@vex-chat/spire 0.7.4 → 1.0.0

package/dist/server/utils.d.ts

@@ -1,7 +1,35 @@
-import { XTypes } from "@vex-chat/types";
-export interface ICensoredUser {
-    userID: string;
-    username: string;
-    lastSeen: Date;
-}
-export declare const censorUser: (user: XTypes.SQL.IUser) => ICensoredUser;
+import type { Device, User, UserRecord } from "@vex-chat/types";
+import type { Request } from "express";
+/**
+ * Strips password fields from a DB user record, returning the
+ * public-safe User shape.
+ */
+export declare const censorUser: (user: UserRecord) => User;
+/**
+ * Safely extract the authenticated device from a request.
+ * Throws if the device is not set (i.e. checkDevice middleware did
+ * not run or the token was not a device token).
+ *
+ * Throws `AppError(401)` — the central error handler turns this into
+ * a JSON 401 response. No stack trace or raw Error leaks.
+ */
+export declare function getDevice(req: Request): Device;
+/**
+ * Safely extract a required route parameter.
+ *
+ * Throws `AppError(400)` if the parameter is missing or is an array
+ * (which shouldn't happen for well-wired routes, but defensively
+ * checked). The error message deliberately does NOT include the
+ * user-supplied value — CWE-79 / CWE-116 fix for the earlier
+ * `"Missing route parameter: " + name` concatenation pattern.
+ */
+export declare function getParam(req: Request, name: string): string;
+/**
+ * Safely extract the authenticated user from a request.
+ * Throws if the user is not set (i.e. protect middleware was not
+ * applied to this route).
+ *
+ * Throws `AppError(401)` — the central error handler turns this into
+ * a JSON 401 response.
+ */
+export declare function getUser(req: Request): User;

package/dist/server/utils.js

@@ -1,11 +1,55 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.censorUser = void 0;
-const censorUser = (user) => {
+import { AppError } from "./errors.js";
+/**
+ * Strips password fields from a DB user record, returning the
+ * public-safe User shape.
+ */
+export const censorUser = (user) => {
     return {
+        lastSeen: user.lastSeen,
         userID: user.userID,
         username: user.username,
-        lastSeen: user.lastSeen,
     };
 };
-exports.censorUser = censorUser;
+/**
+ * Safely extract the authenticated device from a request.
+ * Throws if the device is not set (i.e. checkDevice middleware did
+ * not run or the token was not a device token).
+ *
+ * Throws `AppError(401)` — the central error handler turns this into
+ * a JSON 401 response. No stack trace or raw Error leaks.
+ */
+export function getDevice(req) {
+    if (!req.device)
+        throw new AppError(401, "Not authenticated");
+    return req.device;
+}
+/**
+ * Safely extract a required route parameter.
+ *
+ * Throws `AppError(400)` if the parameter is missing or is an array
+ * (which shouldn't happen for well-wired routes, but defensively
+ * checked). The error message deliberately does NOT include the
+ * user-supplied value — CWE-79 / CWE-116 fix for the earlier
+ * `"Missing route parameter: " + name` concatenation pattern.
+ */
+export function getParam(req, name) {
+    const value = req.params[name];
+    if (!value || Array.isArray(value)) {
+        throw new AppError(400, "Missing or invalid route parameter");
+    }
+    return value;
+}
+/**
+ * Safely extract the authenticated user from a request.
+ * Throws if the user is not set (i.e. protect middleware was not
+ * applied to this route).
+ *
+ * Throws `AppError(401)` — the central error handler turns this into
+ * a JSON 401 response.
+ */
+export function getUser(req) {
+    if (!req.user)
+        throw new AppError(401, "Not authenticated");
+    return req.user;
+}
+//# sourceMappingURL=utils.js.map

package/dist/server/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/server/utils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAQ,EAAE;IACjD,OAAO;QACH,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KAC1B,CAAC;AACN,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY,EAAE,IAAY;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAAY;IAChC,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC,IAAI,CAAC;AACpB,CAAC"}

