cursedbelt-server 1.0.1 → 1.0.2

package/dist/server/guard/index.d.ts

@@ -1,4 +1,5 @@
 export * from './argon2Binding';
+export * from './passwordVerifier';
 export * from './verifier';
 export * from './revocationStore';
 export * from './sessionSigner';

package/dist/server/guard/index.js

@@ -1,6 +1,7 @@
 // The GuardEngine server wiring (02 §4): the argon2id binding adapter that arms
 // cwip's KDF seam, and the Ed25519 session signer that mints and revokes.
 export * from './argon2Binding';
+export * from './passwordVerifier';
 export * from './verifier';
 export * from './revocationStore';
 export * from './sessionSigner';

package/dist/server/index.d.ts

@@ -23,3 +23,4 @@ export type { Migration } from './migration/types';
 export { AUDIT_LOG_MIGRATIONS, auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink, } from './audit';
 export { applyFtsSchema, type BackupInfo, buildFtsSchema, clampLimit, clampOffset, collectSqliteStats, createFts5Search, createSqliteBackupService, createSqliteHealthChecks, createSqliteViewerMiddleware, type DbStats, exportSqliteSnapshot, exportSqliteTable, type Fts5Search, type FtsHighlightOpts, type FtsResult, type FtsSearchOpts, type FtsSnippetOpts, type FtsTableSpec, type ImportMode, type ImportResult, importRowsIntoSqliteTable, isKnownTable, isReadOnlySql, listSqliteTables, NotReadOnlyError, quoteIdent, type RestoreResult, readSqliteTable, restoreSqliteSnapshot, runReadonlySqlite, type SnapshotExport, type SqliteBackupOpts, type SqliteBackupS3Opts, type SqliteBackupService, type SqliteHealthCheck, type SqliteHealthOpts, type SqliteHealthResult, type SqliteHealthStatus, type SqliteTableInfo, type SqliteTablePage, sanitizeFtsQuery, snapshotSqlite, type TableExport, type TableExportFormat, type TableStat, UnknownTableError, } from './sqlite';
 export { computePresence, createEventBus, createWsHub, type EventBus, type EventBusData, joinRoom, leaveRoom, type PresenceEntry, type PresenceState, ROOM_META_KEY, roomOf, type WsChannel, type WsClient, type WsData, type WsHandshake, type WsHub, type WsHubOpts, type WsMessage, } from './ws';
+export { resolveAppDataHome } from './paths/appDataHome';

package/dist/server/index.js

@@ -51,3 +51,7 @@ export { applyFtsSchema, buildFtsSchema, clampLimit, clampOffset, collectSqliteS
 // ── WebSocket hub (task 28): Bun-native upgrade, channel registry, heartbeat, ──
 //    presence-as-a-view, room helpers, and the push-only event-bus subset (ru).
 export { computePresence, createEventBus, createWsHub, joinRoom, leaveRoom, ROOM_META_KEY, roomOf, } from './ws';
+// The app-data root resolver. Exported at the root (2026-09-15, task 148) because
+// `cursedbelt-cc`'s localHost needs it and it answers a question about the HOST, not
+// about any one subsystem — so no subpath barrel is its natural home.
+export { resolveAppDataHome } from './paths/appDataHome';

package/dist/server/jobs/index.d.ts

@@ -1,5 +1,6 @@
 export { createFireQueue } from './fireQueue';
 export { defaultJobLogger } from './logger';
+export { createPlainjobConnection } from './plainjobAdapter';
 export { createPollingJob } from './polling';
 export { createJobRunner } from './runner';
 export { JobTimeoutError } from './timeout';

package/dist/server/jobs/index.js

@@ -4,6 +4,7 @@
 // *definitions* stay business and consume these primitives.
 export { createFireQueue } from './fireQueue';
 export { defaultJobLogger } from './logger';
+export { createPlainjobConnection } from './plainjobAdapter';
 export { createPollingJob } from './polling';
 export { createJobRunner } from './runner';
 export { JobTimeoutError } from './timeout';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "1.0.1",
+	"version": "1.0.2",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -22,7 +22,8 @@
 		"build": "bun run clean && tsc -p tsconfig.build.json",
 		"paths": "bun ../../tools/check-paths.ts .",
 		"verify": "bun run paths && bun run typecheck && bun run build && bun run test",
-		"prepublishOnly": "bun run verify"
+		"prepublishOnly": "bun run verify",
+		"test:pg": "bun run scripts/testPg.ts"
 	},
 	"files": [
 		"dist",
@@ -221,6 +222,7 @@
 		"@node-rs/argon2": "^2.0.2",
 		"@types/bun": "^1.3.14",
 		"@types/node": "^24",
+		"cursedbelt": "^3.0.0",
 		"hono": "4.12.28",
 		"kysely": "^0.28.17",
 		"kysely-bun-sqlite": "^0.4.0",

