cursedbelt-server 4.39.0 → 4.40.1

package/dist/server/activity/migrations.js

@@ -27,4 +27,14 @@ export const ACTIVITY_MIGRATIONS = [
                 db.run(statement);
         },
     },
+    {
+        // A store that ran 0001 before the case-insensitive actor index existed never gets it from
+        // 0001 again. Idempotent, so on a fresh store (where 0001 already built it) it is a no-op.
+        name: "0002_activity_actor_ci",
+        up(db) {
+            for (const statement of ACTIVITY_DDL)
+                if (statement.includes("idx_activity_events_actor_ci"))
+                    db.run(statement);
+        },
+    },
 ];

package/dist/server/activity/schema.js

@@ -33,6 +33,14 @@ export const ACTIVITY_DDL = [
     // question, and the one a fleet-wide search runs first.
     `CREATE INDEX IF NOT EXISTS idx_activity_events_actor
 				 ON ${ACTIVITY_EVENTS_TABLE} (actor, event_id DESC)`,
+    // 🔴 The index the actor filter can actually USE. `buildStream` matches an actor
+    // case-insensitively — `LOWER(actor) = LOWER(?)` — and SQLite cannot use the plain
+    // `actor` index above for that, so every actor query scanned the stream: measured
+    // 2026-09-28 (task 2254) on auth-stage, auth's sign-in familiarity read (actor + action +
+    // outcome, on every sign-in and app-open) cost 760 rows a call and 2.2M rows in four
+    // days, growing with the log for ever. With this index: 41 rows, flat.
+    `CREATE INDEX IF NOT EXISTS idx_activity_events_actor_ci
+				 ON ${ACTIVITY_EVENTS_TABLE} (LOWER(actor), action, at DESC)`,
     // "Everything that ever happened to this record."
     `CREATE INDEX IF NOT EXISTS idx_activity_events_resource
 				 ON ${ACTIVITY_EVENTS_TABLE} (kind, resource_id, event_id DESC)`,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.39.0",
+	"version": "4.40.1",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -352,7 +352,7 @@
 	"dependencies": {
 		"argon2id": "1.0.1",
 		"cursedbelt-core": "^2.1.1",
-		"cursedops": ">=0.8.1 <0.11.0",
+		"cursedops": ">=0.8.1 <0.12.0",
 		"cwip": "^4.6.0",
 		"jose": "^6.2.3"
 	},

package/src/barrelsReachNoOptionalPeer.spec.ts

@@ -132,19 +132,23 @@ const packageOf = (specifier: string): string | undefined => {
  * non-zero exit or an empty bundle THROWS rather than returning an empty set. That is the
  * one way a check like this dies quietly.
  */
-const scan = (entry: string, subpath: string): { packages: Set<string>; bun: Set<string> } => {
+const scan = async (entry: string, subpath: string): Promise<{ packages: Set<string>; bun: Set<string> }> => {
 	const outdir = `${process.env.TMPDIR ?? '/tmp'}/cursedbelt-server-barrel-scan/${subpath.replace(/[^a-z0-9]+/gi, '-')}`;
-	const build = Bun.spawnSync(['bun', 'build', entry, '--target=bun', '--packages=external', '--outdir', outdir], {
+	const child = Bun.spawn(['bun', 'build', entry, '--target=bun', '--packages=external', '--outdir', outdir], {
 		cwd: REPO,
+		stdin: 'ignore',
 		stdout: 'pipe',
 		stderr: 'pipe',
 	});
+	const [, stderr, exitCode] = await Promise.all([
+		new Response(child.stdout).text(),
+		new Response(child.stderr).text(),
+		child.exited,
+	]);
 	const emitted = [...new Bun.Glob('**/*.js').scanSync({ cwd: outdir, onlyFiles: true })];
 	const bundle = emitted.map((f) => readFileSync(`${outdir}/${f}`, 'utf8')).join('\n');
-	if (build.exitCode !== 0 || bundle.trim() === '') {
-		throw new Error(
-			`could not bundle ${subpath} (${entry}, exit ${build.exitCode}) — a check that cannot measure is not a passing check:\n${build.stderr.toString()}`,
-		);
+	if (exitCode !== 0 || bundle.trim() === '') {
+		throw new Error(`could not bundle ${subpath} (${entry}, exit ${exitCode}) — a check that cannot measure is not a passing check:\n${stderr}`);
 	}
 	const packages = new Set<string>();
 	const bun = new Set<string>();
@@ -168,8 +172,8 @@ const scan = (entry: string, subpath: string): { packages: Set<string>; bun: Set
  * One bundle per subpath, shared by both assertions. Bundling is the expensive part of this
  * file and the answer cannot change between two `it`s in the same run.
  */
-const scans = new Map<string, { packages: Set<string>; bun: Set<string> }>();
-const scanOnce = (entry: string, subpath: string): { packages: Set<string>; bun: Set<string> } => {
+const scans = new Map<string, Promise<{ packages: Set<string>; bun: Set<string> }>>();
+const scanOnce = (entry: string, subpath: string): Promise<{ packages: Set<string>; bun: Set<string> }> => {
 	const cached = scans.get(subpath);
 	if (cached !== undefined) return cached;
 	const fresh = scan(entry, subpath);
@@ -190,8 +194,8 @@ describe('no public subpath statically reaches what its consumers may not have',
 
