cursedbelt 2.6.0 → 2.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt",
-	"version": "2.6.0",
+	"version": "2.6.1",
 	"license": "ISC",
 	"type": "module",
 	"description": "Shared Bun + React framework",
@@ -459,7 +459,13 @@
 			"source": "./src/server/storage/index.ts",
 			"import": "./dist/server/storage/index.js"
 		},
-		"./server/storage/types": {
+		"./server/item-crypto": {
+		"types": "./dist/server/auth/vault.d.ts",
+		"bun": "./src/server/auth/vault.ts",
+		"source": "./src/server/auth/vault.ts",
+		"import": "./dist/server/auth/vault.js"
+	},
+	"./server/storage/types": {
 			"types": "./dist/server/storage/types.d.ts",
 			"bun": "./src/server/storage/types.ts",
 			"source": "./src/server/storage/types.ts",

package/src/leafSubpathsImportNothing.spec.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'bun:test';
+import { readdirSync, rmSync, statSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import pkg from '../package.json';
 
@@ -134,10 +135,65 @@ const sourceOf = (subpath: string): string => {
   return bun.replace(/^\.\//, '');
 };
 
+/**
+ * 🔴 The fixture must sit OUTSIDE this repo, and where it lands is not a detail.
+ *
+ * `scripts/testTmpRoot.ts` redirects `$TMPDIR` per process, and when `$FORGE_STATE`
+ * is unset — a bare checkout with no generation around it — its fallback is
+ * deliberately repo-local: `<repo>/.agent.noindex/tmp/<pid>`. For every other suite
+ * that is exactly right. For this one it is fatal: bun resolves a bare import by
+ * walking node_modules UP to the filesystem root, so a fixture under the repo finds
+ * `<repo>/node_modules/otplib` and every peer this check exists to prove unreachable
+ * becomes reachable.
+ *
+ * Measured 2026-09-15: with `$FORGE_STATE` set the negative control failed correctly;
+ * with it unset the SAME control resolved `otplib` out of this repo's own
+ * `node_modules` and the guard fired — *"the fixture resolved 'otplib' … Every
+ * assertion below is vacuous until that is fixed"*. So `bun run verify` was green
+ * under the runner and red in a plain shell, for a reason that has nothing to do with
+ * the code under test. The control did its job; the fixture's address was the bug.
+ *
+ * Resolution here is therefore explicit rather than inherited. The redirected root is
+ * used when it lies outside the repo (the normal case — the runner always sets
+ * `$FORGE_STATE`, and the preload's sweep then cleans up after a killed run). When it
+ * does not, this hops to `$HOME`, which `resolveTestTmpRoot` refuses for the general
+ * default and which this check genuinely requires: an isolated root is the whole
+ * measurement. Stale siblings are swept by mtime, the same way the preload does it,
+ * so the hop cannot accumulate.
+ */
+const REPO_PREFIX = `${REPO.replace(/\/$/, '')}/`;
+
+const fixtureRoot = (): string => {
+  const redirected = process.env.TMPDIR;
+  if (redirected !== undefined && !`${redirected}/`.startsWith(REPO_PREFIX)) {
+    return `${redirected}/leaf-subpath-fixture`;
+  }
+  const home = process.env.HOME?.trim();
+  if (home === undefined || home === '') {
+    throw new Error(
+      'no isolated root available for the leaf fixture ($TMPDIR is inside this repo and $HOME is unset) — ' +
+        'a check that cannot isolate itself is not a passing check',
+    );
+  }
+  const outside = `${home}/.cursedbelt-leaf-fixture.noindex`;
+  try {
+    const cutoff = Date.now() - 6 * 60 * 60 * 1000;
+    for (const entry of readdirSync(outside)) {
+      const path = `${outside}/${entry}`;
+      try {
+        if (statSync(path).mtimeMs < cutoff) rmSync(path, { recursive: true, force: true });
+      } catch {
+        // racing another run's sweep is fine — whoever wins, it goes
+      }
+    }
+  } catch {
+    // no root yet: Bun.write creates it below
+  }
+  return `${outside}/${process.pid}/leaf-subpath-fixture`;
+};
+
 const run = async (): Promise<Record<string, Outcome>> => {
-  // Per-process TMPDIR (see scripts/testTmpRoot.ts), so parallel suites cannot collide and
-  // the preload's sweep is what cleans up after a killed run.
-  const root = `${process.env.TMPDIR ?? '/tmp'}/leaf-subpath-fixture`;
+  const root = fixtureRoot();
   const pkgDir = `${root}/node_modules/cursedbelt`;
 
   // The second lock against bun's auto-install (see the header). The negative control is the