cursedbelt-server 4.11.1 → 4.13.0

package/dist/server/master-lock/accountsPage.js

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE } from "./lockPage";
+import { MASTER_LOCK_DERIVE_SOURCE } from "./lockPage.js";
 /**
  * The page's own two assets.
  *

package/dist/server/master-lock/guard.d.ts

@@ -1,5 +1,5 @@
-import { type LockPageOptions } from "./lockPage";
-import type { MasterLock } from "./masterLock";
+import { type LockPageOptions } from "./lockPage.js";
+import type { MasterLock } from "./masterLock.js";
 export interface MasterLockGuardOptions extends LockPageOptions {
     /**
      * The lock this guard enforces.

package/dist/server/master-lock/guard.js

@@ -12,8 +12,8 @@
  * second wall, not a replacement for the first.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX, MASTER_LOCK_STATE_HEADER, masterLockCookieName, } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, accountsPageHtml, } from "./accountsPage";
-import { LOCK_SCRIPT, LOCK_STYLE, lockPageHtml } from "./lockPage";
+import { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, accountsPageHtml, } from "./accountsPage.js";
+import { LOCK_SCRIPT, LOCK_STYLE, lockPageHtml } from "./lockPage.js";
 const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma: "no-cache" };
 /**
  * The lock page's own CSP. Strict enough to stand in front of `apps/vault`'s wall without

package/dist/server/master-lock/index.d.ts

@@ -20,10 +20,10 @@
  * server-rendered surface under `/__lock/` reaches every app that mounts the guard with no
  * bundle, no framework version to migrate, and no app-local copy to drift.
  */
-export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage";
-export { MASTER_LOCK_CSP, type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard, } from "./guard";
-export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions, lockPageHtml, } from "./lockPage";
-export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, type MasterLockDirectoryOptions, masterLockPrincipalKey, } from "./principals";
-export { FIRST_ACCOUNT_ID, MasterLock, type MasterLockAccount, type MasterLockAddAccountResult, type MasterLockEnrollResult, type MasterLockOptions, type MasterLockRecord, type MasterLockStore, type MasterLockUnlockResult, readRecord, } from "./masterLock";
-export { DEFAULT_SEED_IDLE_MS, generateStagePassword, type MintMasterLockSeedOptions, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed";
-export { MASTER_LOCK_SETTING_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store";
+export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage.js";
+export { MASTER_LOCK_CSP, type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard, } from "./guard.js";
+export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions, lockPageHtml, } from "./lockPage.js";
+export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, type MasterLockDirectoryOptions, masterLockPrincipalKey, } from "./principals.js";
+export { FIRST_ACCOUNT_ID, MasterLock, type MasterLockAccount, type MasterLockAddAccountResult, type MasterLockEnrollResult, type MasterLockOptions, type MasterLockRecord, type MasterLockStore, type MasterLockUnlockResult, readRecord, } from "./masterLock.js";
+export { DEFAULT_SEED_IDLE_MS, generateStagePassword, type MintMasterLockSeedOptions, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed.js";
+export { MASTER_LOCK_SETTING_KEY, MASTER_LOCK_STATE_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store.js";

package/dist/server/master-lock/index.js

@@ -20,10 +20,10 @@
  * server-rendered surface under `/__lock/` reaches every app that mounts the guard with no
  * bundle, no framework version to migrate, and no app-local copy to drift.
  */
-export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage";
-export { MASTER_LOCK_CSP, createMasterLockGuard, } from "./guard";
-export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml, } from "./lockPage";
-export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, masterLockPrincipalKey, } from "./principals";
-export { FIRST_ACCOUNT_ID, MasterLock, readRecord, } from "./masterLock";
-export { DEFAULT_SEED_IDLE_MS, generateStagePassword, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed";
-export { MASTER_LOCK_SETTING_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store";
+export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage.js";
+export { MASTER_LOCK_CSP, createMasterLockGuard, } from "./guard.js";
+export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml, } from "./lockPage.js";
+export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, masterLockPrincipalKey, } from "./principals.js";
+export { FIRST_ACCOUNT_ID, MasterLock, readRecord, } from "./masterLock.js";
+export { DEFAULT_SEED_IDLE_MS, generateStagePassword, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed.js";
+export { MASTER_LOCK_SETTING_KEY, MASTER_LOCK_STATE_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store.js";