 	for (const { subpath, entry } of SUBPATHS) {
 		const allowed = MAY_DRAG[subpath] ?? [];
-		it(`${subpath} drags ${allowed.length === 0 ? 'no optional peer' : allowed.join(' + ') + ' and nothing more'}`, () => {
-			const dragged = [...scanOnce(entry, subpath).packages].filter((n) => OPTIONAL_PEERS.has(n)).sort();
+		it(`${subpath} drags ${allowed.length === 0 ? 'no optional peer' : allowed.join(' + ') + ' and nothing more'}`, async () => {
+			const dragged = [...(await scanOnce(entry, subpath)).packages].filter((n) => OPTIONAL_PEERS.has(n)).sort();
 			const unexpected = dragged.filter((n) => !allowed.includes(n));
 			expect(
 				unexpected,
@@ -213,8 +217,8 @@ describe('no public subpath statically reaches what its consumers may not have',
 
 	for (const { subpath, entry } of SUBPATHS) {
 		const allowed = MAY_NEED_BUN[subpath] ?? [];
-		it(`${subpath} ${allowed.length === 0 ? 'loads on a Worker — no bun builtin' : `needs ${allowed.join(' + ')} and nothing more`}`, () => {
-			const reached = [...scanOnce(entry, subpath).bun].sort();
+		it(`${subpath} ${allowed.length === 0 ? 'loads on a Worker — no bun builtin' : `needs ${allowed.join(' + ')} and nothing more`}`, async () => {
+			const reached = [...(await scanOnce(entry, subpath)).bun].sort();
 			const unexpected = reached.filter((n) => !allowed.includes(n));
 			expect(
 				unexpected,

package/src/leafSubpathsImportNothing.spec.ts

@@ -361,16 +361,20 @@ console.log(JSON.stringify(out));
 `,
   );
 
-  const child = Bun.spawnSync(['bun', 'run', 'entry.ts'], {
+  const child = Bun.spawn(['bun', 'run', 'entry.ts'], {
     cwd: root,
+    stdin: 'ignore',
     stdout: 'pipe',
     stderr: 'pipe',
   });
-  const stdout = child.stdout.toString().trim();
-  if (child.exitCode !== 0 || stdout === '') {
-    throw new Error(
-      `the fixture could not run at all (exit ${child.exitCode}) — that is a broken check, not a passing one:\n${child.stderr.toString()}`,
-    );
+  const [stdoutRaw, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  const stdout = stdoutRaw.trim();
+  if (exitCode !== 0 || stdout === '') {
+    throw new Error(`the fixture could not run at all (exit ${exitCode}) — that is a broken check, not a passing one:\n${stderr}`);
   }
   return JSON.parse(stdout) as Record<string, Outcome>;
 };
@@ -412,16 +416,18 @@ const OPTIONAL_PEERS = new Set(
 /** `import x from "pkg"`, `import "pkg"`, `export … from "pkg"` — one line each, as bun emits. */
 const STATIC_SPECIFIER = /^(?:import|export)\s[^\n]*?["']([^"'\n]+)["'];?$|^import\s*["']([^"'\n]+)["'];?$/gm;
 
