cursedbelt-server 4.43.0 → 4.43.1

package/README.md

@@ -81,7 +81,8 @@ after typing it (task 2138). `src/server/master-lock/sessions.ts` has the why.
 
 ## Standards
 
-`docs/retention.md`, `docs/activity.md`, `docs/notifications.md`, `docs/engagement.md` — the
+`docs/retention.md`, `docs/activity.md`, `docs/notifications.md`, `docs/engagement.md`,
+`docs/ctgr.md` (the GET-tunnel, getOnly and CSRF — register routes through `buildRoutes`) — the
 contracts every app that uses those modules is agreeing to. Cite them from an app with the
 package prefix (`cursedbelt-server/docs/retention.md`).
 

package/docs/ctgr.md

@@ -0,0 +1,24 @@
+# ctgr + getOnly — the server invariants (don't reinvent the transport)
+
+This package owns the GET-tunnel ("ctgr") and the auth guards (`src/server/ctgr.ts`,
+`src/server/ctgrTunnel.ts`, `src/server/middleware/`). Use the primitives; do
+not re-implement the wiring per app or per route.
+
+- **Register routes with `buildRoutes`.** One `register(method, path, ...handlers)` call wires
+  both the real verb route **and** its `/ctgr<XX>` GET twin from a single call. Don't register
+  the twin by hand.
+- **Mount the decode middleware on `CTGR_ROUTE_PATTERN`**, never on a literal `/ctgr*`. Hono's
+  router does **not** treat `/ctgr*` as a prefix wildcard (a bare-suffix `*` matches only one
+  following segment) — `CTGR_ROUTE_PATTERN` (`/:ctgrTwin{ctgr.+}`) is the correct portable
+  matcher. Reuse it everywhere a `/ctgr*` mount is meant.
+- **`unGETify` only decodes** — it turns a `/ctgr<XX>` twin's query params back into the
+  original request and stashes the decoded request/method on the context. Protection lives
+  elsewhere by design:
+  - **getOnly** keys off the **RAW** request method (always `GET` on a twin) in the auth
+    middleware — that's what makes a tunneled write safe.
+  - **CSRF** double-submit fires on **every** `/ctgr*` path.
+- **Binary/download routes MUST NOT go through the tunnel.** Register those as a plain
+  `app.get(path, handler)` so their bytes never ride the base64url codec and get mangled.
+
+Moved here from `cursedbelt/docs/STANDARDS.md` §5 on 2026-10-05: it described this package's
+server tier, which `cursedbelt` stopped shipping at the 2026-09-15 split.

package/docs/skipped-tests.md

@@ -7,13 +7,13 @@ carrying one goes red until it is removed. Inherited from `cursedbelt` at the
 
