my-durable 0.0.7 → 0.0.9

package/apps/dpi-sdk/src/protocol/pairing.ts

@@ -36,7 +36,11 @@ const DeviceId = Type.String({
 });
 const Fingerprint = Type.String({ pattern: "^sha256:[0-9a-f]{64}$", minLength: 71, maxLength: 71 });
 const Nonce = Type.String({ pattern: "^[A-Za-z0-9_-]{43}$", minLength: 43, maxLength: 43 });
-const TunnelToken = Type.String({ pattern: "^dpt_[A-Za-z0-9_-]{43}$", minLength: 47, maxLength: 47 });
+const TunnelToken = Type.String({
+  pattern: "^dpt_[A-Za-z0-9_-]{43}$",
+  minLength: 47,
+  maxLength: 47,
+});
 /**
  * Canonical lower-case UUID v4: any hex is NOT a code, so the version nibble must be 4 and the
  * variant nibble 8/9/a/b.
@@ -57,7 +61,8 @@ const PairCode = Type.String({
 
 const PAIR_CODE_RE = new RegExp(PAIR_CODE_PATTERN);
 /** Shape test for the UUID family — used to pick the normalisation rule, never to accept on its own. */
-const UUID_SHAPED_RE = /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/;
+const UUID_SHAPED_RE =
+  /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/;
 
 /**
  * Exact-shape check for a pairing code, with NO trimming: a value with a leading/trailing space
@@ -97,9 +102,45 @@ export const PairRequest = Type.Object(
     code: PairCode,
     deviceUid: Uuid,
     deviceName: Type.String({ minLength: 1, maxLength: 64 }),
+    /** Machine description the operator sees BEFORE approving (like orca/paseo offers). */
+    hostname: Type.Optional(Type.String({ minLength: 1, maxLength: 128 })),
+    platform: Type.Optional(Type.String({ minLength: 1, maxLength: 64 })),
     publicKey: Type.String({ minLength: 1, maxLength: 256 }), // Ed25519 SPKI PEM
     keyFingerprint: Fingerprint,
     clientTime: Type.Integer(),
+    /**
+     * Hub-proof challenge (offer v3): present only when the offer pinned a hub
+     * key fingerprint. The hub answers with its public key + a signature over
+     * hubProofSigningPayload(...subject: enrollmentId) so the device can check
+     * the responder owns the pinned key BEFORE any credential is accepted.
+     * Optional keeps v1 wire shape: only v3-offer flows ever set it.
+     */
+    hubNonce: Type.Optional(Nonce),
+  },
+  Strict,
+);
+
+/**
+ * Device-INITIATED enrollment (the shape orca/paseo use): the machine asks the
+ * hub for a code instead of waiting for an operator-minted one, so the operator
+ * never has to carry a secret across machines. The tuple is still the full
+ * identity — name, hostname, platform, public key — and the hub still computes
+ * the fingerprint itself and still requires a human approval.
+ */
+export const PairDeviceRequest = Type.Object(
+  {
+    type: Type.Literal("pair.device-request"),
+    v: Type.Literal(1),
+    requestId: Uuid,
+    deviceUid: Uuid,
+    deviceName: Type.String({ minLength: 1, maxLength: 64 }),
+    hostname: Type.Optional(Type.String({ minLength: 1, maxLength: 128 })),
+    platform: Type.Optional(Type.String({ minLength: 1, maxLength: 64 })),
+    publicKey: Type.String({ minLength: 1, maxLength: 256 }),
+    keyFingerprint: Fingerprint,
+    clientTime: Type.Integer(),
+    /** Offer-v3 hub pinning, exactly as the operator-minted flow carries it. */
+    hubNonce: Type.Optional(Nonce),
   },
   Strict,
 );
@@ -112,6 +153,28 @@ export const PairChallenge = Type.Object(
     nonce: Nonce,
     issuedAt: Type.Integer(),
     hubId: Uuid, // deployment ID, not a cryptographic fingerprint
+    /** Present iff the request carried hubNonce (offer v3 pinning). */
+    hubPublicKey: Type.Optional(Type.String({ minLength: 1, maxLength: 256 })), // Ed25519 SPKI PEM
+    hubKeyFingerprint: Type.Optional(Fingerprint),
+    /** Ed25519 over hubProofSigningPayload({..., subject: enrollmentId, nonce: request hubNonce}). */
+    hubSignature: Type.Optional(
+      Type.String({ pattern: "^[A-Za-z0-9_-]{86}$", minLength: 86, maxLength: 86 }),
+    ),
+  },
+  Strict,
+);
+
+/** The hub's answer to a device-initiated request: the code it minted, plus the challenge. */
+export const PairDeviceRequestAck = Type.Object(
+  {
+    type: Type.Literal("pair.device-ack"),
+    v: Type.Literal(1),
+    codeId: Uuid,
+    code: PairCode,
+    expiresAt: Type.Integer(),
+    hubOrigin: Type.String(),
+    hubId: Uuid,
+    challenge: PairChallenge,
   },
   Strict,
 );
@@ -155,6 +218,8 @@ export const TokenIssue = Type.Object(
     tunnelToken: TunnelToken,
     issuedAt: Type.Integer(),
     expiresAt: Type.Null(),
+    /** Present for offer-v3 pairings: the pinned hub identity (same value the offer carried). */
+    hubKeyFingerprint: Type.Optional(Fingerprint),
   },
   Strict,
 );
@@ -287,6 +352,8 @@ export const PAIRING_DTOS = [
   PairError,
   PairCodeIssue,
   PairCodeState,
+  PairDeviceRequest,
+  PairDeviceRequestAck,
 ] as const;
 
