cursedbelt-server 4.21.0 → 4.22.0

package/dist/server/d1/localBackup.d.ts

@@ -82,4 +82,4 @@ export declare function createLocalBackup(opts: LocalBackupOpts): DatabaseBackup
  * a host that genuinely has both.
  */
 export declare function backupFor(flavor: 'local' | 'd1', local: () => LocalBackupOpts, remote: () => TimeTravelOpts): DatabaseBackup;
-export { type BackupSourceChoice, type BackupSourceInput, backupTables, chooseBackupSource, type PullD1Options, pullD1ToSqlite, servedRuntime, type Wrangler, } from './pullD1.js';
+export { type BackupSourceChoice, type BackupSourceInput, backupTables, chooseBackupSource, type PullD1Options, insertLines, pullD1ToSqlite, servedRuntime, spawnWrangler, stripTrailingNuls, type Wrangler, wranglerArgv, } from './pullD1.js';

package/dist/server/d1/localBackup.js

@@ -111,4 +111,4 @@ export function backupFor(flavor, local, remote) {
 // After a Worker cutover the live rows are D1's, and a Mac-hosted backup must pull them down
 // rather than snapshot the frozen file — see `./pullD1.ts`. Here, not in the `./d1` barrel,
 // for the reason this file's header gives: it reaches `bun:sqlite`.
-export { backupTables, chooseBackupSource, pullD1ToSqlite, servedRuntime, } from './pullD1.js';
+export { backupTables, chooseBackupSource, insertLines, pullD1ToSqlite, servedRuntime, spawnWrangler, stripTrailingNuls, wranglerArgv, } from './pullD1.js';

package/dist/server/d1/pullD1.d.ts

@@ -56,6 +56,30 @@ export type Wrangler = (args: string[]) => {
     stdout: string;
     stderr: string;
 };
+/**
+ * The argv that runs `wrangler`: THIS bun binary's `x`, never a bare `bunx` — a launchd job's
+ * PATH has no `bunx` (task 2112), and vault's and patterns' nightly backups each carried this
+ * line until 4.22.0.
+ */
+export declare const wranglerArgv: (bun?: string) => string[];
+/** The real {@link Wrangler}: `bun x wrangler …` in `cwd`, with `env` added to this process's. */
+export declare function spawnWrangler(options: {
+    cwd: string;
+    env?: Record<string, string | undefined>;
+}): Wrangler;
+/**
+ * 🔴 Trailing NUL bytes off a `wrangler d1 export` file, in place. Returns how many were removed.
+ *
+ * Measured 2026-09-23 on vault's D1 (wrangler 4.136.3): `wrangler d1 export --table … --output`
+ * INTERMITTENTLY ends the file in hundreds of NUL bytes (`entries` +988, `oplog` +1,369, `sync_ops`
+ * +5,476 across three runs — a different table each time, always trailing). `bun:sqlite`'s `exec`
+ * reads SQL as a C string, so the first NUL silently ended the load: every table after it came back
+ * EMPTY with no error, and vault's real backup held `vault_keys` = 0 rows (task 2128). Only
+ * TRAILING bytes: a NUL inside the SQL is a different fault, and the row-count check refuses it.
+ */
+export declare function stripTrailingNuls(file: string): number;
+/** `^INSERT INTO ` lines — one per row in a `wrangler d1 export --no-schema` dump. */
+export declare const insertLines: (dump: string) => number;
 /**
  * The tables a snapshot carries, from D1's own `sqlite_master` rows — every real table, and
  * none of what cannot or must not be re-inserted: a virtual table and its shadows (`_config`,

