cursedbelt-server 4.1.0 → 4.2.0

package/src/server/d1/sameShape.spec.ts

@@ -276,4 +276,77 @@ describe('local and D1 drivers return identical shapes', () => {
 		expect(await attempt(p.local)).toBe(0);
 		expect(await attempt(p.remote)).toBe(0);
 	});
+
+	// ── batch META, which both sides got wrong the same way until 2026-09-17 ──────────
+	//
+	// 🔴 These four assert VALUES, not just agreement. The bug they pin was `changes: 0`
+	// hardcoded in `local.ts`'s `allSync` AND in `fakeD1`'s `batch`, so the two drivers
+	// agreed perfectly on a wrong answer and every `expect(local).toEqual(remote)` above
+	// stayed green. A shared bug is the one failure mode a two-implementation test cannot
+	// see, so the numbers have to be written down here. Found by porting
+	// `apps/patterns/src/server/tokens.ts` onto the seam, on its first atomic write.
+
+	test('batch() reports each member’s OWN changes — not zero, on both', async () => {
+		p.seed(`INSERT INTO t (id, text_col) VALUES (1, 'a'), (2, 'b'), (3, 'c')`);
+		const { local, remote } = await both(p, async (db) => {
+			const res = await db.batch([
+				db.prepare("UPDATE t SET text_col = 'z'"),
+				db.prepare('DELETE FROM t WHERE id = ?').bind(1),
+			]);
+			return res.map((r) => r.meta.changes);
+		});
+		expect(local).toEqual(remote);
+		// The whole point: three rows updated and one deleted, reported per statement.
+		expect(local).toEqual([3, 1]);
+	});
+
+	test('batch() reports last_row_id for an insert, on both', async () => {
+		const { local, remote } = await both(p, async (db) => {
+			const res = await db.batch([
+				db.prepare('INSERT INTO t (id, text_col) VALUES (41, ?)').bind('a'),
+				db.prepare('INSERT INTO t (id, text_col) VALUES (42, ?)').bind('b'),
+			]);
+			return res.map((r) => ({ changes: r.meta.changes, last_row_id: r.meta.last_row_id }));
+		});
+		expect(local).toEqual(remote);
+		expect(local).toEqual([
+			{ changes: 1, last_row_id: 41 },
+			{ changes: 1, last_row_id: 42 },
+		]);
+	});
+
+	test('a READ inside a batch reports changes 0, even right after a write', async () => {
+		// 🔴 The trap in the obvious fix. SQLite's `changes()` is connection-wide and
+		// sticky, so a driver that simply reads it after every statement reports the
+		// UPDATE's 3 as the SELECT's own count. Measured 2026-09-17: a `SELECT` following
+		// a one-row insert still answers `changes() = 1`.
+		p.seed(`INSERT INTO t (id, text_col) VALUES (1, 'a'), (2, 'b'), (3, 'c')`);
+		const { local, remote } = await both(p, async (db) => {
+			const res = await db.batch([
+				db.prepare("UPDATE t SET text_col = 'z'"),
+				db.prepare('SELECT id FROM t ORDER BY id'),
+			]);
+			return {
+				changes: res.map((r) => r.meta.changes),
+				rows: res[1]?.results,
+			};
+		});
+		expect(local).toEqual(remote);
+		expect(local.changes).toEqual([3, 0]);
+		expect(local.rows).toEqual([{ id: 1 }, { id: 2 }, { id: 3 }]);
+	});
+
+	test('INSERT … RETURNING in a batch reports its rows AND its changes, on both', async () => {
+		// Returns rows and writes, so neither the `.run()` path nor the pure-read path
+		// answers it — this is the case `total_changes()` differencing exists for.
+		const { local, remote } = await both(p, async (db) => {
+			const res = await db.batch([
+				db.prepare('INSERT INTO t (id, text_col) VALUES (7, ?), (8, ?) RETURNING id').bind('a', 'b'),
+			]);
+			return { rows: res[0]?.results, changes: res[0]?.meta.changes };
+		});
+		expect(local).toEqual(remote);
+		expect(local.changes).toBe(2);
+		expect(local.rows).toEqual([{ id: 7 }, { id: 8 }]);
+	});
 });

package/src/server/d1/values.ts

@@ -1,6 +1,6 @@
 /**
- * The one place that decides what a bound parameter and a returned column MEAN, shared by
- * both drivers.