 export function checkPairingDto<T extends (typeof PAIRING_DTOS)[number]>(
@@ -337,7 +404,7 @@ export function parseHubOrigin(
  * code cannot reach server/CDN query logs, and the origin travels inside the
  * link (no --hub needed on the device).
  */
-export interface PairOffer {
+export interface PairOfferV2 {
   v: 2;
   /** Canonical HTTPS hub origin (the transport the device pairs against). */
   hub: string;
@@ -349,6 +416,20 @@ export interface PairOffer {
   exp: number;
 }
 
+/**
+ * v3 offer — v2 plus `kfp`: the sha256-of-SPKI fingerprint of the hub's
+ * persistent Ed25519 identity key. The device pins it: the hub must PROVE
+ * possession of that exact key during the ceremony (and on every tunnel
+ * connect), so a hub swap is detectable at the device even with TLS intact.
+ */
+export interface PairOfferV3 extends Omit<PairOfferV2, "v"> {
+  v: 3;
+  /** Pinned hub identity: `sha256:<64 hex>` of the hub key's SPKI DER. */
+  kfp: string;
+}
+
+export type PairOffer = PairOfferV2 | PairOfferV3;
+
 /** base64url (no padding) of UTF-8 bytes — browser-safe, no Node builtins. */
 function offerEncode(bytes: Uint8Array): string {
   let binary = "";
@@ -374,24 +455,34 @@ const OFFER_CODE_RE = new RegExp(`^${UUID_V4}$`);
 
 /**
  * Encode an offer to the exact fragment payload: canonical JSON (field order
- * v,hub,id,code,exp — byte-lean and deterministic), base64url, no padding.
+ * v,hub,id,code,exp[,kfp] — byte-lean and deterministic), base64url, no padding.
  * Pure encoder: it does not validate; callers mint from live hub values.
  */
 export function encodePairOffer(offer: PairOffer): string {
-  return offerEncode(
-    new TextEncoder().encode(
-      JSON.stringify({ v: offer.v, hub: offer.hub, id: offer.id, code: offer.code, exp: offer.exp }),
-    ),
-  );
+  const json =
+    offer.v === 3
+      ? {
+          v: offer.v,
+          hub: offer.hub,
+          id: offer.id,
+          code: offer.code,
+          exp: offer.exp,
+          kfp: offer.kfp,
+        }
+      : { v: offer.v, hub: offer.hub, id: offer.id, code: offer.code, exp: offer.exp };
+  return offerEncode(new TextEncoder().encode(JSON.stringify(json)));
 }
 