package/dist/server/d1/pullD1.js

@@ -27,7 +27,7 @@
  * (`./http.ts` has the measurement), and a restore must put back what was there.
  */
 import { Database } from 'bun:sqlite';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 /** Which side a backup must read. Pure, so every branch is testable without a network. */
 export function chooseBackupSource(input) {
     if (input.fromFileFlag) {
@@ -84,6 +84,48 @@ export async function servedRuntime(url, { attempts = 3, sleep = (ms) => new Pro
 }
 /** How many times one table's export is asked for when wrangler says success and writes nothing. */
 const EXPORT_ATTEMPTS = 3;
+/**
+ * The argv that runs `wrangler`: THIS bun binary's `x`, never a bare `bunx` — a launchd job's
+ * PATH has no `bunx` (task 2112), and vault's and patterns' nightly backups each carried this
+ * line until 4.22.0.
+ */
+export const wranglerArgv = (bun = process.execPath) => [bun, 'x', 'wrangler'];
+/** The real {@link Wrangler}: `bun x wrangler …` in `cwd`, with `env` added to this process's. */
+export function spawnWrangler(options) {
+    return (args) => {
+        const r = Bun.spawnSync([...wranglerArgv(), ...args], {
+            cwd: options.cwd,
+            env: { ...process.env, ...options.env },
+            stdout: 'pipe',
+            stderr: 'pipe',
+        });
+        return { code: r.exitCode ?? 1, stdout: r.stdout.toString(), stderr: r.stderr.toString() };
+    };
+}
+/**
+ * 🔴 Trailing NUL bytes off a `wrangler d1 export` file, in place. Returns how many were removed.
+ *
+ * Measured 2026-09-23 on vault's D1 (wrangler 4.136.3): `wrangler d1 export --table … --output`
+ * INTERMITTENTLY ends the file in hundreds of NUL bytes (`entries` +988, `oplog` +1,369, `sync_ops`
+ * +5,476 across three runs — a different table each time, always trailing). `bun:sqlite`'s `exec`
+ * reads SQL as a C string, so the first NUL silently ended the load: every table after it came back
+ * EMPTY with no error, and vault's real backup held `vault_keys` = 0 rows (task 2128). Only
+ * TRAILING bytes: a NUL inside the SQL is a different fault, and the row-count check refuses it.
+ */
+export function stripTrailingNuls(file) {
+    if (!existsSync(file))
+        return 0;
+    const bytes = readFileSync(file);
+    let end = bytes.length;
+    while (end > 0 && bytes[end - 1] === 0)
+        end--;
+    if (end === bytes.length)
+        return 0;
+    writeFileSync(file, bytes.subarray(0, end));
+    return bytes.length - end;
+}
+/** `^INSERT INTO ` lines — one per row in a `wrangler d1 export --no-schema` dump. */
+export const insertLines = (dump) => (dump.match(/^INSERT INTO /gm) ?? []).length;
 /**
  * The tables a snapshot carries, from D1's own `sqlite_master` rows — every real table, and
  * none of what cannot or must not be re-inserted: a virtual table and its shadows (`_config`,
@@ -123,50 +165,82 @@ export async function pullD1ToSqlite(options) {
         throw new Error(`D1 lists no \`${options.requiredTable}\` table (saw: ${rows.map((r) => r.name).join(', ') || 'nothing'})`);
     }
     let sql = '';
-    for (const table of tables) {
-        const dump = `${destination}.${table}.sql`;
-        // 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
-        // collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
-        // command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
-        // asked for again, twice, before it is a refusal; a failure that persists still refuses,
-        // because a snapshot missing a table is not a backup.
-        let exported = { code: 1, stdout: '', stderr: 'not attempted' };
-        for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
-            exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
-            if (exported.code !== 0 || existsSync(dump))
-                break;
+    const dumps = [];
+    try {
+        for (const table of tables) {
+            const dump = `${destination}.${table}.sql`;
+            // 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
+            // collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
+            // command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
+            // asked for again, twice, before it is a refusal; a failure that persists still refuses,
+            // because a snapshot missing a table is not a backup.
+            let exported = { code: 1, stdout: '', stderr: 'not attempted' };
+            for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
+                exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
+                if (exported.code !== 0 || existsSync(dump))
+                    break;
+            }
+            if (exported.code !== 0) {
+                throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
+            }
+            if (!existsSync(dump)) {
+                throw new Error(`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`);
+            }
+            stripTrailingNuls(dump);
+            const text = readFileSync(dump, 'utf8');
+            dumps.push({ table, text });
+            sql += `${text}\n`;
         }
-        if (exported.code !== 0) {
-            throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
+        if (!/INSERT INTO/i.test(sql)) {
+            throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
         }
-        if (!existsSync(dump)) {
-            throw new Error(`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`);
+        const db = new Database(destination, { create: true });
+        try {
+            // `exec`, not `run`: each is many statements and `run` would execute only the first,
+            // leaving a file with a schema and no rows that looks perfectly valid.
+            db.exec(options.schemaSql);
+            // 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
+            // dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
+            // cache its art job creates where it first needs it — made the whole pull refuse with
+            // `no such table`, because its rows were exported and its table was not in the schema.
+            const have = new Set(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name));
+            for (const row of rows) {
+                if (!tables.includes(row.name) || have.has(row.name) || !row.sql)
+                    continue;
+                db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
+            }
+            // One table at a time, so a fault is located rather than smeared over the whole load.
+            for (const { text } of dumps)
+                if (text.trim())
+                    db.exec(text);
+            if (options.afterLoadSql)
+                db.exec(options.afterLoadSql);
+            // 🔴 Every table holds as many rows as its dump has INSERTs, or this is not a backup: the
+            // check that makes a silently truncated load — the NUL padding, or whatever does it next —
+            // a REFUSAL. A row count only; nothing here reads what the rows hold.
+            const short = [];
+            for (const { table, text } of dumps) {
+                if (table === 'sqlite_sequence')
+                    continue;
+                const expected = insertLines(text);
+                const loaded = db.query(`SELECT COUNT(*) AS n FROM "${table.replaceAll('"', '""')}"`).get().n;
+                if (loaded < expected)
+                    short.push(`${table}: ${loaded} of ${expected}`);
+            }
+            if (short.length > 0) {
+                db.close();
+                rmSync(destination, { force: true });
+                throw new Error(`the D1 pull did not load every exported row — ${short.join('; ')}. Refusing the snapshot.`);
+            }
         }
-        sql += `${readFileSync(dump, 'utf8')}\n`;
-    }
-    if (!/INSERT INTO/i.test(sql)) {
-        throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
-    }
-    const db = new Database(destination, { create: true });
-    try {
-        // `exec`, not `run`: each is many statements and `run` would execute only the first,
-        // leaving a file with a schema and no rows that looks perfectly valid.
-        db.exec(options.schemaSql);
-        // 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
-        // dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
-        // cache its art job creates where it first needs it — made the whole pull refuse with
-        // `no such table`, because its rows were exported and its table was not in the schema.
-        const have = new Set(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name));
-        for (const row of rows) {
-            if (!tables.includes(row.name) || have.has(row.name) || !row.sql)
-                continue;
-            db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
+        finally {
+            db.close();
         }
-        db.exec(sql);
-        if (options.afterLoadSql)
-            db.exec(options.afterLoadSql);
     }
     finally {
-        db.close();
+        // The per-table dumps are a second, unmanaged copy of the data that no retention rule
+        // would ever delete — eighteen were found beside vault's snapshot (task 2128).
+        for (const table of tables)
+            rmSync(`${destination}.${table}.sql`, { force: true });
     }
 }

