = textDecoder.decode(raw);
+    const parsed = json.length ? JSON.parse(json) : undefined;
+    const { body, files } = extractFiles(parsed);
+    return files ? { method, body, files } : { method, body };
+}
+/**
+ * Decode a single set of chunk params. For the common single-chunk request this
+ * fully decodes (verifying the payload sha256); for one chunk of a multi-chunk
+ * payload it returns `'partial'` — those reassemble through {@link ChunkStore}.
+ */
+export async function decodeRequest(params) {
+    const chunk = parseChunk(params);
+    if (chunk.total !== 1)
+        return 'partial';
+    if (chunk.sha && (await sha256Hex(chunk.bytes)) !== chunk.sha) {
+        throw new Error('ctgr: payload sha256 mismatch');
+    }
+    return decodePayload(chunk.bytes, chunk.gzip, chunk.method);
+}

package/dist/ctgr/compress.d.ts

@@ -0,0 +1,2 @@
+export declare function gzip(bytes: Uint8Array): Promise<Uint8Array>;
+export declare function gunzip(bytes: Uint8Array): Promise<Uint8Array>;

package/dist/ctgr/compress.js

@@ -0,0 +1,20 @@
+/*
+ * Isomorphic gzip via the web-standard CompressionStream / DecompressionStream —
+ * native on Bun and in the browser, so one implementation serves both the browser
+ * encoder and the Bun server decoder (no `node:zlib`, no `Bun.gzipSync` branch).
+ * Async on both ends, which is why the whole ctgr codec is async.
+ */
+// `new Uint8Array(bytes)` re-backs the view on a plain ArrayBuffer — Blob/SubtleCrypto
+// reject the `ArrayBufferLike` default (which admits SharedArrayBuffer) under TS 6.
+export async function gzip(bytes) {
+    const stream = new Blob([new Uint8Array(bytes)])
+        .stream()
+        .pipeThrough(new CompressionStream('gzip'));
+    return new Uint8Array(await new Response(stream).arrayBuffer());
+}
+export async function gunzip(bytes) {
+    const stream = new Blob([new Uint8Array(bytes)])
+        .stream()
+        .pipeThrough(new DecompressionStream('gzip'));
+    return new Uint8Array(await new Response(stream).arrayBuffer());
+}

package/dist/ctgr/crc32.d.ts

@@ -0,0 +1,2 @@
+/** CRC-32 of `bytes` as an unsigned 32-bit integer. */
+export declare function crc32(bytes: Uint8Array): number;

package/dist/ctgr/crc32.js

@@ -0,0 +1,23 @@
+/*
+ * Pure-JS CRC-32 (IEEE 802.3 / zlib polynomial) over a 256-entry lookup table — no
+ * native addon. Client and server share this exact implementation so a chunk's
+ * `_crc` integrity check computes the same value on both ends of the tunnel.
+ */
+const TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        table[n] = c >>> 0;
+    }
+    return table;
+})();
+/** CRC-32 of `bytes` as an unsigned 32-bit integer. */
+export function crc32(bytes) {
+    let crc = 0xffffffff;
+    for (let i = 0; i < bytes.length; i++) {
+        crc = (crc >>> 8) ^ TABLE[(crc ^ bytes[i]) & 0xff];
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}

package/dist/ctgr/digest.d.ts

@@ -0,0 +1 @@
+export declare function sha256Hex(bytes: Uint8Array): Promise<string>;

package/dist/ctgr/digest.js

@@ -0,0 +1,15 @@
+/*
+ * Hex SHA-256 via web-standard SubtleCrypto — isomorphic (Bun + browser both expose
+ * `crypto.subtle`). Used for the full-payload integrity check the wire format carries
+ * on the last chunk (`_sha`); per-chunk integrity is the cheaper {@link crc32}.
+ */
+export async function sha256Hex(bytes) {
+    // `new Uint8Array(bytes)` re-backs the view on a plain ArrayBuffer — SubtleCrypto's
+    // BufferSource rejects the `ArrayBufferLike` default under TS 6.
+    const digest = await crypto.subtle.digest('SHA-256', new Uint8Array(bytes));
+    const view = new Uint8Array(digest);
+    let hex = '';
+    for (let i = 0; i < view.length; i++)
+        hex += view[i].toString(16).padStart(2, '0');
+    return hex;
+}

