feat: bun, biome, and strict typescript foundation for 2.0

[TurtIeSocks]

First of five plans for 2.0. This one is all groundwork: it swaps the toolchain and clears out the dependencies that would have made the rest awkward, without touching how anything actually behaves. No UI, no routing, no schema work. Those come later.

What changed

Bun replaces Node and Yarn as runtime, package manager, and test runner. yarn.lock is gone in favour of bun.lock, the Dockerfile builds on oven/bun, and all six CI workflows now use oven-sh/setup-bun.

Biome replaces ESLint and Prettier. One tool, one config, and it checks 629 files in under 100ms where the old setup took long enough that nobody ran it locally.

TypeScript is now checked strictly, with tsc wired into both CI and a pre-commit hook. Only app/ is strict today, since src/ and server/ still hold 531 @ts-check'd JavaScript files carrying 612 latent type errors. Those get converted per-plan rather than in one heroic sweep, and the gate stops new ones arriving in the meantime.

Tailwind v4 arrives with a second Vite entry at app.html. It renders one line of placeholder text right now. Nothing serves it yet, which is deliberate: the point was to prove the two-entry build works before anything depends on it.

Three dependencies leave. bcrypt becomes Bun.password, node-fetch becomes the native fetch, and the .custom.jsx override plugin is deleted outright.

Breaking changes

.custom.jsx and .custom.css overrides no longer apply. The mechanism let anyone drop a Foo.custom.jsx beside any source file and silently replace it at build time, with only a build warning. It was never officially supported, and the 2.0 client restructure would have broken every existing override with no compiler signal at all. Better to remove it deliberately than to let it break by accident. Anyone relying on it will need to fork or send the change upstream.

Password hashing moves to Bun.password. Existing bcrypt hashes still verify, including $2a$, $2b$ and $2y$ prefixes at cost factors 4 through 12, all checked against real fixtures generated by bcrypt 5.1.1.

Two things the final review caught

Worth calling out, because both would have shipped and both came from the same root cause.

A single biome check --write --unsafe run early in the branch rewrote code semantically while the test suite stayed green. Most of that damage was found and restored at the time. One piece was not: noThisInStatic had rewritten 95 static call sites in server/src/models/ from this.query() to the hardcoded class name. That reads as harmless, and it was cleared as safe once on the grounds that every model extends Model directly. True, and beside the point. DbManager only binds the base class for the five singleModels. The twelve scanner-backed models get their connection through bindKnex(), which lives on a runtime subclass, so static dispatch through that subclass is the whole mechanism. Naming the base class targets a class that is never bound in any configuration, and every map query would have thrown on first load. No test caught it because none exercises a model through a bound SubModel.

The revert alone would not have held, either. noThisInStatic is part of Biome's recommended preset, so the next bun run format would have quietly put all 95 back. The rule is now off, next to noImportantStyles, which is already off for exactly the same reason after the earlier round of this.

The second one was in the 72-byte bcrypt fallback. bcrypt truncated its input at 72 bytes and Bun does not, so old hashes need a retry against the prefix. The retry worked. The problem was what came after: on success it re-hashed the full submitted password and wrote it back, and the bytes past 72 had never been verified against anything. Someone with a 90 byte password, whose tail has been ignored for years, logs in with a slightly different tail and that typo silently becomes their real password. There is no reset flow, so they would have been locked out until someone edited the database by hand. The retry stays, the write is gone, and there is now a test asserting that a login with a different tail performs zero writes.

Verification

bun install --frozen-lockfile   ok
bun test                        76 pass, 0 fail, 11 files
bun run typecheck               ok
bun run lint                    629 files, clean
bun run build                   ok, both entries emitted

Docker builds and runs, reaching the expected database-config failure with no module resolution problems. The server boots the same way under bun server/src/index.js. The two Vite entries emit separate stylesheets, so Tailwind's global reset stays out of the 1.0 bundle. Every task was reviewed before landing, and the whole branch went through three separate review passes at the end covering auth, boot, and behavioural regressions in the existing client.

What this plan does not do

No existing file is converted to TypeScript. src/ and server/src/ are untouched beyond the two dependency swaps and the model fix above. There is no shadcn, no MapLibre, no deck.gl, and no UI. Routing and the per-user flag that decides who sees app.html are the next plan.

🤖 Generated with Claude Code