package/dist/server/master-lock/accountsPage.js

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE } from "./lockPage.js";
+import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_REVEAL_SOURCE, withRevealToggles } from "./lockPage.js";
 /**
  * The page's own two assets.
  *
@@ -59,7 +59,7 @@ export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 10;
 export function accountsPageHtml(options) {
     const label = escapeHtml(options.appLabel);
     const min = MASTER_LOCK_MIN_PASSWORD_LENGTH;
-    return `<!doctype html>
+    return withRevealToggles(`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -156,7 +156,7 @@ export function accountsPageHtml(options) {
 <script type="module" src="${MASTER_LOCK_ACCOUNTS_PAGE_PATHS.script}"></script>
 </body>
 </html>
-`;
+`);
 }
 /**
  * The page-specific stylesheet. Loaded AFTER `lock.css` and inheriting every `--ml-*` token
@@ -212,6 +212,10 @@ const MIN_LENGTH = ${MASTER_LOCK_MIN_PASSWORD_LENGTH};
 // ── derivation ───────────────────────────────────────────────────────────────
 ${MASTER_LOCK_DERIVE_SOURCE}
 
+// ── show / hide ──────────────────────────────────────────────────────────────
+${MASTER_LOCK_REVEAL_SOURCE}
+wireMasterLockReveal(document);
+
 const rotateForm = document.getElementById("ml-rotate");
 const addForm = document.getElementById("ml-add");
 const list = document.getElementById("ml-accounts");

package/dist/server/master-lock/lockPage.d.ts

@@ -21,7 +21,26 @@ export interface LockPageOptions {
  */
 export declare function lockPageHtml(options: LockPageOptions): string;
 /** The stylesheet. Follows the viewer's theme and commits to nothing else. */
-export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n";
+export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n.secret{position:relative;display:block}\n.secret input{padding-right:68px}\n.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;\n  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);\n  font-size:12.5px;font-weight:600}\n.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}\n.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}\n";
+/**
+ * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
+ * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
+ *
+ * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
+ * `<button type="button" data-reveal>` after it — the inputs keep every attribute, `autocomplete`
+ * included, so a password manager still sees a password field. Behaviour:
+ * {@link MASTER_LOCK_REVEAL_SOURCE}, interpolated into BOTH same-origin scripts, because the wall's
+ * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
+ * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
+ */
+export declare function withRevealToggles(html: string): string;
+/**
+ * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
+ * keeps `aria-pressed`/`aria-label` true to what is on screen, and returns every field to
+ * `password` when its form submits — so a manager saving the credential sees a password field.
+ * Publishes itself on `globalThis`, the seam `lockPage.spec.ts` drives it through.
+ */
+export declare const MASTER_LOCK_REVEAL_SOURCE = "function wireMasterLockReveal(doc) {\n  const buttons = doc.querySelectorAll(\"[data-reveal]\");\n  for (const button of buttons) {\n    const input = button.previousElementSibling;\n    if (!input || input.tagName !== \"INPUT\") continue;\n    const show = (on) => {\n      input.type = on ? \"text\" : \"password\";\n      button.setAttribute(\"aria-pressed\", on ? \"true\" : \"false\");\n      button.setAttribute(\"aria-label\", on ? \"Hide password\" : \"Show password\");\n      button.textContent = on ? \"Hide\" : \"Show\";\n    };\n    button.addEventListener(\"click\", () => {\n      show(input.type === \"password\");\n      input.focus();\n    });\n    input.form?.addEventListener(\"submit\", () => show(false), true);\n  }\n  return buttons.length;\n}\nglobalThis.wireMasterLockReveal = wireMasterLockReveal;";
 /**
  * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
  * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the