package/dist/server/master-lock/masterLock.d.ts

@@ -1,52 +1,3 @@
-/**
- * The sitewide MASTER LOCK — a second wall, in front of a whole app, that the app's own
- * sign-in cannot open.
- *
- * ── What the owner asked for (2026-08-15, their words) ──────────────────────
- * *"I want to be able to share my laptop without certain apps being at risk of other people
- * viewing them while I am still logged in … Until the master password is entered a user
- * logged in as me cannot see anything about the site, not even text or images, nothing at
- * all."*
- *
- * So: standard auth still happens FIRST and is unchanged. This sits behind it. A request
- * that has passed the app's own gate and carries no live unlock is answered with the lock
- * page (for a document) or a 401 (for anything else) — never with the app.
- *
- * ── 🔴 BE HONEST ABOUT WHAT THIS BUYS ───────────────────────────────────────
- * In `apps/vault` the master password IS the encryption key: the server holds ciphertext
- * and a total breach yields noise. **This cannot work that way, and must never be described
- * as if it does.** The apps it guards serve their bytes to browsers; those bytes are
- * plaintext at rest by nature. This is a LOCK ON THE DOOR — an unlocked laptop, a borrowed
- * phone, a hijacked session still cannot open the UI. The owner said the same thing back:
- * *"I am aware that a tech savvy user of my laptop could still get around it by changing
- * code. This work does not worry about that, we are only securing app UI access."*
- * The same distinction is written in `fleet/rules/owner-uis-are-one-ui.md` and in
- * binary-server's `src/admin/passcode.ts`, which is this feature's nearest relative.
- *
- * ── The four decisions that are not obvious ─────────────────────────────────
- *
- * **1. Sessions live in MEMORY, so a restart re-locks.** The correct default for a surface
- * whose whole risk model is "the browser is somewhere it should not be". Same call as the
- * inspector passcode.
- *
- * **2. The idle clock is slid by INTERACTION, never by traffic.** The owner said *"if I
- * leave the site up but don't interact with it"* — and every app here polls. Sliding on any
- * request would let a background refetch hold the lock open all night with nobody at the
- * desk, which is exactly the scenario the feature exists for. So an ordinary request only
- * READS the clock; `touch()` — reached solely by `POST /__lock/ping`, which the browser
- * sends on real pointer/key/touch activity — is the only thing that moves it.
- *
- * **3. The password is never stored, and this process never sees it.** The browser derives
- * `verifier = PBKDF2(KEK ‖ password)` (see `../../core/master-lock/kdf.ts`); the record
- * holds `argon2id(verifier)`. It is seeded from the vault's OWN record so the owner's
- * existing vault master password works on day one without anyone knowing it.
- *
- * **4. Every refusal is the same refusal.** Wrong verifier, throttled, unconfigured and
- * "no unlock" answer with the identical status and body, and a dummy argon2 verify runs on
- * every path so the TIMING does not separate them either. The one thing that varies is the
- * `retryAfterMs` a throttled caller is told — which they already know, since they are the
- * one who has been guessing.
- */
 import { type MasterLockAccountSummary, type MasterLockKdfParams, type MasterLockStatus } from "cursedbelt-core/master-lock";
 /**
  * ONE master password, and therefore one TENANT of the app behind it.
@@ -127,8 +78,29 @@ export interface MasterLockStore {
     read(): string | null;
     write(json: string): void;
 }
+/**
+ * Where the LIVE state goes when the process that holds it does not live — the unlocks that are
+ * open and the throttle's failure count. Synchronous by the same contract as
+ * {@link MasterLockStore}, so a Worker satisfies it from its per-invocation snapshot exactly as
+ * it does the record.
+ *
+ * 🔴 Why it exists (2026-09-22, the night `collections` moved to a Worker): the lock kept its
+ * unlocks in a `Map` on the instance, and a Worker builds the instance once per REQUEST. The
+ * owner typed the right password, got a 200 and a cookie, and the very next request was locked
+ * again — measured on `collections-stage` by `worker-stage-walk.ts`. The throttle had the same
+ * shape: every guess met a fresh counter, so nothing slowed a brute force at all.
+ *
+ * Omitted (the Mac's daemons), the state stays in memory, exactly as before: a restart locks.
+ * Tokens are never stored — only their SHA-256, so a leaked row opens nothing.
+ */
+export interface MasterLockStateStore {
+    read(): string | null;
+    write(json: string): void;
+}
 export interface MasterLockOptions {
     store: MasterLockStore;
+    /** See {@link MasterLockStateStore}. Required wherever the instance does not outlive a request. */
+    state?: MasterLockStateStore;
     /**
      * The BOOTSTRAP record, as JSON, used only when the store is empty — the same shape as
      * {@link MasterLockRecord} with `idleMs` optional.
@@ -225,6 +197,7 @@ export declare class MasterLock {
      * entered again"* — one button, every device.
      */
     private sessions;
+    private readonly stateStore;
     private expiryTimer;
     private failures;
     private lastFailureAt;
@@ -449,6 +422,10 @@ export declare class MasterLock {
     private write;
     /** Drop the in-memory unlock without notifying — for tests between cases. */
     resetForTest(): void;
+    /** Adopt the persisted live state, if there is a store and it holds a readable one. */
+    private loadState;
+    /** Persist the live state — every mutation of it calls this, or a Worker forgets it. */
+    private saveState;
     /** Retire a session whose idle window has passed. Called on every read of the state, so
      *  correctness never depends on the timer having fired. */
     private sweep;

