Phase 5 + all remaining

inventory-server/dashboard/acot-server/utils/phoneAuth.js

@@ -2,9 +2,9 @@
 // The acot-phone-server sends `x-acot-api-key` on every request; we compare
 // against ACOT_PHONE_API_KEY from the environment using timing-safe comparison.
 
-const crypto = require('crypto');
+import crypto from 'node:crypto';
 
-function requirePhoneApiKey(req, res, next) {
+export function requirePhoneApiKey(req, res, next) {
   const expected = process.env.ACOT_PHONE_API_KEY;
   if (!expected) {
     console.error('ACOT_PHONE_API_KEY not configured; rejecting all requests');
@@ -24,5 +24,3 @@ function requirePhoneApiKey(req, res, next) {
 
   next();
 }
-
-module.exports = { requirePhoneApiKey };

inventory-server/dashboard/acot-server/utils/timeUtils.js

@@ -1,4 +1,4 @@
-const { DateTime } = require('luxon');
+import { DateTime } from 'luxon';
 
 const TIMEZONE = 'America/New_York';
 const DB_TIMEZONE = 'UTC-05:00';
@@ -294,19 +294,24 @@ const formatMySQLDate = (input) => {
   return dt.setZone(DB_TIMEZONE).toFormat(DB_DATETIME_FORMAT);
 };
 
-module.exports = {
+// Expose helpers for tests or advanced consumers.
+// Kept as a named `_internal` export so existing destructuring sites
+// (`const { _internal: timeHelpers } = require(...)` → ESM equivalent works)
+// don't need to change beyond the import-statement rewrite.
+const _internal = {
+  getDayStart,
+  getDayEnd,
+  getWeekStart,
+  getRangeForTimeRange,
+  BUSINESS_DAY_START_HOUR,
+};
+
+export {
   getBusinessDayBounds,
   getTimeRangeConditions,
   formatBusinessDate,
   getTimeRangeLabel,
   parseBusinessDate,
   formatMySQLDate,
-  // Expose helpers for tests or advanced consumers
-  _internal: {
-    getDayStart,
-    getDayEnd,
-    getWeekStart,
-    getRangeForTimeRange,
-    BUSINESS_DAY_START_HOUR
-  }
+  _internal,
 };