cursedbelt-server 4.23.0 → 4.24.0

package/README.md

@@ -49,6 +49,14 @@ about the whole options object rather than the one field. Use `serveBun(app, { w
 which takes it as a genuinely optional field and makes the two concrete calls itself.
 `src/server/serveBunOverload.spec.ts` runs `tsc` on the trap and goes red when bun's types change.
 
+## 🔴 argon2id on a Worker: `cursedbelt-server/worker-argon2`
+
+A Worker may not COMPILE WebAssembly, and pure-JS argon2id costs ~2.8 s of billed CPU per
+derivation on workerd (collections' unlock was 8.5 s). `installBunPasswordShim()` first thing in
+the Worker's `fetch` gives `Bun.password` to the auth code, backed by `argon2id`'s two `.wasm`
+files as static imports that wrangler bundles from `node_modules`. No wrangler rule and no local
+`.wasm` declaration are needed. `src/server/worker-argon2/argon2.ts` has the measurements.
+
 ## Standards
 
 `docs/retention.md`, `docs/activity.md`, `docs/notifications.md`, `docs/engagement.md` — the

package/dist/server/worker-argon2/argon2.d.ts

@@ -0,0 +1,11 @@
+import { type computeHash } from "argon2id/lib/setup.js";
+/** What a `.wasm` import is: a compiled module under wrangler, a file path under Bun. */
+export type WasmImport = WebAssembly.Module | string;
+/**
+ * Turn one `.wasm` import into an instance. 🔴 A `Module` is instantiated and NEVER compiled —
+ * that is the whole workerd rule — and only a path (Bun) is read and compiled.
+ */
+export declare function instantiateWasm(source: WasmImport, imports: WebAssembly.Imports): Promise<WebAssembly.WebAssemblyInstantiatedSource>;
+/** Build a hasher from the two binaries — SIMD first, the plain one if SIMD will not load. */
+export declare function loadArgon2(simd?: WasmImport, noSimd?: WasmImport): Promise<computeHash>;
+export declare function argon2(): Promise<computeHash>;

package/dist/server/worker-argon2/argon2.js

@@ -0,0 +1,71 @@
+/**
+ * argon2id as WebAssembly the Worker was HANDED, never WebAssembly it compiles.
+ *
+ * ## 🔴 Why this file exists: one unlock was 8.5–15 seconds of billed CPU
+ *
+ * `collections` averaged **489 CPU-ms per request on 2026-09-22 with a 15.2 s p99** (Cloudflare
+ * GraphQL, `workersInvocationsAdaptive`). Every second of it was `POST /__lock/unlock`: a real
+ * `wrangler tail` of the stage walk on 2026-09-23 read **8,519 CPU-ms and 10.4 s wall** for that
+ * one request and 10–38 ms for each of the other eleven. The lock verifies every account's
+ * argon2id hash (no early exit — `cursedbelt-server/master-lock` explains the timing oracle) plus
+ * a timing equalizer, so production's two accounts are three to four derivations per unlock, and
+ * `@noble/hashes`' pure-JS argon2id costs ~2.8 s each on workerd — five times the 562 ms it
+ * costs on this Mac. The owner waited ten seconds at the lock page, and a third account would
+ * have put the unlock within reach of the Worker's 30 s CPU ceiling, where it is killed and
+ * reads as a wrong password.
+ *
+ * ## 🔴 Why this shape: workerd refuses to COMPILE WebAssembly, not to RUN it
+ *
+ * `hash-wasm` failed here on 2026-09-18 with `Wasm code generation disallowed by embedder`
+ * because it compiles bytes it carries inline (`./password.ts` has the whole story). A
+ * `.wasm` file that is a STATIC import is different: wrangler bundles it as a
+ * `CompiledWasm` module and the runtime hands this code a ready `WebAssembly.Module`, which
+ * `WebAssembly.instantiate(module, imports)` may instantiate. `argon2id` (openpgpjs, MIT) ships
+ * its two binaries as plain files and lets the caller do the instantiating, which is exactly the
+ * seam a Worker needs. Its default entry inlines base64 and compiles it — so it is never imported.
+ *
+ * Under Bun (every test, and the Mac) the same import is a PATH STRING, so the bytes are read
+ * and compiled here — which Bun allows. `index.spec.ts` drives the Worker's branch too, with
+ * `WebAssembly.compile` made to throw exactly as workerd throws.
+ *
+ * ## Why it lives in `cursedbelt-server` (4.24.0)
+ *
+ * It was born in `apps/collections/worker/argon2.ts` (commit 7996ded) while `apps/vault` and
+ * `apps/patterns` still carried the pure-JS copy, so every sign-in there billed seconds. One copy
+ * here, `argon2id` a pinned dependency of this package: its two `.wasm` files ship in its own
+ * `files`, and wrangler — which resolves this subpath's `import` condition, `dist/…/argon2.js`,
+ * where tsc leaves the bare `argon2id/dist/*.wasm` specifiers untouched — bundles them from
+ * `node_modules` as `CompiledWasm`. `index.spec.ts` asserts `dist` still carries them that way.
+ */
+import noSimdWasm from "argon2id/dist/no-simd.wasm";
+import simdWasm from "argon2id/dist/simd.wasm";
+import setupWasm, {} from "argon2id/lib/setup.js";
+/**
+ * Turn one `.wasm` import into an instance. 🔴 A `Module` is instantiated and NEVER compiled —
+ * that is the whole workerd rule — and only a path (Bun) is read and compiled.
+ */
+export async function instantiateWasm(source, imports) {
+    const module = typeof source === "string" ? await WebAssembly.compile(await Bun.file(source).arrayBuffer()) : source;
+    const instance = await WebAssembly.instantiate(module, imports);
+    return { module, instance };
+}
+/** Build a hasher from the two binaries — SIMD first, the plain one if SIMD will not load. */
+export function loadArgon2(simd = simdWasm, noSimd = noSimdWasm) {
+    return setupWasm((imports) => instantiateWasm(simd, imports), (imports) => instantiateWasm(noSimd, imports));
+}
+/*
+ * 🔴 ONE hasher per isolate, built on first use. Not request state — it holds no password and no
+ * result between calls (the library clears its memory after each) — so this is the one kind of
+ * module-scope value a Worker may keep. The reason to keep it is MEMORY: each
+ * instance owns a 65 MB `WebAssembly.Memory` that can never shrink, and an unlock runs three or
+ * four derivations back to back; one per call would stack up to four of them against a 128 MB
+ * isolate before a collector ran. A load that FAILS is not cached, so the next unlock retries.
+ */
+let shared = null;
+export function argon2() {
+    shared ??= loadArgon2().catch((error) => {
+        shared = null;
+        throw error;
+    });
+    return shared;
+}

