cursedbelt 0.0.0

package/dist/ctgr/chunkStore.d.ts

@@ -0,0 +1,25 @@
+import type { CtgrDecoded } from './types';
+export interface ChunkStoreOpts {
+    /** Max concurrent in-flight (incomplete) payloads. Default 200. */
+    maxInFlight?: number;
+    /** Hard cap on a single payload's assembled byte length. Default 10 MB. */
+    maxPayloadBytes?: number;
+    /** Idle TTL before an incomplete payload is evicted. Default 30 s. */
+    ttlMs?: number;
+    /** Injectable clock (tests). Default `Date.now`. */
+    now?: () => number;
+}
+export declare class ChunkStore {
+    private readonly entries;
+    private readonly maxInFlight;
+    private readonly maxPayloadBytes;
+    private readonly ttlMs;
+    private readonly now;
+    constructor(opts?: ChunkStoreOpts);
+    /** Number of in-flight (incomplete) payloads currently buffered. */
+    get size(): number;
+    add(params: Record<string, string> | URLSearchParams): Promise<CtgrDecoded | false | Error>;
+    private finalize;
+    private evictStale;
+}
+//# sourceMappingURL=chunkStore.d.ts.map

package/dist/ctgr/chunkStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunkStore.d.ts","sourceRoot":"","sources":["../../src/ctgr/chunkStore.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAc,MAAM,SAAS,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAoBD,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,GAAE,cAAmB;IAOrC,oEAAoE;IACpE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAEK,GAAG,CACP,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,GAC/C,OAAO,CAAC,WAAW,GAAG,KAAK,GAAG,KAAK,CAAC;YAiEzB,QAAQ;IAetB,OAAO,CAAC,UAAU;CAMnB"}