package/src/server/guard/index.ts

@@ -1,6 +1,7 @@
 // The GuardEngine server wiring (02 §4): the argon2id binding adapter that arms
 // cwip's KDF seam, and the Ed25519 session signer that mints and revokes.
 export * from './argon2Binding';
+export * from './passwordVerifier';
 export * from './verifier';
 export * from './revocationStore';
 export * from './sessionSigner';

package/src/server/index.ts

@@ -246,3 +246,8 @@ export {
   type WsHubOpts,
   type WsMessage,
 } from './ws';
+
+// The app-data root resolver. Exported at the root (2026-09-15, task 148) because
+// `cursedbelt-cc`'s localHost needs it and it answers a question about the HOST, not
+// about any one subsystem — so no subpath barrel is its natural home.
+export { resolveAppDataHome } from './paths/appDataHome';

package/src/server/jobs/index.ts

@@ -5,6 +5,7 @@
 
 export { createFireQueue } from './fireQueue';
 export { defaultJobLogger } from './logger';
+export { createPlainjobConnection } from './plainjobAdapter';
 export { createPollingJob } from './polling';
 export { createJobRunner } from './runner';
 export { JobTimeoutError } from './timeout';

package/src/server/storage/fileUploadClient-chunked.integration.spec.ts

@@ -0,0 +1,183 @@
+/*
+ * At the 2026-09-15 split this spec stays with the server internals it drives
+ * (files/fileRoutes, streamToken, binaryServerStore — none of them exported) and
+ * takes the react-side client from the PUBLISHED `cursedbelt` instead, same as
+ * fileUploadClient.integration.spec.ts beside it. Dev-only; runtime deps stay acyclic.
+ */
+import { Database } from 'bun:sqlite';
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { subtle } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { pickFreePort, startTestServer, type TestServer } from 'cwip/testing';
+import { Hono } from 'hono';
+import { createFileUploadClient } from 'cursedbelt/react/media/upload-client';
+import { runMigrations } from '../migration/runner';
+import { createBinaryServerStore } from './binaryServerStore';
+import {
+  createChunkedUploadService,
+  createSqliteFileCatalogue,
+  createStorageOpsLedger,
+  FILE_CATALOGUE_MIGRATIONS,
+} from './files';
+import { mountFileRoutes } from './files/fileRoutes';
+import { createStreamTokenService } from './streamToken';
+import type { MediaCtx } from './types';
+
+// genapp-100: the missing half of the chunked-upload proof. `chunked.integration.spec.ts`
+// drives the SERVICE against a real binary-server; THIS spec drives the BROWSER CLIENT
+// (`fileUploadClient.uploadAuto`) through the real `mountFileRoutes` edge — the exact wire a
+// generated app uses in production — and pins the load-bearing property: the app origin sees
+// ONLY the small init/complete JSON calls, while every chunk PUTs DIRECT to binary-server.
+// Skips cleanly when the local binary-server checkout isn't present (CI / other machines).
+const BS_DIR = process.env.BINARY_SERVER_DIR ?? '';
+const BS_PRESENT = BS_DIR !== '' && existsSync(path.join(BS_DIR, 'src', 'index.ts'));
+const ISSUER = 'https://demo.local';
+const APP_ID = 'demo';
+const CTX: MediaCtx = { userId: 'user-stub', tenantId: 'user-stub' };
+
+const b64url = (b: ArrayBuffer | Uint8Array) =>
+  Buffer.from(b instanceof Uint8Array ? b : new Uint8Array(b)).toString('base64url');
+const jsonSeg = (o: unknown) => b64url(new TextEncoder().encode(JSON.stringify(o)));
+const pem = (der: ArrayBuffer, label: string) =>
+  `-----BEGIN ${label}-----\n${(
+    Buffer.from(der)
+      .toString('base64')
+      .match(/.{1,64}/g) ?? []
+  ).join('\n')}\n-----END ${label}-----\n`;
+
+// SKIPPED until a real binary-server checkout is present: point BINARY_SERVER_DIR at one.
+// There is deliberately no default — a published package must not go looking in one machine's
+// directory layout — and `binary-server` has not been re-homed here, so this skips on every host today.
+describe.skipIf(!BS_PRESENT)('fileUploadClient chunked path → real binary-server (integration)', () => {
+  let server: TestServer | null = null;
+  let tmp = '';
+  let store: ReturnType<typeof createBinaryServerStore>;
+  const app = new Hono();
+  /** Every request the APP ORIGIN handled: [method+path, request body bytes]. */
+  const originRequests: Array<{ path: string; bodyBytes: number }> = [];
+  /** How many chunk PUTs bypassed the origin and hit binary-server directly. */
+  let directChunkPuts = 0;
+
+  beforeAll(async () => {
+    const kp = await subtle.generateKey(
+      {
+        name: 'RSASSA-PKCS1-v1_5',
+        modulusLength: 2048,
+        publicExponent: new Uint8Array([1, 0, 1]),
