⭐ Helpers

bcrypt.js, customErrors.js, jwt.js — small, focused utilities, each carrying a real fix rather than a straight port.

bcrypt cost factor bumped 10 → 12, not a source bug but current OWASP Password Storage guidance for modern hardware. Tested with a real password round-trip through the actual bcrypt module, no mocking, asserting the hash's own embedded cost factor.

Two JWT security gaps, both real: jwt.sign() never set expiresIn (tokens were valid forever) — fixed to 7d, confirmed safe by reading ahead into the login flow and verifying it always re-issues a fresh token on success. jwt.verify() never restricted algorithms, so it would accept a token signed with any algorithm as long as the signature matched the shared secret — fixed with an explicit algorithms: ["HS256"]. Both fixes were deliberately reverted and their tests watched to confirm they catch the regression before being restored.

customErrors.js had two message-formatting bugs — a trailing space/colon left behind when the optional message argument was omitted (the common case), and a stray double period — both fixed to only append the ": <message>" suffix when a message is actually given.