Migrate codebase from CommonJS to ES Modules

- Convert all require()/module.exports to import/export across 260+ files
- Add "type": "module" to package.json to enable ESM by default
- Add migrations/package.json with "type": "commonjs" to keep db-migrate compatible
- Convert eslint.config.js to ESM with sourceType: "module"
- Replace __dirname/__filename with import.meta.dirname/import.meta.filename
- Replace require.main === module with process.argv[1] === import.meta.filename
- Remove 'use strict' directives (implicit in ESM)
- Convert dynamic require() in switch statements to static import lookup maps
  (dns.js, domains.js, backupformats.js, backupsites.js, network.js)
- Extract self-referencing exports.CONSTANT patterns into standalone const
  declarations (apps.js, services.js, locks.js, users.js, mail.js, etc.)
- Lazify SERVICES object in services.js to avoid circular dependency TDZ issues
- Add clearMailQueue() to mailer.js for ESM-safe queue clearing in tests
- Add _setMockApp() to ldapserver.js for ESM-safe test mocking
- Add _setMockResolve() wrapper to dig.js for ESM-safe DNS mocking in tests
- Convert backupupload.js to use dynamic imports so --check exits before
  loading the module graph (which requires BOX_ENV)
- Update check-install to use ESM import for infra_version.js
- Convert scripts/ (hotfix, release, remote_hotfix.js, find-unused-translations)
- All 1315 tests passing

Migration stats (AI-assisted using Cursor with Claude):
- Wall clock time: ~3-4 hours
- Assistant completions: ~80-100
- Estimated token usage: ~1-2M tokens

Co-authored-by: Cursor <cursoragent@cursor.com>

src/storage/filesystem.js

@@ -1,6 +1,20 @@
-'use strict';
+import assert from 'node:assert';
+import BoxError from '../boxerror.js';
+import crypto from 'crypto';
+import debugModule from 'debug';
+import * as df from '../df.js';
+import fs from 'node:fs';
+import mounts from '../mounts.js';
+import path from 'node:path';
+import paths from '../paths.js';
+import safe from 'safetydance';
+import shellModule from '../shell.js';
+import * as _ from '../underscore.js';
 
-exports = module.exports = {
+const debug = debugModule('box:storage/filesystem');
+const shell = shellModule('filesystem');
+
+export {
     setup,
     teardown,
     cleanup,
@@ -25,20 +39,6 @@ exports = module.exports = {
     removeDir,
 };
 
-const assert = require('node:assert'),
-    BoxError = require('../boxerror.js'),
-    crypto = require('crypto'),
-    debug = require('debug')('box:storage/filesystem'),
-    df = require('../df.js'),
-    fs = require('node:fs'),
-    mounts = require('../mounts.js'),
-    path = require('node:path'),
-    paths = require('../paths.js'),
-    safe = require('safetydance'),
-    shell = require('../shell.js')('filesystem'),
-    _ = require('../underscore.js');
-
-
 function getRootPath(config) {
     assert.strictEqual(typeof config, 'object');
 

src/storage/gcs.js

@@ -1,6 +1,16 @@
-'use strict';
+import assert from 'node:assert';
+import async from 'async';
+import BoxError from '../boxerror.js';
+import constants from '../constants.js';
+import debugModule from 'debug';
+import { Storage as GCS } from '@google-cloud/storage';
+import path from 'node:path';
+import safe from 'safetydance';
+import * as _ from '../underscore.js';
 
-exports = module.exports = {
+const debug = debugModule('box:storage/gcs');
+
+export {
     getAvailableSize,
     getStatus,
 
@@ -25,16 +35,6 @@ exports = module.exports = {
     injectPrivateFields,
 };
 
-const assert = require('node:assert'),
-    async = require('async'),
-    BoxError = require('../boxerror.js'),
-    constants = require('../constants.js'),
-    debug = require('debug')('box:storage/gcs'),
-    GCS = require('@google-cloud/storage').Storage,
-    path = require('node:path'),
-    safe = require('safetydance'),
-    _ = require('../underscore.js');
-
 function getBucket(config) {
     assert.strictEqual(typeof config, 'object');
 

src/storage/interface.js

@@ -1,4 +1,5 @@
-'use strict';
+import assert from 'node:assert';
+import BoxError from '../boxerror.js';
 
 // -------------------------------------------
 //  This file just describes the interface
@@ -10,7 +11,7 @@
 //     retry logic for upload() comes from the syncer since it is stream based
 //     for the other API calls we leave it to the backend to retry. this allows
 //     them to tune the concurrency based on failures/rate limits accordingly
-exports = module.exports = {
+export {
     getAvailableSize,
     getStatus,
 
@@ -36,9 +37,6 @@ exports = module.exports = {
     injectPrivateFields
 };
 
-const assert = require('node:assert'),
-    BoxError = require('../boxerror.js');
-
 function removePrivateFields(config) {
     // in-place removal of tokens and api keys
     return config;

src/storage/s3.js

@@ -1,51 +1,46 @@
-'use strict';
+import assert from 'node:assert';
+import async from 'async';
+import BoxError from '../boxerror.js';
+import { ConfiguredRetryStrategy } from '@smithy/util-retry';
+import constants from '../constants.js';
+import consumers from 'node:stream/consumers';
+import crypto from 'node:crypto';
+import debugModule from 'debug';
+import http from 'node:http';
+import https from 'node:https';
+import { NodeHttpHandler } from '@smithy/node-http-handler';
+import { PassThrough } from 'node:stream';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+import { S3, NoSuchKey, NoSuchBucket } from '@aws-sdk/client-s3';
+import safe from 'safetydance';
+import { Upload } from '@aws-sdk/lib-storage';
+import * as _ from '../underscore.js';
 
-exports = module.exports = {
+const debug = debugModule('box:storage/s3');
+
+const _chunk = chunk;
+
+export {
     setup,
     teardown,
     cleanup,
-
     verifyConfig,
     removePrivateFields,
     injectPrivateFields,
-
     getAvailableSize,
     getStatus,
-
     upload,
     exists,
     download,
     copy,
     copyDir,
-
     listDir,
-
     remove,
     removeDir,
-
-    // Used to mock AWS
-    _chunk: chunk
+    _chunk,
 };
 
-const assert = require('node:assert'),
-    async = require('async'),
-    BoxError = require('../boxerror.js'),
-    { ConfiguredRetryStrategy } = require('@smithy/util-retry'),
-    constants = require('../constants.js'),
-    consumers = require('node:stream/consumers'),
-    crypto = require('node:crypto'),
-    debug = require('debug')('box:storage/s3'),
-    http = require('node:http'),
-    https = require('node:https'),
-    { NodeHttpHandler } = require('@smithy/node-http-handler'),
-    { PassThrough } = require('node:stream'),
-    path = require('node:path'),
-    { Readable } = require('node:stream'),
-    { S3, NoSuchKey, NoSuchBucket } = require('@aws-sdk/client-s3'),
-    safe = require('safetydance'),
-    { Upload } = require('@aws-sdk/lib-storage'),
-    _ = require('../underscore.js');
-
 function S3_NOT_FOUND(error) {
     return error instanceof NoSuchKey || error instanceof NoSuchBucket;
 }