fix(core): fix 6 bugs found in codebase audit

src/adapters/realtime.ts

@@ -1,12 +1,12 @@
-import { BaseAdapter } from './base';
-import type { AnalyticsEngineDataPoint } from '../types/realtime';
+import { BaseAdapter } from './base.js';
+import type { AnalyticsEngineDataPoint } from '../types/index.js';
 import {
   realtimeEventSchema,
   type RealtimeEvent,
   type ServerContext,
 } from '../schemas/index.js';
-import { parseUserAgent } from '../utils/user-agent-parser';
-import { detectBot } from '../utils/bot-detection';
+import { parseUserAgent } from '../utils/user-agent-parser.js';
+import { detectBot } from '../utils/bot-detection.js';
 
 /**
  * Adapter for real-time analytics events

src/durable-objects/realtime-aggregator.ts

@@ -2,9 +2,9 @@ import type {
   RealtimeEvent,
   RealtimeStats,
   AggregatedData,
-} from '../types/realtime';
-import { parseUserAgent } from '../utils/user-agent-parser';
-import { detectBot } from '../utils/bot-detection';
+} from '../types/realtime.js';
+import { parseUserAgent } from '../utils/user-agent-parser.js';
+import { detectBot } from '../utils/bot-detection.js';
 
 /**
  * Durable Object for real-time analytics aggregation

src/routes/projects.ts

@@ -10,8 +10,11 @@ import {
   createProject,
   listProjects,
   getProject,
+  countProjects,
 } from '../services/project.js';
 
+const MAX_LIMIT = 1000;
+
 /**
  * Create and configure projects API router
  */
@@ -68,15 +71,23 @@ export function createProjectsRouter(): Hono<{ Bindings: Env }> {
    */
   app.get('/', async (c) => {
     try {
-      const limit = parseInt(c.req.query('limit') || '100');
-      const offset = parseInt(c.req.query('offset') || '0');
-
-      const projects = await listProjects(c.env.DB, limit, offset);
+      const rawLimit = parseInt(c.req.query('limit') ?? '', 10);
+      const limit =
+        Number.isNaN(rawLimit) || rawLimit < 0
+          ? 100
+          : Math.min(rawLimit, MAX_LIMIT);
+      const rawOffset = parseInt(c.req.query('offset') ?? '', 10);
+      const offset = Number.isNaN(rawOffset) || rawOffset < 0 ? 0 : rawOffset;
+
+      const [projects, total] = await Promise.all([
+        listProjects(c.env.DB, limit, offset),
+        countProjects(c.env.DB),
+      ]);
 
       const response: ProjectListResponse = {
         success: true,
         projects,
-        total: projects.length,
+        total,
       };
 
       return c.json(response);

src/routes/realtime.ts

@@ -1,7 +1,7 @@
 import { Hono } from 'hono';
-import type { Env } from '../types/index';
-import { RealtimeAdapter } from '../adapters/realtime';
-import type { ServerContext, RealtimeEvent } from '../types/realtime';
+import type { Env } from '../types/index.js';
+import { RealtimeAdapter } from '../adapters/realtime.js';
+import type { ServerContext, RealtimeEvent } from '../types/realtime.js';
 
 const realtimeRouter = new Hono<{ Bindings: Env }>();
 const adapter = new RealtimeAdapter();

src/services/analytics-engine.ts

@@ -16,12 +16,12 @@ export class AnalyticsEngineService {
    * Write data point to Analytics Engine dataset with retry logic
    * @returns Success status
    */
-  writeDataPoint<T>(
+  async writeDataPoint<T>(
     env: Env,
     datasetName: keyof Env,
     adapter: DataAdapter<T>,
     rawData: unknown
-  ): { success: boolean; error?: string } {
+  ): Promise<{ success: boolean; error?: string }> {
     try {
       // Validate input data
       if (!adapter.validate(rawData)) {
@@ -42,7 +42,11 @@ export class AnalyticsEngineService {
       }
 
       // Write data point with retry logic
-      const writeResult = this.writeWithRetry(dataset, dataPoint, datasetName);
+      const writeResult = await this.writeWithRetry(
+        dataset,
+        dataPoint,
+        datasetName
+      );
       if (!writeResult.success) {
         return writeResult;
       }
@@ -75,11 +79,11 @@ export class AnalyticsEngineService {
   /**
    * Write data point with exponential backoff retry logic
    */
-  private writeWithRetry(
+  private async writeWithRetry(
     dataset: AnalyticsEngineDataset,
     dataPoint: AnalyticsEngineDataPoint,
     datasetName: keyof Env
-  ): { success: boolean; error?: string } {
+  ): Promise<{ success: boolean; error?: string }> {
     let lastError: Error | undefined;
 
     for (
@@ -115,12 +119,8 @@ export class AnalyticsEngineService {
             }
           );
 