+ * The one place that decides what a bound parameter, a returned column and a statement's
+ * own `meta` MEAN, shared by both drivers.
  *
  * 🔴 **Both drivers call these, and that is why the identical-shapes test can pass.** If
  * the local driver normalized its own way and the remote driver normalized its own way,
@@ -81,6 +81,27 @@ export function normalizeBind(value: unknown, index: number): D1LikeBindable {
 export const normalizeBinds = (values: readonly unknown[]): D1LikeBindable[] =>
 	values.map((v, i) => normalizeBind(v, i));
 
+/** Leading whitespace and SQL comments, which sit in front of the real first keyword. */
+const LEADING_NOISE = /^(?:\s|--[^\n]*\n?|\/\*[\s\S]*?\*\/)+/;
+
+/**
+ * Is this statement a PURE READ — one that cannot possibly have changed a row?
+ *
+ * 🔴 Measured 2026-09-17, and this is why the question has to be asked at all:
+ * SQLite's `changes()` and `last_insert_rowid()` are **connection-wide and sticky**.
+ * After a plain `SELECT` they still read the counters left by the last write — probed
+ * here, a `SELECT` following a 1-row insert reports `changes = 1`. So those counters may
+ * only ever be attributed to a statement that actually wrote something, and a driver
+ * that reads them after a read invents a `changes` out of the previous statement's.
+ *
+ * Only a leading `SELECT` is claimed, because that is the one keyword that is
+ * unambiguous: `WITH … INSERT … RETURNING` and `INSERT … RETURNING` both return rows AND
+ * write. Anything this returns `false` for is measured exactly instead (see
+ * `local.ts`), so a statement shape this does not recognise costs two extra queries —
+ * never a wrong number.
+ */
+export const isPureReadSql = (sql: string): boolean => /^select\b/i.test(sql.replace(LEADING_NOISE, ''));
+
 /**
  * Normalize one column value coming BACK from a driver.
  *

package/src/server/middleware/bodyLimit.spec.ts

@@ -0,0 +1,238 @@
+import { describe, expect, it } from 'bun:test';
+import {
+  type BodyBytesSource,
+  type BodyHeaderSource,
+  type BodyTextSource,
+  readBoundedBytes,
+  readBoundedJson,
+  readBoundedText,
+  refuseOversizedBody,
+} from './bodyLimit';
+
+/**
+ * 🔴 A guard that is the LAST line of defense ships with the test of its failure path,
+ * not only of its success path.
+ *
+ * `apps/roms/src/server/limits.test.ts` is where this came from (2026-09-17). Most of
+ * that file is about roms' own `routes.ts` — that every bounded-body call site takes its
+ * ceiling from `MAX_BODY_BYTES` — and stays there, because it asserts about an app's
+ * routes. What travels with the module is its two behavioural tests (an honest oversized
+ * declaration is refused with both numbers in the message; a body with no declared length
+ * is NOT refused on that ground alone), extended here to the three readers the app-side
+ * file never exercised.
+ *
+ * Every source below is a plain object literal. That is the module's design showing
+ * through rather than a shortcut: the four entry points take structural
+ * `{ req: { … } }` sources, so nothing here needs Hono, a server, or a socket — which is
+ * also why `cursedbelt-server/body-limit` can promise to import nothing at runtime.