package/dist/ctgr/chunkStore.js

@@ -0,0 +1,126 @@
+/*
+ * Server-side bounded accumulator for multi-chunk ctgr payloads. A singleton on the
+ * server (NOT per-request), keyed by the payload id `_cid`. Every `add`:
+ *  - evicts stale entries (per-cid TTL),
+ *  - enforces the max-in-flight + max-payload-bytes caps (DoS bounds),
+ *  - buffers the chunk (its crc is already verified by parseChunk), and
+ *  - on the final chunk, verifies the full-payload sha256 before decoding.
+ *
+ * It NEVER throws: a malformed/corrupt/oversized payload returns an `Error` the
+ * middleware maps to a 400; an intermediate chunk returns `false` (→ 202).
+ */
+import { decodePayload, parseChunk } from './codec';
+import { sha256Hex } from './digest';
+export class ChunkStore {
+    entries = new Map();
+    maxInFlight;
+    maxPayloadBytes;
+    ttlMs;
+    now;
+    constructor(opts = {}) {
+        this.maxInFlight = opts.maxInFlight ?? 200;
+        this.maxPayloadBytes = opts.maxPayloadBytes ?? 10 * 1024 * 1024;
+        this.ttlMs = opts.ttlMs ?? 30_000;
+        this.now = opts.now ?? Date.now;
+    }
+    /** Number of in-flight (incomplete) payloads currently buffered. */
+    get size() {
+        return this.entries.size;
+    }
+    async add(params) {
+        let chunk;
+        try {
+            chunk = parseChunk(params);
+        }
+        catch (err) {
+            return asError(err);
+        }
+        this.evictStale();
+        // Single-chunk fast path: verify sha + decode immediately, no buffering.
+        if (chunk.total === 1) {
+            return this.finalize([chunk.bytes], chunk);
+        }
+        if (chunk.payloadLength > this.maxPayloadBytes) {
+            return new Error('ctgr: payload exceeds size cap');
+        }
+        let entry = this.entries.get(chunk.cid);
+        if (!entry) {
+            if (this.entries.size >= this.maxInFlight) {
+                return new Error('ctgr: too many in-flight payloads');
+            }
+            entry = {
+                parts: new Array(chunk.total),
+                received: 0,
+                total: chunk.total,
+                bytes: 0,
+                payloadLength: chunk.payloadLength,
+                gzip: chunk.gzip,
+                method: chunk.method,
+                updatedAt: this.now(),
+            };
+            this.entries.set(chunk.cid, entry);
+        }
+        else if (entry.total !== chunk.total ||
+            entry.payloadLength !== chunk.payloadLength ||
+            entry.gzip !== chunk.gzip ||
+            entry.method !== chunk.method) {
+            // A payload's framing must not change mid-stream.
+            this.entries.delete(chunk.cid);
+            return new Error('ctgr: inconsistent chunk metadata');
+        }
+        entry.updatedAt = this.now();
+        if (chunk.sha)
+            entry.sha = chunk.sha;
+        if (entry.parts[chunk.index] === undefined) {
+            entry.parts[chunk.index] = chunk.bytes;
+            entry.received += 1;
+            entry.bytes += chunk.bytes.length;
+            if (entry.bytes > this.maxPayloadBytes) {
+                this.entries.delete(chunk.cid);
+                return new Error('ctgr: payload exceeds size cap');
+            }
+        }
+        if (entry.received < entry.total)
+            return false;
+        this.entries.delete(chunk.cid);
+        return this.finalize(entry.parts, entry);
+    }
+    async finalize(parts, meta) {
+        const payload = concat(parts);
+        if (payload.length > this.maxPayloadBytes) {
+            return new Error('ctgr: payload exceeds size cap');
+        }
+        if (meta.sha && (await sha256Hex(payload)) !== meta.sha) {
+            return new Error('ctgr: payload sha256 mismatch');
+        }
+        try {
+            return await decodePayload(payload, meta.gzip, meta.method);
+        }
+        catch (err) {
+            return asError(err);
+        }
+    }
+    evictStale() {
+        const cutoff = this.now() - this.ttlMs;
+        for (const [cid, entry] of this.entries) {
+            if (entry.updatedAt < cutoff)
+                this.entries.delete(cid);
+        }
+    }
+}
+function asError(err) {
+    return err instanceof Error ? err : new Error(String(err));
+}
+function concat(parts) {
+    let total = 0;
+    for (const part of parts)
+        total += part.length;
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
+//# sourceMappingURL=chunkStore.js.map

package/dist/ctgr/chunkStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunkStore.js","sourceRoot":"","sources":["../../src/ctgr/chunkStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,aAAa,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAgCrC,MAAM,OAAO,UAAU;IACJ,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACnC,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,KAAK,CAAS;IACd,GAAG,CAAe;IAEnC,YAAY,OAAuB,EAAE;QACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC;QAClC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,oEAAoE;IACpE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,GAAG,CACP,MAAgD;QAEhD,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YACH,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,yEAAyE;QACzE,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,OAAO,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1C,OAAO,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACxD,CAAC;YACD,KAAK,GAAG;gBACN,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC7B,QAAQ,EAAE,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,CAAC;gBACR,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,IACL,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAC3B,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAC3C,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YACzB,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAC7B,CAAC;YACD,kDAAkD;YAClD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,GAAG;YAAE,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QAErC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3C,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YACvC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpB,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,IAAI,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,OAAO,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAE/C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAqB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,KAAmB,EAAE,IAAkB;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1C,OAAO,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACxD,OAAO,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,MAAM,CAAC,KAAmB;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/ctgr/codec.d.ts

