@timber-js/app 0.2.0-alpha.191 → 0.2.0-alpha.194

package/src/server/actions.ts

@@ -14,10 +14,10 @@
  * See design/08-forms-and-actions.md
  */
 
-import { cache } from '../cache/cache-api';
-import { DenySignal, RedirectSignal } from './primitives';
-import { withSpan } from './tracing';
-import { revalidationAls, type RevalidationState } from './als-registry.js';
+import { cache } from '../cache/cache-api.ts';
+import { DenySignal, RedirectSignal } from './primitives.ts';
+import { withSpan } from './tracing.ts';
+import { revalidationAls, type RevalidationState } from './als-registry.ts';
 // ─── Types ───────────────────────────────────────────────────────────────
 
 /** Result of rendering a revalidation — payload root before RSC serialization. */
@@ -33,7 +33,7 @@ export interface RevalidationResult {
 export type RevalidateRenderer = (path: string) => Promise<RevalidationResult>;
 
 // Re-export the type from the registry for public API consumers.
-export type { RevalidationState } from './als-registry.js';
+export type { RevalidationState } from './als-registry.ts';
 
 /** Options for creating the action handler. */
 export interface ActionHandlerConfig {

package/src/server/als-registry.ts

@@ -32,10 +32,10 @@
  */
 
 import '#server-only-guard';
-import type { CoercedParams } from '../shared/param-value.js';
-import type { SlotParamsRecord } from '../shared/slot-params.js';
+import type { CoercedParams } from '../shared/param-value.ts';
+import type { SlotParamsRecord } from '../shared/slot-params.ts';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import type { DebugComponentEntry } from './rsc-entry/helpers.js';
+import type { DebugComponentEntry } from './rsc-entry/helpers.ts';
 
 /**
  * Return a process-wide singleton `AsyncLocalStorage` keyed by `symbol`.
@@ -159,7 +159,7 @@ export interface RequestContextStore {
    * See TIM-1363, TIM-1367, design/16-metadata.md.
    */
   _metadataEntries?: Array<{
-    metadata: import('./types.js').Metadata | Promise<import('./types.js').Metadata | null>;
+    metadata: import('./types.ts').Metadata | Promise<import('./types.ts').Metadata | null>;
     isPage: boolean;
   }>;
 }
@@ -168,7 +168,7 @@ export interface RequestContextStore {
 export interface CookieEntry {
   name: string;
   value: string;
-  options: import('./cookie-context.js').CookieOptions;
+  options: import('./cookie-context.ts').CookieOptions;
 }
 
 // ─── Tracing ──────────────────────────────────────────────────────────────
@@ -186,7 +186,7 @@ export interface TraceStore {
    * after span creation — the platform API has no getActiveSpan() equivalent.
    * Saved/restored by withSpan() around each callback. See TIM-1135.
    */
-  platformSpan?: import('./tracing.js').PlatformSpan;
+  platformSpan?: import('./tracing.ts').PlatformSpan;
 }
 
 /** @internal — import via tracing.ts public API */
@@ -197,7 +197,7 @@ export const traceAls = getOrCreateAls<TraceStore>(Symbol.for('timber:trace-als'
 // Design doc: (dev-only performance instrumentation)
 
 export interface TimingStore {
-  entries: import('./server-timing.js').TimingEntry[];
+  entries: import('./server-timing.ts').TimingEntry[];
 }
 
 /** @internal — import via server-timing.ts public API */
@@ -224,7 +224,7 @@ export const revalidationAls = getOrCreateAls<RevalidationState>(
 // Design doc: design/08-forms-and-actions.md §"No-JS Error Round-Trip"
 
 /** @internal — import via form-flash.ts public API */
-export const formFlashAls = getOrCreateAls<import('./form-flash.js').FormFlashData>(
+export const formFlashAls = getOrCreateAls<import('./form-flash.ts').FormFlashData>(
   Symbol.for('timber:form-flash-als')
 );
 

package/src/server/asset-headers.ts

@@ -19,13 +19,13 @@
  * Design docs: 18-build-system.md, 06-caching.md
  */
 
-import { IMMUTABLE_CACHE, STATIC_CACHE } from '../adapters/shared.js';
+import { IMMUTABLE_CACHE, STATIC_CACHE } from '../adapters/shared.ts';
 