 /**
- * Structural decode (freshness-blind): exactly the five known fields, v===2,
- * canonical HTTPS origin (byte-exact, reusing the parseHubOrigin rules),
- * canonical UUIDs for id and code, safe-integer exp. Unknown or malformed
- * input → undefined, never a throw. Exported so a caller can tell an EXPIRED
- * offer apart from junk (decodePairOffer refuses both).
+ * Structural decode (freshness-blind): exactly the known fields for the
+ * declared version — five for v2, six for v3 (`kfp` must be a canonical
+ * `sha256:<64 hex>`) — canonical HTTPS origin (byte-exact, reusing the
+ * parseHubOrigin rules), canonical UUIDs for id and code, safe-integer exp.
+ * Unknown or malformed input → undefined, never a throw. Exported so a
+ * caller can tell an EXPIRED offer apart from junk (decodePairOffer refuses
+ * both).
  */
+const OFFER_KFP_RE = /^sha256:[0-9a-f]{64}$/;
 export function readPairOffer(raw: string): PairOffer | undefined {
   const bytes = offerDecode(raw);
   if (!bytes || bytes.length > PAIR_OFFER_MAX_JSON_BYTES) return undefined;
@@ -403,13 +494,19 @@ export function readPairOffer(raw: string): PairOffer | undefined {
   }
   if (!json || typeof json !== "object" || Array.isArray(json)) return undefined;
   const o = json as Record<string, unknown>;
-  if (Object.keys(o).length !== 5 || o.v !== 2) return undefined; // unknown/missing fields refuse
+  if (o.v !== 2 && o.v !== 3) return undefined;
+  const fieldCount = o.v === 3 ? 6 : 5;
+  if (Object.keys(o).length !== fieldCount) return undefined; // unknown/missing fields refuse
   if (typeof o.hub !== "string") return undefined;
   const origin = parseHubOrigin(o.hub);
   if (!origin.ok || origin.origin !== o.hub) return undefined; // canonical form, byte-exact
   if (typeof o.id !== "string" || !OFFER_UUID_RE.test(o.id)) return undefined;
   if (typeof o.code !== "string" || !OFFER_CODE_RE.test(o.code)) return undefined;
   if (typeof o.exp !== "number" || !Number.isSafeInteger(o.exp)) return undefined;
+  if (o.v === 3) {
+    if (typeof o.kfp !== "string" || !OFFER_KFP_RE.test(o.kfp)) return undefined;
+    return { v: 3, hub: o.hub, id: o.id, code: o.code, exp: o.exp, kfp: o.kfp };
+  }
   return { v: 2, hub: o.hub, id: o.id, code: o.code, exp: o.exp };
 }
 
@@ -455,7 +552,10 @@ export function pairOfferFragment(url: string): string | undefined {
  * undefined. The offer's hub must equal the link's own origin (the hub minted
  * this link); the fragment never travels server-side.
  */
-export function parsePairOfferUrl(url: string, now: number = Date.now()): ParsedPairOfferUrl | undefined {
+export function parsePairOfferUrl(
+  url: string,
+  now: number = Date.now(),
+): ParsedPairOfferUrl | undefined {
   let u: URL;
   try {
     u = new URL(url);
@@ -492,6 +592,27 @@ export function pairingSigningPayload(parts: {
   ]);
 }
 
+/**
+ * Exact Ed25519 payload the HUB signs to prove its identity key (offer v3).
+ * `subject` binds the proof to one ceremony ("pair:<enrollmentId>") or one
+ * tunnel session ("tunnel:<deviceId>:<pairingEpoch>") so a captured proof
+ * cannot be replayed elsewhere. Element order is normative.
+ */
+export function hubProofSigningPayload(parts: {
+  hubOrigin: string;
+  hubId: string;
+  subject: string;
+  nonce: string;
+}): string {
+  return JSON.stringify([
+    "dpi-hub-proof-v1",
+    parts.hubOrigin,
+    parts.hubId,
+    parts.subject,
+    parts.nonce,
+  ]);
+}
+
 /**
  * Base64url byte-length validation for credential-bearing strings read from
  * files/env (which may carry a trailing newline). Protocol contexts use the