@@ -0,0 +1,45 @@
+import { type CtgrDecoded, type CtgrMethod, type EncodedRequest, type EncodeOpts, type UploadedFile } from './types';
+/**
+ * Encode a mutating request into one or more `/ctgr<XX>` GET-twin chunks. Small
+ * bodies become a single chunk; large bodies gzip (when over the threshold) and split
+ * into `chunkSizeBytes` pieces. Each chunk carries a crc32; the last carries the
+ * full-payload sha256.
+ */
+export declare function encodeRequest(method: CtgrMethod, url: string, body: unknown, opts?: EncodeOpts): Promise<EncodedRequest>;
+/** A validated, crc-verified single chunk — ready to buffer or decode. */
+export interface ParsedChunk {
+    method: CtgrMethod;
+    gzip: boolean;
+    index: number;
+    total: number;
+    /** Declared full-payload length in bytes (post-gzip, pre-base64). */
+    payloadLength: number;
+    cid: string;
+    /** Full-payload sha256 (hex) — present on the last chunk only. */
+    sha?: string;
+    bytes: Uint8Array;
+}
+/**
+ * Parse + crc-verify ONE chunk's params. Throws on an unknown version, a bad method
+ * abbrev, malformed index/total/length, or a crc mismatch — callers that must not
+ * throw (the chunk store, the middleware) catch and map to an Error/400.
+ */
+export declare function parseChunk(params: Record<string, string> | URLSearchParams): ParsedChunk;
+/**
+ * Split an `__files` array out of a decoded body into multer-shaped uploads. The
+ * `__files` data is standard base64 (what the client's FormData serializer emits);
+ * everything else stays on the returned `body`.
+ */
+export declare function extractFiles(parsed: unknown): {
+    body: unknown;
+    files?: UploadedFile[];
+};
+/** Decode an assembled payload (gunzip when flagged) → method + body (+ files). */
+export declare function decodePayload(payload: Uint8Array, gzipped: boolean, method: CtgrMethod): Promise<CtgrDecoded>;
+/**
+ * Decode a single set of chunk params. For the common single-chunk request this
+ * fully decodes (verifying the payload sha256); for one chunk of a multi-chunk
+ * payload it returns `'partial'` — those reassemble through {@link ChunkStore}.
+ */
+export declare function decodeRequest(params: Record<string, string> | URLSearchParams): Promise<CtgrDecoded | 'partial'>;
+//# sourceMappingURL=codec.d.ts.map

package/dist/ctgr/codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/ctgr/codec.ts"],"names":[],"mappings":"AAiBA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,cAAc,EACnB,KAAK,UAAU,EAGf,KAAK,YAAY,EAClB,MAAM,SAAS,CAAC;AAQjB;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,OAAO,EACb,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,cAAc,CAAC,CAmCzB;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;CACnB;AAMD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,GAAG,WAAW,CAoCxF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAA;CAAE,CAqBvF;AAED,mFAAmF;AACnF,wBAAsB,aAAa,CACjC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,WAAW,CAAC,CAMtB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,GAC/C,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOlC"}