+ */
+
+const textSource = (raw: string): BodyTextSource => ({ req: { text: async () => raw } });
+
+const bytesSource = (bytes: Uint8Array): BodyBytesSource => ({
+  req: {
+    async arrayBuffer() {
+      return bytes.buffer.slice(
+        bytes.byteOffset,
+        bytes.byteOffset + bytes.byteLength,
+      ) as ArrayBuffer;
+    },
+  },
+});
+
+/** A body that dies mid-read — a client that hung up, a socket reset. */
+const brokenText: BodyTextSource = {
+  req: {
+    text: async () => {
+      throw new Error('connection reset');
+    },
+  },
+};
+
+const brokenBytes: BodyBytesSource = {
+  req: {
+    arrayBuffer: async () => {
+      throw new Error('connection reset');
+    },
+  },
+};
+
+const headerSource = (contentLength: string | undefined): BodyHeaderSource => ({
+  req: { header: (name) => (name === 'content-length' ? contentLength : undefined) },
+});
+
+describe('readBoundedJson', () => {
+  it('parses a body inside the ceiling', async () => {
+    const result = await readBoundedJson<{ hello: string }>(
+      textSource('{"hello":"world"}'),
+      { maxBytes: 1024 },
+    );
+    expect(result.ok).toBe(true);
+    expect(result.ok === true ? result.value : null).toEqual({ hello: 'world' });
+  });
+
+  it('refuses an oversized body with 413 and BOTH numbers in the message', async () => {
+    const raw = JSON.stringify({ blob: 'x'.repeat(200) });
+    const result = await readBoundedJson(textSource(raw), {
+      maxBytes: 64,
+      label: 'save state',
+    });
+    expect(result.ok).toBe(false);
+    expect(result.ok === false ? result.status : 0).toBe(413);
+    const error = result.ok === false ? result.error : '';
+    expect(error).toContain('save state');
+    expect(error).toContain(String(raw.length)); // what arrived
+    expect(error).toContain('64'); // what was allowed
+  });
+
+  /**
+   * 🔴 The reason the module measures `TextEncoder().encode(raw).length` and not
+   * `raw.length`. A 4-byte emoji is 2 UTF-16 code units, so a `String.length` check
+   * measures this body at 8 against a real size of 14 — and lets it past a byte limit
+   * the proxy in front is enforcing in real bytes. That mismatch is what this module
+   * exists to close, so it gets an assertion rather than a sentence.
+   */
+  it('measures BYTES, not UTF-16 code units', async () => {
+    const raw = JSON.stringify('😀😀😀');
+    expect(raw.length).toBe(8);
+    expect(new TextEncoder().encode(raw).length).toBe(14);
+    const result = await readBoundedJson(textSource(raw), { maxBytes: 10 });
+    expect(result.ok).toBe(false);
+    expect(result.ok === false ? result.status : 0).toBe(413);
+  });
+
+  it('allows a body exactly ON the ceiling — the limit is inclusive', async () => {
+    const raw = '"abcd"'; // 6 bytes
+    const result = await readBoundedJson(textSource(raw), { maxBytes: 6 });
+    expect(result.ok).toBe(true);
+  });
+
+  /** A 400, never a throw: the caller gets a status to return, not an exception to catch. */
+  it('answers 400 for a body that is not JSON', async () => {
+    const result = await readBoundedJson(textSource('not json at all'), {
+      maxBytes: 1024,
+      label: 'preferences',
+    });
+    expect(result.ok).toBe(false);
+    expect(result.ok === false ? result.status : 0).toBe(400);
+    expect(result.ok === false ? result.error : '').toBe('preferences must be JSON');
+  });
+
+  it('answers 400 when the body cannot be read at all', async () => {
+    const result = await readBoundedJson(brokenText, { maxBytes: 1024 });
+    expect(result.ok).toBe(false);
+    expect(result.ok === false ? result.status : 0).toBe(400);
+    expect(result.ok === false ? result.error : '').toBe('body could not be read');
+  });
+});
+
+describe('readBoundedText', () => {
+  it('hands back the raw text inside the ceiling', async () => {
+    const result = await readBoundedText(textSource('chunk-payload'), { maxBytes: 64 });
+    expect(result.ok).toBe(true);
+    expect(result.ok === true ? result.value : '').toBe('chunk-payload');
+  });
+
+  it('refuses an oversized body with 413, measured in bytes', async () => {
+    const result = await readBoundedText(textSource('😀'.repeat(4)), {
+      maxBytes: 8,
+      label: 'chunk',
+    });
+    expect(result.ok).toBe(false);
+    expect(result.ok === false ? result.status : 0).toBe(413);
+    expect(result.ok === false ? result.error : '').toContain('chunk too large (16 bytes');
+  });
+
+  it('answers 400 when the body cannot be read', async () => {
+    const result = await readBoundedText(brokenText, { maxBytes: 64 });
+    expect(result.ok === false ? result.status : 0).toBe(400);
+  });
+});
+
+describe('readBoundedBytes', () => {
+  it('hands back the exact bytes inside the ceiling', async () => {
+    const payload = new Uint8Array([0x00, 0xff, 0x80, 0x41]);
+    const result = await readBoundedBytes(bytesSource(payload), { maxBytes: 16 });
+    expect(result.ok).toBe(true);
+    expect([...(result.ok === true ? result.value : [])]).toEqual([0x00, 0xff, 0x80, 0x41]);
+  });
+
+  /**
+   * The reason this exists beside {@link readBoundedText}: 0x80 and 0xff are not valid
+   * UTF-8, so decoding cartridge bytes as text would replace them with U+FFFD and measure
+   * a size that is not the size the proxy is enforcing.