package/dist/types/express.d.ts

@@ -0,0 +1,20 @@
+import type { Device, User } from "@vex-chat/types";
+/**
+ * Augment Express's global Request interface with the properties
+ * set by checkAuth and checkDevice middleware.
+ *
+ * The global Express.Request is merged into express-serve-static-core's
+ * Request via `extends Express.Request`, so properties added here are
+ * available on `req` in all route handlers.
+ */
+declare global {
+    namespace Express {
+        interface Request {
+            bearerToken?: string;
+            device?: Device;
+            exp?: number;
+            user?: User;
+        }
+    }
+}
+export {};

package/dist/types/express.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=express.js.map

package/dist/types/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/types/express.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,CAAC"}

package/dist/utils/createLogger.js

@@ -1,26 +1,20 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createLogger = void 0;
-const winston_1 = __importDefault(require("winston"));
+import winston from "winston";
 /**
  * @ignore
  */
-function createLogger(logName, logLevel) {
-    const logger = winston_1.default.createLogger({
-        level: logLevel || "error",
-        format: winston_1.default.format.combine(winston_1.default.format.timestamp({
-            format: "YYYY-MM-DD HH:mm:ss",
-        }), winston_1.default.format.errors({ stack: true }), winston_1.default.format.splat(), winston_1.default.format.json()),
+export function createLogger(logName, logLevel) {
+    const logger = winston.createLogger({
         defaultMeta: { service: "vex-" + logName },
+        format: winston.format.combine(winston.format.timestamp({
+            format: "YYYY-MM-DD HH:mm:ss",
+        }), winston.format.errors({ stack: true }), winston.format.splat(), winston.format.json()),
+        level: logLevel || "error",
         transports: [
             //
             // - Write all logs with level `error` and below to `error.log`
             // - Write all logs with level `info` and below to `combined.log`
             //
-            new winston_1.default.transports.File({
+            new winston.transports.File({
                 filename: "vex:" + logName + ".log",
                 level: "error",
             }),
@@ -30,12 +24,12 @@ function createLogger(logName, logLevel) {
     // If we're not in production then log to the `console` with the format:
     // `${info.level}: ${info.message} JSON.stringify({ ...rest }) `
     //
-    if (process.env.NODE_ENV !== "production" &&
-        process.env.NODE_ENV !== "test") {
-        logger.add(new winston_1.default.transports.Console({
-            format: winston_1.default.format.combine(winston_1.default.format.colorize(), winston_1.default.format.simple()),
+    if (process.env["NODE_ENV"] !== "production" &&
+        process.env["NODE_ENV"] !== "test") {
+        logger.add(new winston.transports.Console({
+            format: winston.format.combine(winston.format.colorize(), winston.format.simple()),
         }));
     }
     return logger;
 }
-exports.createLogger = createLogger;
+//# sourceMappingURL=createLogger.js.map

package/dist/utils/createLogger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createLogger.js","sourceRoot":"","sources":["../../src/utils/createLogger.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAiB;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;QAChC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAC1B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YACrB,MAAM,EAAE,qBAAqB;SAChC,CAAC,EACF,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EACtC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EACtB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CACxB;QACD,KAAK,EAAE,QAAQ,IAAI,OAAO;QAC1B,UAAU,EAAE;YACR,EAAE;YACF,+DAA+D;YAC/D,iEAAiE;YACjE,EAAE;YACF,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;gBACxB,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM;gBACnC,KAAK,EAAE,OAAO;aACjB,CAAC;SACL;KACJ,CAAC,CAAC;IACH,EAAE;IACF,wEAAwE;IACxE,gEAAgE;IAChE,EAAE;IACF,IACI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QACxC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,EACpC,CAAC;QACC,MAAM,CAAC,GAAG,CACN,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;YAC3B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAC1B,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,EACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAC1B;SACJ,CAAC,CACL,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/utils/createUint8UUID.js

