cursedbelt-core 2.13.0 → 2.13.2

package/dist/core/palette/hotkeys.d.ts

@@ -15,7 +15,10 @@ export interface ParsedHotkey extends HotkeyMods {
  * returns `false` when there's no `navigator`.
  */
 export declare function isApplePlatform(): boolean;
-/** Split a `'+'`-separated binding into its required modifiers + final key. */
+/**
+ * Split a `'+'`-separated binding into its required modifiers + final key. `+` is itself a
+ * key — a bare `'+'` or `'$mod++'` splits into empty parts, and the key is the `+`.
+ */
 export declare function parseHotkey(binding: string, isApple?: boolean): ParsedHotkey;
 /** Does a keyboard event satisfy `binding` — exact modifier set + the key? */
 export declare function matchHotkey(e: KeyboardEvent, binding: string, isApple?: boolean): boolean;

package/dist/core/palette/hotkeys.js

@@ -21,14 +21,18 @@ export function isApplePlatform() {
     const probe = `${navigator.platform ?? ''} ${navigator.userAgent ?? ''}`;
     return /mac|iphone|ipad|ipod/i.test(probe);
 }
-/** Split a `'+'`-separated binding into its required modifiers + final key. */
+/**
+ * Split a `'+'`-separated binding into its required modifiers + final key. `+` is itself a
+ * key — a bare `'+'` or `'$mod++'` splits into empty parts, and the key is the `+`.
+ */
 export function parseHotkey(binding, isApple = isApplePlatform()) {
-    const parts = binding
+    const split = binding
         .toLowerCase()
         .split('+')
-        .map((p) => p.trim())
-        .filter(Boolean);
-    const key = parts.pop() ?? '';
+        .map((p) => p.trim());
+    const plusKey = split.length > 1 && split[split.length - 1] === '';
+    const parts = split.filter(Boolean);
+    const key = plusKey ? '+' : (parts.pop() ?? '');
     const tokens = new Set(parts);
     const mod = tokens.has('$mod');
     return {

package/dist/ctgrClient/convertRequest.js

@@ -33,7 +33,7 @@ export async function convertIfOnlyGETRequests(url, init = { method: 'GET' }, fo
     if (!METHOD_TO_ABBREV[upper]) {
         throw new Error(`ctgr: "${method}" is not a tunnelable method`);
     }
-    const body = form ? await formDataToBody(form) : bodyFromInit(init.body);
+    const body = form ? await formDataToBody(form) : bodyFromInit(init.body, upper, url);
     const getInit = toGetInit(init);
     const { chunks } = await encodeRequest(upper, url, body);
     return { requests: chunks.map((chunk) => ({ url: chunk.url, init: getInit })) };
@@ -62,10 +62,26 @@ async function formDataToBody(formData) {
     }
     return { __files: files, ...fields };
 }
-/** The request body as a JS value: a JSON string is parsed; anything else passes through. */
-function bodyFromInit(body) {
-    if (typeof body !== 'string')
-        return body ?? undefined;
+/**
+ * The request body as a JS value: a JSON string is parsed, a plain string rides as itself.
+ *
+ * 🔴 Anything else is REFUSED. The tunnel carries a JSON value or a form's files; a `File`, a
+ * `Blob`, bytes, a stream or `URLSearchParams` handed through here was JSON-serialised as `{}` —
+ * desk's import preview posted a 3.4 MB workbook and the server described "a JSON file" with `{}`
+ * as its sample (forge task 3443). A loud error at the call is the bug; a silent `{}` is data loss.
+ * Send an upload as `FormData`, which is carried whole.
+ */
+function bodyFromInit(body, method, url) {
+    if (body === null || body === undefined)
+        return undefined;
+    if (typeof body !== 'string') {
+        // A plain object or array a caller cast to `BodyInit` serialises as itself — carried as before.
+        const proto = Object.getPrototypeOf(body);
+        if (Array.isArray(body) || proto === Object.prototype || proto === null)
+            return body;
+        const shape = Object.prototype.toString.call(body).slice(8, -1);
+        throw new Error(`ctgr: a ${shape} body cannot ride the GET-only tunnel (${method} ${url}) — send it as FormData or a JSON string`);
+    }
     try {
         return JSON.parse(body);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-core",
-	"version": "2.13.0",
+	"version": "2.13.2",
 	"license": "ISC",
 	"type": "module",
 	"description": "Framework-agnostic core of the cursedbelt split — isomorphic domain logic. cwip below it, cursedbelt-server and cursedbelt (react) above it.",

package/src/core/palette/hotkeys.ts

@@ -35,14 +35,18 @@ export function isApplePlatform(): boolean {
   return /mac|iphone|ipad|ipod/i.test(probe);
 }
 
