cursedbelt-core 2.13.1 → 2.13.3

package/src/ctgrClient/convertRequest.ts

@@ -57,7 +57,7 @@ export async function convertIfOnlyGETRequests(
     throw new Error(`ctgr: "${method}" is not a tunnelable method`);
   }
 
-  const body: unknown = form ? await formDataToBody(form) : bodyFromInit(init.body);
+  const body: unknown = form ? await formDataToBody(form) : bodyFromInit(init.body, upper, url);
   const getInit = toGetInit(init);
   const { chunks } = await encodeRequest(upper, url, body);
   return { requests: chunks.map((chunk) => ({ url: chunk.url, init: getInit })) };
@@ -89,9 +89,26 @@ async function formDataToBody(formData: FormData): Promise<Record<string, unknow
   return { __files: files, ...fields };
 }
 
-/** The request body as a JS value: a JSON string is parsed; anything else passes through. */
-function bodyFromInit(body: BodyInit | null | undefined): unknown {
-  if (typeof body !== 'string') return body ?? undefined;
+/**
+ * The request body as a JS value: a JSON string is parsed, a plain string rides as itself.
+ *
+ * 🔴 Anything else is REFUSED. The tunnel carries a JSON value or a form's files; a `File`, a
+ * `Blob`, bytes, a stream or `URLSearchParams` handed through here was JSON-serialized as `{}` —
+ * desk's import preview posted a 3.4 MB workbook and the server described "a JSON file" with `{}`
+ * as its sample (forge task 3443). A loud error at the call is the bug; a silent `{}` is data loss.
+ * Send an upload as `FormData`, which is carried whole.
+ */
+function bodyFromInit(body: BodyInit | null | undefined, method: string, url: string): unknown {
+  if (body === null || body === undefined) return undefined;
+  if (typeof body !== 'string') {
+    // A plain object or array a caller cast to `BodyInit` serializes as itself — carried as before.
+    const proto = Object.getPrototypeOf(body);
+    if (Array.isArray(body) || proto === Object.prototype || proto === null) return body;
+    const shape = Object.prototype.toString.call(body).slice(8, -1);
+    throw new Error(
+      `ctgr: a ${shape} body cannot ride the GET-only tunnel (${method} ${url}) — send it as FormData or a JSON string`,
+    );
+  }
   try {
     return JSON.parse(body);
   } catch {

package/src/ctgrClient/ctgrClient.spec.ts

@@ -132,4 +132,36 @@ describe('convertIfOnlyGETRequests', () => {
     expect(decoded.files?.[0]).toMatchObject({ originalname: 'p.bin', mimetype: 'image/png' });
     expect(decoded.body).toEqual({ name: 'pic' });
   });
+
+  // forge task 3443: desk posted a workbook as a raw `File`, and it arrived as `{}`.
+  test('mode ON: a body the tunnel cannot carry is refused, never sent as {}', async () => {
+    setCtgrMode(true);
+    const bodies: BodyInit[] = [
+      new File([new Uint8Array([0x50, 0x4b, 3, 4])], 'budget.xlsx'),
+      new Blob(['x']),
+      new Uint8Array([1, 2, 3]),
+      new Uint8Array([1, 2, 3]).buffer,
+      new URLSearchParams({ a: '1' }),
+    ];
+    for (const body of bodies) {
+      await expect(convertIfOnlyGETRequests('/api/v1/files/preview', { method: 'POST', body })).rejects.toThrow(
+        /cannot ride the GET-only tunnel \(POST \/api\/v1\/files\/preview\) — send it as FormData/,
+      );
+    }
+  });
+
+  test('mode ON: a plain object a caller cast to BodyInit still rides as JSON', async () => {
+    setCtgrMode(true);
+    const body = { name: 'Budget' } as unknown as BodyInit;
+    const { requests } = await convertIfOnlyGETRequests('/api/v1/files', { method: 'POST', body });
+    const decoded = await decodeRequest(new URL(requests[0].url, 'http://x').searchParams);
+    if (decoded === 'partial') throw new Error('unreachable');
+    expect(decoded.body).toEqual({ name: 'Budget' });
+  });
+
+  test('mode OFF: any body passes through untouched — only the tunnel is particular', async () => {
+    const body = new Blob(['x']);
+    const { requests } = await convertIfOnlyGETRequests('/api/v1/files/preview', { method: 'POST', body });
+    expect(requests[0].init.body).toBe(body);
+  });
 });

package/src/namedSubpathsResolve.spec.ts

@@ -103,7 +103,7 @@ describe('subpaths named in this repo resolve', () => {
 	});
 
 	it('knows what the manifest exports', () => {
-		// If `exports` is ever read wrong, every offence below silently becomes one.
+		// If `exports` is ever read wrong, every offense below silently becomes one.
 		expect(exported.has('')).toBe(true); // the "." root entry
 		expect(exported.has('/master-lock')).toBe(true);
 		expect(exported.has('/react')).toBe(false); // the react tier stayed in `cursedbelt` at the 2026-09-15 split

package/src/publishShape.spec.ts

@@ -65,7 +65,7 @@ describe('publish shape', () => {
 		// npm rejects a "./"-prefixed bin value, calls the NAME invalid, and drops
 		// the entry — with a warning, not an error. The package publishes fine and
 		// installs with no CLI at all. Invisible under a file: link, where the bin
-		// is linked from the source manifest before npm ever normalises it.
+		// is linked from the source manifest before npm ever normalizes it.
 		const bin = (pkg as { bin?: Record<string, string> }).bin ?? {};
 		const prefixed = Object.entries(bin).filter(([, v]) => v.startsWith('./'));
 		expect(

package/src/shippedFilesAreTracked.spec.ts

@@ -53,8 +53,8 @@ describe('every file inside the published surface is tracked', () => {
 	});
 
 	test('no untracked file sits inside a directory `files` ships', async () => {
-		// --others = untracked; --exclude-standard honours .gitignore, so deliberately
-		// ignored paths (.agent.noindex, node_modules) are not offences.
+		// --others = untracked; --exclude-standard honors .gitignore, so deliberately
+		// ignored paths (.agent.noindex, node_modules) are not offenses.
 		const { ok, out } = await git('ls-files', '--others', '--exclude-standard', '--', ...shippedDirs());
 		expect(ok, 'git ls-files failed').toBe(true);
 		const untracked = out === '' ? [] : out.split('\n');

package/src/testing/bytes.ts

@@ -32,7 +32,7 @@ export const asBody = (bytes: Uint8Array): Uint8Array<ArrayBuffer> => bytes as U
 export const bytesResponse = (bytes: Uint8Array, init?: ResponseInit): Response =>
   new Response(asBody(bytes), init);
 
-/** A readable stream of `bytes` — what the media catalogue's ingest paths take. */
+/** A readable stream of `bytes` — what the media catalog's ingest paths take. */
 export const bytesStream = (bytes: Uint8Array | string): ReadableStream<Uint8Array> =>
   new Response(typeof bytes === 'string' ? asBody(new TextEncoder().encode(bytes)) : asBody(bytes))
     .body as ReadableStream<Uint8Array>;