package/dist/ctgr/codec.js

@@ -0,0 +1,154 @@
+/*
+ * ctgr v1 codec — pack ANY mutating request body into URL-safe GET-twin chunks, and
+ * the pure inverse. Isomorphic (browser + Bun), no runtime deps.
+ *
+ * Pipeline: JSON → UTF-8 bytes → gzip when > threshold → split into chunks → each
+ * chunk base64url-encoded with a crc32, the envelope carrying a self-describing
+ * header (version, gzip flag, method, index/total, payload length, payload id) and a
+ * full-payload sha256 on the last chunk. The decoder needs nothing but the params.
+ *
+ * This replaces the legacy `encode→reverse→swap→base64→swap` chain, which
+ * double-base64'd and whose swap/reverse was trivially-reversible obfuscation, not
+ * protection — the real protection (getOnly JWT claim + CSRF guard) is unchanged.
+ */
+import { fromBase64, fromBase64url, toBase64url } from './base64url';
+import { gunzip, gzip } from './compress';
+import { crc32 } from './crc32';
+import { sha256Hex } from './digest';
+import { ABBREV_TO_METHOD, CTGR_WIRE_VERSION, METHOD_TO_ABBREV, } from './types';
+const DEFAULT_CHUNK_SIZE = 1800;
+const DEFAULT_GZIP_THRESHOLD = 1024;
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+/**
+ * Encode a mutating request into one or more `/ctgr<XX>` GET-twin chunks. Small
+ * bodies become a single chunk; large bodies gzip (when over the threshold) and split
+ * into `chunkSizeBytes` pieces. Each chunk carries a crc32; the last carries the
+ * full-payload sha256.
+ */
+export async function encodeRequest(method, url, body, opts = {}) {
+    const chunkSize = opts.chunkSizeBytes ?? DEFAULT_CHUNK_SIZE;
+    const gzipThreshold = opts.gzipThresholdBytes ?? DEFAULT_GZIP_THRESHOLD;
+    // `JSON.stringify(undefined)` is `undefined`; coerce a missing body to `null` so a
+    // body-less mutation (e.g. DELETE) still rides the normal, single-versioned path.
+    const raw = textEncoder.encode(JSON.stringify(body ?? null));
+    const useGzip = raw.length > gzipThreshold;
+    const payload = useGzip ? await gzip(raw) : raw;
+    const sha = await sha256Hex(payload);
+    const cid = crypto.randomUUID();
+    const abbrev = METHOD_TO_ABBREV[method];
+    const totalChunks = Math.max(1, Math.ceil(payload.length / chunkSize));
+    const chunks = [];
+    for (let i = 0; i < totalChunks; i++) {
+        const slice = payload.subarray(i * chunkSize, (i + 1) * chunkSize);
+        const params = {
+            _cv: CTGR_WIRE_VERSION,
+            _cm: abbrev,
+            _cg: useGzip ? '1' : '0',
+            _ci: String(i),
+            _ct: String(totalChunks),
+            _cl: String(payload.length),
+            _cid: cid,
+            _crc: String(crc32(slice)),
+            _d: toBase64url(slice),
+        };
+        if (i === totalChunks - 1)
+            params._sha = sha;
+        const path = `/ctgr${abbrev}${url}`;
+        const separator = path.includes('?') ? '&' : '?';
+        const query = new URLSearchParams(params).toString();
+        chunks.push({ url: `${path}${separator}${query}`, params });
+    }
+    return { chunks };
+}
+function asRecord(params) {
+    return params instanceof URLSearchParams ? Object.fromEntries(params) : params;
+}
+/**
+ * Parse + crc-verify ONE chunk's params. Throws on an unknown version, a bad method
+ * abbrev, malformed index/total/length, or a crc mismatch — callers that must not
+ * throw (the chunk store, the middleware) catch and map to an Error/400.
+ */
+export function parseChunk(params) {
+    const p = asRecord(params);
+    if (p._cv !== CTGR_WIRE_VERSION) {
+        throw new Error(`ctgr: unsupported wire version "${p._cv ?? ''}"`);
+    }
+    const method = ABBREV_TO_METHOD[p._cm];
+    if (!method)
+        throw new Error(`ctgr: unknown method abbreviation "${p._cm ?? ''}"`);
+    const index = Number(p._ci);
+    const total = Number(p._ct);
+    const payloadLength = Number(p._cl);
+    if (!Number.isInteger(total) || total <= 0)
+        throw new Error('ctgr: invalid chunk total');
+    if (!Number.isInteger(index) || index < 0 || index >= total) {
+        throw new Error('ctgr: chunk index out of range');
+    }
+    if (!Number.isInteger(payloadLength) || payloadLength < 0) {
+        throw new Error('ctgr: invalid payload length');
+    }
+    const bytes = fromBase64url(p._d ?? '');
+    const expectedCrc = Number(p._crc);
+    if (!Number.isInteger(expectedCrc) || crc32(bytes) !== expectedCrc) {
+        throw new Error('ctgr: chunk crc mismatch');
+    }
+    return {
+        method,
+        gzip: p._cg === '1',
+        index,
+        total,
+        payloadLength,
+        cid: p._cid ?? '',
+        sha: p._sha,
+        bytes,
+    };
+}
+/**
+ * Split an `__files` array out of a decoded body into multer-shaped uploads. The
+ * `__files` data is standard base64 (what the client's FormData serializer emits);
+ * everything else stays on the returned `body`.
+ */
+export function extractFiles(parsed) {
+    if (parsed &&
+        typeof parsed === 'object' &&
+        Array.isArray(parsed.__files)) {
+        const source = parsed;
+        const files = source.__files.map((f) => {
+            const buffer = fromBase64(f.dataBase64 ?? '');
+            return {
+                fieldname: f.field ?? 'file',
+                originalname: f.name ?? 'file',
+                mimetype: f.type || 'application/octet-stream',
+                buffer,
+                size: buffer.length,
+            };
+        });
+        const { __files, ...body } = source;
+        return { body, files };
+    }
+    return { body: parsed };
+}
+/** Decode an assembled payload (gunzip when flagged) → method + body (+ files). */
+export async function decodePayload(payload, gzipped, method) {
+    const raw = gzipped ? await gunzip(payload) : payload;
+    const json = textDecoder.decode(raw);
+    const parsed = json.length ? JSON.parse(json) : undefined;
+    const { body, files } = extractFiles(parsed);
+    return files ? { method, body, files } : { method, body };
+}
+/**
+ * Decode a single set of chunk params. For the common single-chunk request this
+ * fully decodes (verifying the payload sha256); for one chunk of a multi-chunk
+ * payload it returns `'partial'` — those reassemble through {@link ChunkStore}.
+ */
+export async function decodeRequest(params) {
+    const chunk = parseChunk(params);
+    if (chunk.total !== 1)
+        return 'partial';
+    if (chunk.sha && (await sha256Hex(chunk.bytes)) !== chunk.sha) {
+        throw new Error('ctgr: payload sha256 mismatch');
+    }
+    return decodePayload(chunk.bytes, chunk.gzip, chunk.method);
+}
+//# sourceMappingURL=codec.js.map