 // Re-export cache constants and generateHeadersFile from the shared adapter
 // module. The canonical definitions live in adapters/shared.ts because
 // adapters are loaded by Node before Vite's resolver is available — they
 // can only import from within their own directory.
-export { IMMUTABLE_CACHE, STATIC_CACHE, generateHeadersFile } from '../adapters/shared.js';
+export { IMMUTABLE_CACHE, STATIC_CACHE, generateHeadersFile } from '../adapters/shared.ts';
 
 /**
  * Regex matching Vite-hashed asset filenames.

package/src/server/chain-url-parts.ts

@@ -20,11 +20,11 @@
  * See design/07-routing.md §"Intercepting Routes".
  */
 
-import type { ManifestSegmentNode } from './route-matcher.js';
-import type { RouteMatch } from './pipeline.js';
-import type { CoercedParams } from '../shared/param-value.js';
-import { effectiveUrlSegment } from '../routing/segment-classify.js';
-import { computeInterceptedBase } from '../routing/interception.js';
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { RouteMatch } from './pipeline.ts';
+import type { CoercedParams } from '../shared/param-value.ts';
+import { effectiveUrlSegment } from '../routing/segment-classify.ts';
+import { computeInterceptedBase } from '../routing/interception.ts';
 
 /**
  * Extract raw URL path parts from a segment chain.

package/src/server/children-interception.ts

@@ -29,10 +29,10 @@
  * See design/07-routing.md §"Intercepting Routes".
  */
 
-import type { RouteMatch } from './pipeline.js';
-import { collectMiddlewareChain, type ManifestSegmentNode } from './route-matcher.js';
-import { findInterceptingMatch } from './slot-interception.js';
-import { treePathNames } from '../routing/segment-keys.js';
+import type { RouteMatch } from './pipeline.ts';
+import { collectMiddlewareChain, type ManifestSegmentNode } from './route-matcher.ts';
+import { findInterceptingMatch } from './slot-interception.ts';
+import { treePathNames } from '../routing/segment-keys.ts';
 
 /**
  * Resolve a children-path interception to a complete route match.

package/src/server/compress.ts

@@ -14,7 +14,7 @@
 // fails the build with an explanatory error rather than resolving to nothing
 // on the deployed server.
 
-import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.js';
+import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.ts';
 
 // ─── Constants ────────────────────────────────────────────────────────────
 

package/src/server/cookie-context.ts

@@ -12,19 +12,19 @@
  * smuggling primitive that the encoding contract closes.
  */
 
-import { requestContextAls, type RequestContextStore } from './als-registry.js';
-import { isDebug } from './debug.js';
+import { requestContextAls, type RequestContextStore } from './als-registry.ts';
+import { isDebug } from './debug.ts';
 import {
   assertValidCookieName,
   assertValidCookieValue,
   assertValidCookieOptions,
-} from '../cookies/validation.js';
+} from '../cookies/validation.ts';
 import {
   parseCookieHeader,
   parseSetCookie,
   safeDecodeCookieValue,
   serializeCookieEntry,
-} from './cookie-parsing.js';
+} from './cookie-parsing.ts';
 
 // Re-export the validators so framework-internal consumers and tests can
 // import the canonical implementation from the same module that hosts

package/src/server/cookie-parsing.ts

@@ -17,8 +17,8 @@
 
 import { parseCookie, parseSetCookie as upstreamParseSetCookie, stringifySetCookie } from 'cookie';
 
-import type { CookieEntry } from './als-registry.js';
-import type { CookieOptions } from './cookie-context.js';
+import type { CookieEntry } from './als-registry.ts';
+import type { CookieOptions } from './cookie-context.ts';
 
 /**
  * Parse a Cookie header string into a Map of name → value pairs.