-          // Exponential backoff delay (synchronous for simplicity in edge runtime)
-          // Note: In real-world edge runtime, this would be async, but for testing we keep it sync
-          const start = Date.now();
-          while (Date.now() - start < delay) {
-            // Busy wait for delay
-          }
+          // Async exponential backoff — avoids blocking the V8 event loop
+          await new Promise<void>((r) => setTimeout(r, delay));
         }
       }
     }

src/services/analytics-query.ts

@@ -377,17 +377,19 @@ export class AnalyticsQueryService {
         allValues.length
     );
 
-    timeseries.forEach((point) => {
-      const zScore = Math.abs((point.value - mean) / stdDev);
-      if (zScore > 2.5 && allValues.length > 10) {
-        anomalies.push({
-          timestamp: point.timestamp,
-          description: `Unusual activity detected: ${Math.round(point.value)} events`,
-          severity: zScore > 3 ? 'high' : 'medium',
-          value: point.value,
-        });
-      }
-    });
+    if (stdDev > 0) {
+      timeseries.forEach((point) => {
+        const zScore = Math.abs((point.value - mean) / stdDev);
+        if (zScore > 2.5 && allValues.length > 10) {
+          anomalies.push({
+            timestamp: point.timestamp,
+            description: `Unusual activity detected: ${Math.round(point.value)} events`,
+            severity: zScore > 3 ? 'high' : 'medium',
+            value: point.value,
+          });
+        }
+      });
+    }
 
     // Generate recommendations
     if (trends.length > 0 && trends[0]?.direction === 'up') {

src/services/project.ts

@@ -121,6 +121,18 @@ export async function listProjects(
   return results || [];
 }
 
+/**
+ * Count total number of projects
+ * @param db D1 database binding
+ * @returns Total project count
+ */
+export async function countProjects(db: D1Database): Promise<number> {
+  const result = await db
+    .prepare('SELECT COUNT(*) as count FROM projects')
+    .first<{ count: number }>();
+  return result?.count ?? 0;
+}
+
 /**
  * Update last_used timestamp for a project
  * @param db D1 database binding

src/services/self-tracking.ts

@@ -74,8 +74,8 @@ export class SelfTrackingService {
     }
 
     // Create async write operation
-    const writePromise = Promise.resolve().then(() => {
-      const result = this.analyticsService.writeDataPoint(
+    const writePromise = Promise.resolve().then(async () => {
+      const result = await this.analyticsService.writeDataPoint(
         env,
         'SELF_TRACKING_ANALYTICS',
         this.adapter,

src/types/realtime.ts

@@ -248,13 +248,3 @@ export interface AggregatedData {
     visitor_id?: string;
   }>;
 }
-
-/**
- * Analytics Engine data point format
- * Reference: https://developers.cloudflare.com/analytics/analytics-engine/
- */
-export interface AnalyticsEngineDataPoint {
-  indexes?: string[]; // Max 1 index, max 96 bytes each
-  doubles?: number[]; // Numeric values
-  blobs?: string[]; // String values, max 5120 bytes each
-}

src/utils/fingerprint.ts

@@ -1,4 +1,4 @@
-import type { FingerprintComponents, Fingerprint } from '../types/realtime';
+import type { FingerprintComponents, Fingerprint } from '../types/realtime.js';
 
 /**
  * Generate a privacy-respecting fingerprint from browser components

src/utils/route-handler.ts

@@ -11,14 +11,14 @@ export function createAnalyticsHandler<T>(
   adapter: DataAdapter<T>,
   analyticsService: AnalyticsEngineService
 ): {
-  handleGet: (c: Context<{ Bindings: Env }>) => Response;
+  handleGet: (c: Context<{ Bindings: Env }>) => Promise<Response>;
   handlePost: (c: Context<{ Bindings: Env }>) => Promise<Response>;
 } {
   return {
     /**
      * Handle GET requests with query parameters
      */
-    handleGet: (c: Context<{ Bindings: Env }>): Response => {
+    handleGet: async (c: Context<{ Bindings: Env }>): Promise<Response> => {
       const rawData = c.req.query() as Record<string, string | string[]>;
       const projectId = c.get('project_id');
 