package/dist/ctgr/codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../src/ctgr/codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EAOjB,gBAAgB,GAGjB,MAAM,SAAS,CAAC;AAEjB,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AACtC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAkB,EAClB,GAAW,EACX,IAAa,EACb,OAAmB,EAAE;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,IAAI,kBAAkB,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAExE,mFAAmF;IACnF,kFAAkF;IAClF,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,aAAa,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;QACnE,MAAM,MAAM,GAA2B;YACrC,GAAG,EAAE,iBAAiB;YACtB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YACxB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;YACd,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;YACxB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC3B,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC;SACvB,CAAC;QACF,IAAI,CAAC,KAAK,WAAW,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC;QAC7C,MAAM,IAAI,GAAG,QAAQ,MAAM,GAAG,GAAG,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAgBD,SAAS,QAAQ,CAAC,MAAgD;IAChE,OAAO,MAAM,YAAY,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAgD;IACzE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B,IAAI,CAAC,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAiB,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACzF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,WAAW,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO;QACL,MAAM;QACN,IAAI,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG;QACnB,KAAK;QACL,KAAK;QACL,aAAa;QACb,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QACjB,GAAG,EAAE,CAAC,CAAC,IAAI;QACX,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,IACE,MAAM;QACN,OAAO,MAAM,KAAK,QAAQ;QAC1B,KAAK,CAAC,OAAO,CAAE,MAAgC,CAAC,OAAO,CAAC,EACxD,CAAC;QACD,MAAM,MAAM,GAAG,MAAiE,CAAC;QACjF,MAAM,KAAK,GAAmB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACrD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO;gBACL,SAAS,EAAE,CAAC,CAAC,KAAK,IAAI,MAAM;gBAC5B,YAAY,EAAE,CAAC,CAAC,IAAI,IAAI,MAAM;gBAC9B,QAAQ,EAAE,CAAC,CAAC,IAAI,IAAI,0BAA0B;gBAC9C,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,MAAM;aACpB,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAmB,EACnB,OAAgB,EAChB,MAAkB;IAElB,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAY,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAgD;IAEhD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC"}

package/dist/ctgr/compress.d.ts

@@ -0,0 +1,3 @@
+export declare function gzip(bytes: Uint8Array): Promise<Uint8Array>;
+export declare function gunzip(bytes: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=compress.d.ts.map