package/dist/server/master-lock/masterLock.js

@@ -47,6 +47,8 @@
  * `retryAfterMs` a throttled caller is told — which they already know, since they are the
  * one who has been guessing.
  */
+import { createHash } from "node:crypto";
+import { constantTimeEqual } from "cwip/constant-time";
 import { clampIdleMs, isMasterLockKdfParams, windowRemaining, } from "cursedbelt-core/master-lock";
 /** The id a legacy single-password record migrates to. Fixed, because the app that adopts
  *  this stamps its existing rows with it — a random id would orphan the library it is
@@ -87,11 +89,14 @@ export class MasterLock {
      * entered again"* — one button, every device.
      */
     sessions = new Map();
+    stateStore = null;
     expiryTimer = null;
     failures = 0;
     lastFailureAt = 0;
     constructor(options) {
         this.store = options.store;
+        this.stateStore = options.state ?? null;
+        this.loadState();
         this.now = options.now ?? Date.now;
         this.onLockedChange = options.onLockedChange;
         this.log = options.log ?? (() => undefined);
@@ -220,7 +225,7 @@ export class MasterLock {
         if (this.sessions.size === 0)
             return null;
         let found = null;
-        for (const presented of presentedTokens(req)) {
+        for (const presented of presentedTokens(req).map(tokenDigest)) {
             for (const [live, session] of this.sessions) {
                 // No early `return`: every candidate is compared against every live token so
                 // the loop's duration does not say which cookie in the jar was the right one.
@@ -307,6 +312,7 @@ export class MasterLock {
             }
             this.failures += 1;
             this.lastFailureAt = now;
+            this.saveState();
             return { ok: false, retryAfterMs: windowRemaining(this.failures, this.lastFailureAt, now) };
         }
         return { ok: true, ...this.open(opened.id, now) };
@@ -322,7 +328,8 @@ export class MasterLock {
         const wasLocked = this.sessions.size === 0;
         // ADDED, never replacing: the desk and the phone are the same person and both stay
         // open. See the `sessions` note.
-        this.sessions.set(token, { accountId, lastActivityAt: now });
+        this.sessions.set(tokenDigest(token), { accountId, lastActivityAt: now });
+        this.saveState();
         this.scheduleExpiry();
         if (wasLocked)
             this.onLockedChange?.(false);
@@ -481,7 +488,7 @@ export class MasterLock {
         // phone left on the counter locks on its own schedule while the desk stays open —
         // which is decision 2 applied per device rather than per person.
         let slid = false;
-        for (const presented of presentedTokens(req)) {
+        for (const presented of presentedTokens(req).map(tokenDigest)) {
             for (const [live, session] of this.sessions) {
                 // No early `return`, for the reason `accountFor` gives: the loop's duration
                 // must not say which of the jar's cookies was this app's.
@@ -491,8 +498,10 @@ export class MasterLock {
                 }
             }
         }
-        if (slid)
+        if (slid) {
+            this.saveState();
             this.scheduleExpiry();
+        }
         return slid;
     }
     /** The manual lock — the owner's *"I want a lock option to turn the site back to needing
@@ -504,6 +513,7 @@ export class MasterLock {
         // owner's requirement is "no one can see anything until the master password is
         // entered again", and a lock that left the phone open would not be that.
         this.sessions.clear();
+        this.saveState();
         this.clearExpiry();
         this.onLockedChange?.(true);
     }
@@ -588,6 +598,33 @@ export class MasterLock {
         this.lastFailureAt = 0;
         this.clearExpiry();
     }
+    /** Adopt the persisted live state, if there is a store and it holds a readable one. */
+    loadState() {
+        if (!this.stateStore)
+            return;
+        const raw = this.stateStore.read();
+        if (!raw)
+            return;
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed.v !== 1)
+                return;
+            for (const [digest, session] of parsed.sessions ?? []) {
+                if (typeof digest === "string" && typeof session?.accountId === "string" && Number.isFinite(session.lastActivityAt)) {
+                    this.sessions.set(digest, { accountId: session.accountId, lastActivityAt: session.lastActivityAt });
+                }
+            }
+            this.failures = Number.isFinite(parsed.failures) ? Number(parsed.failures) : 0;
+            this.lastFailureAt = Number.isFinite(parsed.lastFailureAt) ? Number(parsed.lastFailureAt) : 0;
+        }
+        catch {
+            // Unreadable state is LOCKED state: nothing is open, which is the safe reading.
+        }
+    }
+    /** Persist the live state — every mutation of it calls this, or a Worker forgets it. */
+    saveState() {
+        this.stateStore?.write(JSON.stringify({ v: 1, sessions: [...this.sessions], failures: this.failures, lastFailureAt: this.lastFailureAt }));
+    }
     /** Retire a session whose idle window has passed. Called on every read of the state, so
      *  correctness never depends on the timer having fired. */
     sweep() {
@@ -596,11 +633,14 @@ export class MasterLock {
             return;
         const now = this.now();
         const wasOpen = this.sessions.size > 0;
+        const before = this.sessions.size;
         for (const [token, session] of this.sessions) {
             // Each device expires on its OWN clock, so one going idle never shortens another.
             if (now - session.lastActivityAt > record.idleMs)
                 this.sessions.delete(token);
         }
+        if (this.sessions.size !== before)
+            this.saveState();
         if (wasOpen && this.sessions.size === 0) {
             this.clearExpiry();
             this.onLockedChange?.(true);
@@ -791,6 +831,10 @@ async function equalize(candidate) {
     equalizerHash ??= Bun.password.hash("master-lock-timing-equalizer", { algorithm: "argon2id" });
     await Bun.password.verify(candidate || "x", await equalizerHash).catch(() => false);
 }
+/** What a session is KEYED by — never the token itself, so persisted state opens nothing. */
+function tokenDigest(token) {
+    return createHash("sha256").update(token).digest("base64url");
+}
 function randomToken() {
     const bytes = new Uint8Array(TOKEN_BYTES);
     crypto.getRandomValues(bytes);
@@ -822,14 +866,3 @@ function presentedTokens(req) {
     }
     return out;
 }
-function constantTimeEqual(a, b) {
-    const x = Buffer.from(a);
-    const y = Buffer.from(b);
-    // A length difference is already a non-match, and `timingSafeEqual` throws on one.
-    if (x.length !== y.length)
-        return false;
-    let diff = 0;
-    for (let i = 0; i < x.length; i += 1)
-        diff |= x[i] ^ y[i];
-    return diff === 0;
-}