package/dist/server/worker-argon2/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `cursedbelt-server/worker-argon2` — argon2id a Cloudflare Worker can afford, and the
+ * `Bun.password` shim that lets the same auth code verify on the Mac and on the edge.
+ *
+ * `./argon2.ts` is the WHY (8.5 s of billed CPU per unlock in pure JS; workerd forbids compiling
+ * WebAssembly, so the `.wasm` is a static import wrangler bundles); `./password.ts` is the shim.
+ */
+export { argon2, instantiateWasm, loadArgon2, type WasmImport } from "./argon2.js";
+export { type BunPasswordShim, installBunPasswordShim, parsePhc, workerPassword } from "./password.js";

package/dist/server/worker-argon2/index.js

@@ -0,0 +1,9 @@
+/**
+ * `cursedbelt-server/worker-argon2` — argon2id a Cloudflare Worker can afford, and the
+ * `Bun.password` shim that lets the same auth code verify on the Mac and on the edge.
+ *
+ * `./argon2.ts` is the WHY (8.5 s of billed CPU per unlock in pure JS; workerd forbids compiling
+ * WebAssembly, so the `.wasm` is a static import wrangler bundles); `./password.ts` is the shim.
+ */
+export { argon2, instantiateWasm, loadArgon2 } from "./argon2.js";
+export { installBunPasswordShim, parsePhc, workerPassword } from "./password.js";

package/dist/server/worker-argon2/password.d.ts

@@ -0,0 +1,26 @@
+interface Phc {
+    m: number;
+    t: number;
+    p: number;
+    salt: Uint8Array;
+    hash: Uint8Array;
+}
+/** `$argon2id$v=19$m=65536,t=2,p=1$<salt>$<hash>` → its parts, or null. */
+export declare function parsePhc(encoded: string): Phc | null;
+export interface BunPasswordShim {
+    verify(password: string, hash: string): Promise<boolean>;
+    hash(password: string, options?: {
+        algorithm?: string;
+        memoryCost?: number;
+        timeCost?: number;
+    }): Promise<string>;
+}
+export declare const workerPassword: BunPasswordShim;
+/**
+ * Install the shim, once, before any route can run.
+ *
+ * Idempotent, and it never overwrites a real `Bun` — so importing this module in a
+ * Bun test does nothing, which is what keeps the gate honest about the Mac.
+ */
+export declare function installBunPasswordShim(): void;
+export {};