package/dist/server/master-lock/lockPage.js

@@ -41,7 +41,7 @@ export function lockPageHtml(options) {
                 "Choose one now. Nobody else can see it and nobody else can reset it — " +
                 "if you forget it, it cannot be recovered, so leave yourself a hint."
             : "This site is locked. Signing in is not enough — enter the master password to continue."));
-    return `<!doctype html>
+    return withRevealToggles(`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -88,7 +88,7 @@ export function lockPageHtml(options) {
 <script type="module" src="${MASTER_LOCK_PATHS.script}"></script>
 </body>
 </html>
-`;
+`);
 }
 /** The stylesheet. Follows the viewer's theme and commits to nothing else. */
 export const LOCK_STYLE = `:root{color-scheme:light dark;
@@ -128,7 +128,54 @@ button.quiet[disabled]{opacity:.5}
 .hints dt{font-weight:650;color:var(--ml-text)}
 .hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}
 .hints dd:last-child{margin-bottom:0}
+.secret{position:relative;display:block}
+.secret input{padding-right:68px}
+.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;
+  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);
+  font-size:12.5px;font-weight:600}
+.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}
+.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}
 `;
+/**
+ * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
+ * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
+ *
+ * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
+ * `<button type="button" data-reveal>` after it — the inputs keep every attribute, `autocomplete`
+ * included, so a password manager still sees a password field. Behaviour:
+ * {@link MASTER_LOCK_REVEAL_SOURCE}, interpolated into BOTH same-origin scripts, because the wall's
+ * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
+ * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
+ */
+export function withRevealToggles(html) {
+    return html.replace(/(<input\b[^>]*\btype="password"[^>]*>)/g, '<span class="secret">$1<button type="button" class="reveal" data-reveal aria-label="Show password" aria-pressed="false">Show</button></span>');
+}
+/**
+ * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
+ * keeps `aria-pressed`/`aria-label` true to what is on screen, and returns every field to
+ * `password` when its form submits — so a manager saving the credential sees a password field.
+ * Publishes itself on `globalThis`, the seam `lockPage.spec.ts` drives it through.
+ */
+export const MASTER_LOCK_REVEAL_SOURCE = `function wireMasterLockReveal(doc) {
+  const buttons = doc.querySelectorAll("[data-reveal]");
+  for (const button of buttons) {
+    const input = button.previousElementSibling;
+    if (!input || input.tagName !== "INPUT") continue;
+    const show = (on) => {
+      input.type = on ? "text" : "password";
+      button.setAttribute("aria-pressed", on ? "true" : "false");
+      button.setAttribute("aria-label", on ? "Hide password" : "Show password");
+      button.textContent = on ? "Hide" : "Show";
+    };
+    button.addEventListener("click", () => {
+      show(input.type === "password");
+      input.focus();
+    });
+    input.form?.addEventListener("submit", () => show(false), true);
+  }
+  return buttons.length;
+}
+globalThis.wireMasterLockReveal = wireMasterLockReveal;`;
 /**
  * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
  * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the
@@ -179,6 +226,10 @@ export const LOCK_SCRIPT = `const paths = ${JSON.stringify(MASTER_LOCK_PATHS)};
 // ── derivation ───────────────────────────────────────────────────────────────
 ${MASTER_LOCK_DERIVE_SOURCE}
 
+// ── show / hide ──────────────────────────────────────────────────────────────
+${MASTER_LOCK_REVEAL_SOURCE}
+wireMasterLockReveal(document);
+
 const form = document.getElementById("ml-form");
 const input = document.getElementById("ml-input");
 const confirmInput = document.getElementById("ml-confirm");

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.21.0",
+	"version": "4.22.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -213,7 +213,7 @@
 			"types": "./dist/server/auth/passwordCost.d.ts",
 			"bun": "./src/server/auth/passwordCost.ts",
 			"source": "./src/server/auth/passwordCost.ts",
-			"import": "./dist/server/_bunOnly.js"
+			"import": "./dist/server/auth/passwordCost.js"
 		},
 		"./request-log": {
 			"types": "./dist/server/requestLog/requestMetrics.d.ts",
@@ -302,7 +302,7 @@
 	},
 	"dependencies": {
 		"cursedbelt-core": "^2.1.1",
-		"cursedops": "^0.5.2",
+		"cursedops": "^0.6.0",
 		"cwip": "^4.6.0",
 		"jose": "^6.2.3"
 	},

package/src/server/d1/localBackup.ts

@@ -145,7 +145,11 @@ export {
 	backupTables,
 	chooseBackupSource,
 	type PullD1Options,
+	insertLines,
 	pullD1ToSqlite,
 	servedRuntime,
+	spawnWrangler,
+	stripTrailingNuls,
 	type Wrangler,
+	wranglerArgv,
 } from './pullD1.js';

package/src/server/d1/pullD1.spec.ts

@@ -1,9 +1,17 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, describe, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { backupTables, chooseBackupSource, pullD1ToSqlite, servedRuntime, type Wrangler } from './localBackup.js';
+import {
+	backupTables,
+	chooseBackupSource,
+	pullD1ToSqlite,
+	servedRuntime,
+	stripTrailingNuls,
+	type Wrangler,
+	wranglerArgv,
+} from './localBackup.js';
 
 const dirs: string[] = [];
 const scratch = (): string => {
@@ -198,6 +206,58 @@ describe('pulling D1 down — table by table, because a whole-database export re
 		await expect(pull(dir, run)).rejects.toThrow(/--table meta failed/);
 	});
 
