cursedbelt-server 4.7.0 → 4.9.0

package/dist/server/storage/binaryStore.js

@@ -454,7 +454,12 @@ export function createBinaryStore(cfg) {
             const titleQs = title ? `&title=${encodeURIComponent(title)}` : '';
             const immutableQs = opts?.immutable ? '&immutable=1' : '';
             for (let ci = 0; ci < total; ci++) {
-                const token = await signToken({ k: appKey(key), sid, ci, tc: total }, UPLOAD_TOKEN_TTL_SECONDS);
+                // 🔴 `sz` is the SOURCE length, and it is what makes `tc` above not load-bearing: bs
+                // checks it before and after assembly and answers 422 rather than indexing a short
+                // object (see `FileTokenClaims.sz` in `./types`). `total` is derived from `blob.size`
+                // two lines up, so the number is already in hand — declaring it costs nothing, and
+                // NOT declaring it is what left 579 of 579 fleet assembles unprovable on 2026-09-18.
+                const token = await signToken({ k: appKey(key), sid, ci, tc: total, sz: blob.size }, UPLOAD_TOKEN_TTL_SECONDS);
                 const slice = new Uint8Array(await blob
                     .slice(ci * chunkBytes, Math.min((ci + 1) * chunkBytes, blob.size))
                     .arrayBuffer());

package/dist/server/storage/files/chunkedUpload.d.ts

@@ -35,7 +35,7 @@ export interface ChunkedUploadService {
 /**
  * Mint the direct-to-backend PUT URL for one chunk. The app supplies this so the module stays
  * backend-agnostic. For binary-server: `${base}/upload-chunk/${app}/${key}?token=` with a token
- * carrying { k, uid, sid, ci, tc }.
+ * carrying { k, uid, sid, ci, tc, sz }.
  */
 export type MintChunkUpload = (args: {
     key: string;
@@ -43,6 +43,17 @@ export type MintChunkUpload = (args: {
     ci: number;
     tc: number;
     owner: string;
+    /**
+     * The SOURCE byte length this session was opened with — pass it straight into the token's `sz`
+     * claim (`FileTokenClaims.sz`), which is the only end-to-end integrity check the upload path
+     * has: binary-server compares it to the assembled object and answers 422 instead of indexing a
+     * short one.
+     *
+     * 🔴 `undefined` when the caller could not state a positive length, and then the claim must be
+     * OMITTED rather than sent as `0` — a declared zero refuses every assemble. That is the same
+     * posture the claim itself has: optional, so that declaring it could never take an upload down.
+     */
+    sz?: number;
 }) => Promise<string>;
 export declare function createChunkedUploadService(cfg: {
     catalogue: FileCatalogue;

package/dist/server/storage/files/chunkedUpload.js

@@ -39,7 +39,12 @@ export function createChunkedUploadService(cfg) {
                 tags: req.tags,
                 createdAt: now(),
             });
-            const chunkUploadUrls = await Promise.all(Array.from({ length: chunkCount }, (_, ci) => cfg.mintChunkUpload({ key, sid, ci, tc: chunkCount, owner })));
+            // 🔴 The source length rides along, because `chunkCount` above is derived from it and a
+            // count is not a length: a session that splits the file wrongly stores whatever it sent,
+            // faithfully, with a 201. Omitted rather than zeroed when the caller stated no positive
+            // size — `sz: 0` would refuse every assemble. See `MintChunkUpload.sz`.
+            const declaredSize = Number.isFinite(req.size) && req.size > 0 ? req.size : undefined;
+            const chunkUploadUrls = await Promise.all(Array.from({ length: chunkCount }, (_, ci) => cfg.mintChunkUpload({ key, sid, ci, tc: chunkCount, owner, sz: declaredSize })));
             return { fileId, sid, key, chunkSize, chunkCount, chunkUploadUrls };
         },
         async complete(sid, confirmed) {

package/dist/server/storage/types.d.ts

@@ -69,6 +69,32 @@ export type FileTokenClaims = {
     ci?: number;
     /** Total chunk count. */
     tc?: number;
+    /**
+     * The SOURCE file's exact byte length, declared by the minting client when the chunk session
+     * is created. binary-server checks it before and after assembly and answers 422 on a
+     * mismatch, indexing nothing.
+     *
+     * 🔴 This is the only END-TO-END integrity claim the upload path has; everything else in it
+     * is an internal consistency check. `tc` comes from the client, the assemble fires when `tc`
+     * parts have been counted, and the checksum is computed over whatever was assembled — so a
+     * session that believes a 6-minute video is one 16 MiB part gets exactly that stored,
+     * faithfully, with a 201. That is what happened to `collections/file/u_fd668e6a-…` on
+     * 2026-08-13: nothing anywhere compared the finished object to the file it came from.
+     *
+     * With `sz`, `tc` stops being load-bearing. The part size is the client's choice by design
+     * (a browser picks its own slice), so `tc` and the chunk size are one degree of freedom and
+     * the server cannot derive either; declaring the length costs a client nothing, because
+     * every mint site already has the number in hand. A wrong `tc` can then only cost a REFUSED
+     * upload, never a short object indexed `active`.
+     *
+     * Optional, and it stays optional until a tenant is measured at zero undeclared assembles:
+     * an upload the owner cannot complete is worse than the hole. An absent `sz` is recorded on
+     * the assemble event (`resp_meta.declared` is `null`), so which tenants still do not declare
+     * is a query rather than an audit. `apps/binary-server/src/tokens.ts` is the mirror this
+     * shape is verified against, and `declaredSizeOf` in `apps/binary-server/src/server.ts` is
+     * what reads it.
+     */
+    sz?: number;
     /** Download filename → Content-Disposition. */
     fn?: string;
     dl?: 'inline' | 'attachment';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.7.0",
+	"version": "4.9.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",