package/dist/ctgr/compress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compress.d.ts","sourceRoot":"","sources":["../../src/ctgr/compress.ts"],"names":[],"mappings":"AAQA,wBAAsB,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAKjE;AAED,wBAAsB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAKnE"}

package/dist/ctgr/compress.js

@@ -0,0 +1,21 @@
+/*
+ * Isomorphic gzip via the web-standard CompressionStream / DecompressionStream —
+ * native on Bun and in the browser, so one implementation serves both the browser
+ * encoder and the Bun server decoder (no `node:zlib`, no `Bun.gzipSync` branch).
+ * Async on both ends, which is why the whole ctgr codec is async.
+ */
+// `new Uint8Array(bytes)` re-backs the view on a plain ArrayBuffer — Blob/SubtleCrypto
+// reject the `ArrayBufferLike` default (which admits SharedArrayBuffer) under TS 6.
+export async function gzip(bytes) {
+    const stream = new Blob([new Uint8Array(bytes)])
+        .stream()
+        .pipeThrough(new CompressionStream('gzip'));
+    return new Uint8Array(await new Response(stream).arrayBuffer());
+}
+export async function gunzip(bytes) {
+    const stream = new Blob([new Uint8Array(bytes)])
+        .stream()
+        .pipeThrough(new DecompressionStream('gzip'));
+    return new Uint8Array(await new Response(stream).arrayBuffer());
+}
+//# sourceMappingURL=compress.js.map

package/dist/ctgr/compress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compress.js","sourceRoot":"","sources":["../../src/ctgr/compress.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,uFAAuF;AACvF,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,KAAiB;IAC1C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;SAC7C,MAAM,EAAE;SACR,WAAW,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAiB;IAC5C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;SAC7C,MAAM,EAAE;SACR,WAAW,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/ctgr/crc32.d.ts

@@ -0,0 +1,3 @@
+/** CRC-32 of `bytes` as an unsigned 32-bit integer. */
+export declare function crc32(bytes: Uint8Array): number;
+//# sourceMappingURL=crc32.d.ts.map

package/dist/ctgr/crc32.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crc32.d.ts","sourceRoot":"","sources":["../../src/ctgr/crc32.ts"],"names":[],"mappings":"AAeA,uDAAuD;AACvD,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAM/C"}

package/dist/ctgr/crc32.js

@@ -0,0 +1,24 @@
+/*
+ * Pure-JS CRC-32 (IEEE 802.3 / zlib polynomial) over a 256-entry lookup table — no
+ * native addon. Client and server share this exact implementation so a chunk's
+ * `_crc` integrity check computes the same value on both ends of the tunnel.
+ */
+const TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        table[n] = c >>> 0;
+    }
+    return table;
+})();
+/** CRC-32 of `bytes` as an unsigned 32-bit integer. */
+export function crc32(bytes) {
+    let crc = 0xffffffff;
+    for (let i = 0; i < bytes.length; i++) {
+        crc = (crc >>> 8) ^ TABLE[(crc ^ bytes[i]) & 0xff];
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
+//# sourceMappingURL=crc32.js.map

package/dist/ctgr/crc32.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crc32.js","sourceRoot":"","sources":["../../src/ctgr/crc32.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE;IAClB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACzE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,EAAE,CAAC;AAEL,uDAAuD;AACvD,MAAM,UAAU,KAAK,CAAC,KAAiB;IACrC,IAAI,GAAG,GAAG,UAAU,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC"}

package/dist/ctgr/digest.d.ts

@@ -0,0 +1,2 @@
+export declare function sha256Hex(bytes: Uint8Array): Promise<string>;
+//# sourceMappingURL=digest.d.ts.map

package/dist/ctgr/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/ctgr/digest.ts"],"names":[],"mappings":"AAKA,wBAAsB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAQlE"}