package/apps/dpi-sdk/src/protocol/tunnel.ts

@@ -26,7 +26,12 @@ const DeviceId = Type.String({
   maxLength: 32,
 });
 const Fingerprint = Type.String({ pattern: "^sha256:[0-9a-f]{64}$", minLength: 71, maxLength: 71 });
-const TunnelToken = Type.String({ pattern: "^dpt_[A-Za-z0-9_-]{43}$", minLength: 47, maxLength: 47 });
+const TunnelToken = Type.String({
+  pattern: "^dpt_[A-Za-z0-9_-]{43}$",
+  minLength: 47,
+  maxLength: 47,
+});
+const Nonce = Type.String({ pattern: "^[A-Za-z0-9_-]{43}$", minLength: 43, maxLength: 43 });
 const SubscriptionFields = {
   subscriptionId: Uuid,
   sub: Type.String({ minLength: 1, maxLength: 512 }),
@@ -60,37 +65,94 @@ export type TunnelAuthError = Static<typeof TunnelAuthError>;
  * models/api; the tunnel validates it only as a JSON object with a known
  * discriminator to avoid duplicating the full grammar here.
  */
-const FramePayload = Type.Object({
-  type: Type.Union([
-    Type.Literal("hello"), Type.Literal("fault"), Type.Literal("tree"), Type.Literal("activity"),
-    Type.Literal("session"), Type.Literal("agents"), Type.Literal("tasks"), Type.Literal("usage"),
-    Type.Literal("snapshot"), Type.Literal("batch"), Type.Literal("inbox"), Type.Literal("doc"),
-  ]),
-}, { additionalProperties: true });
+const FramePayload = Type.Object(
+  {
+    type: Type.Union([
+      Type.Literal("hello"),
+      Type.Literal("fault"),
+      Type.Literal("tree"),
+      Type.Literal("activity"),
+      Type.Literal("session"),
+      Type.Literal("agents"),
+      Type.Literal("tasks"),
+      Type.Literal("usage"),
+      Type.Literal("snapshot"),
+      Type.Literal("batch"),
+      Type.Literal("inbox"),
+      Type.Literal("doc"),
+    ]),
+  },
+  { additionalProperties: true },
+);
 
 /** Hub mux control frames must never be accepted from a device, even after chunk reassembly. */
-export function checkDeviceFrame(value: unknown): value is Exclude<Frame, { type: "network" | "disconnected" }> {
+export function checkDeviceFrame(
+  value: unknown,
+): value is Exclude<Frame, { type: "network" | "disconnected" }> {
   return Value.Check(FramePayload, value);
 }
 
 const TunnelControl = Type.Union([
-  Type.Object({ type: Type.Literal("control"), action: Type.Literal("subscribe"), ...SubscriptionFields }, Strict),
-  Type.Object({ type: Type.Literal("control"), action: Type.Literal("unsubscribe"), ...SubscriptionFields }, Strict),
-  Type.Object({ type: Type.Literal("control"), action: Type.Literal("revoked"), notice: Type.Object({
-    type: Type.Literal("pair.revoke"), v: Type.Literal(1), deviceId: DeviceId, pairingEpoch: Uuid,
-    reason: Type.Union([Type.Literal("user"), Type.Literal("compromise"), Type.Literal("hub_migrated")]),
-    revokedAt: Type.Integer(),
-  }, Strict) }, Strict),
   Type.Object(
-    { type: Type.Literal("control"), action: Type.Literal("token-rotate"), tunnelToken: TunnelToken, ...RotationFields },
+    { type: Type.Literal("control"), action: Type.Literal("subscribe"), ...SubscriptionFields },
+    Strict,
+  ),
+  Type.Object(
+    { type: Type.Literal("control"), action: Type.Literal("unsubscribe"), ...SubscriptionFields },
+    Strict,
+  ),
+  Type.Object(
+    {
+      type: Type.Literal("control"),
+      action: Type.Literal("revoked"),
+      notice: Type.Object(
+        {
+          type: Type.Literal("pair.revoke"),
+          v: Type.Literal(1),
+          deviceId: DeviceId,
+          pairingEpoch: Uuid,
+          reason: Type.Union([
+            Type.Literal("user"),
+            Type.Literal("compromise"),
+            Type.Literal("hub_migrated"),
+          ]),
+          revokedAt: Type.Integer(),
+        },
+        Strict,
+      ),
+    },
+    Strict,
+  ),
+  Type.Object(
+    {
+      type: Type.Literal("control"),
+      action: Type.Literal("token-rotate"),
+      tunnelToken: TunnelToken,
+      ...RotationFields,
+    },
+    Strict,
+  ),
+  Type.Object(
+    { type: Type.Literal("control"), action: Type.Literal("token-rotate-ack"), ...RotationFields },
+    Strict,
+  ),
+  Type.Object(
+    {
+      type: Type.Literal("control"),
+      action: Type.Literal("unpair"),
+      pairingEpoch: Uuid,
+      reason: Type.Literal("hub_migrated"),
+    },
+    Strict,
+  ),
+  Type.Object(
+    {
+      type: Type.Literal("control"),
+      action: Type.Literal("close"),
+      reason: Type.String({ maxLength: 512 }),
+    },
     Strict,
   ),
-  Type.Object({ type: Type.Literal("control"), action: Type.Literal("token-rotate-ack"), ...RotationFields }, Strict),
-  Type.Object({
-    type: Type.Literal("control"), action: Type.Literal("unpair"),
-    pairingEpoch: Uuid, reason: Type.Literal("hub_migrated"),
-  }, Strict),
-  Type.Object({ type: Type.Literal("control"), action: Type.Literal("close"), reason: Type.String({ maxLength: 512 }) }, Strict),
 ]);
 
