cursedbelt-server 4.0.0 → 4.1.0

package/dist/server/storage/binaryStoreFake.d.ts

@@ -0,0 +1,56 @@
+/**
+ * A `BinaryStore` that does nothing, so adding a method to the interface stops
+ * breaking twenty-two test files in apps nobody touched.
+ *
+ * ── The measurement (2026-09-08) ────────────────────────────────────────────
+ * `BinaryStore.fetchMedia` was added to serve audio off this Mac while
+ * Cloudflare's daily Worker quota was spent — a good change, landed on `main`,
+ * with apps/music green. It also broke **apps/collections and apps/roms**, four
+ * test files each, with `Property 'fetchMedia' is missing in type`. Both apps
+ * were left unable to typecheck, and therefore unable to gate or deploy, by a
+ * commit neither of them appears in. Nobody noticed for hours: a worker's
+ * `verify:scoped` only typechecks the workspaces its own diff touches, which is
+ * exactly the property that makes it fast.
+ *
+ * The owner's rule, in his words: *"a change to roms for example cannot block
+ * family tree app from passing its tests."* This is that rule for the one
+ * interface twenty-two suites all fake by hand.
+ *
+ * 🔴 **This is why the fake travels WITH the interface, into this package.** An
+ * interface whose change can break two other apps from a third app's commit is a
+ * shared interface already; a fake living in a different repo from the interface it
+ * fakes cannot do the job it exists for, because the two can be changed
+ * independently. Published as `cursedbelt-server/binary-store/testing`, beside
+ * `cursedbelt-server/binary-store` — the same split as `./d1` and `./d1/testing`, and
+ * for the same reason: a consumer's PRODUCTION graph must not be able to reach a
+ * fake.
+ *
+ * ── 🔴 Why defaults and not optional members ────────────────────────────────
+ * The obvious alternative is to mark each new capability `fetchMedia?:` on the
+ * interface. That moves the cost to every REAL consumer — each one then has to
+ * narrow before calling, for a method the production store always has — and it
+ * makes "did we implement this?" unanswerable by the typechecker, which is the
+ * one question the interface exists to answer. The fakes are the side that
+ * should absorb the change, so the defaults live here.
+ *
+ * ── What a default may do ───────────────────────────────────────────────────
+ * As little as possible, and never something a test could mistake for a result.
+ * `get` and `meta` answer "not here"; `fetchMedia` answers 404; the mutators do
+ * nothing. A suite that cares about any of them overrides it — spread this first
+ * and the file's own members win:
+ *
+ *     const store: BinaryStore = {
+ *       ...binaryStoreFakeDefaults("collections"),
+ *       async meta(key) { … what this suite is actually about … },
+ *     };
+ */
+import type { BinaryStore } from './binaryStore';
+/**
+ * Every member of {@link BinaryStore}, inert.
+ *
+ * @param appId the tenant the fake claims to be. Required, and deliberately so —
+ *        a blank tenant is the mistake `binaryStoreTenant` exists to catch, and a
+ *        fake that quietly defaults it would hide a test written against the
+ *        wrong app.
+ */
+export declare function binaryStoreFakeDefaults(appId: string): BinaryStore;