package/dist/ctgr/digest.js

@@ -0,0 +1,16 @@
+/*
+ * Hex SHA-256 via web-standard SubtleCrypto — isomorphic (Bun + browser both expose
+ * `crypto.subtle`). Used for the full-payload integrity check the wire format carries
+ * on the last chunk (`_sha`); per-chunk integrity is the cheaper {@link crc32}.
+ */
+export async function sha256Hex(bytes) {
+    // `new Uint8Array(bytes)` re-backs the view on a plain ArrayBuffer — SubtleCrypto's
+    // BufferSource rejects the `ArrayBufferLike` default under TS 6.
+    const digest = await crypto.subtle.digest('SHA-256', new Uint8Array(bytes));
+    const view = new Uint8Array(digest);
+    let hex = '';
+    for (let i = 0; i < view.length; i++)
+        hex += view[i].toString(16).padStart(2, '0');
+    return hex;
+}
+//# sourceMappingURL=digest.js.map

package/dist/ctgr/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../src/ctgr/digest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAiB;IAC/C,oFAAoF;IACpF,iEAAiE;IACjE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/ctgr/index.d.ts

@@ -0,0 +1,9 @@
+export { fromBase64, fromBase64url, toBase64, toBase64url } from './base64url';
+export { ChunkStore, type ChunkStoreOpts } from './chunkStore';
+export { decodePayload, decodeRequest, encodeRequest, extractFiles, type ParsedChunk, parseChunk, } from './codec';
+export { gunzip, gzip } from './compress';
+export { crc32 } from './crc32';
+export { sha256Hex } from './digest';
+export { ABBREV_TO_METHOD, CTGR_WIRE_VERSION, type CtgrAbbrev, type CtgrDecoded, type CtgrMethod, type EncodedChunk, type EncodedRequest, type EncodeOpts, METHOD_TO_ABBREV, type SerializedFile, type UploadedFile, } from './types';
+export { decodeV0Payload, V0ChunkStore, type V0ChunkStoreOpts } from './v0compat';
+//# sourceMappingURL=index.d.ts.map

package/dist/ctgr/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ctgr/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,YAAY,EACZ,KAAK,WAAW,EAChB,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/ctgr/index.js

@@ -0,0 +1,14 @@
+/*
+ * cursedbelt/ctgr — the isomorphic ctgr codec (browser + Bun, no runtime deps). The
+ * Hono transport binding (`unGETify` + `buildRoutes`) lives in `cursedbelt/server`;
+ * the browser guard + request converter live in `cursedbelt/client`.
+ */
+export { fromBase64, fromBase64url, toBase64, toBase64url } from './base64url';
+export { ChunkStore } from './chunkStore';
+export { decodePayload, decodeRequest, encodeRequest, extractFiles, parseChunk, } from './codec';
+export { gunzip, gzip } from './compress';
+export { crc32 } from './crc32';
+export { sha256Hex } from './digest';
+export { ABBREV_TO_METHOD, CTGR_WIRE_VERSION, METHOD_TO_ABBREV, } from './types';
+export { decodeV0Payload, V0ChunkStore } from './v0compat';
+//# sourceMappingURL=index.js.map

package/dist/ctgr/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ctgr/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAC;AAC/D,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,YAAY,EAEZ,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EAOjB,gBAAgB,GAGjB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAyB,MAAM,YAAY,CAAC"}

