[mini-bomba]

• I agree to license my contribution under AGPL-3.0-only with my contribution automatically being licensed under LGPL-3.0 additionally after 6 months

---

started out as an effort to slightly optimize the permission checks - currently if you submit 100 chapters in one batch, the server calls canSubmit() 100 times, which makes 100 uncached vip queries
ended up being a giant tangent involving updating literally every single dependency this project has, including typescript

things done:

• sqlite support removal cherrypicked from the slop branch
• literally all packages upgraded to the latest version
  • list of breaking changes posted on discord
• nodejs updated to 26
• TS targets set to nodenext
  • this required .js suffixes to be added everywhere; i instead converted everything to fragment imports
  • #* defaults to the ./src directory, with an implicit .js suffix
  • #types/* is a special case that adds a .model.js suffix instead
  • #test/* instead looks in the ./test directory
• replaced ts-node with tsx
• replaced test/test.ts (script that would run mocha directly) with test/setup.ts (script that exports global mocha hooks) and made mocha import it before running tests (along with tsx)
• replaced ts-mock-imports with manual mocking
  • tsx doesn't like modifying module objects, breaking ts-mock-imports
  • YouTubeAPI.listVideos() is a static method of a class, so i just overwrote the method directly
  • rateLimitMiddleware() is an exported function, so i implemented mocking support for it
    • setMockRateLimitMiddleware() is a new function that can be called with a replacement function for rateLimitMiddleware, or undefined to reset the function to the default impl
    • rateLimitMiddleware() checks a variable set by setMockRateLimitMiddleware() and if it's not undefined, it passes all the arguments to it and returns the result
• all route handlers that use req.body now either use optional chaining or check whether the body exists at the start of processing
  • apparently in latest express req.body is nullable
  • doesn't appear in typings, but this caused 100+ test failures
• old segment submit endpoint no longer modifies req.param because it appears to be readonly now
  • instead, if the segment is described via query parameters, the category defaults to sponsor
• calls to canSubmit for the same category within a single request are cached using Map.getOrInsertComputed
• added error handling middleware to log every uncaught error in every route handler
  • returns 500 with the message A server-side error was thrown while handling this request