 | file | waiting for |
 | --- | --- |
-| `src/server/search/pgSearchProvider.pg.test.ts` | 24 | 22 | 2026-09-13 |
-| `src/server/storage/transcode.integration.spec.ts` | 7 | 5 | 2026-09-13 |
-| `src/server/storage/binaryServerProcessing.integration.spec.ts` | 4 | 2 | 2026-09-13 |
-| `src/server/storage/chunked.integration.spec.ts` | 3 | 1 | 2026-09-13 |
-| `src/server/media-bun/image.spec.ts` | the optional `sharp` peer | no |
-| `src/server/media-bun/video.spec.ts` | `ffmpeg` + `ffprobe` on `PATH` | no |
-| `src/server/storage/imageThumbnail.spec.ts` | `ffmpeg` on `PATH` | no |
-| `src/server/storage/videoProcessor.posterOnly.spec.ts` | `ffmpeg` on `PATH` | no |
-| `src/server/storage/files/adapter.photo.display.spec.ts` | `ffmpeg` on `PATH` | no |
-| `src/server/storage/fileUploadClient-chunked.integration.spec.ts` | a real `binary-server` checkout — set `BINARY_SERVER_DIR`. No default by design: a published package must not go looking in one machine's directory layout, and `binary-server` has not been re-homed into this generation, so it skips on every host today. Moved here from `cursedbelt` at the 2026-09-15 split, with the storage internals it drives. |
+| `src/server/search/pgSearchProvider.pg.test.ts` | `CC_PG_URL` naming a throwaway Postgres | `bun run test:pg` supplies one |
+| `src/server/storage/transcode.integration.spec.ts` | a real `binary-server` checkout — set `BINARY_SERVER_DIR`. It starts binary-server's processing worker beside the store, because only the worker runs a job |
+| `src/server/storage/binaryServerProcessing.integration.spec.ts` | a real `binary-server` checkout (`BINARY_SERVER_DIR`) and `ffmpeg` on `PATH`. It starts the processing worker too |
+| `src/server/storage/chunked.integration.spec.ts` | a real `binary-server` checkout — set `BINARY_SERVER_DIR` |
+| `src/server/media-bun/image.spec.ts` | the optional `sharp` peer |
+| `src/server/media-bun/video.spec.ts` | `ffmpeg` + `ffprobe` on `PATH` |
+| `src/server/storage/imageThumbnail.spec.ts` | `ffmpeg` on `PATH` |
+| `src/server/storage/videoProcessor.posterOnly.spec.ts` | `ffmpeg` on `PATH` |
+| `src/server/storage/files/adapter.photo.display.spec.ts` | `ffmpeg` on `PATH` |
+| `src/server/storage/fileUploadClient-chunked.integration.spec.ts` | a real `binary-server` checkout — set `BINARY_SERVER_DIR` to its path (`apps/binary-server` in this generation). No default by design: a published package must not go looking in one machine's directory layout. Moved here from `cursedbelt` at the 2026-09-15 split, with the storage internals it drives. |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.43.0",
+	"version": "4.43.1",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -365,7 +365,7 @@
 	"dependencies": {
 		"argon2id": "1.0.1",
 		"cursedbelt-core": "^2.1.1",
-		"cursedops": ">=0.8.1 <0.14.0",
+		"cursedops": ">=0.8.1 <1.0.0",
 		"cwip": "^4.6.0",
 		"jose": "^6.2.3"
 	},

package/src/cursedopsRange.spec.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'bun:test';
+import pkg from '../package.json';
+
+/**
+ * `cursedops` is a dependency here, so an app that takes a cursedops this range does not admit
+ * installs TWO copies — the app's at the top and a nested one under `cursedbelt-server`. The
+ * range used to stop at the next 0.x minor (`<0.10.0`, `<0.12.0`, `<0.13.0`, `<0.14.0`), and every
+ * cursedops minor needed a hand-widening here before the ship could bump apps onto it with one
+ * copy (4.30.1, 4.40.3, 4.40.4, and again for cursedops 0.14.0 — forge task 2832). All this
+ * package takes from it is `forgeState` from `cursedops/roots`, and `tools/publish-libs.sh`'s
+ * consumer preflight runs every app on a new cursedops before it ships, so the cap bought nothing
+ * but the chore. It is gone; this keeps it gone for the whole 0.x line.
+ */
+describe('cursedops range', () => {
+	const range = pkg.dependencies.cursedops;
+
+	it('admits every later cursedops 0.x minor, so an app bumping cursedops keeps one copy', () => {
+		for (const version of ['0.14.0', '0.15.0', '0.20.3', '0.99.0']) {
+			expect({ version, admitted: Bun.semver.satisfies(version, range) }).toEqual({ version, admitted: true });
+		}
+	});
+
+	it('still refuses what predates forgeState', () => {
+		expect(Bun.semver.satisfies('0.8.0', range)).toBe(false);
+	});
+});

package/src/server/storage/binaryServerProcessing.integration.spec.ts

@@ -1,4 +1,5 @@
 import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import type { Subprocess } from 'bun';
 import { existsSync, mkdirSync } from 'node:fs';
 import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
@@ -19,7 +20,11 @@ const FFMPEG_PRESENT = Bun.which('ffmpeg') !== null;
 