package/dist/server/master-lock/principals.d.ts

@@ -1,4 +1,4 @@
-import { MasterLock } from "./masterLock";
+import { MasterLock } from "./masterLock.js";
 /** Namespace for every per-person record, so one glance at the table says what they are. */
 export declare const MASTER_LOCK_PRINCIPAL_KEY_PREFIX = "master_lock:principal:";
 /**

package/dist/server/master-lock/principals.js

@@ -46,7 +46,7 @@
  * record is stored under, which is the only thing it ever really was.
  */
 import { createHash } from "node:crypto";
-import { MasterLock, readRecord } from "./masterLock";
+import { MasterLock, readRecord } from "./masterLock.js";
 /** Namespace for every per-person record, so one glance at the table says what they are. */
 export const MASTER_LOCK_PRINCIPAL_KEY_PREFIX = "master_lock:principal:";
 /**

package/dist/server/master-lock/seed.d.ts

@@ -1,5 +1,5 @@
 import { type MasterLockKdfParams } from "cursedbelt-core/master-lock/kdf";
-import { type MasterLockRecord } from "./masterLock";
+import { type MasterLockRecord } from "./masterLock.js";
 /**
  * The idle window a freshly minted lock starts with.
  *

package/dist/server/master-lock/seed.js

@@ -24,7 +24,7 @@
  */
 import { DEFAULT_IDLE_MS } from "cursedbelt-core/master-lock/policy";
 import { deriveMasterLockVerifier, newMasterLockKdfParams, } from "cursedbelt-core/master-lock/kdf";
-import { FIRST_ACCOUNT_ID } from "./masterLock";
+import { FIRST_ACCOUNT_ID } from "./masterLock.js";
 /**
  * The idle window a freshly minted lock starts with.
  *