@@ -33,7 +33,7 @@ export function createAnalyticsHandler<T>(
       const dataWithProject = projectId
         ? { ...rawData, project_id: projectId }
         : rawData;
-      const result = analyticsService.writeDataPoint(
+      const result = await analyticsService.writeDataPoint(
         c.env,
         dataset,
         adapter,
@@ -95,7 +95,7 @@ export function createAnalyticsHandler<T>(
         projectId && !Array.isArray(rawData)
           ? { ...rawData, project_id: projectId }
           : rawData;
-      const result = analyticsService.writeDataPoint(
+      const result = await analyticsService.writeDataPoint(
         c.env,
         dataset,
         adapter,

test/e2e/projects-api.test.ts

@@ -240,6 +240,7 @@ describe('Projects API E2E', () => {
       ];
 
       statement.all.mockResolvedValueOnce({ results: mockProjects });
+      statement.first.mockResolvedValueOnce({ count: 3 });
 
       const app = createRouter();
       const request = new Request('http://localhost/api/project');
@@ -260,6 +261,7 @@ describe('Projects API E2E', () => {
 
     it('should handle empty project list', async () => {
       statement.all.mockResolvedValueOnce({ results: [] });
+      statement.first.mockResolvedValueOnce({ count: 0 });
 
       const app = createRouter();
       const request = new Request('http://localhost/api/project');
@@ -277,6 +279,37 @@ describe('Projects API E2E', () => {
       }
     });
 
+    it('should return DB total, not page size (pagination test)', async () => {
+      // Page returns 1 project but DB has 10 total
+      statement.all.mockResolvedValueOnce({
+        results: [
+          {
+            id: 'proj2',
+            description: 'Project 2',
+            created_at: 2,
+            last_used: null,
+          },
+        ],
+      });
+      statement.first.mockResolvedValueOnce({ count: 10 });
+
+      const app = createRouter();
+      const request = new Request(
+        'http://localhost/api/project?limit=1&offset=1'
+      );
+
+      const response = await app.fetch(request, env);
+      const data = (await response.json()) as
+        | ProjectListResponse
+        | ErrorResponse;
+
+      expect(response.status).toBe(200);
+      if ('success' in data && data.success) {
+        expect(data.projects).toHaveLength(1);
+        expect(data.total).toBe(10); // DB total, not page size
+      }
+    });
+
     it('should support pagination with limit and offset', async () => {
       statement.all.mockResolvedValueOnce({
         results: [
@@ -288,6 +321,7 @@ describe('Projects API E2E', () => {
           },
         ],
       });
+      statement.first.mockResolvedValueOnce({ count: 1 });
 
       const app = createRouter();
       const request = new Request(
@@ -306,6 +340,52 @@ describe('Projects API E2E', () => {
       expect(statement.bind).toHaveBeenCalledWith(1, 1);
     });
 
+    it('should use default limit=100 and offset=0 for NaN params', async () => {
+      statement.all.mockResolvedValueOnce({ results: [] });
+      statement.first.mockResolvedValueOnce({ count: 0 });
+
+      const app = createRouter();
+      const request = new Request(
+        'http://localhost/api/project?limit=abc&offset=xyz'
+      );
+
+      const response = await app.fetch(request, env);
+
+      expect(response.status).toBe(200);
+      // NaN should fall back to defaults: limit=100, offset=0
+      expect(statement.bind).toHaveBeenCalledWith(100, 0);
+    });
+
+    it('should clamp negative limit to default and negative offset to 0', async () => {
+      statement.all.mockResolvedValueOnce({ results: [] });
+      statement.first.mockResolvedValueOnce({ count: 0 });
+
+      const app = createRouter();
+      const request = new Request(
+        'http://localhost/api/project?limit=-10&offset=-5'
+      );
+
+      const response = await app.fetch(request, env);
+
+      expect(response.status).toBe(200);
+      // Negative limit should default to 100, negative offset should be 0
+      expect(statement.bind).toHaveBeenCalledWith(100, 0);
+    });
+
+    it('should enforce MAX_LIMIT of 1000', async () => {
+      statement.all.mockResolvedValueOnce({ results: [] });
+      statement.first.mockResolvedValueOnce({ count: 0 });
+
+      const app = createRouter();
+      const request = new Request('http://localhost/api/project?limit=9999');
+
+      const response = await app.fetch(request, env);
+
+      expect(response.status).toBe(200);
+      // Limit above MAX_LIMIT should be clamped to 1000
+      expect(statement.bind).toHaveBeenCalledWith(1000, 0);
+    });
+
     it('should return 500 on database error', async () => {
       statement.all.mockRejectedValueOnce(
         new Error('Database connection failed')