package/src/server/default-logger.ts

@@ -18,9 +18,9 @@
  * See design/17-logging.md §"DefaultLogger"
  */
 
-import { isDevMode, isDebug } from './debug.js';
-import { formatSsrError } from './error-formatter.js';
-import type { TimberLogger } from './logger.js';
+import { isDevMode, isDebug } from './debug.ts';
+import { formatSsrError } from './error-formatter.ts';
+import type { TimberLogger } from './logger.ts';
 
 /**
  * Format data fields as `key=value` pairs for human-readable output.

package/src/server/deny-boundary.ts

@@ -35,16 +35,16 @@
 
 import { createElement } from 'react';
 
-import { ErrorReconstituter } from '../client/error-reconstituter.js';
-import type { SerializableError } from '../client/error-reconstituter.js';
-import { requestContextAls } from './als-registry.js';
-import { DenySignal } from './primitives.js';
-import { loadModule } from './safe-load.js';
-import type { ManifestLoader } from './safe-load.js';
-import { withSpan } from './tracing.js';
-import { isValidElementType, type LoadedComponent } from './utils/element-type.js';
-import { isMdxFilePath } from './utils/mdx-file.js';
-import type { ManifestSegmentNode } from './route-matcher.js';
+import { ErrorReconstituter } from '../client/error-reconstituter.tsx';
+import type { SerializableError } from '../client/error-reconstituter.tsx';
+import { requestContextAls } from './als-registry.ts';
+import { DenySignal } from './primitives.ts';
+import { loadModule } from './safe-load.ts';
+import type { ManifestLoader } from './safe-load.ts';
+import { withSpan } from './tracing.ts';
+import { isValidElementType, type LoadedComponent } from './utils/element-type.ts';
+import { isMdxFilePath } from './utils/mdx-file.ts';
+import type { ManifestSegmentNode } from './route-matcher.ts';
 
 // ─── Types ────────────────────────────────────────────────────────────────
 

package/src/server/deny-renderer.ts

@@ -16,31 +16,31 @@
  */
 
 import { createElement, Fragment } from 'react';
-import { renderToReadableStream } from '../rsc-runtime/rsc.js';
-
-import { DenySignal } from './primitives.js';
-import { appVisibleSearch } from '../shared/rsc-cache-key.js';
-import { getSlotParamsForClient } from './request-context.js';
-import { withPublishedParams } from './publish-params.js';
-import { renderDenyEntry, type DenyEntryShape } from './deny-boundary.js';
-import { getCookiesForSsr } from './cookie-context.js';
-import { logRenderError } from './logger.js';
-import { loadModule } from './safe-load.js';
-import { isMdxFilePath } from './utils/mdx-file.js';
-import { isDebug } from './debug.js';
-import { resolveMetadata, renderMetadataToElements } from './metadata.js';
-import { headElementsToReact } from './metadata.js';
-import { resolveStatusFile } from './status-code-resolver.js';
-import { defaultStatusPageResponse } from './default-status-page.js';
-import { rscErrorEnvelope } from '../shared/rsc-error-envelope.js';
-import type { ManifestSegmentNode } from './route-matcher.js';
-import type { RouteMatch } from './pipeline.js';
-import type { NavContext } from './ssr-bridge-types.js';
-import { flightInitScript } from './flight-scripts.js';
-import type { ClientBootstrapConfig } from './html-injectors.js';
-import type { Metadata } from './types.js';
-import { teeWithErrorPropagation } from './stream-utils.js';
-import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.js';
+import { renderToReadableStream } from '../rsc-runtime/rsc.ts';
+
+import { DenySignal } from './primitives.ts';
+import { appVisibleSearch } from '../shared/rsc-cache-key.ts';
+import { getSlotParamsForClient } from './request-context.ts';
+import { withPublishedParams } from './publish-params.ts';
+import { renderDenyEntry, type DenyEntryShape } from './deny-boundary.ts';
+import { getCookiesForSsr } from './cookie-context.ts';
+import { logRenderError } from './logger.ts';
+import { loadModule } from './safe-load.ts';
+import { isMdxFilePath } from './utils/mdx-file.ts';
+import { isDebug } from './debug.ts';
+import { resolveMetadata, renderMetadataToElements } from './metadata.ts';
+import { headElementsToReact } from './metadata.ts';
+import { resolveStatusFile } from './status-code-resolver.ts';
+import { defaultStatusPageResponse } from './default-status-page.ts';
+import { rscErrorEnvelope } from '../shared/rsc-error-envelope.ts';
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { RouteMatch } from './pipeline.ts';
+import type { NavContext } from './ssr-bridge-types.ts';
+import { flightInitScript } from './flight-scripts.ts';
+import type { ClientBootstrapConfig } from './html-injectors.ts';
+import type { Metadata } from './types.ts';
+import { teeWithErrorPropagation } from './stream-utils.ts';
+import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.ts';
 
