Compress URL params with DEFLATE and a preset dictionary

[matthewnessworthy]

Summary

json_encode + base64_encode + urlencode pushed template URLs past 1kb, causing SEO issues. URL params and template payloads are now raw-DEFLATE compressed and encoded as unpadded URL-safe base64 (RFC 4648 §5) — every output character is RFC 3986 unreserved, so urlencode() never expands a token.

New UrlCodec with a versioned token format:

prefix	encoding
_1	DEFLATE with preset dictionary v1 — what compress() emits
_0	DEFLATE without dictionary — accepted
none	legacy standard base64 — accepted, old URLs keep decoding

• Dictionary v1 (3007 bytes, md5 b6b973310e98eb1286b280d1d65c45ea) was built from 23k real production template payloads: top payload shapes as contiguous skeletons, near-constant values (Now Hiring, de vânzare, SUPRAFAȚĂ, …), real bucket paths (horizon-files-prod/og-template/…, shared-folder-prod/…). It is a frozen byte-for-byte wire contract with the image service — never edit it; new vocabulary goes under prefix _2.
• JSON is encoded with JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE before compression (kills \/ doubling on S3 paths).
• ext-zlib / ext-json declared in composer.json.
• Empty-params URLs (/-/ segment) and their signatures are byte-identical to before.

Results (real production corpus, n=2875)

	legacy	plain deflate	dict v1
mean token	444	318	125
p95 token	562	405	193

The test-fixture template URL drops 822 → 251 chars; a real cde-prop payload tokenizes to 46 chars.

Tests

14 tests passing, including a pinned dictionary md5 (cross-language drift guard), roundtrips with unicode, legacy decode, and invalid-token rejection. Verified end-to-end against the lambda: PHP-signed URLs with _1 tokens pass signature validation and decode on both resize and template routes.

Deploy order

⚠️ RingierIMU/image-service-lambda#515 must deploy first — it decodes all three formats, so it ships safely ahead of this encoder.

🤖 Generated with Claude Code