package/dist/server/worker-argon2/password.js

@@ -0,0 +1,164 @@
+/**
+ * argon2id on `workerd`, where the obvious answer does not work.
+ *
+ * ## 🔴 The finding, and it applies to every app in this fleet
+ *
+ * **A Worker may not compile WebAssembly at runtime.** `hash-wasm` — the first and
+ * most natural choice, and the one every search result recommends — inlines its
+ * argon2 module as base64 and calls `WebAssembly.compile(bytes)` on first use.
+ * Deployed here on 2026-09-18, that produced:
+ *
+ * ```
+ * [patterns] argon2 verification threw:   ← the pilot's log line, quoted verbatim
+ *   WebAssembly.compile(): Wasm code generation disallowed by embedder
+ * ```
+ *
+ * It **builds, deploys and starts perfectly**, and fails only when somebody tries
+ * to sign in — where it is indistinguishable from a wrong password, because a KDF
+ * that throws must fail closed. That combination is the worst shape a defect can
+ * have, and it is why `verify` below logs the error: a silent `false` cost a
+ * diagnosis on the day this was written. On Workers, WASM must be a *static
+ * import* of a `.wasm` file that wrangler bundles as a module; a library that
+ * carries its bytes inline can never satisfy that.
+ *
+ * So this runs **argon2id as WebAssembly that wrangler bundles as a static module** —
+ * `./argon2.ts`, which instantiates a `WebAssembly.Module` it was handed and never compiles
+ * one. Until 2026-09-23 it was `@noble/hashes/argon2`, pure JavaScript: byte-identical output
+ * and 562 ms per verification on this Mac, which read as acceptable — and on workerd it was
+ * **~2.8 s per derivation**, so one unlock (every account's hash plus the timing equalizer)
+ * billed 8.5 s on the stage and 15 s in production, and was 489 CPU-ms averaged over every
+ * request the app served on 2026-09-22. `./argon2.ts` carries the measurement.
+ * `cursedbelt-server/login-throttle` is what holds the line against a flood, not the KDF's cost.
+ *
+ * ## What this buys, and it is the reason to pay for argon2id at all
+ *
+ * **The owner's existing password hash works on a Worker unchanged.** No re-hash,
+ * no "sign in again on the new host", and above all no downgrade to PBKDF2 to fit
+ * the runtime — `ownerAuth.ts` argues at length for argon2id over a fast KDF, and
+ * a port that quietly swapped it would have thrown that argument away for a
+ * platform detail. Same PHC string, same parameters, same answer.
+ *
+ * ## Why a GLOBAL shim rather than an injected verifier
+ *
+ * `Bun.password` is reached from three files (`auth.ts`, `ownerAuth.ts`,
+ * `cursedbelt-server/password`), and `Bun.` is a *global property access*, not an import — so
+ * a Worker bundle containing it builds fine and throws `Bun is not defined` only
+ * when a login happens. Threading a verifier through three signatures would be
+ * three more places for the Mac and the edge to disagree. Installing the global
+ * instead keeps the auth tier byte-identical on both runtimes, which is the same
+ * argument the apps' `store.ts` make for the async database seam.
+ *
+ * Used by `collections`, `vault` and `patterns` (each app's `worker/index.ts` calls
+ * {@link installBunPasswordShim} first thing). In `vault` this is ONLY the sign-in / lock
+ * verifier: the vault's ciphertext is derived and opened in the browser and never comes near it.
+ */
+import { constantTimeEqualBytes } from "cwip/constant-time";
+import { argon2 } from "./argon2.js";
+/** What Bun's `argon2id` default writes, so a hash minted here matches one minted there. */
+const DEFAULT_MEMORY_KIB = 65_536;
+const DEFAULT_ITERATIONS = 2;
+const DEFAULT_PARALLELISM = 1;
+const HASH_BYTES = 32;
+// 32, matching what `Bun.password.hash` actually writes — measured 2026-09-18.
+const SALT_BYTES = 32;
+/**
+ * argon2's PHC encoding is base64 **without padding**, and with the standard
+ * alphabet rather than base64url. Getting either wrong yields a salt that decodes
+ * to the wrong bytes and a verification that fails for a correct password.
+ */
+const b64decode = (value) => {
+    const padded = value + "===".slice((value.length + 3) % 4);
+    return Uint8Array.from(atob(padded), (ch) => ch.charCodeAt(0));
+};
+const b64encode = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/=+$/, "");
+/** `$argon2id$v=19$m=65536,t=2,p=1$<salt>$<hash>` → its parts, or null. */
+export function parsePhc(encoded) {
+    const parts = encoded.split("$");
+    // ["", "argon2id", "v=19", "m=...,t=...,p=...", salt, hash]
+    if (parts.length !== 6 || parts[1] !== "argon2id")
+        return null;
+    const params = new Map(parts[3].split(",").map((pair) => {
+        const [key, value] = pair.split("=");
+        return [key, Number(value)];
+    }));
+    const m = params.get("m");
+    const t = params.get("t");
+    const p = params.get("p");
+    if (!m || !t || !p)
+        return null;
+    try {
+        return { m, t, p, salt: b64decode(parts[4]), hash: b64decode(parts[5]) };
+    }
+    catch {
+        return null;
+    }
+}
+export const workerPassword = {
+    async verify(password, encoded) {
+        if (!password || !encoded)
+            return false;
+        try {
+            const phc = parsePhc(encoded);
+            if (!phc)
+                return false;
+            const derive = await argon2();
+            const derived = derive({
+                password: new TextEncoder().encode(password),
+                salt: phc.salt,
+                // 🔴 The STORED parameters, never this file's defaults. A hash written
+                // under a different cost must still verify, or rotating the cost locks
+                // the owner out of their own app.
+                passes: phc.t,
+                memorySize: phc.m,
+                parallelism: phc.p,
+                tagLength: phc.hash.length,
+            });
+            // Through the fleet's one constant-time primitive, exactly as
+            // `sync/tokens.ts` compares digests. A `===` here is a timing oracle on the
+            // one comparison in the app where it would matter.
+            return constantTimeEqualBytes(derived, phc.hash);
+        }
+        catch (error) {
+            // A malformed stored hash must fail CLOSED, exactly as `auth.ts` does on
+            // Bun. Returning `false` rather than throwing keeps the refusal a phrase
+            // instead of a 500 that tells a caller the hash is broken.
+            //
+            // 🔴 But it is LOGGED, because a silent `false` here is indistinguishable
+            // from a wrong password — and on 2026-09-18 that cost a diagnosis: a
+            // working credential was refused and the only line anywhere said "invalid
+            // email or password". Never the password, never the hash; the error only.
+            console.error(`[cursedbelt-server/worker-argon2] argon2 verification threw: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+    },
+    async hash(password, options = {}) {
+        const salt = new Uint8Array(SALT_BYTES);
+        crypto.getRandomValues(salt);
+        // `memoryCost`/`timeCost` are Bun's names; `cursedbelt-server/password` passes exactly
+        // those two, and its test profile passes much smaller ones.
+        const m = options.memoryCost ?? DEFAULT_MEMORY_KIB;
+        const t = options.timeCost ?? DEFAULT_ITERATIONS;
+        const derive = await argon2();
+        const derived = derive({
+            password: new TextEncoder().encode(password),
+            salt,
+            passes: t,
+            memorySize: m,
+            parallelism: DEFAULT_PARALLELISM,
+            tagLength: HASH_BYTES,
+        });
+        return `$argon2id$v=19$m=${m},t=${t},p=${DEFAULT_PARALLELISM}$${b64encode(salt)}$${b64encode(derived)}`;
+    },
+};
+/**
+ * Install the shim, once, before any route can run.
+ *
+ * Idempotent, and it never overwrites a real `Bun` — so importing this module in a
+ * Bun test does nothing, which is what keeps the gate honest about the Mac.
+ */
+export function installBunPasswordShim() {
+    const existing = globalThis.Bun;
+    if (existing)
+        return;
+    globalThis.Bun = { password: workerPassword };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.23.0",
+	"version": "4.24.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -215,6 +215,12 @@
 			"source": "./src/server/auth/passwordCost.ts",
 			"import": "./dist/server/auth/passwordCost.js"
 		},
+		"./worker-argon2": {
+			"types": "./dist/server/worker-argon2/index.d.ts",
+			"bun": "./src/server/worker-argon2/index.ts",
+			"source": "./src/server/worker-argon2/index.ts",
+			"import": "./dist/server/worker-argon2/index.js"
+		},
 		"./request-log": {
 			"types": "./dist/server/requestLog/requestMetrics.d.ts",
 			"bun": "./src/server/requestLog/requestMetrics.ts",
@@ -301,6 +307,7 @@
 		}
 	},
 	"dependencies": {
+		"argon2id": "1.0.1",
 		"cursedbelt-core": "^2.1.1",
 		"cursedops": "^0.6.0",
 		"cwip": "^4.6.0",