-/** Split a `'+'`-separated binding into its required modifiers + final key. */
+/**
+ * Split a `'+'`-separated binding into its required modifiers + final key. `+` is itself a
+ * key — a bare `'+'` or `'$mod++'` splits into empty parts, and the key is the `+`.
+ */
 export function parseHotkey(binding: string, isApple = isApplePlatform()): ParsedHotkey {
-  const parts = binding
+  const split = binding
     .toLowerCase()
     .split('+')
-    .map((p) => p.trim())
-    .filter(Boolean);
-  const key = parts.pop() ?? '';
+    .map((p) => p.trim());
+  const plusKey = split.length > 1 && split[split.length - 1] === '';
+  const parts = split.filter(Boolean);
+  const key = plusKey ? '+' : (parts.pop() ?? '');
   const tokens = new Set(parts);
   const mod = tokens.has('$mod');
   return {

package/src/core/palette/palette.spec.ts

@@ -133,6 +133,14 @@ describe('formatHotkey', () => {
   test('multiple modifiers order Apple-style (⌃⌥⇧⌘)', () => {
     expect(formatHotkey('$mod+shift+p', true)).toBe('⇧⌘P');
   });
+  test('`+` is a key too — a bare `+` or `shift++` draws a + cap, never an empty one', () => {
+    expect(formatHotkey('+', true)).toBe('+');
+    expect(formatHotkey('+', false)).toBe('+');
+    expect(formatHotkey('$mod++', true)).toBe('⌘+');
+    expect(formatHotkey('$mod++', false)).toBe('Ctrl +');
+    expect(parseHotkey('shift++')).toMatchObject({ shift: true, key: '+' });
+    expect(matchHotkey(kd({ key: '+' }), '+', true)).toBe(true);
+  });
 });
 
 // ── ShortcutRegistry ──────────────────────────────────────────────────────────

package/src/ctgrClient/convertRequest.ts

@@ -57,7 +57,7 @@ export async function convertIfOnlyGETRequests(
     throw new Error(`ctgr: "${method}" is not a tunnelable method`);
   }
 
-  const body: unknown = form ? await formDataToBody(form) : bodyFromInit(init.body);
+  const body: unknown = form ? await formDataToBody(form) : bodyFromInit(init.body, upper, url);
   const getInit = toGetInit(init);
   const { chunks } = await encodeRequest(upper, url, body);
   return { requests: chunks.map((chunk) => ({ url: chunk.url, init: getInit })) };
@@ -89,9 +89,26 @@ async function formDataToBody(formData: FormData): Promise<Record<string, unknow
   return { __files: files, ...fields };
 }
 
-/** The request body as a JS value: a JSON string is parsed; anything else passes through. */
-function bodyFromInit(body: BodyInit | null | undefined): unknown {
-  if (typeof body !== 'string') return body ?? undefined;
+/**
+ * The request body as a JS value: a JSON string is parsed, a plain string rides as itself.
+ *
+ * 🔴 Anything else is REFUSED. The tunnel carries a JSON value or a form's files; a `File`, a
+ * `Blob`, bytes, a stream or `URLSearchParams` handed through here was JSON-serialised as `{}` —
+ * desk's import preview posted a 3.4 MB workbook and the server described "a JSON file" with `{}`
+ * as its sample (forge task 3443). A loud error at the call is the bug; a silent `{}` is data loss.
+ * Send an upload as `FormData`, which is carried whole.
+ */
+function bodyFromInit(body: BodyInit | null | undefined, method: string, url: string): unknown {
+  if (body === null || body === undefined) return undefined;
+  if (typeof body !== 'string') {
+    // A plain object or array a caller cast to `BodyInit` serialises as itself — carried as before.
+    const proto = Object.getPrototypeOf(body);
+    if (Array.isArray(body) || proto === Object.prototype || proto === null) return body;
+    const shape = Object.prototype.toString.call(body).slice(8, -1);
+    throw new Error(
+      `ctgr: a ${shape} body cannot ride the GET-only tunnel (${method} ${url}) — send it as FormData or a JSON string`,
+    );
+  }
   try {
     return JSON.parse(body);
   } catch {

package/src/ctgrClient/ctgrClient.spec.ts

@@ -132,4 +132,36 @@ describe('convertIfOnlyGETRequests', () => {
     expect(decoded.files?.[0]).toMatchObject({ originalname: 'p.bin', mimetype: 'image/png' });
     expect(decoded.body).toEqual({ name: 'pic' });
   });
+
+  // forge task 3443: desk posted a workbook as a raw `File`, and it arrived as `{}`.
+  test('mode ON: a body the tunnel cannot carry is refused, never sent as {}', async () => {
+    setCtgrMode(true);
+    const bodies: BodyInit[] = [
+      new File([new Uint8Array([0x50, 0x4b, 3, 4])], 'budget.xlsx'),
+      new Blob(['x']),
+      new Uint8Array([1, 2, 3]),
+      new Uint8Array([1, 2, 3]).buffer,
+      new URLSearchParams({ a: '1' }),
+    ];
+    for (const body of bodies) {
+      await expect(convertIfOnlyGETRequests('/api/v1/files/preview', { method: 'POST', body })).rejects.toThrow(
+        /cannot ride the GET-only tunnel \(POST \/api\/v1\/files\/preview\) — send it as FormData/,
+      );
+    }
+  });
+
+  test('mode ON: a plain object a caller cast to BodyInit still rides as JSON', async () => {
+    setCtgrMode(true);
+    const body = { name: 'Budget' } as unknown as BodyInit;
+    const { requests } = await convertIfOnlyGETRequests('/api/v1/files', { method: 'POST', body });
+    const decoded = await decodeRequest(new URL(requests[0].url, 'http://x').searchParams);
+    if (decoded === 'partial') throw new Error('unreachable');
+    expect(decoded.body).toEqual({ name: 'Budget' });
+  });
+
+  test('mode OFF: any body passes through untouched — only the tunnel is particular', async () => {
+    const body = new Blob(['x']);
+    const { requests } = await convertIfOnlyGETRequests('/api/v1/files/preview', { method: 'POST', body });
+    expect(requests[0].init.body).toBe(body);
+  });
 });