+	test("🔴 bun:sqlite's exec stops at a NUL with no error — the defect, pinned (task 2128)", () => {
+		const db = new Database(':memory:');
+		db.exec('CREATE TABLE t (v TEXT)');
+		db.exec("INSERT INTO t VALUES('a');\n\0\0\nINSERT INTO t VALUES('lost');");
+		expect((db.query('SELECT COUNT(*) AS n FROM t').get() as { n: number }).n).toBe(1);
+		db.close();
+	});
+
+	test('🔴 a NUL-padded export still loads EVERY table (vault, 2026-09-23: vault_keys came back empty)', async () => {
+		const dir = scratch();
+		const { run } = fake((table) =>
+			table === 'items'
+				? `INSERT INTO items (id, name) VALUES ('itm_1', 'a');\n${'\0'.repeat(988)}`
+				: table === 'meta'
+					? "INSERT INTO meta (key, value) VALUES ('k', 'v');\nINSERT INTO meta (key, value) VALUES ('k2', 'v2');"
+					: '',
+		);
+		await pull(dir, run);
+		const db = new Database(join(dir, 'pulled.sqlite'), { readonly: true });
+		expect((db.query('SELECT COUNT(*) AS n FROM meta').get() as { n: number }).n).toBe(2);
+		db.close();
+	});
+
+	test('🔴 a load SHORT of its dump — whatever truncated it — is refused, and leaves no snapshot', async () => {
+		const dir = scratch();
+		// A NUL INSIDE the SQL (not trailing, so not stripped) ends the exec mid-table.
+		const { run } = fake((table) =>
+			table === 'items' ? "INSERT INTO items (id) VALUES ('a');\n\0\nINSERT INTO items (id) VALUES ('b');" : '',
+		);
+		await expect(pull(dir, run)).rejects.toThrow(/items: 1 of 2/);
+		expect(existsSync(join(dir, 'pulled.sqlite'))).toBe(false);
+	});
+
+	test('the per-table dumps are deleted — on success AND on a refusal', async () => {
+		const dir = scratch();
+		const { run } = fake((table) => (table === 'items' ? "INSERT INTO items (id) VALUES ('a');" : ''));
+		await pull(dir, run);
+		expect(readdirSync(dir).filter((f) => f.endsWith('.sql'))).toEqual([]);
+		const bad = fake((table) => (table === 'meta' ? null : "INSERT INTO items (id) VALUES ('x');"));
+		await expect(pull(scratch(), bad.run)).rejects.toThrow();
+	});
+
+	test('stripTrailingNuls strips only TRAILING NULs; wranglerArgv is this bun, never a bare bunx', () => {
+		const dir = scratch();
+		const f = join(dir, 'x.sql');
+		writeFileSync(f, 'a\0b\0\0\0');
+		expect(stripTrailingNuls(f)).toBe(3);
+		expect(readFileSync(f, 'utf8')).toBe('a\0b');
+		expect(stripTrailingNuls(f)).toBe(0);
+		expect(wranglerArgv('/x/bun')).toEqual(['/x/bun', 'x', 'wrangler']);
+	});
+
 	test('🔴 an export with no rows at all THROWS — never an empty library dated today', async () => {
 		const dir = scratch();
 		const { run } = fake(() => '');

package/src/server/d1/pullD1.ts

@@ -28,7 +28,7 @@
  */
 
 import { Database } from 'bun:sqlite';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 
 export type BackupSourceChoice = { kind: 'file' | 'd1' | 'refuse'; why: string };
 
@@ -103,6 +103,49 @@ const EXPORT_ATTEMPTS = 3;
 /** One `wrangler` invocation, as {@link pullD1ToSqlite} needs it. Injected so a spec runs none. */
 export type Wrangler = (args: string[]) => { code: number; stdout: string; stderr: string };
 
+/**
+ * The argv that runs `wrangler`: THIS bun binary's `x`, never a bare `bunx` — a launchd job's
+ * PATH has no `bunx` (task 2112), and vault's and patterns' nightly backups each carried this
+ * line until 4.22.0.
+ */
+export const wranglerArgv = (bun: string = process.execPath): string[] => [bun, 'x', 'wrangler'];
+
+/** The real {@link Wrangler}: `bun x wrangler …` in `cwd`, with `env` added to this process's. */
+export function spawnWrangler(options: { cwd: string; env?: Record<string, string | undefined> }): Wrangler {
+	return (args) => {
+		const r = Bun.spawnSync([...wranglerArgv(), ...args], {
+			cwd: options.cwd,
+			env: { ...process.env, ...options.env },
+			stdout: 'pipe',
+			stderr: 'pipe',
+		});
+		return { code: r.exitCode ?? 1, stdout: r.stdout.toString(), stderr: r.stderr.toString() };
+	};
+}
+
+/**
+ * 🔴 Trailing NUL bytes off a `wrangler d1 export` file, in place. Returns how many were removed.
+ *
+ * Measured 2026-09-23 on vault's D1 (wrangler 4.136.3): `wrangler d1 export --table … --output`
+ * INTERMITTENTLY ends the file in hundreds of NUL bytes (`entries` +988, `oplog` +1,369, `sync_ops`
+ * +5,476 across three runs — a different table each time, always trailing). `bun:sqlite`'s `exec`
+ * reads SQL as a C string, so the first NUL silently ended the load: every table after it came back
+ * EMPTY with no error, and vault's real backup held `vault_keys` = 0 rows (task 2128). Only
+ * TRAILING bytes: a NUL inside the SQL is a different fault, and the row-count check refuses it.
+ */
+export function stripTrailingNuls(file: string): number {
+	if (!existsSync(file)) return 0;
+	const bytes = readFileSync(file);
+	let end = bytes.length;
+	while (end > 0 && bytes[end - 1] === 0) end--;
+	if (end === bytes.length) return 0;
+	writeFileSync(file, bytes.subarray(0, end));
+	return bytes.length - end;
+}
+
+/** `^INSERT INTO ` lines — one per row in a `wrangler d1 export --no-schema` dump. */
+export const insertLines = (dump: string): number => (dump.match(/^INSERT INTO /gm) ?? []).length;
+
 /**
  * The tables a snapshot carries, from D1's own `sqlite_master` rows — every real table, and
  * none of what cannot or must not be re-inserted: a virtual table and its shadows (`_config`,
@@ -161,51 +204,77 @@ export async function pullD1ToSqlite(options: PullD1Options): Promise<void> {
 	}
 
