cursedbelt-server 4.7.0 → 4.8.0

package/dist/server/storage/binaryStore.js

@@ -454,7 +454,12 @@ export function createBinaryStore(cfg) {
             const titleQs = title ? `&title=${encodeURIComponent(title)}` : '';
             const immutableQs = opts?.immutable ? '&immutable=1' : '';
             for (let ci = 0; ci < total; ci++) {
-                const token = await signToken({ k: appKey(key), sid, ci, tc: total }, UPLOAD_TOKEN_TTL_SECONDS);
+                // 🔴 `sz` is the SOURCE length, and it is what makes `tc` above not load-bearing: bs
+                // checks it before and after assembly and answers 422 rather than indexing a short
+                // object (see `FileTokenClaims.sz` in `./types`). `total` is derived from `blob.size`
+                // two lines up, so the number is already in hand — declaring it costs nothing, and
+                // NOT declaring it is what left 579 of 579 fleet assembles unprovable on 2026-09-18.
+                const token = await signToken({ k: appKey(key), sid, ci, tc: total, sz: blob.size }, UPLOAD_TOKEN_TTL_SECONDS);
                 const slice = new Uint8Array(await blob
                     .slice(ci * chunkBytes, Math.min((ci + 1) * chunkBytes, blob.size))
                     .arrayBuffer());

package/dist/server/storage/types.d.ts

@@ -69,6 +69,32 @@ export type FileTokenClaims = {
     ci?: number;
     /** Total chunk count. */
     tc?: number;
+    /**
+     * The SOURCE file's exact byte length, declared by the minting client when the chunk session
+     * is created. binary-server checks it before and after assembly and answers 422 on a
+     * mismatch, indexing nothing.
+     *
+     * 🔴 This is the only END-TO-END integrity claim the upload path has; everything else in it
+     * is an internal consistency check. `tc` comes from the client, the assemble fires when `tc`
+     * parts have been counted, and the checksum is computed over whatever was assembled — so a
+     * session that believes a 6-minute video is one 16 MiB part gets exactly that stored,
+     * faithfully, with a 201. That is what happened to `collections/file/u_fd668e6a-…` on
+     * 2026-08-13: nothing anywhere compared the finished object to the file it came from.
+     *
+     * With `sz`, `tc` stops being load-bearing. The part size is the client's choice by design
+     * (a browser picks its own slice), so `tc` and the chunk size are one degree of freedom and
+     * the server cannot derive either; declaring the length costs a client nothing, because
+     * every mint site already has the number in hand. A wrong `tc` can then only cost a REFUSED
+     * upload, never a short object indexed `active`.
+     *
+     * Optional, and it stays optional until a tenant is measured at zero undeclared assembles:
+     * an upload the owner cannot complete is worse than the hole. An absent `sz` is recorded on
+     * the assemble event (`resp_meta.declared` is `null`), so which tenants still do not declare
+     * is a query rather than an audit. `apps/binary-server/src/tokens.ts` is the mirror this
+     * shape is verified against, and `declaredSizeOf` in `apps/binary-server/src/server.ts` is
+     * what reads it.
+     */
+    sz?: number;
     /** Download filename → Content-Disposition. */
     fn?: string;
     dl?: 'inline' | 'attachment';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.7.0",
+	"version": "4.8.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",

package/src/server/storage/binaryStore.spec.ts

@@ -283,6 +283,26 @@ describe('putLarge', () => {
     expect(claims.every((p) => p.k === 'roms/video/x')).toBe(true);
   });
 