package/dist/server/master-lock/store.d.ts

@@ -6,9 +6,14 @@
  * `app_settings`, a `Map` in a test. Asking for a whole table would be asking each adopter
  * to write a migration for three fields.
  */
-import type { MasterLockStore } from "./masterLock";
+import type { MasterLockStore } from "./masterLock.js";
 /** The default key, so two apps' rows look the same when somebody goes looking. */
 export declare const MASTER_LOCK_SETTING_KEY = "master_lock:record";
+/**
+ * The key the LIVE state (open unlocks, the throttle) is kept under, beside the record — see
+ * `MasterLockStateStore`. `createKvMasterLockStore(kv, MASTER_LOCK_STATE_KEY)` is that store.
+ */
+export declare const MASTER_LOCK_STATE_KEY = "master_lock:state";
 /** Wrap an app's existing key/value settings surface. */
 export declare function createKvMasterLockStore(kv: {
     get(key: string): string | null | undefined;

package/dist/server/master-lock/store.js

@@ -1,5 +1,10 @@
 /** The default key, so two apps' rows look the same when somebody goes looking. */
 export const MASTER_LOCK_SETTING_KEY = "master_lock:record";
+/**
+ * The key the LIVE state (open unlocks, the throttle) is kept under, beside the record — see
+ * `MasterLockStateStore`. `createKvMasterLockStore(kv, MASTER_LOCK_STATE_KEY)` is that store.
+ */
+export const MASTER_LOCK_STATE_KEY = "master_lock:state";
 /** Wrap an app's existing key/value settings surface. */
 export function createKvMasterLockStore(kv, key = MASTER_LOCK_SETTING_KEY) {
     return {

package/dist/server/media-bun/index.d.ts

@@ -1,4 +1,4 @@
 export { buildProbeArgs, buildThumbnailArgs, buildTrimArgs, ffmpegTimeToSeconds, type ProbeResult, parseFfmpegProgress, parseFfprobe, type VideoCodecPlan, videoCodecPlan, } from 'cursedbelt-core/media/ffmpeg';
-export { renderImage } from './image';
-export { aacWebAudioArgs, buildFrameJpegArgs, buildSpriteVtt, buildStreamProbeArgs, canStreamCopy, EMPTY_PROBE, FASTSTART, faststartArgs, h264WebVideoArgs, hlsLadderArgs, imageThumbnailArgs, LIBRARY_CRF, LIBRARY_SCALE, parseProgressMicros, parseStreamProbe, planSprite, posterArgs, resolveLadder, type SpritePlan, spriteArgs, type VideoProbe, } from './streaming';
-export { extractFrameJpeg, extractThumbnail, isFfmpegAvailable, isFfprobeAvailable, probeMedia, probeVideoStream, runFfmpegProgress, trimVideo, } from './video';
+export { renderImage } from './image.js';
+export { aacWebAudioArgs, buildFrameJpegArgs, buildSpriteVtt, buildStreamProbeArgs, canStreamCopy, EMPTY_PROBE, FASTSTART, faststartArgs, h264WebVideoArgs, hlsLadderArgs, imageThumbnailArgs, LIBRARY_CRF, LIBRARY_SCALE, parseProgressMicros, parseStreamProbe, planSprite, posterArgs, resolveLadder, type SpritePlan, spriteArgs, type VideoProbe, } from './streaming.js';
+export { extractFrameJpeg, extractThumbnail, isFfmpegAvailable, isFfprobeAvailable, probeMedia, probeVideoStream, runFfmpegProgress, trimVideo, } from './video.js';