@@ -1,12 +1,8 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.uuidToUint8 = exports.createUint8UUID = void 0;
-const uuid_1 = require("uuid");
-function createUint8UUID() {
-    return uuidToUint8(uuid_1.v4());
+import { parse as uuidParse } from "uuid";
+export function createUint8UUID() {
+    return uuidToUint8(crypto.randomUUID());
 }
-exports.createUint8UUID = createUint8UUID;
-function uuidToUint8(uuid) {
-    return new Uint8Array(uuid_1.parse(uuid));
+export function uuidToUint8(uuid) {
+    return new Uint8Array(uuidParse(uuid));
 }
-exports.uuidToUint8 = uuidToUint8;
+//# sourceMappingURL=createUint8UUID.js.map

package/dist/utils/createUint8UUID.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createUint8UUID.js","sourceRoot":"","sources":["../../src/utils/createUint8UUID.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,MAAM,UAAU,eAAe;IAC3B,OAAO,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/utils/jwtSecret.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Returns the JWT signing secret.
+ *
+ * Prefers JWT_SECRET (dedicated HMAC key) over SPK (NaCl server signing key).
+ * Falls back to SPK for backward compat with existing deployments.
+ */
+export declare function getJwtSecret(): string;

package/dist/utils/jwtSecret.js

@@ -0,0 +1,15 @@
+/**
+ * Returns the JWT signing secret.
+ *
+ * Prefers JWT_SECRET (dedicated HMAC key) over SPK (NaCl server signing key).
+ * Falls back to SPK for backward compat with existing deployments.
+ */
+export function getJwtSecret() {
+    const secret = process.env["JWT_SECRET"] ?? process.env["SPK"];
+    if (!secret) {
+        throw new Error("Neither JWT_SECRET nor SPK is set. " +
+            "Set JWT_SECRET (preferred) or SPK in your environment.");
+    }
+    return secret;
+}
+//# sourceMappingURL=jwtSecret.js.map

package/dist/utils/jwtSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtSecret.js","sourceRoot":"","sources":["../../src/utils/jwtSecret.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,qCAAqC;YACjC,wDAAwD,CAC/D,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/utils/loadEnv.js

@@ -1,28 +1,13 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadEnv = void 0;
-const dotenv_1 = require("dotenv");
-/*
-  Populate process.env with vars from .env and verify required vars are present.
-  Thanks Z for this function.
-*/
-function loadEnv() {
-    dotenv_1.config();
-    const requiredEnvVars = [
-        // "SQL_HOST",
-        // "SQL_USER",
-        // "SQL_PASSWORD",
-        // "SQL_DB_NAME",
-        // "SQL_PORT",
-        "CANARY",
-        "DB_TYPE",
-        "SPK",
-    ];
+import { config } from "dotenv";
+/* Populate process.env with vars from .env and verify required vars are present. */
+export function loadEnv() {
+    config();
+    const requiredEnvVars = ["CANARY", "DB_TYPE", "SPK"];
     for (const required of requiredEnvVars) {
         if (process.env[required] === undefined) {
-            console.warn(`Required environment variable '${required}' is not set. Please consult the README.`);
+            process.stderr.write(`Required environment variable '${required}' is not set. Please consult the README.\n`);
             process.exit(1);
         }
     }
 }
-exports.loadEnv = loadEnv;
+//# sourceMappingURL=loadEnv.js.map

package/dist/utils/loadEnv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,MAAM,eAAe,GAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/utils/msgpack.d.ts