 // SKIPPED until a real binary-server checkout is present: point BINARY_SERVER_DIR at one.
 // There is deliberately no default — a published package must not go looking in one machine's
-// directory layout — and `binary-server` has not been re-homed here, so this skips on every host today.
+// directory layout. In this generation that checkout is `$FORGE/apps/binary-server`.
+// BS_ALLOW_NEW_STORE=1: the spawned server refuses to invent a store it was not given, and this
+// throwaway one is exactly a store it should create.
+// BS_SECRETS_FILE=/dev/null: otherwise it folds in this machine's binary-server.env — the real R2
+// keys and passcode — and a throwaway store has no business holding them.
 // ffmpeg must be on PATH too: the proof is that the REMOTE side runs real ffmpeg, not that the client posted a job.
 describe.skipIf(!BS_PRESENT || !FFMPEG_PRESENT)(
   'binaryServerProcessing → real binary-server (integration)',
@@ -27,6 +32,7 @@ describe.skipIf(!BS_PRESENT || !FFMPEG_PRESENT)(
     let port: number;
     let storeDir: string;
     let server: TestServer | null = null;
+    let worker: Subprocess | null = null;
     let tmpData: string;
     const INTERNAL_SECRET = 'test-processing-secret';
     const APP = 'ptest';
@@ -36,21 +42,33 @@ describe.skipIf(!BS_PRESENT || !FFMPEG_PRESENT)(
       storeDir = path.join(tmpData, 'binaries');
       mkdirSync(storeDir, { recursive: true });
       port = await pickFreePort();
+      const env = {
+        PORT: String(port),
+        HOST: '127.0.0.1',
+        STORAGE_ROOT: storeDir,
+        DB_PATH: path.join(tmpData, 'test.sqlite'),
+        BS_ALLOW_NEW_STORE: '1',
+        BS_SECRETS_FILE: '/dev/null',
+        INTERNAL_SECRET,
+        NODE_ENV: 'test',
+      };
       server = await startTestServer({
         cwd: BS_DIR,
         cmd: ['bun', path.join(BS_DIR, 'src', 'index.ts')],
         port,
-        env: {
-          PORT: String(port),
-          HOST: '127.0.0.1',
-          STORAGE_ROOT: storeDir,
-          DB_PATH: path.join(tmpData, 'test.sqlite'),
-          INTERNAL_SECRET,
-          NODE_ENV: 'test',
-        },
+        env,
         healthPath: '/healthz',
         timeoutMs: 90_000,
       });
+      // The store only ENQUEUES a job; binary-server's processing worker (its own process since
+      // bs task 2694) leases and runs it, and writes each output back through the store's API.
+      // Without one, every job stays `pending` and the client times out.
+      worker = Bun.spawn(['bun', path.join(BS_DIR, 'src', 'processingWorker.ts')], {
+        cwd: BS_DIR,
+        env: { ...process.env, ...env },
+        stdout: 'inherit',
+        stderr: 'inherit',
+      });
 
       // Register the tenant, the way `register-app` does for a real one. This is
       // not harness ceremony: since binary-server started INDEXING every transcode
@@ -71,7 +89,7 @@ describe.skipIf(!BS_PRESENT || !FFMPEG_PRESENT)(
         ],
         {
           cwd: BS_DIR,
-          env: { ...process.env, STORAGE_ROOT: storeDir, DB_PATH: path.join(tmpData, 'test.sqlite') },
+          env: { ...process.env, STORAGE_ROOT: storeDir, DB_PATH: path.join(tmpData, 'test.sqlite'), BS_ALLOW_NEW_STORE: '1', BS_SECRETS_FILE: '/dev/null' },
           stdout: 'inherit',
           stderr: 'inherit',
         },
@@ -80,6 +98,8 @@ describe.skipIf(!BS_PRESENT || !FFMPEG_PRESENT)(
     }, 90_000);
 