package/src/server/telemetryIsWorkerSafe.spec.ts

@@ -43,6 +43,23 @@ describe('🔴 cursedbelt-server/password — a Worker can import it (task 2129)
 	});
 });
 
+describe('🔴 cursedbelt-server/worker-argon2 — it exists to be imported by a Worker', () => {
+	test('reaches no `bun:` module at runtime; `Bun.file` is touched only on the Bun-only path branch', () => {
+		const { files, bunImports } = runtimeGraph(join(import.meta.dir, 'worker-argon2', 'index.ts'));
+		expect(bunImports).toEqual([]);
+		// Not vacuous: the loader and the shim are both in the graph.
+		expect(files.some((f) => f.endsWith('worker-argon2/argon2.ts'))).toBe(true);
+		expect(files.some((f) => f.endsWith('worker-argon2/password.ts'))).toBe(true);
+	});
+
+	test("its export map's `import` is the real module, not the Bun-only refusal", () => {
+		const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', '..', 'package.json'), 'utf8')) as {
+			exports: Record<string, { import?: string }>;
+		};
+		expect(pkg.exports['./worker-argon2']?.import).toBe('./dist/server/worker-argon2/index.js');
+	});
+});
+
 describe('cursedbelt-server/telemetry', () => {
 	test('🔴 reaches no `bun:` module at runtime — a Worker can import it', () => {
 		const { files, bunImports } = runtimeGraph(join(import.meta.dir, 'telemetry.ts'));

