cursedops 0.10.0 → 0.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.0",
+	"version": "0.10.1",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/relay.ts

@@ -426,7 +426,10 @@ export class RelayLink {
 		if (declared > this.maxBodyBytes) return tooBig();
 		const id = crypto.randomUUID();
 		const frame = await requestFrame(id, request);
-		if (frame.body !== null && frame.body.length > (this.maxBodyBytes * 4) / 3 + 4) return tooBig();
+		// Exactly, off the base64: a chunked upload carries no content-length, and a slack bound let
+		// the ceiling + 2 bytes through (roms' suite caught it at MAX_BODY_BYTES + 1).
+		const pad = frame.body?.endsWith("==") ? 2 : frame.body?.endsWith("=") ? 1 : 0;
+		if (frame.body !== null && (frame.body.length / 4) * 3 - pad > this.maxBodyBytes) return tooBig();
 		return await new Promise<Response>((resolve) => {
 			const timer = setTimeout(() => {
 				this.pending.delete(id);