package/dist/ctgr/types.d.ts

@@ -0,0 +1,65 @@
+/** The mutating HTTP methods ctgr tunnels through a `/ctgr<XX>` GET twin. */
+export type CtgrMethod = 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+/** Method → its 2-char abbreviation (the `/ctgr<XX>` path segment + the `_cm` param). */
+export declare const METHOD_TO_ABBREV: {
+    readonly POST: "po";
+    readonly PATCH: "pa";
+    readonly PUT: "pu";
+    readonly DELETE: "de";
+};
+/** The inverse of {@link METHOD_TO_ABBREV}. */
+export declare const ABBREV_TO_METHOD: {
+    readonly po: "POST";
+    readonly pa: "PATCH";
+    readonly pu: "PUT";
+    readonly de: "DELETE";
+};
+export type CtgrAbbrev = keyof typeof ABBREV_TO_METHOD;
+/** Current wire-format version. v0 (the legacy `_cv`-absent codec) lives in `v0compat.ts`. */
+export declare const CTGR_WIRE_VERSION = "1";
+/**
+ * A reconstructed multipart upload, multer-shaped so the file came over the ctgr
+ * GET-tunnel the same way it would over multipart. `buffer` is raw isomorphic bytes
+ * (a `Uint8Array`, not a Node `Buffer`) — wrap it where a `Buffer` is required.
+ */
+export interface UploadedFile {
+    fieldname: string;
+    originalname: string;
+    mimetype: string;
+    buffer: Uint8Array;
+    size: number;
+}
+/** The fully-decoded request a downstream handler / validator consumes. */
+export interface CtgrDecoded {
+    /** The original HTTP method the GET twin stands in for. */
+    method: CtgrMethod;
+    /** The parsed JSON body, with any `__files` array extracted into {@link files}. */
+    body: unknown;
+    /** Reconstructed uploads — present only when the body carried an `__files` array. */
+    files?: UploadedFile[];
+}
+/** One encoded chunk: the GET-twin URL plus the query params it carries (same data). */
+export interface EncodedChunk {
+    /** `/ctgr<XX><path>?<params>` — a path (no origin); the caller adds any prefix. */
+    url: string;
+    /** The `_c*` params, also serialized into {@link url}. Handy for tests + reassembly. */
+    params: Record<string, string>;
+}
+/** The output of `encodeRequest`: one chunk for small bodies, N for large ones. */
+export interface EncodedRequest {
+    chunks: EncodedChunk[];
+}
+export interface EncodeOpts {
+    /** Max payload bytes per chunk (pre-base64url). Default 1800 → ~2400 URL chars. */
+    chunkSizeBytes?: number;
+    /** Gzip the payload when it exceeds this many bytes. Default 1024. */
+    gzipThresholdBytes?: number;
+}
+/** The `__files` entry shape the client serializes an upload into (base64 data). */
+export interface SerializedFile {
+    field?: string;
+    name?: string;
+    type?: string;
+    dataBase64?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/ctgr/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ctgr/types.ts"],"names":[],"mappings":"AAMA,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE7D,yFAAyF;AACzF,eAAO,MAAM,gBAAgB;;;;;CAKkB,CAAC;AAEhD,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB;;;;;CAKkB,CAAC;AAEhD,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEvD,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,MAAM,EAAE,UAAU,CAAC;IACnB,mFAAmF;IACnF,IAAI,EAAE,OAAO,CAAC;IACd,qFAAqF;IACrF,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/ctgr/types.js

@@ -0,0 +1,22 @@
+/*
+ * ctgr wire-format types + the method⇄abbreviation maps shared by the codec, the
+ * chunk store, the Hono transport, and the browser client. Pure types + literal
+ * const maps only (no runtime APIs) so this module is trivially isomorphic.
+ */
+/** Method → its 2-char abbreviation (the `/ctgr<XX>` path segment + the `_cm` param). */
+export const METHOD_TO_ABBREV = {
+    POST: 'po',
+    PATCH: 'pa',
+    PUT: 'pu',
+    DELETE: 'de',
+};
+/** The inverse of {@link METHOD_TO_ABBREV}. */
+export const ABBREV_TO_METHOD = {
+    po: 'POST',
+    pa: 'PATCH',
+    pu: 'PUT',
+    de: 'DELETE',
+};
+/** Current wire-format version. v0 (the legacy `_cv`-absent codec) lives in `v0compat.ts`. */
+export const CTGR_WIRE_VERSION = '1';
+//# sourceMappingURL=types.js.map

package/dist/ctgr/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ctgr/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,yFAAyF;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;IACX,GAAG,EAAE,IAAI;IACT,MAAM,EAAE,IAAI;CACiC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,EAAE,EAAE,MAAM;IACV,EAAE,EAAE,OAAO;IACX,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,QAAQ;CACiC,CAAC;AAIhD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC"}