package/src/server/worker-argon2/argon2.ts

@@ -0,0 +1,85 @@
+/**
+ * argon2id as WebAssembly the Worker was HANDED, never WebAssembly it compiles.
+ *
+ * ## 🔴 Why this file exists: one unlock was 8.5–15 seconds of billed CPU
+ *
+ * `collections` averaged **489 CPU-ms per request on 2026-09-22 with a 15.2 s p99** (Cloudflare
+ * GraphQL, `workersInvocationsAdaptive`). Every second of it was `POST /__lock/unlock`: a real
+ * `wrangler tail` of the stage walk on 2026-09-23 read **8,519 CPU-ms and 10.4 s wall** for that
+ * one request and 10–38 ms for each of the other eleven. The lock verifies every account's
+ * argon2id hash (no early exit — `cursedbelt-server/master-lock` explains the timing oracle) plus
+ * a timing equalizer, so production's two accounts are three to four derivations per unlock, and
+ * `@noble/hashes`' pure-JS argon2id costs ~2.8 s each on workerd — five times the 562 ms it
+ * costs on this Mac. The owner waited ten seconds at the lock page, and a third account would
+ * have put the unlock within reach of the Worker's 30 s CPU ceiling, where it is killed and
+ * reads as a wrong password.
+ *
+ * ## 🔴 Why this shape: workerd refuses to COMPILE WebAssembly, not to RUN it
+ *
+ * `hash-wasm` failed here on 2026-09-18 with `Wasm code generation disallowed by embedder`
+ * because it compiles bytes it carries inline (`./password.ts` has the whole story). A
+ * `.wasm` file that is a STATIC import is different: wrangler bundles it as a
+ * `CompiledWasm` module and the runtime hands this code a ready `WebAssembly.Module`, which
+ * `WebAssembly.instantiate(module, imports)` may instantiate. `argon2id` (openpgpjs, MIT) ships
+ * its two binaries as plain files and lets the caller do the instantiating, which is exactly the
+ * seam a Worker needs. Its default entry inlines base64 and compiles it — so it is never imported.
+ *
+ * Under Bun (every test, and the Mac) the same import is a PATH STRING, so the bytes are read
+ * and compiled here — which Bun allows. `index.spec.ts` drives the Worker's branch too, with
+ * `WebAssembly.compile` made to throw exactly as workerd throws.
+ *
+ * ## Why it lives in `cursedbelt-server` (4.24.0)
+ *
+ * It was born in `apps/collections/worker/argon2.ts` (commit 7996ded) while `apps/vault` and
+ * `apps/patterns` still carried the pure-JS copy, so every sign-in there billed seconds. One copy
+ * here, `argon2id` a pinned dependency of this package: its two `.wasm` files ship in its own
+ * `files`, and wrangler — which resolves this subpath's `import` condition, `dist/…/argon2.js`,
+ * where tsc leaves the bare `argon2id/dist/*.wasm` specifiers untouched — bundles them from
+ * `node_modules` as `CompiledWasm`. `index.spec.ts` asserts `dist` still carries them that way.
+ */
+import noSimdWasm from "argon2id/dist/no-simd.wasm";
+import simdWasm from "argon2id/dist/simd.wasm";
+import setupWasm, { type computeHash } from "argon2id/lib/setup.js";
+
+/** What a `.wasm` import is: a compiled module under wrangler, a file path under Bun. */
+export type WasmImport = WebAssembly.Module | string;
+
+/**
+ * Turn one `.wasm` import into an instance. 🔴 A `Module` is instantiated and NEVER compiled —
+ * that is the whole workerd rule — and only a path (Bun) is read and compiled.
+ */
+export async function instantiateWasm(
+	source: WasmImport,
+	imports: WebAssembly.Imports,
+): Promise<WebAssembly.WebAssemblyInstantiatedSource> {
+	const module =
+		typeof source === "string" ? await WebAssembly.compile(await Bun.file(source).arrayBuffer()) : source;
+	const instance = await WebAssembly.instantiate(module, imports);
+	return { module, instance };
+}
+
+/** Build a hasher from the two binaries — SIMD first, the plain one if SIMD will not load. */
+export function loadArgon2(simd: WasmImport = simdWasm, noSimd: WasmImport = noSimdWasm): Promise<computeHash> {
+	return setupWasm(
+		(imports) => instantiateWasm(simd, imports),
+		(imports) => instantiateWasm(noSimd, imports),
+	);
+}
+
+/*
+ * 🔴 ONE hasher per isolate, built on first use. Not request state — it holds no password and no
+ * result between calls (the library clears its memory after each) — so this is the one kind of
+ * module-scope value a Worker may keep. The reason to keep it is MEMORY: each
+ * instance owns a 65 MB `WebAssembly.Memory` that can never shrink, and an unlock runs three or
+ * four derivations back to back; one per call would stack up to four of them against a 128 MB
+ * isolate before a collector ran. A load that FAILS is not cached, so the next unlock retries.
+ */
+let shared: Promise<computeHash> | null = null;
+
+export function argon2(): Promise<computeHash> {
+	shared ??= loadArgon2().catch((error: unknown) => {
+		shared = null;
+		throw error;
+	});
+	return shared;
+}