+  it('🔴 declares the SOURCE byte length as `sz` on every chunk, whatever the split', async () => {
+    // The claim that makes `tc` above not load-bearing. binary-server checks `sz` before and
+    // after assembly and answers 422 rather than indexing a short object — but only for a
+    // client that declares it, and on 2026-09-18 that was 0 of 579 fleet assembles. So: the
+    // number is the SOURCE's, it is identical on every part, and it does not move when the
+    // client picks a different slice size (`tc` and the chunk size are the client's one
+    // degree of freedom; the length is not).
+    const store = makeStore();
+    reply = () => ok(null, { status: 201 });
+
+    await store.putLarge('video/x', new Uint8Array(10), 'video/mp4', { chunkBytes: 4 });
+    expect(calls.map((c) => tokenOf(c.url).payload.sz)).toEqual([10, 10, 10]);
+
+    calls = [];
+    await store.putLarge('video/y', new Uint8Array(10), 'video/mp4', { chunkBytes: 7 });
+    const claims = calls.map((c) => tokenOf(c.url).payload);
+    expect(claims.map((p) => p.tc)).toEqual([2, 2]); // a different split…
+    expect(claims.map((p) => p.sz)).toEqual([10, 10]); // …and the same declared length
+  });
+
   it('🔴 sends the real BYTES of each slice, not a lazy view', async () => {
     // The 2026-08-13 hang: a Bun.file partial view handed to fetch never sends, and
     // 42 files / 35 GB failed 42/42 for a day with nothing in binary-server's log.

package/src/server/storage/binaryStore.ts

@@ -741,8 +741,13 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       const titleQs = title ? `&title=${encodeURIComponent(title)}` : '';
       const immutableQs = opts?.immutable ? '&immutable=1' : '';
       for (let ci = 0; ci < total; ci++) {
+        // 🔴 `sz` is the SOURCE length, and it is what makes `tc` above not load-bearing: bs
+        // checks it before and after assembly and answers 422 rather than indexing a short
+        // object (see `FileTokenClaims.sz` in `./types`). `total` is derived from `blob.size`
+        // two lines up, so the number is already in hand — declaring it costs nothing, and
+        // NOT declaring it is what left 579 of 579 fleet assembles unprovable on 2026-09-18.
         const token = await signToken(
-          { k: appKey(key), sid, ci, tc: total },
+          { k: appKey(key), sid, ci, tc: total, sz: blob.size },
           UPLOAD_TOKEN_TTL_SECONDS,
         );
         const slice = new Uint8Array(

package/src/server/storage/types.ts

@@ -93,6 +93,32 @@ export type FileTokenClaims = {
   ci?: number;
   /** Total chunk count. */
   tc?: number;
+  /**
+   * The SOURCE file's exact byte length, declared by the minting client when the chunk session
+   * is created. binary-server checks it before and after assembly and answers 422 on a
+   * mismatch, indexing nothing.
+   *
+   * 🔴 This is the only END-TO-END integrity claim the upload path has; everything else in it
+   * is an internal consistency check. `tc` comes from the client, the assemble fires when `tc`
+   * parts have been counted, and the checksum is computed over whatever was assembled — so a
+   * session that believes a 6-minute video is one 16 MiB part gets exactly that stored,
+   * faithfully, with a 201. That is what happened to `collections/file/u_fd668e6a-…` on
+   * 2026-08-13: nothing anywhere compared the finished object to the file it came from.
+   *
+   * With `sz`, `tc` stops being load-bearing. The part size is the client's choice by design
+   * (a browser picks its own slice), so `tc` and the chunk size are one degree of freedom and
+   * the server cannot derive either; declaring the length costs a client nothing, because
+   * every mint site already has the number in hand. A wrong `tc` can then only cost a REFUSED
+   * upload, never a short object indexed `active`.
+   *
+   * Optional, and it stays optional until a tenant is measured at zero undeclared assembles:
+   * an upload the owner cannot complete is worse than the hole. An absent `sz` is recorded on
+   * the assemble event (`resp_meta.declared` is `null`), so which tenants still do not declare
+   * is a query rather than an audit. `apps/binary-server/src/tokens.ts` is the mirror this
+   * shape is verified against, and `declaredSizeOf` in `apps/binary-server/src/server.ts` is
+   * what reads it.
+   */
+  sz?: number;
   /** Download filename → Content-Disposition. */
   fn?: string;
   dl?: 'inline' | 'attachment';