 	let sql = '';
-	for (const table of tables) {
-		const dump = `${destination}.${table}.sql`;
-		// 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
-		// collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
-		// command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
-		// asked for again, twice, before it is a refusal; a failure that persists still refuses,
-		// because a snapshot missing a table is not a backup.
-		let exported = { code: 1, stdout: '', stderr: 'not attempted' };
-		for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
-			exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
-			if (exported.code !== 0 || existsSync(dump)) break;
+	const dumps: { table: string; text: string }[] = [];
+	try {
+		for (const table of tables) {
+			const dump = `${destination}.${table}.sql`;
+			// 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
+			// collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
+			// command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
+			// asked for again, twice, before it is a refusal; a failure that persists still refuses,
+			// because a snapshot missing a table is not a backup.
+			let exported = { code: 1, stdout: '', stderr: 'not attempted' };
+			for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
+				exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
+				if (exported.code !== 0 || existsSync(dump)) break;
+			}
+			if (exported.code !== 0) {
+				throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
+			}
+			if (!existsSync(dump)) {
+				throw new Error(
+					`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`,
+				);
+			}
+			stripTrailingNuls(dump);
+			const text = readFileSync(dump, 'utf8');
+			dumps.push({ table, text });
+			sql += `${text}\n`;
 		}
-		if (exported.code !== 0) {
-			throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
+		if (!/INSERT INTO/i.test(sql)) {
+			throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
 		}
-		if (!existsSync(dump)) {
-			throw new Error(
-				`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`,
-			);
-		}
-		sql += `${readFileSync(dump, 'utf8')}\n`;
-	}
-	if (!/INSERT INTO/i.test(sql)) {
-		throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
-	}
 
-	const db = new Database(destination, { create: true });
-	try {
-		// `exec`, not `run`: each is many statements and `run` would execute only the first,
-		// leaving a file with a schema and no rows that looks perfectly valid.
-		db.exec(options.schemaSql);
-		// 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
-		// dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
-		// cache its art job creates where it first needs it — made the whole pull refuse with
-		// `no such table`, because its rows were exported and its table was not in the schema.
-		const have = new Set(
-			(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all() as { name: string }[]).map((r) => r.name),
-		);
-		for (const row of rows) {
-			if (!tables.includes(row.name) || have.has(row.name) || !row.sql) continue;
-			db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
+		const db = new Database(destination, { create: true });
+		try {
+			// `exec`, not `run`: each is many statements and `run` would execute only the first,
+			// leaving a file with a schema and no rows that looks perfectly valid.
+			db.exec(options.schemaSql);
+			// 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
+			// dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
+			// cache its art job creates where it first needs it — made the whole pull refuse with
+			// `no such table`, because its rows were exported and its table was not in the schema.
+			const have = new Set(
+				(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all() as { name: string }[]).map((r) => r.name),
+			);
+			for (const row of rows) {
+				if (!tables.includes(row.name) || have.has(row.name) || !row.sql) continue;
+				db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
+			}
+			// One table at a time, so a fault is located rather than smeared over the whole load.
+			for (const { text } of dumps) if (text.trim()) db.exec(text);
+			if (options.afterLoadSql) db.exec(options.afterLoadSql);
+			// 🔴 Every table holds as many rows as its dump has INSERTs, or this is not a backup: the
+			// check that makes a silently truncated load — the NUL padding, or whatever does it next —
+			// a REFUSAL. A row count only; nothing here reads what the rows hold.
+			const short: string[] = [];
+			for (const { table, text } of dumps) {
+				if (table === 'sqlite_sequence') continue;
+				const expected = insertLines(text);
+				const loaded = (db.query(`SELECT COUNT(*) AS n FROM "${table.replaceAll('"', '""')}"`).get() as { n: number }).n;
+				if (loaded < expected) short.push(`${table}: ${loaded} of ${expected}`);
+			}
+			if (short.length > 0) {
+				db.close();
+				rmSync(destination, { force: true });
+				throw new Error(`the D1 pull did not load every exported row — ${short.join('; ')}. Refusing the snapshot.`);
+			}
+		} finally {
+			db.close();
 		}
-		db.exec(sql);
-		if (options.afterLoadSql) db.exec(options.afterLoadSql);
 	} finally {
-		db.close();
+		// The per-table dumps are a second, unmanaged copy of the data that no retention rule
+		// would ever delete — eighteen were found beside vault's snapshot (task 2128).
+		for (const table of tables) rmSync(`${destination}.${table}.sql`, { force: true });
 	}
 }

package/src/server/master-lock/accountsPage.ts

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions } from "./lockPage.js";
+import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_REVEAL_SOURCE, type LockPageOptions, withRevealToggles } from "./lockPage.js";
 