+   */
+  it('does not corrupt bytes that are invalid UTF-8', async () => {
+    const payload = new Uint8Array([0x80, 0xfe, 0xff]);
+    const result = await readBoundedBytes(bytesSource(payload), { maxBytes: 16 });
+    expect(result.ok === true ? result.value.length : -1).toBe(3);
+    expect(new TextDecoder().decode(result.ok === true ? result.value : new Uint8Array())).toBe(
+      '���',
+    );
+  });
+
+  it('refuses an oversized buffer with 413 and both numbers', async () => {
+    const result = await readBoundedBytes(bytesSource(new Uint8Array(100)), {
+      maxBytes: 32,
+      label: 'rom chunk',
+    });
+    expect(result.ok === false ? result.status : 0).toBe(413);
+    expect(result.ok === false ? result.error : '').toBe(
+      'rom chunk too large (100 bytes; the limit is 32)',
+    );
+  });
+
+  it('answers 400 when the body cannot be read', async () => {
+    const result = await readBoundedBytes(brokenBytes, { maxBytes: 32 });
+    expect(result.ok === false ? result.status : 0).toBe(400);
+  });
+});
+
+describe('refuseOversizedBody', () => {
+  /** The guard itself: an honest oversized declaration is refused, and the message names
+   *  both numbers so a 413 is actionable rather than mysterious. */
+  it('refuses an oversized declared body with both numbers in the message', () => {
+    const refusal = refuseOversizedBody(headerSource('4194305'), {
+      maxBytes: 4 * 1024 * 1024,
+      label: 'save state',
+    });
+    expect(refusal?.status).toBe(413);
+    expect(refusal?.error).toContain('save state');
+    expect(refusal?.error).toContain('4194305');
+    expect(refusal?.error).toContain('4194304');
+  });
+
+  /**
+   * A chunked request legitimately omits `Content-Length`. Refusing it would break a
+   * correct client to catch a dishonest one — and the dishonest one is caught by the
+   * buffering readers anyway, which measure what actually arrived.
+   */
+  it('does not refuse a body with no declared length on that ground alone', () => {
+    expect(refuseOversizedBody(headerSource(undefined), { maxBytes: 1024 })).toBeNull();
+  });
+
+  it('does not refuse an unparseable declared length', () => {
+    expect(refuseOversizedBody(headerSource('not-a-number'), { maxBytes: 1024 })).toBeNull();
+  });
+
+  it('does not refuse a body exactly on the ceiling', () => {
+    expect(refuseOversizedBody(headerSource('1024'), { maxBytes: 1024 })).toBeNull();
+  });
+
+  /**
+   * 🔴 The compensating control, asserted rather than described. This function TRUSTS the
+   * header — it has to, because a `multipart/form-data` body cannot be measured without
+   * buffering it first, which is the thing the limit exists to prevent. What makes that
+   * safe is that a liar only gets as far as the next guard: a body declaring 1 byte and
+   * carrying 5 MB is still refused by the reader that measures what arrived.
+   */
+  it('is bypassed by a lying header — and the buffering reader still refuses', async () => {
+    const liar = headerSource('1');
+    expect(refuseOversizedBody(liar, { maxBytes: 1024 })).toBeNull();
+
+    const actuallyHuge = await readBoundedBytes(bytesSource(new Uint8Array(5000)), {
+      maxBytes: 1024,
+    });
+    expect(actuallyHuge.ok === false ? actuallyHuge.status : 0).toBe(413);
+  });
+});

package/src/server/middleware/bodyLimit.ts

@@ -0,0 +1,210 @@
+/**
+ * Reading a request body without first agreeing how big it may be.
+ *
+ * ── Why this is one function rather than one per app (2026-07-27) ────────────
+ * The two apps behind the shared owner-auth were inconsistently hardened, in a
+ * way an adversarial review found and neither test suite could:
+ *
+ * - the companion app (since folded into `apps/orch`) read `c.req.text()`,
+ *   checked the length, and returned 413 BEFORE parsing — correct.