 /** Layout component entry for deny page wrapping. */
 export interface LayoutEntry {
@@ -357,6 +357,19 @@ async function renderDenyPageJson(
   // A .json status file that fails to load is not a usable match — return
   // null so the caller continues to the framework default rather than
   // rejecting out of the chain.
+  // Dev warning: deny(status, data) carries data but JSON status files are
+  // static bodies — the data is silently dropped. The same deny() would
+  // deliver the data to a .tsx file's dangerouslyPassData prop. See
+  // design/10-error-handling.md §"Status-Code File Variants".
+  if (isDebug() && deny.data !== undefined) {
+    console.warn(
+      `[timber] deny(${deny.status}, data) resolved to ${resolution.file.filePath}, ` +
+        `which is a static JSON file. The data argument is dropped — JSON status files ` +
+        `are returned verbatim with no interpolation. If you need the data in the ` +
+        `response, use a .tsx status file or a route handler (route.ts).`
+    );
+  }
+
   const mod = await loadModule(resolution.file).catch(() => null);
   if (!mod) return null;
   const jsonContent = mod.default ?? mod;

package/src/server/early-hints-sender.ts

@@ -18,8 +18,8 @@
  * Design doc: 02-rendering-pipeline.md §"Early Hints (103)"
  */
 
-import { earlyHintsSenderAls } from './als-registry.js';
-import { swallow } from './logger.js';
+import { earlyHintsSenderAls } from './als-registry.ts';
+import { swallow } from './logger.ts';
 
 /** Function that sends Link header values as a 103 Early Hints response. */
 export type EarlyHintsSenderFn = (links: string[]) => void;

package/src/server/early-hints.ts

@@ -19,8 +19,8 @@ import {
   collectRouteCss,
   collectRouteFonts,
   collectRouteModulepreloads,
-} from './build-manifest.js';
-import type { BuildManifest } from './build-manifest.js';
+} from './build-manifest.ts';
+import type { BuildManifest } from './build-manifest.ts';
 
 /** Minimal segment shape needed for early hint collection. */
 interface SegmentWithFiles {

package/src/server/error-boundary-wrapper.ts

@@ -19,9 +19,9 @@
  */
 
 import type { ReactNode } from 'react';
-import type { SegmentNode } from '../routing/types.js';
-import { isValidElementType, type LoadedComponent } from './utils/element-type.js';
-import { isMdxFilePath } from './utils/mdx-file.js';
+import type { SegmentNode } from '../routing/types.ts';
+import { isValidElementType, type LoadedComponent } from './utils/element-type.ts';
+import { isMdxFilePath } from './utils/mdx-file.ts';
 