 /**
  * The page's own two assets.
@@ -67,7 +67,7 @@ export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 10;
 export function accountsPageHtml(options: LockPageOptions): string {
 	const label = escapeHtml(options.appLabel);
 	const min = MASTER_LOCK_MIN_PASSWORD_LENGTH;
-	return `<!doctype html>
+	return withRevealToggles(`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -164,7 +164,7 @@ export function accountsPageHtml(options: LockPageOptions): string {
 <script type="module" src="${MASTER_LOCK_ACCOUNTS_PAGE_PATHS.script}"></script>
 </body>
 </html>
-`;
+`);
 }
 
 /**
@@ -222,6 +222,10 @@ const MIN_LENGTH = ${MASTER_LOCK_MIN_PASSWORD_LENGTH};
 // ── derivation ───────────────────────────────────────────────────────────────
 ${MASTER_LOCK_DERIVE_SOURCE}
 
+// ── show / hide ──────────────────────────────────────────────────────────────
+${MASTER_LOCK_REVEAL_SOURCE}
+wireMasterLockReveal(document);
+
 const rotateForm = document.getElementById("ml-rotate");
 const addForm = document.getElementById("ml-add");
 const list = document.getElementById("ml-accounts");

package/src/server/master-lock/lockPage.spec.ts

@@ -13,8 +13,16 @@
  */
 import { describe, expect, test } from "bun:test";
 import { MASTER_LOCK_PATHS, type MasterLockKdfParams, deriveMasterLockVerifier } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_ACCOUNTS_SCRIPT } from "./accountsPage.js";
-import { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml } from "./lockPage.js";
+import { accountsPageHtml, MASTER_LOCK_ACCOUNTS_SCRIPT } from "./accountsPage.js";
+import { MASTER_LOCK_CSP } from "./guard.js";
+import {
+	LOCK_SCRIPT,
+	LOCK_STYLE,
+	MASTER_LOCK_DERIVE_SOURCE,
+	MASTER_LOCK_REVEAL_SOURCE,
+	lockPageHtml,
+	withRevealToggles,
+} from "./lockPage.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,
@@ -90,3 +98,55 @@ describe("the page itself", () => {
 		expect(LOCK_STYLE).not.toContain("@import");
 	});
 });
+
+describe("🔴 every password field on the wall can be shown and hidden (task 077-438)", () => {
+	const pages = {
+		"lock (unlock)": lockPageHtml({ appLabel: "Vault" }),
+		"lock (enroll)": lockPageHtml({ appLabel: "Vault", enroll: true }),
+		accounts: accountsPageHtml({ appLabel: "Vault" }),
+	};
+
+	for (const [name, html] of Object.entries(pages)) {
+		test(`${name}: one Show control per password input, each input keeping its autocomplete`, () => {
+			const inputs = [...html.matchAll(/<input\b[^>]*\btype="password"[^>]*>/g)].map((m) => m[0]);
+			expect(inputs.length).toBeGreaterThan(0);
+			expect((html.match(/data-reveal/g) ?? []).length).toBe(inputs.length);
+			for (const input of inputs) expect(input).toMatch(/autocomplete="(current|new)-password"/);
+			// …and still no inline script: the behaviour ships in the same-origin file.
+			expect(html).not.toMatch(/<script(?![^>]*\bsrc=)[^>]*>/);
+		});
+	}
+
+	test("both served scripts carry the ONE reveal source and call it", () => {
+		for (const script of [LOCK_SCRIPT, MASTER_LOCK_ACCOUNTS_SCRIPT]) {
+			expect(script).toContain(MASTER_LOCK_REVEAL_SOURCE);
+			expect(script).toContain("wireMasterLockReveal(document);");
+		}
+	});
+
+	test("clicking shows, clicking again hides, and a submit returns the field to a password", () => {
+		document.body.innerHTML = withRevealToggles(
+			'<form><input type="password" name="p" autocomplete="current-password"><button type="submit">Go</button></form>',
+		);
+		const wire = new Function(`${MASTER_LOCK_REVEAL_SOURCE}\nreturn globalThis.wireMasterLockReveal;`)() as (d: Document) => number;
+		expect(wire(document)).toBe(1);
+		const input = document.querySelector("input") as HTMLInputElement;
+		const button = document.querySelector("[data-reveal]") as HTMLButtonElement;
+		button.click();
+		expect(input.type).toBe("text");
+		expect(button.getAttribute("aria-pressed")).toBe("true");
+		expect(button.getAttribute("aria-label")).toBe("Hide password");
+		button.click();
+		expect(input.type).toBe("password");
+		button.click();
+		(document.querySelector("form") as HTMLFormElement).dispatchEvent(new Event("submit", { cancelable: true }));
+		expect(input.type).toBe("password");
+		expect(button.type).toBe("button"); // never submits the form itself
+	});
+
+	test("🔴 the CSP is unchanged — still no inline script and nothing off-origin", () => {
+		expect(MASTER_LOCK_CSP).toContain("script-src 'self'");
+		expect(MASTER_LOCK_CSP).not.toContain("unsafe-inline");
+		expect(MASTER_LOCK_CSP).not.toMatch(/nonce-|sha256-/);
+	});
+});

package/src/server/master-lock/lockPage.ts

@@ -67,7 +67,7 @@ export function lockPageHtml(options: LockPageOptions): string {
 					"if you forget it, it cannot be recovered, so leave yourself a hint."
 				: "This site is locked. Signing in is not enough — enter the master password to continue."),
 	);
-	return `<!doctype html>
+	return withRevealToggles(`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -120,7 +120,7 @@ export function lockPageHtml(options: LockPageOptions): string {
 <script type="module" src="${MASTER_LOCK_PATHS.script}"></script>
 </body>
 </html>
-`;
+`);
 }
 