package/dist/server/media-bun/index.js

@@ -3,8 +3,8 @@
 // via native ffmpeg/ffprobe. App handlers keep auth, FsNode lookup, quota, and
 // storeFile; this owns the actual pixel/codec work.
 export { buildProbeArgs, buildThumbnailArgs, buildTrimArgs, ffmpegTimeToSeconds, parseFfmpegProgress, parseFfprobe, videoCodecPlan, } from 'cursedbelt-core/media/ffmpeg';
-export { renderImage } from './image';
+export { renderImage } from './image.js';
 // Streaming pipeline: faststart remux, HLS adaptive-bitrate ladder, scrub sprite + WebVTT,
 // poster, codec-aware probe — pure builders/parsers (testable without ffmpeg).
-export { aacWebAudioArgs, buildFrameJpegArgs, buildSpriteVtt, buildStreamProbeArgs, canStreamCopy, EMPTY_PROBE, FASTSTART, faststartArgs, h264WebVideoArgs, hlsLadderArgs, imageThumbnailArgs, LIBRARY_CRF, LIBRARY_SCALE, parseProgressMicros, parseStreamProbe, planSprite, posterArgs, resolveLadder, spriteArgs, } from './streaming';
-export { extractFrameJpeg, extractThumbnail, isFfmpegAvailable, isFfprobeAvailable, probeMedia, probeVideoStream, runFfmpegProgress, trimVideo, } from './video';
+export { aacWebAudioArgs, buildFrameJpegArgs, buildSpriteVtt, buildStreamProbeArgs, canStreamCopy, EMPTY_PROBE, FASTSTART, faststartArgs, h264WebVideoArgs, hlsLadderArgs, imageThumbnailArgs, LIBRARY_CRF, LIBRARY_SCALE, parseProgressMicros, parseStreamProbe, planSprite, posterArgs, resolveLadder, spriteArgs, } from './streaming.js';
+export { extractFrameJpeg, extractThumbnail, isFfmpegAvailable, isFfprobeAvailable, probeMedia, probeVideoStream, runFfmpegProgress, trimVideo, } from './video.js';

package/dist/server/media-bun/video.d.ts

@@ -1,6 +1,6 @@
 import { type VideoProgressEvent, type VideoTrimSpec } from 'cursedbelt-core/media';
 import { type ProbeResult } from 'cursedbelt-core/media/ffmpeg';
-import { type VideoProbe } from './streaming';
+import { type VideoProbe } from './streaming.js';
 /** Is ffmpeg runnable? Cheap probe used to skip server media ops / tests cleanly. */
 export declare function isFfmpegAvailable(bin?: string): Promise<boolean>;
 /** Is ffprobe runnable? */

package/dist/server/media-bun/video.js

@@ -4,7 +4,7 @@
 // `FFMPEG_PATH` / `FFPROBE_PATH`. Replaces ca's hand-rolled spawn boilerplate.
 import { assertValidVideoTrimSpec, } from 'cursedbelt-core/media';
 import { buildProbeArgs, buildThumbnailArgs, buildTrimArgs, parseFfmpegProgress, parseFfprobe, } from 'cursedbelt-core/media/ffmpeg';
-import { buildFrameJpegArgs, buildStreamProbeArgs, EMPTY_PROBE, parseProgressMicros, parseStreamProbe, } from './streaming';
+import { buildFrameJpegArgs, buildStreamProbeArgs, EMPTY_PROBE, parseProgressMicros, parseStreamProbe, } from './streaming.js';
 const FFMPEG = process.env.FFMPEG_PATH || 'ffmpeg';
 const FFPROBE = process.env.FFPROBE_PATH || 'ffprobe';
 /** Is ffmpeg runnable? Cheap probe used to skip server media ops / tests cleanly. */

package/dist/server/metrics/telemetrySink.d.ts

@@ -1,5 +1,5 @@
 import type { Database } from 'bun:sqlite';
-import { type MetricRow } from './metricsBuffer';
+import { type MetricRow } from './metricsBuffer.js';
 /**
  * ONE seam for "this app served a request", with two backends and no third.
  *

package/dist/server/metrics/telemetrySink.js

@@ -1,4 +1,4 @@
-import { createMetricsBuffer } from './metricsBuffer';
+import { createMetricsBuffer } from './metricsBuffer.js';
 /**
  * 🔴 **The data-point layout is a WIRE FORMAT.** Analytics Engine columns are
  * positional (`blob1`, `double1`, …), so every saved SQL query breaks if a

package/dist/server/middleware/correlationId.d.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from 'hono';
-import type { CursedbeltEnv } from '../context';
+import type { CursedbeltEnv } from '../context.js';
 /**
  * Assign every request a correlation id: reuse a safe inbound `x-correlation-id`
  * (so a trace survives the proxy hop), else mint a `crypto.randomUUID()`. Stored on

package/dist/server/middleware/errorEnvelope.d.ts

@@ -1,5 +1,5 @@
 import type { ErrorHandler } from 'hono';
-import type { CursedbeltEnv } from '../context';
+import type { CursedbeltEnv } from '../context.js';
 /**
  * Hono `onError` handler. Converts ANY thrown value into the ONE canonical rich
  * envelope — `{ error: { name, message, code?, status?, category?, context?,