package/dist/ctgr/index.d.ts

@@ -0,0 +1,9 @@
+export { fromBase64, fromBase64url, toBase64, toBase64url } from './base64url';
+export { ChunkAccumulator, type ChunkAccumulatorConfig, } from './chunkAccumulator';
+export { ChunkStore, type ChunkStoreOpts } from './chunkStore';
+export { decodePayload, decodeRequest, encodeRequest, extractFiles, type ParsedChunk, parseChunk, } from './codec';
+export { gunzip, gzip } from './compress';
+export { crc32 } from './crc32';
+export { sha256Hex } from './digest';
+export { ABBREV_TO_METHOD, CTGR_WIRE_VERSION, type CtgrAbbrev, type CtgrDecoded, type CtgrMethod, type EncodedChunk, type EncodedRequest, type EncodeOpts, METHOD_TO_ABBREV, type SerializedFile, type UploadedFile, } from './types';
+export { decodeV0Payload, V0ChunkStore, type V0ChunkStoreOpts } from './v0compat';

package/dist/ctgr/index.js

@@ -0,0 +1,17 @@
+/*
+ * src/ctgr — the isomorphic ctgr codec, re-exported from `cursedbelt-server`; (browser + Bun, no runtime deps). The
+ * Hono transport binding (`unGETify` + `buildRoutes`) lives in `cursedbelt-server`;
+ * the browser guard + request converter live in `cursedbelt-cc/client`.
+ *
+ * The ChunkAccumulator is the primary abstraction for multi-chunk payload assembly;
+ * ChunkStore is kept for backward compatibility (they are identical implementations).
+ */
+export { fromBase64, fromBase64url, toBase64, toBase64url } from './base64url';
+export { ChunkAccumulator, } from './chunkAccumulator';
+export { ChunkStore } from './chunkStore';
+export { decodePayload, decodeRequest, encodeRequest, extractFiles, parseChunk, } from './codec';
+export { gunzip, gzip } from './compress';
+export { crc32 } from './crc32';
+export { sha256Hex } from './digest';
+export { ABBREV_TO_METHOD, CTGR_WIRE_VERSION, METHOD_TO_ABBREV, } from './types';
+export { decodeV0Payload, V0ChunkStore } from './v0compat';

package/dist/ctgr/types.d.ts

@@ -0,0 +1,64 @@
+/** The mutating HTTP methods ctgr tunnels through a `/ctgr<XX>` GET twin. */
+export type CtgrMethod = 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+/** Method → its 2-char abbreviation (the `/ctgr<XX>` path segment + the `_cm` param). */
+export declare const METHOD_TO_ABBREV: {
+    readonly POST: "po";
+    readonly PATCH: "pa";
+    readonly PUT: "pu";
+    readonly DELETE: "de";
+};
+/** The inverse of {@link METHOD_TO_ABBREV}. */
+export declare const ABBREV_TO_METHOD: {
+    readonly po: "POST";
+    readonly pa: "PATCH";
+    readonly pu: "PUT";
+    readonly de: "DELETE";
+};
+export type CtgrAbbrev = keyof typeof ABBREV_TO_METHOD;
+/** Current wire-format version. v0 (the legacy `_cv`-absent codec) lives in `v0compat.ts`. */
+export declare const CTGR_WIRE_VERSION = "1";
+/**
+ * A reconstructed multipart upload, multer-shaped so the file came over the ctgr
+ * GET-tunnel the same way it would over multipart. `buffer` is raw isomorphic bytes
+ * (a `Uint8Array`, not a Node `Buffer`) — wrap it where a `Buffer` is required.
+ */
+export interface UploadedFile {
+    fieldname: string;
+    originalname: string;
+    mimetype: string;
+    buffer: Uint8Array;
+    size: number;
+}
+/** The fully-decoded request a downstream handler / validator consumes. */
+export interface CtgrDecoded {
+    /** The original HTTP method the GET twin stands in for. */
+    method: CtgrMethod;
+    /** The parsed JSON body, with any `__files` array extracted into {@link files}. */
+    body: unknown;
+    /** Reconstructed uploads — present only when the body carried an `__files` array. */
+    files?: UploadedFile[];
+}
+/** One encoded chunk: the GET-twin URL plus the query params it carries (same data). */
+export interface EncodedChunk {
+    /** `/ctgr<XX><path>?<params>` — a path (no origin); the caller adds any prefix. */
+    url: string;
+    /** The `_c*` params, also serialized into {@link url}. Handy for tests + reassembly. */
+    params: Record<string, string>;
+}
+/** The output of `encodeRequest`: one chunk for small bodies, N for large ones. */
+export interface EncodedRequest {
+    chunks: EncodedChunk[];
+}
+export interface EncodeOpts {
+    /** Max payload bytes per chunk (pre-base64url). Default 1800 → ~2400 URL chars. */
+    chunkSizeBytes?: number;
+    /** Gzip the payload when it exceeds this many bytes. Default 1024. */
+    gzipThresholdBytes?: number;
+}
+/** The `__files` entry shape the client serializes an upload into (base64 data). */
+export interface SerializedFile {
+    field?: string;
+    name?: string;
+    type?: string;
+    dataBase64?: string;
+}