package/src/server/storage/binaryStore.spec.ts

@@ -283,6 +283,26 @@ describe('putLarge', () => {
     expect(claims.every((p) => p.k === 'roms/video/x')).toBe(true);
   });
 
+  it('🔴 declares the SOURCE byte length as `sz` on every chunk, whatever the split', async () => {
+    // The claim that makes `tc` above not load-bearing. binary-server checks `sz` before and
+    // after assembly and answers 422 rather than indexing a short object — but only for a
+    // client that declares it, and on 2026-09-18 that was 0 of 579 fleet assembles. So: the
+    // number is the SOURCE's, it is identical on every part, and it does not move when the
+    // client picks a different slice size (`tc` and the chunk size are the client's one
+    // degree of freedom; the length is not).
+    const store = makeStore();
+    reply = () => ok(null, { status: 201 });
+
+    await store.putLarge('video/x', new Uint8Array(10), 'video/mp4', { chunkBytes: 4 });
+    expect(calls.map((c) => tokenOf(c.url).payload.sz)).toEqual([10, 10, 10]);
+
+    calls = [];
+    await store.putLarge('video/y', new Uint8Array(10), 'video/mp4', { chunkBytes: 7 });
+    const claims = calls.map((c) => tokenOf(c.url).payload);
+    expect(claims.map((p) => p.tc)).toEqual([2, 2]); // a different split…
+    expect(claims.map((p) => p.sz)).toEqual([10, 10]); // …and the same declared length
+  });
+
   it('🔴 sends the real BYTES of each slice, not a lazy view', async () => {
     // The 2026-08-13 hang: a Bun.file partial view handed to fetch never sends, and
     // 42 files / 35 GB failed 42/42 for a day with nothing in binary-server's log.

package/src/server/storage/binaryStore.ts

@@ -741,8 +741,13 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       const titleQs = title ? `&title=${encodeURIComponent(title)}` : '';
       const immutableQs = opts?.immutable ? '&immutable=1' : '';
       for (let ci = 0; ci < total; ci++) {
+        // 🔴 `sz` is the SOURCE length, and it is what makes `tc` above not load-bearing: bs
+        // checks it before and after assembly and answers 422 rather than indexing a short
+        // object (see `FileTokenClaims.sz` in `./types`). `total` is derived from `blob.size`
+        // two lines up, so the number is already in hand — declaring it costs nothing, and
+        // NOT declaring it is what left 579 of 579 fleet assembles unprovable on 2026-09-18.
         const token = await signToken(
-          { k: appKey(key), sid, ci, tc: total },
+          { k: appKey(key), sid, ci, tc: total, sz: blob.size },
           UPLOAD_TOKEN_TTL_SECONDS,
         );
         const slice = new Uint8Array(

package/src/server/storage/files/chunkedUpload.spec.ts

@@ -39,7 +39,7 @@ describe('chunked upload', () => {
       now: () => ++clock,
     });
     const ledger = createStorageOpsLedger(db, () => ++clock);
-    const minted: Array<{ key: string; sid: string; ci: number; tc: number }> = [];
+    const minted: Array<{ key: string; sid: string; ci: number; tc: number; sz?: number }> = [];
     const svc = createChunkedUploadService({
       catalogue,
       ledger,
@@ -67,6 +67,10 @@ describe('chunked upload', () => {
     expect(init.chunkUploadUrls).toHaveLength(3);
     expect(minted.map((m) => m.ci)).toEqual([0, 1, 2]);
     expect(minted.every((m) => m.tc === 3 && m.sid === init.sid)).toBe(true);
+    // 🔴 The SOURCE length, on every chunk. `tc` is derived from it and a count is not a length:
+    // without this the minter has nothing to put in the token's `sz` claim, and binary-server's
+    // only end-to-end check of the finished object against its source stays inert.
+    expect(minted.map((m) => m.sz)).toEqual([20 * 1024 * 1024, 20 * 1024 * 1024, 20 * 1024 * 1024]);
     // The mint targets exactly the key the catalogue will look for on complete.
     expect(init.key).toBe(catalogueUploadKey('u1', init.fileId, 'image/png'));
 
@@ -78,6 +82,16 @@ describe('chunked upload', () => {
     expect(svc.pending()).toBe(1);
   });
 