 export const TunnelFrame = Type.Union([
@@ -106,6 +168,12 @@ export const TunnelFrame = Type.Union([
       apiVersion: Type.Literal(1),
       tunnelProto: Type.Literal(1),
       keyFingerprint: Fingerprint,
+      /**
+       * Hub-proof challenge (pinned pairings): the hub's `hello` must answer
+       * with proof of the pinned identity key over this nonce. Optional keeps
+       * the v1 wire shape for pre-pinning devices.
+       */
+      proofNonce: Type.Optional(Nonce),
     },
     Strict,
   ),
@@ -117,15 +185,30 @@ export const TunnelFrame = Type.Union([
       hubId: Uuid,
       connectionId: Uuid,
       serverTime: Type.Integer(),
+      /** Present iff the handshake carried proofNonce (hub identity proof). */
+      hubPublicKey: Type.Optional(Type.String({ minLength: 1, maxLength: 256 })),
+      hubKeyFingerprint: Type.Optional(Fingerprint),
+      hubSignature: Type.Optional(
+        Type.String({ pattern: "^[A-Za-z0-9_-]{86}$", minLength: 86, maxLength: 86 }),
+      ),
     },
     Strict,
   ),
-  Type.Object({ type: Type.Literal("tunnel-data"), frame: FramePayload, ...SubscriptionFields }, Strict),
+  Type.Object(
+    { type: Type.Literal("tunnel-data"), frame: FramePayload, ...SubscriptionFields },
+    Strict,
+  ),
   Type.Object(
     {
       type: Type.Literal("rest-request"),
       reqId: Uuid,
-      method: Type.Union([Type.Literal("GET"), Type.Literal("POST"), Type.Literal("PUT"), Type.Literal("PATCH"), Type.Literal("DELETE")]),
+      method: Type.Union([
+        Type.Literal("GET"),
+        Type.Literal("POST"),
+        Type.Literal("PUT"),
+        Type.Literal("PATCH"),
+        Type.Literal("DELETE"),
+      ]),
       path: Type.String({ minLength: 1, maxLength: 2048 }),
       idempotencyKey: Type.Optional(Type.String({ minLength: 1, maxLength: 256 })),
       body: Type.Optional(Type.Unknown()),
@@ -146,7 +229,10 @@ export const TunnelFrame = Type.Union([
   Type.Object(
     {
       type: Type.Literal("fault"),
-      error: Type.Object({ code: Type.String({ maxLength: 64 }), message: Type.String({ maxLength: 512 }) }, Strict),
+      error: Type.Object(
+        { code: Type.String({ maxLength: 64 }), message: Type.String({ maxLength: 512 }) },
+        Strict,
+      ),
       subscriptionId: Type.Optional(Uuid),
       reqId: Type.Optional(Uuid),
     },
@@ -167,7 +253,14 @@ const ChunkBase = {
 
 const TunnelChunk = Type.Union([
   Type.Object({ ...ChunkBase, kind: Type.Literal("tunnel-data"), ...SubscriptionFields }, Strict),
-  Type.Object({ ...ChunkBase, kind: Type.Union([Type.Literal("rest-request"), Type.Literal("rest-response")]), reqId: Uuid }, Strict),
+  Type.Object(
+    {
+      ...ChunkBase,
+      kind: Type.Union([Type.Literal("rest-request"), Type.Literal("rest-response")]),
+      reqId: Uuid,
+    },
+    Strict,
+  ),
 ]);
 export type TunnelChunk = Static<typeof TunnelChunk>;
 
@@ -211,7 +304,11 @@ function messageKey(msg: { type: string; action?: string; kind?: string }): stri
 }
 