package/dist/server/middleware/errorEnvelope.js

@@ -1,5 +1,5 @@
 import { HTTPException } from 'hono/http-exception';
-import { ApiError, isAppError, toErrorEnvelope } from '../errors';
+import { ApiError, isAppError, toErrorEnvelope } from '../errors.js';
 /**
  * Hono `onError` handler. Converts ANY thrown value into the ONE canonical rich
  * envelope — `{ error: { name, message, code?, status?, category?, context?,

package/dist/server/middleware/index.d.ts

@@ -1,10 +1,10 @@
-export { correlationId } from './correlationId';
-export { type CorsOpts, corsAllowlist, corsOptsFromEnv } from './corsAllowlist';
-export { errorEnvelope } from './errorEnvelope';
-export { crossOriginRefusal } from './localOrigin';
-export { clientIp, createRateLimiter, type RateLimitOpts } from './rateLimit';
-export { type RequestLoggerOpts, requestLogger } from './requestLogger';
-export { type AnalyticsEngineDataset, createTelemetrySink, type TelemetryEvent, type TelemetrySink, type TelemetrySinkOptions, } from '../metrics/telemetrySink';
-export { type CspDirectives, type SecurityHeadersOpts, securityHeaders, } from './securityHeaders';
-export { toValidationIssues, VALIDATION_ERROR_CODE, type ValidationIssue, validationEnvelope, } from '../errors';
-export { type ZValidatorTarget, zValidator } from './zValidator';
+export { correlationId } from './correlationId.js';
+export { type CorsOpts, corsAllowlist, corsOptsFromEnv } from './corsAllowlist.js';
+export { errorEnvelope } from './errorEnvelope.js';
+export { crossOriginRefusal } from './localOrigin.js';
+export { clientIp, createRateLimiter, type RateLimitOpts } from './rateLimit.js';
+export { type RequestLoggerOpts, requestLogger } from './requestLogger.js';
+export { type AnalyticsEngineDataset, createTelemetrySink, type TelemetryEvent, type TelemetrySink, type TelemetrySinkOptions, } from '../metrics/telemetrySink.js';
+export { type CspDirectives, type SecurityHeadersOpts, securityHeaders, } from './securityHeaders.js';
+export { toValidationIssues, VALIDATION_ERROR_CODE, type ValidationIssue, validationEnvelope, } from '../errors.js';
+export { type ZValidatorTarget, zValidator } from './zValidator.js';

package/dist/server/middleware/index.js

@@ -1,13 +1,13 @@
 // The cross-cutting cursedbelt server middleware set.
-export { correlationId } from './correlationId';
-export { corsAllowlist, corsOptsFromEnv } from './corsAllowlist';
-export { errorEnvelope } from './errorEnvelope';
-export { crossOriginRefusal } from './localOrigin';
-export { clientIp, createRateLimiter } from './rateLimit';
-export { requestLogger } from './requestLogger';
+export { correlationId } from './correlationId.js';
+export { corsAllowlist, corsOptsFromEnv } from './corsAllowlist.js';
+export { errorEnvelope } from './errorEnvelope.js';
+export { crossOriginRefusal } from './localOrigin.js';
+export { clientIp, createRateLimiter } from './rateLimit.js';
+export { requestLogger } from './requestLogger.js';
 // The telemetry seam `requestLogger` writes through — re-exported here so a caller
 // that reaches `./middleware` for the logger can bind Analytics Engine in the same import.
-export { createTelemetrySink, } from '../metrics/telemetrySink';
-export { securityHeaders, } from './securityHeaders';
-export { toValidationIssues, VALIDATION_ERROR_CODE, validationEnvelope, } from '../errors';
-export { zValidator } from './zValidator';
+export { createTelemetrySink, } from '../metrics/telemetrySink.js';
+export { securityHeaders, } from './securityHeaders.js';
+export { toValidationIssues, VALIDATION_ERROR_CODE, validationEnvelope, } from '../errors.js';
+export { zValidator } from './zValidator.js';

package/dist/server/middleware/rateLimit.js

@@ -1,5 +1,5 @@
 import { getConnInfo } from 'hono/bun';
-import { ApiError, toErrorEnvelope } from '../errors';
+import { ApiError, toErrorEnvelope } from '../errors.js';
 /**
  * The client IP for rate-limiting / logging.
  *