+ * - `apps/roms` called `await c.req.json()` first and checked the size deep
+ *   inside the save-state store — i.e. it buffered and parsed an arbitrary body
+ *   into a process whose unit caps at 300 MB of memory before forming an
+ *   opinion about its size.
+ *
+ * Both went through {@link readBoundedJson} after that. The guard is one
+ * function so the posture cannot diverge again, and it is deliberately the
+ * *last* line of defense: a proxy's `client_max_body_size` refuses an oversized
+ * body at the edge, and this refuses it if the proxy is absent, misconfigured,
+ * or bypassed — which is exactly the case in dev, in `preview:prod`, and for any
+ * request that reaches the loopback port directly.
+ *
+ * ── Where it came from (2026-09-17) ──────────────────────────────────────────
+ * Five apps — `roms`, `family`, `music`, `vault`, `collections` — carried this
+ * file byte-for-byte identical (`b36d0eedee7a`), which is the posture diverging
+ * again, only more slowly and with nothing watching: a repo's gate proves that
+ * repo, so five green gates is what five copies of a security guard look like
+ * from the outside. Confirmed identical with `shasum -a256` before the move, so
+ * there was no fork to reconcile and nothing was dropped.
+ *
+ * 🔴 It is published as the LEAF subpath `cursedbelt-server/body-limit`, never
+ * through the `./middleware` barrel — that barrel drags `hono` and the error
+ * envelope, and this module's whole promise is that it imports NOTHING. The
+ * source is a `{ req: { text() } }` / `{ req: { arrayBuffer() } }` /
+ * `{ req: { header() } }` structural type rather than a Hono context, so a
+ * caller needs no framework to use it and a test needs none to exercise it.
+ * `src/leafSubpathsImportNothing.spec.ts` is what holds that promise.
+ */
+
+/** What {@link readBoundedBytes} gives back. */
+export type BoundedBytes =
+  | { ok: true; value: Uint8Array }
+  | { ok: false; status: 413 | 400; error: string };
+
+/** The minimum a route needs to hand over a raw body. */
+export interface BodyBytesSource {
+  req: { arrayBuffer(): Promise<ArrayBuffer> };
+}
+
+/** What {@link readBoundedJson} gives back — a discriminated result, never a throw. */
+export type BoundedJson<T> =
+  | { ok: true; value: T }
+  | { ok: false; status: 413; error: string }
+  | { ok: false; status: 400; error: string };
+
+export interface BoundedJsonOptions {
+  /** Hard ceiling on the raw body, in bytes. */
+  maxBytes: number;
+  /** What to call the payload in the error message (e.g. "save state"). */
+  label?: string;
+}
+
+/** The minimum a route needs from Hono's context — kept structural so tests need no Hono. */
+export interface BodyTextSource {
+  req: { text(): Promise<string> };
+}
+
+/** What {@link readBoundedText} gives back. Same shape, minus the parse failure. */
+export type BoundedText =
+  | { ok: true; value: string }
+  | { ok: false; status: 413 | 400; error: string };
+
+/**
+ * Read a body as TEXT, refusing anything over `maxBytes`.
+ *
+ * The sibling of {@link readBoundedJson}, for a payload that IS the text rather
+ * than a document containing it — `apps/patterns`' chunked sends put their
+ * metadata in the query string and the chunk in the raw body, which spares a
+ * megabyte-scale caller from JSON-escaping every piece and spares this process
+ * from parsing what it is only going to concatenate.
+ *
+ * Same byte-not-character measurement, and for the same reason: it is the number
+ * the proxy in front of this is enforcing.
+ */
+export async function readBoundedText(
+  c: BodyTextSource,
+  options: BoundedJsonOptions,
+): Promise<BoundedText> {
+  const { maxBytes, label = 'body' } = options;
+  let raw: string;
+  try {
+    raw = await c.req.text();
+  } catch {
+    return { ok: false, status: 400, error: `${label} could not be read` };
+  }
+  const bytes = new TextEncoder().encode(raw).length;
+  if (bytes > maxBytes) {
+    return {
+      ok: false,
+      status: 413,
+      error: `${label} too large (${bytes} bytes; the limit is ${maxBytes})`,
+    };
+  }
+  return { ok: true, value: raw };
+}
+
+/**
+ * Read a body as RAW BYTES, refusing anything over `maxBytes`.