package/dist/ctgr/types.js

@@ -0,0 +1,21 @@
+/*
+ * ctgr wire-format types + the method⇄abbreviation maps shared by the codec, the
+ * chunk store, the Hono transport, and the browser client. Pure types + literal
+ * const maps only (no runtime APIs) so this module is trivially isomorphic.
+ */
+/** Method → its 2-char abbreviation (the `/ctgr<XX>` path segment + the `_cm` param). */
+export const METHOD_TO_ABBREV = {
+    POST: 'po',
+    PATCH: 'pa',
+    PUT: 'pu',
+    DELETE: 'de',
+};
+/** The inverse of {@link METHOD_TO_ABBREV}. */
+export const ABBREV_TO_METHOD = {
+    po: 'POST',
+    pa: 'PATCH',
+    pu: 'PUT',
+    de: 'DELETE',
+};
+/** Current wire-format version. v0 (the legacy `_cv`-absent codec) lives in `v0compat.ts`. */
+export const CTGR_WIRE_VERSION = '1';

package/dist/ctgr/v0compat.d.ts

@@ -0,0 +1,27 @@
+import type { CtgrDecoded, CtgrMethod } from './types';
+/** Reverse the v0 client pipeline (`encode→reverse→swap→encode→swap`) and parse JSON. */
+export declare function decodeV0Payload(encoded: string): unknown;
+export interface V0ChunkStoreOpts {
+    maxInFlight?: number;
+    /** Hard cap on the joined encoded string length (chars). Default ~80 MB. */
+    maxPayloadChars?: number;
+    ttlMs?: number;
+    now?: () => number;
+}
+/**
+ * Bounded accumulator for v0 requests, mirroring the legacy `unGETifyRoute` (`p` for
+ * a single payload; `cid`/`ci`/`ct`/`p` for chunked). Same `add` contract as the v1
+ * {@link ChunkStore}: `false` for an intermediate chunk, {@link CtgrDecoded} when
+ * complete, `Error` on malformed input.
+ */
+export declare class V0ChunkStore {
+    private readonly entries;
+    private readonly maxInFlight;
+    private readonly maxPayloadChars;
+    private readonly ttlMs;
+    private readonly now;
+    constructor(opts?: V0ChunkStoreOpts);
+    get size(): number;
+    add(params: Record<string, string>, method: CtgrMethod): CtgrDecoded | false | Error;
+    private evictStale;
+}