+        hash: 'SHA-256',
+      },
+      true,
+      ['sign', 'verify'],
+    );
+    const spki = pem(await subtle.exportKey('spki', kp.publicKey), 'PUBLIC KEY');
+    const signJwt = async (claims: Record<string, unknown>) => {
+      const now = Math.floor(Date.now() / 1000);
+      const input = `${jsonSeg({ alg: 'RS256', typ: 'JWT' })}.${jsonSeg({ iss: ISSUER, iat: now, exp: now + 3600, ...claims })}`;
+      const sig = await subtle.sign('RSASSA-PKCS1-v1_5', kp.privateKey, new TextEncoder().encode(input));
+      return `${input}.${b64url(new Uint8Array(sig))}`;
+    };
+
+    tmp = await mkdtemp(path.join(tmpdir(), 'bs-client-int-'));
+    const port = await pickFreePort();
+    server = await startTestServer({
+      cwd: BS_DIR,
+      cmd: ['bun', path.join(BS_DIR, 'src', 'index.ts')],
+      port,
+      env: {
+        PORT: String(port),
+        HOST: '127.0.0.1',
+        STORAGE_ROOT: path.join(tmp, 'binaries'),
+        DB_PATH: path.join(tmp, 'bs.sqlite'),
+        FILE_TOKEN_PUBLIC_KEY: spki,
+        FILE_TOKEN_ISSUER: ISSUER,
+        CA_APP_ID: APP_ID,
+        INTERNAL_SECRET: 'demo-internal',
+      },
+      healthPath: '/healthz',
+      timeoutMs: 90_000,
+    });
+    const base = server.baseUrl;
+
+    store = createBinaryServerStore({
+      baseUrl: base,
+      appId: APP_ID,
+      signFileToken: (c) => signJwt(c),
+      internalSecret: 'demo-internal',
+    });
+    const db = new Database(':memory:');
+    runMigrations(db, FILE_CATALOGUE_MIGRATIONS);
+    const catalogue = createSqliteFileCatalogue({
+      db,
+      store,
+      workDir: path.join(tmp, 'work'),
+      owner: (c) => c.userId,
+    });
+    const svc = createChunkedUploadService({
+      catalogue,
+      ledger: createStorageOpsLedger(db),
+      backend: 'binary',
+      chunkSize: 64 * 1024,
+      owner: (c) => c.userId,
+      mintChunkUpload: async ({ key, sid, ci, tc, owner }) => {
+        const token = await signJwt({ k: `${APP_ID}/${key}`, uid: owner, sid, ci, tc });
+        return `${base}/upload-chunk/${APP_ID}/${key}?token=${encodeURIComponent(token)}`;
+      },
+    });
+    mountFileRoutes(app, {
+      store,
+      token: createStreamTokenService({ secret: 's' }),
+      catalogue,
+      authorizeUpload: () => CTX,
+      chunked: svc,
+    });
+  }, 90_000);
+
+  afterAll(async () => {
+    await server?.stop();
+    await rm(tmp, { recursive: true, force: true });
+  });
+
+  test('uploadAuto splits a large file into direct-to-bs chunk PUTs; the origin sees only init/complete', async () => {
+    // The client's fetch seam is where prod's routing lives: same-origin paths go
+    // to the app, absolute (minted) URLs go straight out to binary-server.
+    const client = createFileUploadClient({
+      authHeaders: () => ({ Authorization: 'Bearer test' }),
+      chunkThreshold: 128 * 1024,
+      fetchImpl: (async (input: RequestInfo | URL, init?: RequestInit) => {
+        const url = String(input);
+        if (url.startsWith('http')) {
+          directChunkPuts++;
+          return fetch(input as string, init);
+        }
+        const bodyBytes =
+          init?.body instanceof Blob ? init.body.size : typeof init?.body === 'string' ? init.body.length : 0;
+        originRequests.push({ path: url, bodyBytes });
+        return app.request(url, init);
+      }) as typeof fetch,
+    });
+
+    // ~1 MiB of deterministic bytes → 16 × 64 KiB chunks, well over the 128 KiB threshold.
+    const bytes = new Uint8Array(1024 * 1024).map((_, i) => (i * 31 + 7) % 256);
+    const file = new File([bytes], 'big-clip.bin', { type: 'application/octet-stream' });
+
+    const result = await client.uploadAuto(file, { tags: ['chunked-proof'] });
+    expect(result.ok).toBe(true);
+    const fileId = result.ok ? (result.file?.id ?? '') : '';
+    expect(fileId.length).toBeGreaterThan(0);
+
+    // Every chunk bypassed the origin…
+    expect(directChunkPuts).toBe(16);
+    // …and the origin handled ONLY small JSON control calls (init + complete):
+    expect(originRequests.map((r) => r.path)).toEqual(['/_files/upload-init', '/_files/upload-complete']);
+    for (const r of originRequests) expect(r.bodyBytes).toBeLessThan(2_048);
+
+    // The assembled object on binary-server is byte-identical to the source (bs Range GET).
+    const back = await store.get(`fs/${CTX.userId}/${fileId}`);
+    expect(back).not.toBeNull();
+    expect(back?.length).toBe(bytes.byteLength);
+    expect(Buffer.from(back as Uint8Array).equals(Buffer.from(bytes))).toBe(true);
+  });
+});