+ *
+ * The third member of the family, for a payload that is neither JSON nor text:
+ * roms' ROM-upload chunks are cartridge bytes, and routing them through
+ * {@link readBoundedText} would decode arbitrary binary as UTF-8 — which is
+ * lossy (every invalid sequence becomes U+FFFD) and measures a size that is not
+ * the size the proxy in front is enforcing.
+ *
+ * A `Content-Length` claim is deliberately NOT trusted here: it is a header, and
+ * the guard has to hold against a body that disagrees with it. The measurement is
+ * the buffer that actually arrived.
+ */
+export async function readBoundedBytes(
+  c: BodyBytesSource,
+  options: BoundedJsonOptions,
+): Promise<BoundedBytes> {
+  const { maxBytes, label = 'body' } = options;
+  let buffer: ArrayBuffer;
+  try {
+    buffer = await c.req.arrayBuffer();
+  } catch {
+    return { ok: false, status: 400, error: `${label} could not be read` };
+  }
+  if (buffer.byteLength > maxBytes) {
+    return {
+      ok: false,
+      status: 413,
+      error: `${label} too large (${buffer.byteLength} bytes; the limit is ${maxBytes})`,
+    };
+  }
+  return { ok: true, value: new Uint8Array(buffer) };
+}
+
+/** The minimum {@link refuseOversizedBody} needs — a header lookup, nothing else. */
+export interface BodyHeaderSource {
+  req: { header(name: string): string | undefined };
+}
+
+/**
+ * Refuse a body by its DECLARED `Content-Length`, without reading it.
+ *
+ * The fourth member of the family, and the only one for a body that cannot be
+ * buffered first: a `multipart/form-data` upload. The other three measure the
+ * bytes that actually arrived, which is strictly better — but they get to,
+ * because they buffer. `c.req.formData()` gives no such opportunity: by the time
+ * it resolves, the whole upload is already in a process whose unit caps at
+ * 300 MB of memory, which is the thing the limit exists to prevent.
+ *
+ * So this trusts the header, and the docblock says so plainly. A liar gets
+ * through to the buffering call — but a liar was always going to, and this still
+ * turns the honest 3 GB folder-drop (the actual failure shape) into a refusal
+ * the app can explain instead of an OOM or an nginx HTML 413 the app never sees.
+ * It is a companion to the proxy's `client_max_body_size`, never a replacement.
+ *
+ * A missing or unparseable header is NOT a refusal: chunked requests omit it
+ * legitimately, and refusing them would break a correct client to catch a
+ * dishonest one.
+ */
+export function refuseOversizedBody(
+  c: BodyHeaderSource,
+  options: BoundedJsonOptions,
+): { status: 413; error: string } | null {
+  const { maxBytes, label = 'body' } = options;
+  const declared = Number(c.req.header('content-length'));
+  if (!Number.isFinite(declared) || declared <= maxBytes) return null;
+  return {
+    status: 413,
+    error: `${label} too large (${declared} bytes; the limit is ${maxBytes})`,
+  };
+}
+
+/**
+ * Read a JSON body, refusing anything over `maxBytes` before parsing it.
+ *
+ * The size is measured in BYTES, not characters. `String.length` counts UTF-16
+ * code units, so a body of 4-byte emoji measures half its true size that way —
+ * which would let a caller past a byte limit the proxy is enforcing in real
+ * bytes, and produce the mismatch this module exists to close.
+ */
+export async function readBoundedJson<T = unknown>(
+  c: BodyTextSource,
+  options: BoundedJsonOptions,
+): Promise<BoundedJson<T>> {
+  const { maxBytes, label = 'body' } = options;
+  let raw: string;
+  try {
+    raw = await c.req.text();
+  } catch {
+    return { ok: false, status: 400, error: `${label} could not be read` };
+  }
+  const bytes = new TextEncoder().encode(raw).length;
+  if (bytes > maxBytes) {
+    return {
+      ok: false,
+      status: 413,
+      error: `${label} too large (${bytes} bytes; the limit is ${maxBytes})`,
+    };
+  }
+  try {
+    return { ok: true, value: JSON.parse(raw) as T };
+  } catch {
+    return { ok: false, status: 400, error: `${label} must be JSON` };
+  }
+}