package/dist/ctgr/v0compat.js

@@ -0,0 +1,128 @@
+/*
+ * Legacy (v0) ctgr decoder — kept ONLY for the rollout window so a server running v1
+ * still understands requests from not-yet-updated clients (which send no `_cv`). The
+ * v0 codec was `encode→reverse→swap→base64→swap`: a trivially reversible transform,
+ * never a security mechanism (the real protection is the getOnly JWT claim + the CSRF
+ * guard, both unchanged). Delete this file once all clients ship v1.
+ *
+ * Detect v0 by the ABSENCE of `_cv` (the old client never sent it) — the safest
+ * heuristic, since v1 always sets `_cv=1`. v0 carried the method only in the path
+ * (`/ctgr<XX>`), so the middleware passes the path-derived method in.
+ */
+import { fromBase64 } from './base64url';
+import { extractFiles } from './codec';
+const decodeBase64Utf8 = (str) => new TextDecoder().decode(fromBase64(str));
+const reverseString = (str) => str.split('').reverse().join('');
+const swapEnds = (str) => {
+    if (str.length < 2)
+        return str;
+    const arr = str.split('');
+    arr[0] = str[str.length - 1];
+    arr[str.length - 1] = str[0];
+    return arr.join('');
+};
+/** Reverse the v0 client pipeline (`encode→reverse→swap→encode→swap`) and parse JSON. */
+export function decodeV0Payload(encoded) {
+    const json = decodeBase64Utf8(reverseString(swapEnds(decodeBase64Utf8(swapEnds(encoded)))));
+    let body = JSON.parse(json);
+    // The legacy client occasionally double-encoded the body string; unwrap it.
+    if (typeof body === 'string')
+        body = JSON.parse(body);
+    return body;
+}
+function toDecoded(body, method) {
+    const { body: rest, files } = extractFiles(body);
+    return files ? { method, body: rest, files } : { method, body: rest };
+}
+/**
+ * Bounded accumulator for v0 requests, mirroring the legacy `unGETifyRoute` (`p` for
+ * a single payload; `cid`/`ci`/`ct`/`p` for chunked). Same `add` contract as the v1
+ * {@link ChunkStore}: `false` for an intermediate chunk, {@link CtgrDecoded} when
+ * complete, `Error` on malformed input.
+ */
+export class V0ChunkStore {
+    entries = new Map();
+    maxInFlight;
+    maxPayloadChars;
+    ttlMs;
+    now;
+    constructor(opts = {}) {
+        this.maxInFlight = opts.maxInFlight ?? 200;
+        this.maxPayloadChars = opts.maxPayloadChars ?? 80 * 1024 * 1024;
+        this.ttlMs = opts.ttlMs ?? 2 * 60 * 1000;
+        this.now = opts.now ?? Date.now;
+    }
+    get size() {
+        return this.entries.size;
+    }
+    add(params, method) {
+        this.evictStale();
+        // Single payload (or a body-less converted request: no `p`).
+        if (params.cid === undefined) {
+            if (!params.p)
+                return { method, body: undefined };
+            try {
+                return toDecoded(decodeV0Payload(params.p), method);
+            }
+            catch (err) {
+                return asError(err);
+            }
+        }
+        // Chunked payload.
+        const cid = params.cid;
+        const total = Number(params.ct);
+        const index = Number(params.ci);
+        if (!Number.isInteger(total) ||
+            total <= 0 ||
+            !Number.isInteger(index) ||
+            index < 0 ||
+            index >= total) {
+            return new Error('ctgr v0: invalid chunk metadata');
+        }
+        let entry = this.entries.get(cid);
+        if (!entry) {
+            if (this.entries.size >= this.maxInFlight) {
+                return new Error('ctgr v0: too many in-flight payloads');
+            }
+            entry = {
+                parts: new Array(total),
+                total,
+                received: 0,
+                chars: 0,
+                method,
+                updatedAt: this.now(),
+            };
+            this.entries.set(cid, entry);
+        }
+        entry.updatedAt = this.now();
+        const piece = params.p ?? '';
+        if (entry.parts[index] === undefined) {
+            entry.parts[index] = piece;
+            entry.received += 1;
+            entry.chars += piece.length;
+            if (entry.chars > this.maxPayloadChars) {
+                this.entries.delete(cid);
+                return new Error('ctgr v0: payload exceeds size cap');
+            }
+        }
+        if (entry.received < entry.total)
+            return false;
+        this.entries.delete(cid);
+        try {
+            return toDecoded(decodeV0Payload(entry.parts.join('')), method);
+        }
+        catch (err) {
+            return asError(err);
+        }
+    }
+    evictStale() {
+        const cutoff = this.now() - this.ttlMs;
+        for (const [cid, entry] of this.entries) {
+            if (entry.updatedAt < cutoff)
+                this.entries.delete(cid);
+        }
+    }
+}
+function asError(err) {
+    return err instanceof Error ? err : new Error(String(err));
+}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * cursedbelt-core — the framework-agnostic bottom of the cursedbelt split
+ * (task 148, 2026-09-15). Isomorphic domain logic only: no react, no hono,
+ * no DOM requirement at runtime. `cwip` sits below this package;
+ * `cursedbelt-server` and `cursedbelt` (the React design system) sit above it
+ * and share their domain models through it by published version.
+ *
+ * The real surface is the subpath exports (`cursedbelt-core/sharing`,
+ * `cursedbelt-core/master-lock`, …) — this root barrel stays deliberately
+ * tiny because a fat root barrel is what made the pre-split `cursedbelt`
+ * drag 47 dependencies into every consumer.
+ */
+export declare const VERSION = "1.0.0";
+export { contrastText } from './core/color';
+export { isSiteCopyKey, SITE_COPY_BAKED_ONLY, SITE_COPY_DEFAULTS, SITE_COPY_KEYS, SITE_COPY_MAX_VALUE_LENGTH, type SiteCopyKey, } from './core/site/siteCopy';

package/dist/index.js

@@ -0,0 +1,17 @@
+/**
+ * cursedbelt-core — the framework-agnostic bottom of the cursedbelt split
+ * (task 148, 2026-09-15). Isomorphic domain logic only: no react, no hono,
+ * no DOM requirement at runtime. `cwip` sits below this package;
+ * `cursedbelt-server` and `cursedbelt` (the React design system) sit above it
+ * and share their domain models through it by published version.
+ *
+ * The real surface is the subpath exports (`cursedbelt-core/sharing`,
+ * `cursedbelt-core/master-lock`, …) — this root barrel stays deliberately
+ * tiny because a fat root barrel is what made the pre-split `cursedbelt`
+ * drag 47 dependencies into every consumer.
+ */
+export const VERSION = '1.0.0';
+// The two root-level conveniences the pre-split "." barrel actually served:
+// the WCAG readable-foreground picker and the baked marketing-copy contract.
+export { contrastText } from './core/color';
+export { isSiteCopyKey, SITE_COPY_BAKED_ONLY, SITE_COPY_DEFAULTS, SITE_COPY_KEYS, SITE_COPY_MAX_VALUE_LENGTH, } from './core/site/siteCopy';