-const staticOptionalPeersOf = (entry: string): string[] => {
-  const build = Bun.spawnSync(
+const staticOptionalPeersOf = async (entry: string): Promise<string[]> => {
+  const child = Bun.spawn(
     ['bun', 'build', entry, '--target=bun', '--packages=external'],
-    { cwd: REPO, stdout: 'pipe', stderr: 'pipe' },
+    { cwd: REPO, stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' },
   );
-  const bundle = build.stdout.toString();
-  if (build.exitCode !== 0 || bundle.trim() === '') {
-    throw new Error(
-      `could not bundle ${entry} (exit ${build.exitCode}) — a check that cannot measure is not a passing check:\n${build.stderr.toString()}`,
-    );
+  const [bundle, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  if (exitCode !== 0 || bundle.trim() === '') {
+    throw new Error(`could not bundle ${entry} (exit ${exitCode}) — a check that cannot measure is not a passing check:\n${stderr}`);
   }
   const found = new Set<string>();
   for (const match of bundle.matchAll(STATIC_SPECIFIER)) {
@@ -478,9 +484,9 @@ describe('barrels reach no optional peer statically', () => {
   });
 
   for (const target of NO_STATIC_OPTIONAL_PEERS) {
-    it(`${pkg.name}/${target.subpath.slice(2)} costs a consumer no optional peer to import`, () => {
+    it(`${pkg.name}/${target.subpath.slice(2)} costs a consumer no optional peer to import`, async () => {
       expect(
-        staticOptionalPeersOf(target.entry),
+        await staticOptionalPeersOf(target.entry),
         `importing ${pkg.name}/${target.subpath.slice(2)} statically pulls these OPTIONAL peers, so every consumer must install them for code it may never call. Either import the leaf module that has what you need instead of a sibling INDEX (that is how 'otplib' got in here twice), or make the dependency lazy: \`const { x } = await import('pkg')\` inside the function that needs it.`,
       ).toEqual([]);
     });

package/src/lockfileIsTracked.spec.ts

@@ -23,7 +23,6 @@
  * to skip it. Ignored-vs-not is the property that actually regresses.
  */
 import { describe, expect, test } from 'bun:test'
-import { spawnSync } from 'node:child_process'
 import { existsSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 
@@ -37,13 +36,18 @@ describe('bun.lock is part of the checkout', () => {
     ).toBe(true)
   })
 
-  test('git is not told to ignore it', () => {
-    const git = spawnSync('git', ['check-ignore', '-q', 'bun.lock'], { cwd: repoRoot })
-    if (git.error) return // no git on this host: nothing to assert about ignore rules
+  test('git is not told to ignore it', async () => {
+    let status: number
+    try {
+      const child = Bun.spawn(['git', 'check-ignore', '-q', 'bun.lock'], { cwd: repoRoot, stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' })
+      status = await child.exited
+    } catch {
+      return // no git on this host: nothing to assert about ignore rules
+    }
 
     // exit 0 = the path IS ignored; 1 = it is not; anything else = git could not tell us.
     expect(
-      git.status,
+      status,
       'bun.lock is gitignored, so a fresh clone has no lockfile and `bun install --frozen-lockfile` cannot pass there. Delete the stanza from .gitignore rather than the assertion.',
     ).not.toBe(0)
   })