@@ -0,0 +1,2 @@
+import { Packr } from "msgpackr";
+export declare const msgpack: Packr;

package/dist/utils/msgpack.js

@@ -0,0 +1,4 @@
+import { Packr } from "msgpackr";
+// Standard msgpack encoder/decoder configured for broad compatibility.
+export const msgpack = new Packr({ moreTypes: false, useRecords: false });
+//# sourceMappingURL=msgpack.js.map

package/dist/utils/msgpack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msgpack.js","sourceRoot":"","sources":["../../src/utils/msgpack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEjC,uEAAuE;AACvE,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC"}

package/package.json

@@ -1,80 +1,108 @@
 {
     "name": "@vex-chat/spire",
-    "version": "0.7.4",
+    "version": "1.0.0",
     "description": "Vex server implementation in NodeJS.",
-    "main": "./dist/index.js",
+    "type": "module",
+    "files": [
+        "dist",
+        "src",
+        "LICENSE"
+    ],
     "author": "Extra <extrahash@protonmail.com>",
     "license": "AGPL-3.0-or-later",
+    "engines": {
+        "node": ">=24.0.0",
+        "npm": ">=10.0.0"
+    },
+    "packageManager": "npm@10.9.2",
+    "publishConfig": {
+        "access": "public",
+        "registry": "https://registry.npmjs.org/"
+    },
     "scripts": {
-        "start": "node ./dist/run.js",
+        "preinstall": "npx only-allow npm",
+        "start": "node --experimental-strip-types src/run.ts",
         "restart": "pm2 restart spire && pm2 logs spire",
-        "build": "node ./node_modules/typescript/bin/tsc",
-        "prettier": "node ./node_modules/prettier/bin-prettier.js '**/*.{ts,tsx,json,md}' --tab-width 4 --trailing-comma es5 --ignore-path .gitignore  --arrow-parens always --write",
-        "lint": "./node_modules/tslint/bin/tslint src/**/*.ts{,x}",
-        "lint-fix": "./node_modules/tslint/bin/tslint src/**/*.ts{,x} --fix",
-        "api-knex": "TS_NODE_COMPILER_OPTIONS='{ \"module\": \"commonjs\" }' knex --knexfile=./src/knexfile.ts",
-        "test": "jest",
-        "prepublish": "yarn build"
+        "build": "tsc",
+        "format": "prettier --write .",
+        "format:check": "prettier --check .",
+        "lint": "eslint src/",
+        "lint:fix": "eslint src/ --fix",
+        "prepare": "husky",
+        "test": "vitest run",
+        "gen-spk": "node scripts/gen-spk.js",
+        "docs": "node ./scripts/generate-docs.js",
+        "license:check": "node scripts/fix-license-checker.mjs && npx @onebeyond/license-checker scan --allowOnly MIT MIT-0 ISC BSD-2-Clause BSD-3-Clause Apache-2.0 0BSD MPL-2.0 CC0-1.0 CC-BY-3.0 CC-BY-4.0 Unlicense BlueOak-1.0.0 Python-2.0 Zlib PSF-2.0 Artistic-2.0 AGPL-3.0-or-later WTFPL \"(MIT AND CC-BY-3.0)\" --ignoreRootPackageLicense --disableReport",
+        "service:status-monitor": "node ./services/status-monitor/index.js",
+        "service:status-monitor:clear-history": "node ./services/status-monitor/clear-history.js",
+        "service:deploy-hook": "node ./services/deploy-hook/index.js",
+        "monitor": "node ./services/status-monitor/index.js"
     },
     "devDependencies": {
-        "husky": "^3.1.0",
-        "jest": "^26.6.3",
-        "lint-staged": "^9.5.0",
-        "prettier": "^1.19.1",
-        "ts-jest": "^26.4.4",
-        "ts-node": "^9.1.1",
-        "tslint": "^5.20.1",
-        "tslint-config-prettier": "^1.18.0",
-        "typescript": "^4.1.3"
+        "@changesets/cli": "2.30.0",
+        "@onebeyond/license-checker": "2.2.0",