package/dist/server/middleware/requestLogger.d.ts

@@ -1,8 +1,8 @@
 import type { Database } from 'bun:sqlite';
 import type { MiddlewareHandler } from 'hono';
-import type { CursedbeltEnv } from '../context';
-import type { MetricsBuffer } from '../metrics/metricsBuffer';
-import { type AnalyticsEngineDataset, type TelemetrySink } from '../metrics/telemetrySink';
+import type { CursedbeltEnv } from '../context.js';
+import type { MetricsBuffer } from '../metrics/metricsBuffer.js';
+import { type AnalyticsEngineDataset, type TelemetrySink } from '../metrics/telemetrySink.js';
 /**
  * Structured request/response logging. After each request it records one
  * telemetry event through the {@link TelemetrySink} (off the hot path) and, for

package/dist/server/middleware/requestLogger.js

@@ -1,7 +1,7 @@
 import { HTTPException } from 'hono/http-exception';
-import { isApiError } from '../errors';
-import { normalizeRoute } from '../metrics/normalizeRoute';
-import { createTelemetrySink, } from '../metrics/telemetrySink';
+import { isApiError } from '../errors.js';
+import { normalizeRoute } from '../metrics/normalizeRoute.js';
+import { createTelemetrySink, } from '../metrics/telemetrySink.js';
 function statusOfThrown(err) {
     if (isApiError(err))
         return err.status;

package/dist/server/middleware/zValidator.d.ts

@@ -1,6 +1,6 @@
 import type { Env, MiddlewareHandler } from 'hono';
 import type { ZodType, z } from 'zod';
-import type { CursedbeltEnv } from '../context';
+import type { CursedbeltEnv } from '../context.js';
 /** The request locations a schema can validate. Mirrors Hono's body/non-body split. */
 export type ZValidatorTarget = 'json' | 'form' | 'query' | 'param';
 /**

package/dist/server/middleware/zValidator.js

@@ -1,4 +1,4 @@
-import { validationEnvelope } from '../errors';
+import { validationEnvelope } from '../errors.js';
 /**
  * Read the value a target validates against. The body targets (`json`/`form`) prefer
  * the ctgr-decoded body so a tunnelled mutation validates its real payload; the

package/dist/server/migration/runner.d.ts

@@ -1,5 +1,5 @@
 import type { Database } from 'bun:sqlite';
-import type { Migration } from './types';
+import type { Migration } from './types.js';
 /**
  * The versioned SQLite migration runner — a tiny `_migrations`-sentinel runner, NOT
  * a schema-first ORM. It replaces the old scattered guarded-`ALTER` /

package/dist/server/net/outboundGuard.js

@@ -33,7 +33,7 @@
  */
 import { isIP } from 'node:net';
 import { lookup } from 'node:dns/promises';
-import { AppError } from '../errors';
+import { AppError } from '../errors.js';
 export const OUTBOUND_URL_BLOCKED = 'OUTBOUND_URL_BLOCKED';
 const blocked = (reason, context) => new AppError(`Outbound request refused: ${reason}.`, {
     code: OUTBOUND_URL_BLOCKED,

package/dist/server/notifications/index.d.ts

@@ -36,12 +36,12 @@
  *    route that notifies somebody else; producing is server-side code calling
  *    `center.notify*`.
  */
-export { createNotificationHub } from "./hub";
-export type { NotificationHub, NotificationHubEvent, NotificationHubListener, NotificationHubOptions, } from "./hub";
-export { NOTIFICATION_MIGRATIONS, NOTIFICATIONS_TABLE } from "./migrations";
-export { mountNotificationRoutes } from "./routes";
-export type { NotificationRouteCenter, NotificationRoutesOptions } from "./routes";
-export { createNotificationService } from "./service";
-export type { CreateNotificationServiceOptions, NotificationService, NotificationServiceMountOptions, } from "./service";
+export { createNotificationHub } from "./hub.js";
+export type { NotificationHub, NotificationHubEvent, NotificationHubListener, NotificationHubOptions, } from "./hub.js";
+export { NOTIFICATION_MIGRATIONS, NOTIFICATIONS_TABLE } from "./migrations.js";
+export { mountNotificationRoutes } from "./routes.js";
+export type { NotificationRouteCenter, NotificationRoutesOptions } from "./routes.js";
+export { createNotificationService } from "./service.js";
+export type { CreateNotificationServiceOptions, NotificationService, NotificationServiceMountOptions, } from "./service.js";
 export { createNotificationCenter, createMemoryNotificationStore, createSqliteNotificationStore, migrateNotificationsSchema, } from "cwip/notifications";
 export type { AppNotification, ListNotificationsQuery, NotificationAudience, NotificationCenter, NotificationCenterOptions, NotificationDraft, NotificationFilter, NotificationPage, NotificationSeverity, NotificationSink, NotificationStore, Notifier, } from "cwip/notifications";