 /** The stylesheet. Follows the viewer's theme and commits to nothing else. */
@@ -161,8 +161,60 @@ button.quiet[disabled]{opacity:.5}
 .hints dt{font-weight:650;color:var(--ml-text)}
 .hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}
 .hints dd:last-child{margin-bottom:0}
+.secret{position:relative;display:block}
+.secret input{padding-right:68px}
+.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;
+  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);
+  font-size:12.5px;font-weight:600}
+.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}
+.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}
 `;
 
+/**
+ * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
+ * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
+ *
+ * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
+ * `<button type="button" data-reveal>` after it — the inputs keep every attribute, `autocomplete`
+ * included, so a password manager still sees a password field. Behaviour:
+ * {@link MASTER_LOCK_REVEAL_SOURCE}, interpolated into BOTH same-origin scripts, because the wall's
+ * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
+ * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
+ */
+export function withRevealToggles(html: string): string {
+	return html.replace(
+		/(<input\b[^>]*\btype="password"[^>]*>)/g,
+		'<span class="secret">$1<button type="button" class="reveal" data-reveal aria-label="Show password" aria-pressed="false">Show</button></span>',
+	);
+}
+
+/**
+ * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
+ * keeps `aria-pressed`/`aria-label` true to what is on screen, and returns every field to
+ * `password` when its form submits — so a manager saving the credential sees a password field.
+ * Publishes itself on `globalThis`, the seam `lockPage.spec.ts` drives it through.
+ */
+export const MASTER_LOCK_REVEAL_SOURCE = `function wireMasterLockReveal(doc) {
+  const buttons = doc.querySelectorAll("[data-reveal]");
+  for (const button of buttons) {
+    const input = button.previousElementSibling;
+    if (!input || input.tagName !== "INPUT") continue;
+    const show = (on) => {
+      input.type = on ? "text" : "password";
+      button.setAttribute("aria-pressed", on ? "true" : "false");
+      button.setAttribute("aria-label", on ? "Hide password" : "Show password");
+      button.textContent = on ? "Hide" : "Show";
+    };
+    button.addEventListener("click", () => {
+      show(input.type === "password");
+      input.focus();
+    });
+    input.form?.addEventListener("submit", () => show(false), true);
+  }
+  return buttons.length;
+}
+globalThis.wireMasterLockReveal = wireMasterLockReveal;`;
+
 /**
  * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
  * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the
@@ -214,6 +266,10 @@ export const LOCK_SCRIPT = `const paths = ${JSON.stringify(MASTER_LOCK_PATHS)};
 // ── derivation ───────────────────────────────────────────────────────────────
 ${MASTER_LOCK_DERIVE_SOURCE}
 
+// ── show / hide ──────────────────────────────────────────────────────────────
+${MASTER_LOCK_REVEAL_SOURCE}
+wireMasterLockReveal(document);
+
 const form = document.getElementById("ml-form");
 const input = document.getElementById("ml-input");
 const confirmInput = document.getElementById("ml-confirm");

package/src/server/telemetryIsWorkerSafe.spec.ts

@@ -25,6 +25,24 @@ function runtimeGraph(entry: string): { files: string[]; bunImports: string[] }
 	return { files: [...seen], bunImports };
 }
 
+describe('🔴 cursedbelt-server/password — a Worker can import it (task 2129)', () => {
+	test('reaches no `bun:` module at runtime; `Bun.password` is touched only at CALL time', () => {
+		const { files, bunImports } = runtimeGraph(join(import.meta.dir, 'auth', 'passwordCost.ts'));
+		expect(bunImports).toEqual([]);
+		expect(files.some((f) => f.endsWith('passwordCost.ts'))).toBe(true);
+	});
+
+	test("its export map's `import` is the real module, not the Bun-only refusal", () => {
+		// Until 4.22.0 it was `_bunOnly.js`, and a Worker bundle (esbuild resolves `import`, never
+		// `bun`) failed: No matching export in "…/_bunOnly.js" for import "hashSecret". So patterns
+		// and vault kept copies of the cost decision — the security-relevant half.
+		const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', '..', 'package.json'), 'utf8')) as {
+			exports: Record<string, { import?: string }>;
+		};
+		expect(pkg.exports['./password']?.import).toBe('./dist/server/auth/passwordCost.js');
+	});
+});
+
 describe('cursedbelt-server/telemetry', () => {
 	test('🔴 reaches no `bun:` module at runtime — a Worker can import it', () => {
 		const { files, bunImports } = runtimeGraph(join(import.meta.dir, 'telemetry.ts'));