package/src/server/storage/fileUploadClient.integration.spec.ts

@@ -0,0 +1,139 @@
+/*
+ * Moved from cursedbelt's src/react/media at the 2026-09-15 split: this spec
+ * drives the published react-side upload client against this package's storage
+ * INTERNALS (diskStore, streamToken, private-media), which are deliberately not
+ * exported — so the spec lives beside them and takes the client half from the
+ * published `cursedbelt` instead. Runtime deps stay acyclic; this is dev-only.
+ */
+import { Database } from 'bun:sqlite';
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { Hono } from 'hono';
+import { MAX_SINGLE_UPLOAD_BYTES } from 'cursedbelt-core/media/upload-limits';
+import { runMigrations } from '../migration/runner';
+import { generateUserSalt } from '../private-media/crypto';
+import { createUnlockService } from '../private-media/unlock';
+import { createDiskStore } from './diskStore';
+import { createSqliteFileCatalogue } from './files/catalogue';
+import { mountFileRoutes, SINGLE_UPLOAD_TOO_LARGE } from './files/fileRoutes';
+import { FILE_CATALOGUE_MIGRATIONS } from './files/migrations';
+import { createStreamTokenService } from './streamToken';
+import type { MediaCtx } from './types';
+import { createFileUploadClient } from 'cursedbelt/react/media/upload-client';
+
+// Drives the REAL mountFileRoutes edge — the client and the routes share one header
+// protocol (X-Filename/X-Tags/X-Unlock-Token), so the round-trip is the contract.
+
+const CTX: MediaCtx = { userId: 'u1', tenantId: 't1' };
+const unlock = createUnlockService({ serverSecret: 'srv', unlockSecret: 'unl' });
+const salt = generateUserSalt();
+
+describe('createFileUploadClient ⇄ mountFileRoutes', () => {
+  let db: Database;
+  let root: string;
+  const app = new Hono();
+  const client = createFileUploadClient({
+    authHeaders: () => ({ Authorization: 'Bearer test' }),
+    fetchImpl: ((input: RequestInfo | URL, init?: RequestInit) =>
+      app.request(input as string, init)) as typeof fetch,
+  });
+
+  beforeAll(async () => {
+    db = new Database(':memory:');
+    runMigrations(db, FILE_CATALOGUE_MIGRATIONS);
+    root = await mkdtemp(path.join(tmpdir(), 'fuc-'));
+    const catalogue = createSqliteFileCatalogue({
+      db,
+      store: createDiskStore(root),
+      workDir: path.join(root, 'w'),
+      owner: (c) => c.userId,
+    });
+    mountFileRoutes(app, {
+      store: createDiskStore(root),
+      token: createStreamTokenService({ secret: 's' }),
+      catalogue,
+      authorizeUpload: () => CTX,
+      privateUpload: {
+        unlock,
+        authorize: async () => ({ userId: CTX.userId, userSalt: salt }),
+      },
+    });
+  });
+  afterAll(async () => {
+    db.close();
+    await rm(root, { recursive: true, force: true });
+  });
+
+  let uploadedId = '';
+
+  test('upload carries filename + tags through to the catalogue row', async () => {