 /** The minimum a route file must carry for the walk: a path to classify as MDX. */
 interface BoundaryFile {
@@ -73,8 +73,6 @@ export interface ErrorBoundaryWrapConfig<TFile, TElement> {
    * host-specific stand-in). Injected — see the module docstring.
    */
   errorBoundaryComponent: unknown;
-  /** When true, skip 4xx error boundaries — deny catching handles them in-tree. See TIM-666. */
-  skipDenyBoundaries?: boolean;
   /** Segment key stamped on every boundary this walk creates. See `ErrorBoundaryProps`. */
   segmentKey?: string;
 }
@@ -149,7 +147,7 @@ export async function wrapSegmentWithErrorBoundaries<
   element: TElement,
   config: ErrorBoundaryWrapConfig<TFile, TElement>
 ): Promise<TElement> {
-  const { loadModule, skipDenyBoundaries = false } = config;
+  const { loadModule } = config;
 
   if (segment.statusFiles) {
     // Specific status files (innermost — highest priority at runtime)
@@ -157,10 +155,6 @@ export async function wrapSegmentWithErrorBoundaries<
       if (key === '4xx' || key === '5xx') continue;
       const status = parseInt(key, 10);
       if (isNaN(status)) continue;
-      // Skip 4xx boundaries when deny catching is active — the deny
-      // page is rendered by AccessGate/PageDenyBoundary instead.
-      if (skipDenyBoundaries && status >= 400 && status <= 499) continue;
-
       const Component = await loadBoundaryComponent(file, loadModule);
       if (Component) {
         element = wrapInBoundary(element, Component, file, status, { status }, config);
@@ -170,8 +164,6 @@ export async function wrapSegmentWithErrorBoundaries<
     // Category catch-alls (4xx.tsx, 5xx.tsx)
     for (const [key, file] of Object.entries(segment.statusFiles)) {
       if (key !== '4xx' && key !== '5xx') continue;
-      if (skipDenyBoundaries && key === '4xx') continue;
-
       const Component = await loadBoundaryComponent(file, loadModule);
       if (Component) {
         const categoryStatus = key === '4xx' ? 400 : 500;

package/src/server/fallback-error.ts

@@ -10,15 +10,15 @@
  * exposed to the client (design/13-security.md principle 4).
  */
 
-import type { RouteMatch } from './pipeline.js';
-import type { ManifestSegmentNode } from './route-matcher.js';
-import type { ClientBootstrapConfig } from './html-injectors.js';
-import type { LayoutEntry } from './deny-renderer.js';
-import type { GlobalErrorFile } from './rsc-entry/error-renderer.js';
-import { swallow } from './logger.js';
-import { logRenderError } from './logger.js';
-import { loadModule } from './safe-load.js';
-import { sourceMapError } from './dev-source-map.js';
+import type { RouteMatch } from './pipeline.ts';
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { ClientBootstrapConfig } from './html-injectors.ts';
+import type { LayoutEntry } from './deny-renderer.ts';
+import type { GlobalErrorFile } from './rsc-entry/error-renderer.ts';
+import { swallow } from './logger.ts';
+import { logRenderError } from './logger.ts';
+import { loadModule } from './safe-load.ts';
+import { sourceMapError } from './dev-source-map.ts';
 
 /**
  * Render a fallback error page when the render pipeline throws.
@@ -35,7 +35,7 @@ export async function renderFallbackError(
   clientBootstrap: ClientBootstrapConfig,
   globalError?: GlobalErrorFile,
   projectRoot?: string,
-  hmrOptions?: import('../dev-tools/dev-page-shell.js').DevErrorHmrOptions
+  hmrOptions?: import('../dev-tools/dev-page-shell.ts').DevErrorHmrOptions
 ): Promise<Response> {
   // Source-map the error's stack trace in dev mode so the error page
   // shows original source positions. See TIM-811.
@@ -45,7 +45,7 @@ export async function renderFallbackError(
     return renderDevErrorPage(error, projectRoot, hmrOptions);
   }
   // Lazy import to avoid loading error-renderer in the pipeline module
-  const { renderErrorPage } = await import('./rsc-entry/error-renderer.js');
+  const { renderErrorPage } = await import('./rsc-entry/error-renderer.ts');
   const segments = [rootSegment];
   const layoutComponents: LayoutEntry[] = [];
   // Wrap layout loading in try/catch — if the root layout module itself
@@ -95,7 +95,7 @@ export async function renderFallbackError(
 export async function renderDevErrorPage(
   error: unknown,
   projectRoot?: string,
-  hmrOptions?: import('../dev-tools/dev-page-shell.js').DevErrorHmrOptions
+  hmrOptions?: import('../dev-tools/dev-page-shell.ts').DevErrorHmrOptions
 ): Promise<Response> {
   const err = error instanceof Error ? error : new Error(String(error));
   const root = projectRoot ?? process.cwd();
@@ -104,7 +104,7 @@ export async function renderDevErrorPage(
   try {
     // Dynamic import — keeps dev-error-page.ts and its transitive deps
     // (dev-error-overlay.ts, @jridgewell/trace-mapping) out of production bundles.
-    const { generateDevErrorPage } = await import('../dev-tools/error-page.js');
+    const { generateDevErrorPage } = await import('../dev-tools/error-page.ts');
     html = generateDevErrorPage(err, 'render', root, hmrOptions);
     // Inject Vite client script so the error overlay fires when HMR connects.
     html = html.replace(