+  test('🔴 a size the caller could not state is OMITTED, never declared as zero', async () => {
+    // `sz: 0` would compare zero to the assembled length and refuse every assemble — so an
+    // unknown size degrades to exactly today's behaviour (no claim, recorded undeclared) rather
+    // than to a 422. `chunkCount` still clamps to one chunk, which is the old `req.size || 1`.
+    const { svc, minted } = build();
+    const init = await svc.init(CTX, { name: 'unknown.bin', mime: 'application/octet-stream', size: 0 });
+    expect(init.chunkCount).toBe(1);
+    expect(minted.map((m) => m.sz)).toEqual([undefined]);
+  });
+
   test('complete registers the catalogue row over the assembled bytes + marks the op done', async () => {
     const { catalogue, ledger, svc } = build();
     const init = await svc.init(CTX, {

package/src/server/storage/files/chunkedUpload.ts

@@ -64,7 +64,7 @@ export interface ChunkedUploadService {
 /**
  * Mint the direct-to-backend PUT URL for one chunk. The app supplies this so the module stays
  * backend-agnostic. For binary-server: `${base}/upload-chunk/${app}/${key}?token=` with a token
- * carrying { k, uid, sid, ci, tc }.
+ * carrying { k, uid, sid, ci, tc, sz }.
  */
 export type MintChunkUpload = (args: {
   key: string;
@@ -72,6 +72,17 @@ export type MintChunkUpload = (args: {
   ci: number;
   tc: number;
   owner: string;
+  /**
+   * The SOURCE byte length this session was opened with — pass it straight into the token's `sz`
+   * claim (`FileTokenClaims.sz`), which is the only end-to-end integrity check the upload path
+   * has: binary-server compares it to the assembled object and answers 422 instead of indexing a
+   * short one.
+   *
+   * 🔴 `undefined` when the caller could not state a positive length, and then the claim must be
+   * OMITTED rather than sent as `0` — a declared zero refuses every assemble. That is the same
+   * posture the claim itself has: optional, so that declaring it could never take an upload down.
+   */
+  sz?: number;
 }) => Promise<string>;
 
 export function createChunkedUploadService(cfg: {
@@ -110,9 +121,14 @@ export function createChunkedUploadService(cfg: {
         tags: req.tags,
         createdAt: now(),
       });
+      // 🔴 The source length rides along, because `chunkCount` above is derived from it and a
+      // count is not a length: a session that splits the file wrongly stores whatever it sent,
+      // faithfully, with a 201. Omitted rather than zeroed when the caller stated no positive
+      // size — `sz: 0` would refuse every assemble. See `MintChunkUpload.sz`.
+      const declaredSize = Number.isFinite(req.size) && req.size > 0 ? req.size : undefined;
       const chunkUploadUrls = await Promise.all(
         Array.from({ length: chunkCount }, (_, ci) =>
-          cfg.mintChunkUpload({ key, sid, ci, tc: chunkCount, owner }),
+          cfg.mintChunkUpload({ key, sid, ci, tc: chunkCount, owner, sz: declaredSize }),
         ),
       );
       return { fileId, sid, key, chunkSize, chunkCount, chunkUploadUrls };

package/src/server/storage/types.ts

@@ -93,6 +93,32 @@ export type FileTokenClaims = {
   ci?: number;
   /** Total chunk count. */
   tc?: number;
+  /**
+   * The SOURCE file's exact byte length, declared by the minting client when the chunk session
+   * is created. binary-server checks it before and after assembly and answers 422 on a
+   * mismatch, indexing nothing.
+   *
+   * 🔴 This is the only END-TO-END integrity claim the upload path has; everything else in it
+   * is an internal consistency check. `tc` comes from the client, the assemble fires when `tc`
+   * parts have been counted, and the checksum is computed over whatever was assembled — so a
+   * session that believes a 6-minute video is one 16 MiB part gets exactly that stored,
+   * faithfully, with a 201. That is what happened to `collections/file/u_fd668e6a-…` on
+   * 2026-08-13: nothing anywhere compared the finished object to the file it came from.
+   *
+   * With `sz`, `tc` stops being load-bearing. The part size is the client's choice by design
+   * (a browser picks its own slice), so `tc` and the chunk size are one degree of freedom and
+   * the server cannot derive either; declaring the length costs a client nothing, because
+   * every mint site already has the number in hand. A wrong `tc` can then only cost a REFUSED
+   * upload, never a short object indexed `active`.
+   *
+   * Optional, and it stays optional until a tenant is measured at zero undeclared assembles:
+   * an upload the owner cannot complete is worse than the hole. An absent `sz` is recorded on
+   * the assemble event (`resp_meta.declared` is `null`), so which tenants still do not declare
+   * is a query rather than an audit. `apps/binary-server/src/tokens.ts` is the mirror this
+   * shape is verified against, and `declaredSizeOf` in `apps/binary-server/src/server.ts` is
+   * what reads it.
+   */
+  sz?: number;
   /** Download filename → Content-Disposition. */
   fn?: string;
   dl?: 'inline' | 'attachment';