package/src/server/activity/actorIndex.spec.ts

@@ -0,0 +1,25 @@
+/**
+ * 🔴 The actor filter must reach an index (task 2254).
+ *
+ * `buildStream` matches an actor with `LOWER(actor) = LOWER(?)`, which the plain `actor` index
+ * cannot serve — so until `idx_activity_events_actor_ci` every actor query scanned the stream.
+ * Measured on auth-stage, 2026-09-28: 760 rows a call on auth's sign-in familiarity read, growing
+ * with the log; 41 with the index. This pins the PLAN, so dropping the index or changing the
+ * filter's shape fails here rather than on the next bill.
+ */
+import { Database } from "bun:sqlite";
+import { expect, test } from "bun:test";
+import { buildStream } from "./query.js";
+import { ACTIVITY_DDL } from "./schema.js";
+
+test("a case-insensitive actor + action filter searches idx_activity_events_actor_ci, never a scan", () => {
+	const db = new Database(":memory:");
+	for (const ddl of ACTIVITY_DDL) db.run(ddl);
+	const insert = db.prepare("INSERT INTO activity_events (at, app, actor, action, outcome) VALUES (?, 'auth', ?, ?, 'ok')");
+	for (let i = 0; i < 500; i++) insert.run(new Date(1_790_000_000_000 + i).toISOString(), `user${i % 50}@example.com`, i % 2 ? "auth.sign-in" : "auth.app-open");
+	db.run("ANALYZE");
+	const { sql, params } = buildStream({ actor: "User7@Example.com", action: "auth.sign-in", outcome: "ok", limit: 20 }, []);
+	const plan = (db.query(`EXPLAIN QUERY PLAN ${sql}`).all(...(params as never[])) as { detail: string }[]).map((r) => r.detail).join(" | ");
+	expect(plan).toContain("idx_activity_events_actor_ci");
+	expect(plan).not.toMatch(/SCAN activity_events/);
+});

package/src/server/activity/d1.spec.ts

@@ -129,7 +129,7 @@ describe("cursedbelt-server/activity/d1", () => {
 		const migrated = new Database(":memory:");
 		runMigrations(migrated, ACTIVITY_MIGRATIONS);
 		expect(shape(withDdl(ACTIVITY_DDL))).toEqual(shape(migrated));
-		expect(shape(migrated).length).toBe(5);
+		expect(shape(migrated).length).toBe(6);
 	});
 
 	test("🔴 refuses an event that cannot be filtered or attributed, and writes nothing", async () => {

package/src/server/activity/migrations.ts

@@ -30,4 +30,12 @@ export const ACTIVITY_MIGRATIONS: readonly Migration[] = [
 			for (const statement of ACTIVITY_DDL) db.run(statement);
 		},
 	},
+	{
+		// A store that ran 0001 before the case-insensitive actor index existed never gets it from
+		// 0001 again. Idempotent, so on a fresh store (where 0001 already built it) it is a no-op.
+		name: "0002_activity_actor_ci",
+		up(db: Database): void {
+			for (const statement of ACTIVITY_DDL) if (statement.includes("idx_activity_events_actor_ci")) db.run(statement);
+		},
+	},
 ];

package/src/server/activity/schema.ts

@@ -35,6 +35,14 @@ export const ACTIVITY_DDL: readonly string[] = [
 	// question, and the one a fleet-wide search runs first.
 	`CREATE INDEX IF NOT EXISTS idx_activity_events_actor
 				 ON ${ACTIVITY_EVENTS_TABLE} (actor, event_id DESC)`,
+	// 🔴 The index the actor filter can actually USE. `buildStream` matches an actor
+	// case-insensitively — `LOWER(actor) = LOWER(?)` — and SQLite cannot use the plain
+	// `actor` index above for that, so every actor query scanned the stream: measured
+	// 2026-09-28 (task 2254) on auth-stage, auth's sign-in familiarity read (actor + action +
+	// outcome, on every sign-in and app-open) cost 760 rows a call and 2.2M rows in four
+	// days, growing with the log for ever. With this index: 41 rows, flat.
+	`CREATE INDEX IF NOT EXISTS idx_activity_events_actor_ci
+				 ON ${ACTIVITY_EVENTS_TABLE} (LOWER(actor), action, at DESC)`,
 	// "Everything that ever happened to this record."
 	`CREATE INDEX IF NOT EXISTS idx_activity_events_resource
 				 ON ${ACTIVITY_EVENTS_TABLE} (kind, resource_id, event_id DESC)`,

package/src/server/serveBunOverload.spec.ts

@@ -20,26 +20,31 @@ import { fileURLToPath } from 'node:url';
 const DIR = fileURLToPath(new URL('./typetests/', import.meta.url));
 const TSC = fileURLToPath(new URL('../../node_modules/typescript/bin/tsc', import.meta.url));
 