     afterAll(async () => {
+      worker?.kill();
+      await worker?.exited;
       await server?.stop();
       await rm(tmpData, { recursive: true, force: true }).catch(() => void 0);
     });
@@ -97,7 +117,7 @@ describe.skipIf(!BS_PRESENT || !FFMPEG_PRESENT)(
       `;
       const proc = Bun.spawn(['bun', '-e', helper, `${APP}/${key}`, localFile], {
         cwd: BS_DIR,
-        env: { ...process.env, STORAGE_ROOT: storeDir, DB_PATH: path.join(tmpData, 'test.sqlite') },
+        env: { ...process.env, STORAGE_ROOT: storeDir, DB_PATH: path.join(tmpData, 'test.sqlite'), BS_ALLOW_NEW_STORE: '1', BS_SECRETS_FILE: '/dev/null' },
         stdout: 'inherit',
         stderr: 'inherit',
       });

package/src/server/storage/chunked.integration.spec.ts

@@ -40,7 +40,11 @@ const pem = (der: ArrayBuffer, label: string) =>
 
 // SKIPPED until a real binary-server checkout is present: point BINARY_SERVER_DIR at one.
 // There is deliberately no default — a published package must not go looking in one machine's
-// directory layout — and `binary-server` has not been re-homed here, so this skips on every host today.
+// directory layout. In this generation that checkout is `$FORGE/apps/binary-server`.
+// BS_ALLOW_NEW_STORE=1: the spawned server refuses to invent a store it was not given, and this
+// throwaway one is exactly a store it should create.
+// BS_SECRETS_FILE=/dev/null: otherwise it folds in this machine's binary-server.env — the real R2
+// keys and passcode — and a throwaway store has no business holding them.
 describe.skipIf(!BS_PRESENT)('chunked upload → real binary-server (integration)', () => {
   let server: TestServer | null = null;
   let tmp = '';
@@ -83,7 +87,7 @@ describe.skipIf(!BS_PRESENT)('chunked upload → real binary-server (integration
         PORT: String(port),
         HOST: '127.0.0.1',
         STORAGE_ROOT: path.join(tmp, 'binaries'),
-        DB_PATH: path.join(tmp, 'bs.sqlite'),
+        DB_PATH: path.join(tmp, 'bs.sqlite'), BS_ALLOW_NEW_STORE: '1', BS_SECRETS_FILE: '/dev/null',
         FILE_TOKEN_PUBLIC_KEY: spki,
         FILE_TOKEN_ISSUER: ISSUER,
         CA_APP_ID: APP_ID,

package/src/server/storage/fileUploadClient-chunked.integration.spec.ts

@@ -50,7 +50,11 @@ const pem = (der: ArrayBuffer, label: string) =>
 
 // SKIPPED until a real binary-server checkout is present: point BINARY_SERVER_DIR at one.
 // There is deliberately no default — a published package must not go looking in one machine's
-// directory layout — and `binary-server` has not been re-homed here, so this skips on every host today.
+// directory layout. In this generation that checkout is `$FORGE/apps/binary-server`.
+// BS_ALLOW_NEW_STORE=1: the spawned server refuses to invent a store it was not given, and this
+// throwaway one is exactly a store it should create.
+// BS_SECRETS_FILE=/dev/null: otherwise it folds in this machine's binary-server.env — the real R2
+// keys and passcode — and a throwaway store has no business holding them.
 describe.skipIf(!BS_PRESENT)('fileUploadClient chunked path → real binary-server (integration)', () => {
   let server: TestServer | null = null;
   let tmp = '';
@@ -90,7 +94,7 @@ describe.skipIf(!BS_PRESENT)('fileUploadClient chunked path → real binary-serv
         PORT: String(port),
         HOST: '127.0.0.1',
         STORAGE_ROOT: path.join(tmp, 'binaries'),
-        DB_PATH: path.join(tmp, 'bs.sqlite'),
+        DB_PATH: path.join(tmp, 'bs.sqlite'), BS_ALLOW_NEW_STORE: '1', BS_SECRETS_FILE: '/dev/null',
         FILE_TOKEN_PUBLIC_KEY: spki,
         FILE_TOKEN_ISSUER: ISSUER,
         CA_APP_ID: APP_ID,