package/src/server/flight-injection-state.ts

@@ -18,7 +18,7 @@
  * Design doc: 02-rendering-pipeline.md
  */
 
-import type { TransitionMap } from '../utils/state-machine.js';
+import type { TransitionMap } from '../utils/state-machine.ts';
 
 // ─── States ──────────────────────────────────────────────────────────────────
 

package/src/server/form-flash.ts

@@ -14,8 +14,8 @@
  * See design/08-forms-and-actions.md §"No-JS Error Round-Trip"
  */
 
-import type { ValidationErrors } from './action-client.js';
-import { formFlashAls } from './als-registry.js';
+import type { ValidationErrors } from './action-client.ts';
+import { formFlashAls } from './als-registry.ts';
 
 // ─── Types ───────────────────────────────────────────────────────────────
 

package/src/server/html-injector-core.ts

@@ -24,16 +24,16 @@
  * Design docs: 02-rendering-pipeline.md §"Streaming Constraints", 18-build-system.md §"Entry Files"
  */
 
-import { createMachine, type Machine } from '../utils/state-machine.js';
-import { flightChunkScript } from './flight-scripts.js';
+import { createMachine, type Machine } from '../utils/state-machine.ts';
+import { flightChunkScript } from './flight-scripts.ts';
 import {
   flightInjectionTransitions,
   isHtmlDone,
   isPullDone,
   type FlightInjectionState,
   type FlightInjectionEvent,
-} from './flight-injection-state.js';
-import { withTimeout, RenderTimeoutError } from './render-timeout.js';
+} from './flight-injection-state.ts';
+import { withTimeout, RenderTimeoutError } from './render-timeout.ts';
 
 // ─── Encoders / Constants ────────────────────────────────────────────────────
 

package/src/server/html-injectors.ts

@@ -28,10 +28,10 @@ import {
   processInjectorChunk,
   processSuffixChunk,
   suffixFlush,
-} from './html-injector-core.js';
-import { flightChunkScript } from './flight-scripts.js';
-import { withTimeout, RenderTimeoutError } from './render-timeout.js';
-import { createTickCoalescer } from './coalesce-tick.js';
+} from './html-injector-core.ts';
+import { flightChunkScript } from './flight-scripts.ts';
+import { withTimeout, RenderTimeoutError } from './render-timeout.ts';
+import { createTickCoalescer } from './coalesce-tick.ts';
 
 // ─── Buffered Transform ──────────────────────────────────────────────────────
 
@@ -414,7 +414,7 @@ export function buildClientScripts(runtimeConfig: {
   clientJavascript: { disabled: boolean; enableHMRInDev: boolean };
   dev: boolean;
   devBrowserLogs?: string;
-  buildManifest?: import('./build-manifest.js').BuildManifest;
+  buildManifest?: import('./build-manifest.ts').BuildManifest;
 }): ClientBootstrapConfig {
   if (runtimeConfig.clientJavascript.disabled) {
     // When client JS is disabled, import /@vite/client in dev mode if

package/src/server/index.ts

@@ -4,21 +4,21 @@
 // Framework-internal pipeline plumbing is in #server-internal (Node package import).
 // Design doc: design/triage/api-naming-spike.md §8.5
 