package/src/server/worker-argon2/index.spec.ts

@@ -0,0 +1,162 @@
+/**
+ * `cursedbelt-server/worker-argon2`: the Worker's argon2id loads the way workerd lets it, and
+ * agrees with `Bun.password` byte for byte.
+ *
+ * 🔴 The branch that matters cannot run here by accident: under Bun a `.wasm` import is a file
+ * PATH, so `argon2()` in this process compiles — which workerd forbids. These cases hand the
+ * loader what wrangler hands it (a compiled `WebAssembly.Module`) with `WebAssembly.compile`
+ * rigged to throw workerd's own words, so a loader that compiled anyway goes red here rather
+ * than at an owner's lock page (`./password.ts`, the 2026-09-18 `hash-wasm` deploy).
+ *
+ * The shim is driven DIRECTLY rather than through `installBunPasswordShim`: the shim does nothing
+ * when a real `Bun` exists, so testing through it here would test Bun and report on the Worker.
+ * Lifted from `apps/collections/worker/{argon2,password}.test.ts` (commit 7996ded).
+ */
+import { afterEach, describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import noSimdPath from "argon2id/dist/no-simd.wasm";
+import simdPath from "argon2id/dist/simd.wasm";
+import { argon2, installBunPasswordShim, instantiateWasm, loadArgon2, parsePhc, workerPassword } from "./index.js";
+
+const WORKERD_REFUSAL = "WebAssembly.compile(): Wasm code generation disallowed by embedder";
+const realCompile = WebAssembly.compile;
+
+/** workerd's rule, reproduced: instantiating a module is allowed, compiling bytes is not. */
+function forbidCompile(): void {
+	WebAssembly.compile = (() => Promise.reject(new Error(WORKERD_REFUSAL))) as typeof WebAssembly.compile;
+}
+
+afterEach(() => {
+	WebAssembly.compile = realCompile;
+});
+
+/** What wrangler's `CompiledWasm` rule hands the bundle, compiled BEFORE the rule is imposed. */
+async function asWranglerHandsIt(path: string | WebAssembly.Module): Promise<WebAssembly.Module> {
+	return typeof path === "string" ? realCompile(await Bun.file(path).arrayBuffer()) : path;
+}
+
+const PASSWORD = "the tide remembers every shore";
+const hex = (bytes: Uint8Array): string => Buffer.from(bytes).toString("hex");
+
+describe("argon2id on the Worker", () => {
+	it("🔴 derives from a compiled Module with compilation forbidden — byte-identical to Bun.password", async () => {
+		const simd = await asWranglerHandsIt(simdPath);
+		const noSimd = await asWranglerHandsIt(noSimdPath);
+		// Bun's DEFAULT argon2id (m=64 MiB, t=2) — what every production hash in the fleet carries —
+		// and a cheap profile, so the stored parameters are proven to be the ones used.
+		const stored = [
+			await Bun.password.hash(PASSWORD, { algorithm: "argon2id" }),
+			await Bun.password.hash(PASSWORD, { algorithm: "argon2id", memoryCost: 4096, timeCost: 1 }),
+		];
+		forbidCompile();
+		const derive = await loadArgon2(simd, noSimd);
+		for (const phcString of stored) {
+			const phc = parsePhc(phcString);
+			if (!phc) throw new Error(`Bun wrote a hash this module cannot parse: ${phcString}`);
+			const derived = derive({
+				password: new TextEncoder().encode(PASSWORD),
+				salt: phc.salt,
+				passes: phc.t,
+				memorySize: phc.m,
+				parallelism: phc.p,
+				tagLength: phc.hash.length,
+			});
+			expect(hex(derived)).toBe(hex(phc.hash));
+		}
+	});
+
+	it("🔴 a loader that COMPILES goes red under the same rule — the check can fail", async () => {
+		forbidCompile();
+		await expect(
+			instantiateWasm(simdPath, { env: { memory: new WebAssembly.Memory({ initial: 1 }) } }),
+		).rejects.toThrow(WORKERD_REFUSAL);
+	});
+
+	it("keeps ONE hasher per isolate — a 65 MB memory per call would stack against 128 MB", async () => {
+		expect(await argon2()).toBe(await argon2());
+	});
+
+	it("is several times cheaper than the pure-JS derivation it replaced, at the owner's real cost", async () => {
+		const derive = await argon2();
+		const started = process.cpuUsage();
+		derive({
+			password: new TextEncoder().encode(PASSWORD),
+			salt: new Uint8Array(32).fill(7),
+			passes: 2,
+			memorySize: 65_536,
+			parallelism: 1,
+			tagLength: 32,
+		});
+		// CPU, not wall clock, so a loaded gate does not stretch it: WASM measured ~70–180 CPU-ms
+		// on this Mac, `@noble/hashes`' pure JS ~530–600 (and ~2.8 s on workerd). The ceiling sits
+		// between them.
+		const spent = process.cpuUsage(started);
+		expect((spent.user + spent.system) / 1000).toBeLessThan(400);
+	});
+});
+
+describe("the Bun.password shim", () => {
+	it("verifies a hash Bun wrote — the whole reason the owner keeps their password", async () => {
+		const hash = await Bun.password.hash(PASSWORD, { algorithm: "argon2id" });
+		expect(await workerPassword.verify(PASSWORD, hash)).toBe(true);
+	});
+
+	it("refuses a wrong password against a hash Bun wrote", async () => {
+		const hash = await Bun.password.hash(PASSWORD, { algorithm: "argon2id" });
+		expect(await workerPassword.verify("not the password", hash)).toBe(false);
+	});
+
+	it("writes a hash BUN can verify, so a password changed on the edge still works on the Mac", async () => {
+		const hash = await workerPassword.hash(PASSWORD, { memoryCost: 4096, timeCost: 1 });
+		expect(hash.startsWith("$argon2id$v=19$m=4096,t=1,p=1$")).toBe(true);
+		expect(await Bun.password.verify(PASSWORD, hash)).toBe(true);
+	});
+
+	it("honours the STORED cost parameters, not its own defaults", async () => {
+		const cheap = await Bun.password.hash(PASSWORD, { algorithm: "argon2id", memoryCost: 4096, timeCost: 1 });
+		expect(parsePhc(cheap)?.m).toBe(4096);
+		expect(await workerPassword.verify(PASSWORD, cheap)).toBe(true);
+	});
+
+	it("fails closed on junk rather than throwing", async () => {
+		for (const junk of ["", "not-a-hash", "$argon2id$", "$argon2i$v=19$m=1,t=1,p=1$AA$AA"]) {
+			expect(await workerPassword.verify(PASSWORD, junk)).toBe(false);
+		}
+		expect(await workerPassword.verify("", "$argon2id$v=19$m=4096,t=1,p=1$AA$AA")).toBe(false);
+	});
+
+	it("decodes unpadded PHC base64, which is where a salt silently goes wrong", async () => {
+		const parsed = parsePhc(await Bun.password.hash(PASSWORD, { algorithm: "argon2id" }));
+		// Bun's default salt and digest are both 32 bytes — measured, not assumed.
+		expect(parsed?.salt.length).toBe(32);
+		expect(parsed?.hash.length).toBe(32);
+	});
+
+	it("never overwrites a real Bun — so installing it in this process is a no-op", () => {
+		const before = Bun.password;
+		installBunPasswordShim();
+		expect(Bun.password).toBe(before);
+	});
+});
+
+describe("🔴 what wrangler bundles", () => {
+	const dist = join(import.meta.dir, "..", "..", "..", "dist", "server", "worker-argon2", "argon2.js");
+
+	it("dist keeps both .wasm files as STATIC imports — the only shape workerd will run", () => {
+		// wrangler resolves this subpath's `import` condition, i.e. this file. A build that inlined
+		// or dynamically loaded the bytes would deploy fine and refuse every sign-in.
+		const built = readFileSync(dist, "utf8");
+		expect(built).toMatch(/^import \w+ from ["']argon2id\/dist\/simd\.wasm["'];?$/m);
+		expect(built).toMatch(/^import \w+ from ["']argon2id\/dist\/no-simd\.wasm["'];?$/m);
+	});
+
+	it("never imports argon2id's default entry, which compiles inline base64", () => {
+		for (const file of ["argon2.ts", "password.ts", "index.ts"]) {
+			const source = readFileSync(join(import.meta.dir, file), "utf8");
+			expect(source).not.toMatch(/from ["']argon2id["']/);
+		}
+		const built = readFileSync(dist, "utf8");
+		expect(built).not.toMatch(/from ["']argon2id["']/);
+	});
+});