package/src/server/storage/transcode.integration.spec.ts

@@ -1,4 +1,5 @@
 import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import type { Subprocess } from 'bun';
 import { existsSync, mkdirSync } from 'node:fs';
 import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
@@ -18,11 +19,16 @@ const BS_PRESENT = BS_DIR !== '' && existsSync(path.join(BS_DIR, 'src', 'index.t
 
 // SKIPPED until a real binary-server checkout is present: point BINARY_SERVER_DIR at one.
 // There is deliberately no default — a published package must not go looking in one machine's
-// directory layout — and `binary-server` has not been re-homed here, so this skips on every host today.
+// directory layout. In this generation that checkout is `$FORGE/apps/binary-server`.
+// BS_ALLOW_NEW_STORE=1: the spawned server refuses to invent a store it was not given, and this
+// throwaway one is exactly a store it should create.
+// BS_SECRETS_FILE=/dev/null: otherwise it folds in this machine's binary-server.env — the real R2
+// keys and passcode — and a throwaway store has no business holding them.
 describe.skipIf(!BS_PRESENT)('transcode API → real binary-server (integration)', () => {
   let port: number;
   let storeDir: string;
   let server: TestServer | null = null;
+  let worker: Subprocess | null = null;
   let tmpData: string;
   const INTERNAL_SECRET = 'test-transcode-secret';
 
@@ -32,24 +38,37 @@ describe.skipIf(!BS_PRESENT)('transcode API → real binary-server (integration)
     mkdirSync(storeDir, { recursive: true });
 
     port = await pickFreePort();
+    const env = {
+      PORT: String(port),
+      HOST: '127.0.0.1',
+      STORAGE_ROOT: storeDir,
+      DB_PATH: path.join(tmpData, 'test.sqlite'),
+      BS_ALLOW_NEW_STORE: '1',
+      BS_SECRETS_FILE: '/dev/null',
+      INTERNAL_SECRET,
+      NODE_ENV: 'test',
+    };
     server = await startTestServer({
       cwd: BS_DIR,
       cmd: ['bun', path.join(BS_DIR, 'src', 'index.ts')],
       port,
-      env: {
-        PORT: String(port),
-        HOST: '127.0.0.1',
-        STORAGE_ROOT: storeDir,
-        DB_PATH: path.join(tmpData, 'test.sqlite'),
-        INTERNAL_SECRET,
-        NODE_ENV: 'test',
-      },
+      env,
       healthPath: '/healthz',
       timeoutMs: 90_000,
     });
+    // The store only ENQUEUES a job; binary-server's processing worker (its own process since
+    // bs task 2694) leases and runs it. Without one, every job stays `pending` forever.
+    worker = Bun.spawn(['bun', path.join(BS_DIR, 'src', 'processingWorker.ts')], {
+      cwd: BS_DIR,
+      env: { ...process.env, ...env },
+      stdout: 'inherit',
+      stderr: 'inherit',
+    });
   }, 90_000);
 
   afterAll(async () => {
+    worker?.kill();
+    await worker?.exited;
     await server?.stop();
     await rm(tmpData, { recursive: true, force: true }).catch(() => void 0);
   });
@@ -118,7 +137,9 @@ describe.skipIf(!BS_PRESENT)('transcode API → real binary-server (integration)
       await Bun.sleep(100);
     }
     expect(status).toBe('failed');
-  });
+    // Past bun's 5 s default: a timeout kills the spawned server, and the tests after this one
+    // then fail at `fetch` instead of here, naming the wrong thing.
+  }, 15_000);
 
   test('GET /api/transcode/:jobId returns 404 for unknown job', async () => {
     const res = await fetch(`http://localhost:${port}/api/transcode/nonexistent-job-id`, {