+        "@types/better-sqlite3": "7.6.13",
+        "@types/cors": "2.8.19",
+        "@types/express": "5.0.6",
+        "@types/jsonwebtoken": "9.0.10",
+        "@types/morgan": "1.9.10",
+        "@types/multer": "2.1.0",
+        "@types/node": "25.6.0",
+        "@types/uuid": "10.0.0",
+        "@types/ws": "8.18.1",
+        "@vitest/eslint-plugin": "1.6.15",
+        "eslint": "10.2.0",
+        "eslint-config-prettier": "10.1.8",
+        "eslint-plugin-n": "17.24.0",
+        "eslint-plugin-perfectionist": "5.8.0",
+        "husky": "9.1.7",
+        "lint-staged": "16.4.0",
+        "prettier": "3.8.2",
+        "type-coverage": "2.29.7",
+        "typedoc": "0.28.18",
+        "typescript": "6.0.2",
+        "typescript-eslint": "8.58.1",
+        "vitest": "4.1.4"
+    },
+    "typeCoverage": {
+        "atLeast": 95,
+        "ignoreCatch": true
     },
     "lint-staged": {
-        "src/**/*.{ts}": [
-            "./node_modules/tslint/bin/tslint -c tslint.json --fix",
-            "git add"
+        "*.ts": [
+            "eslint --fix",
+            "prettier --write"
         ]
     },
-    "husky": {
-        "hooks": {
-            "pre-commit": "yarn prettier; git add --all; lint-staged",
-            "pre-push": "git diff HEAD --quiet && npm test"
-        }
+    "overrides": {
+        "@types/ws": "8.18.1",
+        "@types/readable-stream": "4.0.11",
+        "lodash": "4.18.1",
+        "minimatch": "10.2.5"
     },
     "dependencies": {
-        "@extrahash/sleep": "^1.0.0",
-        "@types/cookie-parser": "^1.4.2",
-        "@types/cors": "^2.8.8",
-        "@types/express": "^4.17.9",
-        "@types/express-ws": "^3.0.0",
-        "@types/jsonwebtoken": "^8.5.0",
-        "@types/morgan": "^1.9.2",
-        "@types/msgpack-lite": "^0.1.7",
-        "@types/multer": "^1.4.5",
-        "@types/parse-duration": "^0.3.0",
-        "@types/uuid": "^8.3.0",
-        "@types/ws": "^7.4.0",
-        "@vex-chat/crypto": "^0.7.15",
-        "@vex-chat/types": "^0.10.9",
-        "chalk": "^4.1.0",
-        "cookie-parser": "^1.4.5",
-        "cors": "^2.8.5",
-        "dotenv": "^8.2.0",
-        "express": "^4.17.1",
-        "express-ws": "^4.0.0",
-        "file-type": "^16.1.0",
-        "helmet": "^4.2.0",
-        "jsonwebtoken": "^8.5.1",
-        "knex": "^0.21.12",
-        "morgan": "^1.10.0",
-        "msgpack-lite": "^0.1.26",
-        "multer": "^1.4.2",
-        "mysql": "^2.18.1",
-        "parse-duration": "^0.4.4",
-        "pbkdf2": "^3.1.1",
-        "sqlite": "^4.0.17",
-        "sqlite3": "^5.0.0",
-        "tweetnacl": "^1.0.3",
-        "uuid": "^8.3.1",
-        "winston": "^3.3.3",
-        "ws": "^7.4.0"
+        "@asyncapi/web-component": "2.6.5",
+        "@scalar/express-api-reference": "0.9.7",
+        "@vex-chat/crypto": "2.0.0",
+        "@vex-chat/types": "2.0.0",
+        "better-sqlite3": "11.10.0",
+        "cors": "2.8.6",
+        "dotenv": "17.4.1",
+        "express": "5.2.1",
+        "express-rate-limit": "8.3.2",
+        "file-type": "22.0.1",
+        "helmet": "8.1.0",
+        "jsonwebtoken": "9.0.3",
+        "kysely": "0.28.16",
+        "morgan": "1.10.1",
+        "msgpackr": "1.11.8",
+        "multer": "2.1.1",
+        "parse-duration": "2.1.6",
+        "picocolors": "1.1.1",
+        "tweetnacl": "1.0.3",
+        "uuid": "8.3.2",
+        "winston": "3.19.0",
+        "ws": "8.20.0",
+        "zod": "4.3.6"
     }
 }