package/src/server/worker-argon2/index.ts

@@ -0,0 +1,9 @@
+/**
+ * `cursedbelt-server/worker-argon2` — argon2id a Cloudflare Worker can afford, and the
+ * `Bun.password` shim that lets the same auth code verify on the Mac and on the edge.
+ *
+ * `./argon2.ts` is the WHY (8.5 s of billed CPU per unlock in pure JS; workerd forbids compiling
+ * WebAssembly, so the `.wasm` is a static import wrangler bundles); `./password.ts` is the shim.
+ */
+export { argon2, instantiateWasm, loadArgon2, type WasmImport } from "./argon2.js";
+export { type BunPasswordShim, installBunPasswordShim, parsePhc, workerPassword } from "./password.js";

package/src/server/worker-argon2/password.ts

@@ -0,0 +1,185 @@
+/**
+ * argon2id on `workerd`, where the obvious answer does not work.
+ *
+ * ## 🔴 The finding, and it applies to every app in this fleet
+ *
+ * **A Worker may not compile WebAssembly at runtime.** `hash-wasm` — the first and
+ * most natural choice, and the one every search result recommends — inlines its
+ * argon2 module as base64 and calls `WebAssembly.compile(bytes)` on first use.
+ * Deployed here on 2026-09-18, that produced:
+ *
+ * ```
+ * [patterns] argon2 verification threw:   ← the pilot's log line, quoted verbatim
+ *   WebAssembly.compile(): Wasm code generation disallowed by embedder
+ * ```
+ *
+ * It **builds, deploys and starts perfectly**, and fails only when somebody tries
+ * to sign in — where it is indistinguishable from a wrong password, because a KDF
+ * that throws must fail closed. That combination is the worst shape a defect can
+ * have, and it is why `verify` below logs the error: a silent `false` cost a
+ * diagnosis on the day this was written. On Workers, WASM must be a *static
+ * import* of a `.wasm` file that wrangler bundles as a module; a library that
+ * carries its bytes inline can never satisfy that.
+ *
+ * So this runs **argon2id as WebAssembly that wrangler bundles as a static module** —
+ * `./argon2.ts`, which instantiates a `WebAssembly.Module` it was handed and never compiles
+ * one. Until 2026-09-23 it was `@noble/hashes/argon2`, pure JavaScript: byte-identical output
+ * and 562 ms per verification on this Mac, which read as acceptable — and on workerd it was
+ * **~2.8 s per derivation**, so one unlock (every account's hash plus the timing equalizer)
+ * billed 8.5 s on the stage and 15 s in production, and was 489 CPU-ms averaged over every
+ * request the app served on 2026-09-22. `./argon2.ts` carries the measurement.
+ * `cursedbelt-server/login-throttle` is what holds the line against a flood, not the KDF's cost.
+ *
+ * ## What this buys, and it is the reason to pay for argon2id at all
+ *
+ * **The owner's existing password hash works on a Worker unchanged.** No re-hash,
+ * no "sign in again on the new host", and above all no downgrade to PBKDF2 to fit
+ * the runtime — `ownerAuth.ts` argues at length for argon2id over a fast KDF, and
+ * a port that quietly swapped it would have thrown that argument away for a
+ * platform detail. Same PHC string, same parameters, same answer.
+ *
+ * ## Why a GLOBAL shim rather than an injected verifier
+ *
+ * `Bun.password` is reached from three files (`auth.ts`, `ownerAuth.ts`,
+ * `cursedbelt-server/password`), and `Bun.` is a *global property access*, not an import — so
+ * a Worker bundle containing it builds fine and throws `Bun is not defined` only
+ * when a login happens. Threading a verifier through three signatures would be
+ * three more places for the Mac and the edge to disagree. Installing the global
+ * instead keeps the auth tier byte-identical on both runtimes, which is the same
+ * argument the apps' `store.ts` make for the async database seam.
+ *
+ * Used by `collections`, `vault` and `patterns` (each app's `worker/index.ts` calls
+ * {@link installBunPasswordShim} first thing). In `vault` this is ONLY the sign-in / lock
+ * verifier: the vault's ciphertext is derived and opened in the browser and never comes near it.
+ */
+import { constantTimeEqualBytes } from "cwip/constant-time";
+import { argon2 } from "./argon2.js";
+
+/** What Bun's `argon2id` default writes, so a hash minted here matches one minted there. */
+const DEFAULT_MEMORY_KIB = 65_536;
+const DEFAULT_ITERATIONS = 2;
+const DEFAULT_PARALLELISM = 1;
+const HASH_BYTES = 32;
+// 32, matching what `Bun.password.hash` actually writes — measured 2026-09-18.
+const SALT_BYTES = 32;
+
+/**
+ * argon2's PHC encoding is base64 **without padding**, and with the standard
+ * alphabet rather than base64url. Getting either wrong yields a salt that decodes
+ * to the wrong bytes and a verification that fails for a correct password.