package/dist/server/storage/binaryStoreFake.js

@@ -0,0 +1,63 @@
+/**
+ * Every member of {@link BinaryStore}, inert.
+ *
+ * @param appId the tenant the fake claims to be. Required, and deliberately so —
+ *        a blank tenant is the mistake `binaryStoreTenant` exists to catch, and a
+ *        fake that quietly defaults it would hide a test written against the
+ *        wrong app.
+ */
+export function binaryStoreFakeDefaults(appId) {
+    return {
+        appId,
+        async put() { },
+        async putLarge() { },
+        async get() {
+            return null;
+        },
+        async meta() {
+            return null;
+        },
+        async stat() {
+            return null;
+        },
+        async has() {
+            return false;
+        },
+        // 🔴 `"unknown"`, never `"absent"`. A fake that claimed to know a key is missing
+        // would let a listing route's "answer only from the memo" branch look exercised
+        // when nothing was ever memoized — the one thing a test of that branch is for.
+        known() {
+            return 'unknown';
+        },
+        // 🔴 `0`, and never a lie about work done. The real one returns how many
+        // negative memos it dropped, and an app's repair route reports that number to
+        // the owner — a fake that invented one would make a broken repair read as a
+        // working one in the only test that could catch it.
+        forgetMisses() {
+            return 0;
+        },
+        cacheStats() {
+            return { present: 0, absent: 0 };
+        },
+        async remove() { },
+        async removePrefix() { },
+        async mediaUrl(key) {
+            // Carries the key, so an assertion on "which object was linked" reads.
+            return `https://binary-server.test/media/${appId}/${key}`;
+        },
+        async mediaPrefixUrl(prefix, master) {
+            // Carries BOTH, because the bug this shape exists to prevent is signing the wrong
+            // one of them — a URL pointing at the master but scoped to the wrong prefix 403s
+            // every segment while the master itself loads fine.
+            return `https://binary-server.test/media/${appId}/${master}?p=${encodeURIComponent(prefix)}`;
+        },
+        async fetchMedia() {
+            // 🔴 404, not an empty 200. A fake that answers "here are zero bytes" makes a
+            // streaming route look like it worked on an object that does not exist.
+            return new Response(null, { status: 404 });
+        },
+        async signToken(_claims, _ttlSeconds) {
+            return 'fake-token';
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.0.0",
+	"version": "4.1.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -54,6 +54,18 @@
 			"source": "./src/server/bench/index.ts",
 			"import": "./dist/server/bench/index.js"
 		},
+		"./binary-store": {
+			"types": "./dist/server/storage/binaryStore.d.ts",
+			"bun": "./src/server/storage/binaryStore.ts",
+			"source": "./src/server/storage/binaryStore.ts",
+			"import": "./dist/server/storage/binaryStore.js"
+		},
+		"./binary-store/testing": {
+			"types": "./dist/server/storage/binaryStoreFake.d.ts",
+			"bun": "./src/server/storage/binaryStoreFake.ts",
+			"source": "./src/server/storage/binaryStoreFake.ts",
+			"import": "./dist/server/storage/binaryStoreFake.js"
+		},
 		"./d1": {
 			"types": "./dist/server/d1/index.d.ts",
 			"bun": "./src/server/d1/index.ts",

package/src/leafSubpathsImportNothing.spec.ts

@@ -114,6 +114,30 @@ const LEAVES = [
     /** The failed-login backoff. Every app with a login door; shipped as 2.5.1. */
     evaluates: 'createLoginThrottle',
   },
+  {
+    subpath: './binary-store',
+    /**
+     * 🔴 The binary-server CLIENT, and the leaf whose promise is the largest. It arrived
+     * in 4.1.0 from five app-side copies, and it is the module that decides whether a ROM
+     * byte, a photograph, a song and a scanned document are readable — so every app takes
+     * it, and none of them may pay `sharp`/`otplib`/`kysely` for the privilege. It sits
+     * in `src/server/storage/` beside the file-catalogue and transcode graph, which is
+     * exactly the barrel this must never be reached through: `./storage`'s index is heavy
+     * and this module's whole point is that it costs `node:crypto` and nothing else.
+     */
+    evaluates: 'createBinaryStore',
+  },
+  {
+    subpath: './binary-store/testing',
+    /**
+     * The fake travels WITH the interface — it exists so that adding a method to
+     * `BinaryStore` stops breaking twenty-two suites in apps nobody touched, and a fake
+     * in a different package from its interface cannot do that job. Split from
+     * `./binary-store` so a consumer's PRODUCTION graph can never reach it, the same way
+     * `./d1/testing` is split from `./d1`.
+     */
+    evaluates: 'binaryStoreFakeDefaults',
+  },
 ] as const;
 
 /**