+    const res = await client.upload(new File(['hello'], 'notes.txt', { type: 'text/plain' }), {
+      tags: ['a', 'b'],
+    });
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    expect(res.file?.name).toBe('notes.txt');
+    expect(res.file?.tags).toEqual(['a', 'b']);
+    uploadedId = res.file?.id ?? '';
+  });
+
+  test('replace overwrites bytes under the same id', async () => {
+    const res = await client.replace(uploadedId, new Blob(['replaced'], { type: 'text/plain' }), {
+      name: 'notes-v2.txt',
+    });
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    expect(res.file?.id).toBe(uploadedId);
+    expect(res.file?.name).toBe('notes-v2.txt');
+    expect(res.file?.size).toBe('replaced'.length);
+  });
+
+  test('uploadPrivate with an unlock token lands an encrypted item', async () => {
+    const { token } = await unlock.unlock({ userId: CTX.userId, userSalt: salt, password: 'pw' });
+    const res = await client.uploadPrivate(
+      new File(['secret-bytes'], 'secret.jpg', { type: 'image/jpeg' }),
+      { unlockToken: token, tags: ['hidden'] },
+    );
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    expect(res.file?.processingStatus).toBe('ready'); // image blob path — no ffmpeg
+  });
+
+  test('uploadAuto falls back to the streamed PUT when chunked is unwired (404 init)', async () => {
+    const big = new File([new Uint8Array(9 * 1024 * 1024)], 'big.bin', {
+      type: 'application/octet-stream',
+    });
+    const res = await client.uploadAuto(big);
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    expect(res.file?.size).toBe(big.size);
+  });
+
+  test('uploadAuto surfaces a single-request-cap 413 as a hard ok:false error', async () => {
+    // Chunked is unwired (404 init) so uploadAuto falls back to the single PUT; a file over
+    // MAX_SINGLE_UPLOAD_BYTES must come back ok:false with the server's clear message — not a
+    // silent failure. (The guard fails fast on Content-Length, so no giant disk write.)
+    const tooBig = new File([new Uint8Array(MAX_SINGLE_UPLOAD_BYTES + 1024)], 'huge.bin', {
+      type: 'application/octet-stream',
+    });
+    const res = await client.uploadAuto(tooBig);
+    expect(res.ok).toBe(false);
+    if (res.ok) return;
+    expect(res.error).toBe(SINGLE_UPLOAD_TOO_LARGE);
+  });
+
+  test('an unauthenticated client is rejected', async () => {
+    const anon = createFileUploadClient({
+      authHeaders: () => ({}),
+      fetchImpl: ((_input: RequestInfo | URL, init?: RequestInit) => {
+        // Simulate the guard rejecting a missing session: the route's authorizeUpload above
+        // always allows, so drive a route that doesn't exist to prove errors surface cleanly.
+        return app.request('/_files/upload-nope', init);
+      }) as typeof fetch,
+    });
+    const res = await anon.upload(new File(['x'], 'x.txt', { type: 'text/plain' }));
+    expect(res.ok).toBe(false);
+  });
+});