-const tsc = (project: string) => {
-  const run = Bun.spawnSync(['bun', TSC, '-p', project], { stdout: 'pipe', stderr: 'pipe' });
-  return { code: run.exitCode, out: `${run.stdout.toString()}${run.stderr.toString()}` };
+const tsc = async (project: string) => {
+  const child = Bun.spawn(['bun', TSC, '-p', project], { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' });
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  return { code, out: `${stdout}${stderr}` };
 };
 
 describe("Bun.serve's websocket overload", () => {
-  it('the trap is still live in bun’s types, and serveBun is the seam that never meets it', () => {
-    const run = tsc(`${DIR}tsconfig.json`);
+  it('the trap is still live in bun’s types, and serveBun is the seam that never meets it', async () => {
+    const run = await tsc(`${DIR}tsconfig.json`);
     expect(run.out).toBe('');
     expect(run.code).toBe(0);
   }, 60_000);
 
-  it('🔴 without the directives the SAME lines fail — so the check above can go red', () => {
+  it('🔴 without the directives the SAME lines fail — so the check above can go red', async () => {
     const source = readFileSync(`${DIR}serveBunOverload.ts`, 'utf8').replace(/^\s*\/\/ @ts-expect-error.*$/gm, '');
     const file = `${DIR}serveBunOverload.stripped.ts`;
     const project = `${DIR}tsconfig.stripped.json`;
     writeFileSync(file, source);
     writeFileSync(project, JSON.stringify({ extends: './tsconfig.json', include: ['serveBunOverload.stripped.ts'] }));
     try {
-      const run = tsc(project);
+      const run = await tsc(project);
       expect(run.code).not.toBe(0);
       const errors = run.out.split('\n').filter((line) => line.includes('error TS'));
       expect(errors).toHaveLength(2);

package/src/shippedFilesAreTracked.spec.ts

@@ -25,7 +25,6 @@
  * when `git` cannot answer — a check that silently degrades to green is worse than none.
  */
 import { describe, expect, test } from 'bun:test';
-import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import pkg from '../package.json';
@@ -36,14 +35,15 @@ const repoRoot = fileURLToPath(new URL('..', import.meta.url));
 const shippedDirs = (): string[] =>
 	((pkg as { files?: string[] }).files ?? []).filter((f) => f !== 'dist' && existsSync(`${repoRoot}/${f}`));
 
-const git = (...args: string[]): { ok: boolean; out: string } => {
-	const r = spawnSync('git', ['-C', repoRoot, ...args], { encoding: 'utf8' });
-	return { ok: r.status === 0, out: (r.stdout ?? '').trim() };
+const git = async (...args: string[]): Promise<{ ok: boolean; out: string }> => {
+	const child = Bun.spawn(['git', '-C', repoRoot, ...args], { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' });
+	const [out, , code] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+	return { ok: code === 0, out: out.trim() };
 };
 
 describe('every file inside the published surface is tracked', () => {
-	test('git can answer at all — a degraded check must refuse, not pass', () => {
-		expect(git('rev-parse', '--is-inside-work-tree').ok, 'not a git checkout, so this check proves nothing').toBe(true);
+	test('git can answer at all — a degraded check must refuse, not pass', async () => {
+		expect((await git('rev-parse', '--is-inside-work-tree')).ok, 'not a git checkout, so this check proves nothing').toBe(true);
 	});
 
 	test('package.json names a shippable directory to scan', () => {
@@ -52,10 +52,10 @@ describe('every file inside the published surface is tracked', () => {
 		expect(shippedDirs().length, '`files` names no committed directory — nothing would be scanned').toBeGreaterThan(0);
 	});
 
-	test('no untracked file sits inside a directory `files` ships', () => {
+	test('no untracked file sits inside a directory `files` ships', async () => {
 		// --others = untracked; --exclude-standard honours .gitignore, so deliberately
 		// ignored paths (.agent.noindex, node_modules) are not offences.
-		const { ok, out } = git('ls-files', '--others', '--exclude-standard', '--', ...shippedDirs());
+		const { ok, out } = await git('ls-files', '--others', '--exclude-standard', '--', ...shippedDirs());
 		expect(ok, 'git ls-files failed').toBe(true);
 		const untracked = out === '' ? [] : out.split('\n');
 		expect(