+ */
+const b64decode = (value: string): Uint8Array => {
+	const padded = value + "===".slice((value.length + 3) % 4);
+	return Uint8Array.from(atob(padded), (ch) => ch.charCodeAt(0));
+};
+
+const b64encode = (bytes: Uint8Array): string =>
+	btoa(String.fromCharCode(...bytes)).replace(/=+$/, "");
+
+interface Phc {
+	m: number;
+	t: number;
+	p: number;
+	salt: Uint8Array;
+	hash: Uint8Array;
+}
+
+/** `$argon2id$v=19$m=65536,t=2,p=1$<salt>$<hash>` → its parts, or null. */
+export function parsePhc(encoded: string): Phc | null {
+	const parts = encoded.split("$");
+	// ["", "argon2id", "v=19", "m=...,t=...,p=...", salt, hash]
+	if (parts.length !== 6 || parts[1] !== "argon2id") return null;
+	const params = new Map(
+		(parts[3] as string).split(",").map((pair) => {
+			const [key, value] = pair.split("=");
+			return [key as string, Number(value)] as const;
+		}),
+	);
+	const m = params.get("m");
+	const t = params.get("t");
+	const p = params.get("p");
+	if (!m || !t || !p) return null;
+	try {
+		return { m, t, p, salt: b64decode(parts[4] as string), hash: b64decode(parts[5] as string) };
+	} catch {
+		return null;
+	}
+}
+
+export interface BunPasswordShim {
+	verify(password: string, hash: string): Promise<boolean>;
+	hash(
+		password: string,
+		options?: { algorithm?: string; memoryCost?: number; timeCost?: number },
+	): Promise<string>;
+}
+
+export const workerPassword: BunPasswordShim = {
+	async verify(password, encoded) {
+		if (!password || !encoded) return false;
+		try {
+			const phc = parsePhc(encoded);
+			if (!phc) return false;
+			const derive = await argon2();
+			const derived = derive({
+				password: new TextEncoder().encode(password),
+				salt: phc.salt,
+				// 🔴 The STORED parameters, never this file's defaults. A hash written
+				// under a different cost must still verify, or rotating the cost locks
+				// the owner out of their own app.
+				passes: phc.t,
+				memorySize: phc.m,
+				parallelism: phc.p,
+				tagLength: phc.hash.length,
+			});
+			// Through the fleet's one constant-time primitive, exactly as
+			// `sync/tokens.ts` compares digests. A `===` here is a timing oracle on the
+			// one comparison in the app where it would matter.
+			return constantTimeEqualBytes(derived, phc.hash);
+		} catch (error) {
+			// A malformed stored hash must fail CLOSED, exactly as `auth.ts` does on
+			// Bun. Returning `false` rather than throwing keeps the refusal a phrase
+			// instead of a 500 that tells a caller the hash is broken.
+			//
+			// 🔴 But it is LOGGED, because a silent `false` here is indistinguishable
+			// from a wrong password — and on 2026-09-18 that cost a diagnosis: a
+			// working credential was refused and the only line anywhere said "invalid
+			// email or password". Never the password, never the hash; the error only.
+			console.error(
+				`[cursedbelt-server/worker-argon2] argon2 verification threw: ${error instanceof Error ? error.message : String(error)}`,
+			);
+			return false;
+		}
+	},
+
+	async hash(password, options = {}) {
+		const salt = new Uint8Array(SALT_BYTES);
+		crypto.getRandomValues(salt);
+		// `memoryCost`/`timeCost` are Bun's names; `cursedbelt-server/password` passes exactly
+		// those two, and its test profile passes much smaller ones.
+		const m = options.memoryCost ?? DEFAULT_MEMORY_KIB;
+		const t = options.timeCost ?? DEFAULT_ITERATIONS;
+		const derive = await argon2();
+		const derived = derive({
+			password: new TextEncoder().encode(password),
+			salt,
+			passes: t,
+			memorySize: m,
+			parallelism: DEFAULT_PARALLELISM,
+			tagLength: HASH_BYTES,
+		});
+		return `$argon2id$v=19$m=${m},t=${t},p=${DEFAULT_PARALLELISM}$${b64encode(salt)}$${b64encode(derived)}`;
+	},
+};
+
+/**
+ * Install the shim, once, before any route can run.
+ *
+ * Idempotent, and it never overwrites a real `Bun` — so importing this module in a
+ * Bun test does nothing, which is what keeps the gate honest about the Mac.
+ */
+export function installBunPasswordShim(): void {
+	const existing = (globalThis as { Bun?: unknown }).Bun;
+	if (existing) return;
+	(globalThis as { Bun?: unknown }).Bun = { password: workerPassword };
+}

package/src/server/worker-argon2/wasm.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A `.wasm` import, as the two runtimes that load this code spell it: wrangler bundles the file
+ * as a `CompiledWasm` module and hands over a `WebAssembly.Module`; Bun hands over the file's
+ * path. `./argon2.ts` accepts both, and is the only importer outside its spec.
+ */
+declare module "*.wasm" {
+	const source: WebAssembly.Module | string;
+	export default source;
+}