 /** Returns the allowed direction(s), or null if the message type is unknown. */
-export function messageDirection(msg: { type: string; action?: string; kind?: string }): Direction[] {
+export function messageDirection(msg: {
+  type: string;
+  action?: string;
+  kind?: string;
+}): Direction[] {
   const key = messageKey(msg);
   const dirs: Direction[] = [];
   if (HUB_TO_DEVICE.has(key)) dirs.push("hub->device");
@@ -258,31 +355,57 @@ export function allowedInPhase(
  * the decision is made on exactly the bytes that will be requested, and only a route the device serves to a
  * remote caller (rest-routes.ts) with one of its methods passes.
  */
-export function validateRestRequest(input: { method: string; path: string }): { ok: true } | { ok: false; error: string } {
+export function validateRestRequest(input: {
+  method: string;
+  path: string;
+}): { ok: true } | { ok: false; error: string } {
   const refuse = (error: string) => ({ ok: false as const, error });
-  if (!/^(GET|POST|PUT|PATCH|DELETE)$/.test(input.method)) return refuse("rest: method not allowed");
+  if (!/^(GET|POST|PUT|PATCH|DELETE)$/.test(input.method))
+    return refuse("rest: method not allowed");
   const raw = input.path;
-  if (raw.includes("..") || raw.includes("\\") || raw.includes("://") || raw.startsWith("//")) {
+  // Traversal and absolute-URL checks apply to the ROUTED PATH only. The query
+  // string is data (fs/dirs carries `path=C:\Users\…` on Windows devices) and
+  // never influences routing, so backslashes and %5C are legal there.
+  const rawPath = raw.split("?")[0]!;
+  if (rawPath.includes("..") || rawPath.includes("\\") || rawPath.includes("://") || rawPath.startsWith("//")) {
     return refuse("rest: path traversal or absolute URL rejected");
   }
   let decoded: string;
   try {
-    decoded = decodeURIComponent(raw);
+    decoded = decodeURIComponent(rawPath);
   } catch {
     return refuse("rest: invalid percent-encoding");
   }
-  if (decoded.includes("..") || decoded.includes("\\") || decoded.includes("://") || decoded.startsWith("//")) {
+  if (
+    decoded.includes("..") ||
+    decoded.includes("\\") ||
+    decoded.includes("://") ||
+    decoded.startsWith("//")
+  ) {
     return refuse("rest: encoded traversal rejected");
   }
+  // The query is data, but its percent-encoding must still be well-formed.
+  const queryAt = raw.indexOf("?");
+  if (queryAt >= 0) {
+    try {
+      decodeURIComponent(raw.slice(queryAt + 1));
+    } catch {
+      return refuse("rest: invalid percent-encoding");
+    }
+  }
   if (!raw.startsWith(REST_PATH_PREFIX)) return refuse("rest: path outside /v1 rejected");
   if (!/^[\x21-\x7e]+$/.test(raw) || raw.includes("#")) {
-    return refuse("rest: path must be printable ASCII without a fragment (percent-encode everything else)");
+    return refuse(
+      "rest: path must be printable ASCII without a fragment (percent-encode everything else)",
+    );
   }
   const query = raw.indexOf("?");
   const pathname = query < 0 ? raw : raw.slice(0, query);
   if (pathname.includes(";")) return refuse("rest: path parameters are not accepted");
   const segments = pathname.slice(REST_PATH_PREFIX.length).split("/");
-  if (segments.some((segment) => segment === "" || segment.toLowerCase() === "%2e" || segment === ".")) {
+  if (
+    segments.some((segment) => segment === "" || segment.toLowerCase() === "%2e" || segment === ".")
+  ) {
     return refuse("rest: path is not canonical (empty or dot segment)");
   }
   if (matchesRestRoute(input.method, segments)) return { ok: true };
@@ -314,9 +437,10 @@ export function validateChunkEnvelope(chunk: {
   }
   const decodedLength = base64DecodedLength(chunk.data);
   if (decodedLength < 0) return { ok: false, error: "chunk: invalid base64" };
-  const expected = chunk.index === chunk.count - 1
-    ? chunk.totalBytes - CHUNK_RAW_BYTES * (chunk.count - 1)
-    : CHUNK_RAW_BYTES;
+  const expected =
+    chunk.index === chunk.count - 1
+      ? chunk.totalBytes - CHUNK_RAW_BYTES * (chunk.count - 1)
+      : CHUNK_RAW_BYTES;
   if (decodedLength !== expected) {
     return { ok: false, error: `chunk: size mismatch at index ${chunk.index}` };
   }