-export type { AccessContext } from './types';
-export type { MiddlewareContext } from './types';
-export type { RouteContext } from './types';
-export type { Metadata, MetadataRoute, MetadataHandler, MetadataResult } from './types';
+export type { AccessContext } from './types.ts';
+export type { MiddlewareContext } from './types.ts';
+export type { RouteContext } from './types.ts';
+export type { Metadata, MetadataRoute, MetadataHandler, MetadataResult } from './types.ts';
 
 // Request Context — ALS-backed accessors (all sync)
 // Prefer defineSearchParams().get() and getSegmentParams(SEGMENT_PATH) for typed access.
 // Design doc: design/04-authorization.md §"AccessContext does not include cookies or headers"
-export { getHeaders, getSegmentParams } from './request-context';
-export type { ReadonlyHeaders } from './request-context';
+export { getHeaders, getSegmentParams } from './request-context.ts';
+export type { ReadonlyHeaders } from './request-context.ts';
 
 // Cookie Context — ALS-backed getCookieJar() escape hatch
 // Design doc: design/29-cookies.md
-export { getCookieJar } from './cookie-context';
-export type { RequestCookies, CookieOptions, SetCookieOptions } from './cookie-context';
+export { getCookieJar } from './cookie-context.ts';
+export type { RequestCookies, CookieOptions, SetCookieOptions } from './cookie-context.ts';
 
 // Runtime primitives
 export {
@@ -29,16 +29,16 @@ export {
   waitUntil,
   type DenyOptions,
   type RedirectOptions,
-} from './primitives';
+} from './primitives.ts';
 // RenderError removed from public exports per TIM-724.
 // Use deny({ status: 500, data: ... }) instead. RenderError stays in
 // #server-internal for pipeline catch logic.
-export type { RenderErrorDigest } from './primitives';
+export type { RenderErrorDigest } from './primitives.ts';
 // JsonSerializable moved to @timber-js/app/codec as the single canonical path.
 // Re-export removed per TIM-721.
 
 // Server Actions — user-facing action client and validation
-export { createActionClient, ActionError, validated } from './action-client';
+export { createActionClient, ActionError, validated } from './action-client.ts';
 export type {
   ActionResult,
   ActionFn,
@@ -48,24 +48,24 @@ export type {
   ActionMiddleware,
   ActionSchema,
   ValidationErrors,
-} from './action-client';
+} from './action-client.ts';
 
 // FormData Preprocessing
-export { coerce, parseFormData } from './form-data';
+export { coerce, parseFormData } from './form-data.ts';
 
 // Form Flash (no-JS error round-trip)
-export { getFormFlash } from './form-flash';
-export type { FormFlashData } from './form-flash';
+export { getFormFlash } from './form-flash.ts';
+export type { FormFlashData } from './form-flash.ts';
 
 // Revalidation — user-facing revalidation APIs
-export { revalidatePath, revalidateTag } from './actions';
+export { revalidatePath, revalidateTag } from './actions.ts';
 
 // Tracing — per-request trace ID via ALS (user-facing accessors)
 // Design doc: design/17-logging.md §"trace_id is Always Set"
-export { getTraceId, getSpanId, withSpan, addSpanEvent } from './tracing';
+export { getTraceId, getSpanId, withSpan, addSpanEvent } from './tracing.ts';
 
 // Coerced param types — the post-coercion domain for segment params.
 // TIM-1347: these replaced the previous `Record<string, string | string[]>` lie.
-export type { CoercedParamValue, CoercedParams } from '../shared/param-value';
+export type { CoercedParamValue, CoercedParams } from '../shared/param-value.ts';
 
 // Segment params types — re-exported for convenience.

package/src/server/instrumentation.ts

@@ -9,7 +9,7 @@
  * See design/17-logging.md §"instrumentation.ts — The Entry Point"
  */
 
-import { setLogger, type TimberLogger } from './logger.js';
+import { setLogger, type TimberLogger } from './logger.ts';
 
 // ─── Instrumentation Types ────────────────────────────────────────────────