cursedbelt-server 4.12.0 → 4.13.0

package/dist/server/d1/localBackup.d.ts

@@ -32,7 +32,7 @@
  * WAL is the only reason `../sqlite/backup.ts` is safe.
  */
 import type { Database } from 'bun:sqlite';
-import type { DatabaseBackup, TimeTravelOpts } from './backup';
+import type { DatabaseBackup, TimeTravelOpts } from './backup.js';
 export interface LocalBackupOpts {
     /** The live handle — checkpointed before the snapshot is taken. */
     db: Database;

package/dist/server/d1/localBackup.js

@@ -33,8 +33,8 @@
  */
 import { existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { snapshotSqlite } from '../sqlite/backup';
-import { createTimeTravelBackup } from './backup';
+import { snapshotSqlite } from '../sqlite/backup.js';
+import { createTimeTravelBackup } from './backup.js';
 /**
  * Force the WAL back into the principal database and truncate the log file.
  *

package/dist/server/d1/remote.d.ts

@@ -14,7 +14,7 @@
  * a real binding satisfies it without a cast, and the test suite can satisfy it with a
  * fake that has no `workerd` in sight.
  */
-import { type D1LikeDatabase } from './types';
+import { type D1LikeDatabase } from './types.js';
 /** What D1 reports back about a statement. Its `meta` is richer than the local driver's. */
 export interface D1BindingMeta {
     duration?: number;

package/dist/server/d1/remote.js

@@ -14,9 +14,9 @@
  * a real binding satisfies it without a cast, and the test suite can satisfy it with a
  * fake that has no `workerd` in sight.
  */
-import { assertBatchSize, assertWithinLimits } from './limits';
-import { D1UnsupportedError, } from './types';
-import { makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values';
+import { assertBatchSize, assertWithinLimits } from './limits.js';
+import { D1UnsupportedError, } from './types.js';
+import { makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values.js';
 /**
  * D1 reports a failed statement by RESOLVING with `success: false` in some paths rather
  * than rejecting, so a driver that only catches rejections reports a silent no-op as a

package/dist/server/d1/scheduling.d.ts

@@ -33,7 +33,7 @@
  * all, and {@link classifySchedule} says so by name instead of silently rounding them up to
  * a minute, which would change behaviour in production and nowhere else.
  */
-import type { D1LikeDatabase } from './types';
+import type { D1LikeDatabase } from './types.js';
 /** The Workers primitive a piece of scheduled work maps onto. */
 export type WorkersPrimitive = 'cron-trigger' | 'queue' | 'durable-object-alarm' | 'unportable';
 /** How a job is triggered — the input to the choice, not the choice itself. */

package/dist/server/d1/values.d.ts

@@ -11,7 +11,7 @@
  * Every rule below was measured against `bun:sqlite` on 2026-09-16 (`Bun 1.3`), not
  * recalled: the probe wrote each type into a `CREATE TABLE t (v)` column and read it back.
  */
-import { type D1LikeBindable, type D1LikeMeta, type D1LikeValue } from './types';
+import { type D1LikeBindable, type D1LikeMeta, type D1LikeValue } from './types.js';
 /**
  * Normalize one bound parameter to something BOTH drivers accept, or throw.
  *

package/dist/server/d1/values.js

@@ -11,7 +11,7 @@
  * Every rule below was measured against `bun:sqlite` on 2026-09-16 (`Bun 1.3`), not
  * recalled: the probe wrote each type into a `CREATE TABLE t (v)` column and read it back.
  */
-import { D1BindError } from './types';
+import { D1BindError } from './types.js';
 /**
  * The largest integer a JS number holds exactly. A `bigint` beyond this cannot survive the
  * round trip through either driver — measured, `bun:sqlite` returns `9007199254740992` for

package/dist/server/db/kysely.d.ts

@@ -1,6 +1,6 @@
 import type { Database } from 'bun:sqlite';
 import { Kysely } from 'kysely';
-import type { PlumbingSchema } from './plumbingTypes';
+import type { PlumbingSchema } from './plumbingTypes.js';
 /**
  * A Kysely query builder typed to the {@link PlumbingSchema} plumbing tables, on the
  * `bun:sqlite` dialect. Use it for type-checked reads/writes of sessions, config,

package/dist/server/dropzone/index.d.ts

@@ -9,5 +9,5 @@
  * Consumers (2026-08-13): `apps/music`, `apps/family`, `apps/collections` in
  * cursed-satellites. Each supplies a `DropHandler` and nothing else.
  */
-export { describeSweep, isJunkName, isStable, pruneEmptyDirs, scanDropzone, sweepDropzone, type DropHandler, type DropOutcome, type DroppedFile, type ScanOptions, type SweepReport, } from "./scan";
-export { askBinaryServerAboutDuplicate, hashFile, type DuplicateVerdict, type DuplicateQuestion, } from "./duplicates";
+export { describeSweep, isJunkName, isStable, pruneEmptyDirs, scanDropzone, sweepDropzone, type DropHandler, type DropOutcome, type DroppedFile, type ScanOptions, type SweepReport, } from "./scan.js";
+export { askBinaryServerAboutDuplicate, hashFile, type DuplicateVerdict, type DuplicateQuestion, } from "./duplicates.js";

package/dist/server/dropzone/index.js

@@ -9,5 +9,5 @@
  * Consumers (2026-08-13): `apps/music`, `apps/family`, `apps/collections` in
  * cursed-satellites. Each supplies a `DropHandler` and nothing else.
  */
-export { describeSweep, isJunkName, isStable, pruneEmptyDirs, scanDropzone, sweepDropzone, } from "./scan";
-export { askBinaryServerAboutDuplicate, hashFile, } from "./duplicates";
+export { describeSweep, isJunkName, isStable, pruneEmptyDirs, scanDropzone, sweepDropzone, } from "./scan.js";
+export { askBinaryServerAboutDuplicate, hashFile, } from "./duplicates.js";

package/dist/server/guard/argon2Binding.js

@@ -23,7 +23,7 @@
  *     promise AND (usually) a string.
  */
 import { assertArgon2idReady, CC_ARGON2ID_VERSION, setArgon2idDeriver, } from 'cwip/guard';
-import { AppError } from '../errors';
+import { AppError } from '../errors.js';
 /** argon2id's variant number in the `@node-rs/argon2` / reference-implementation vocabulary. */
 export const ARGON2ID_ALGORITHM = 2;
 /**

package/dist/server/guard/index.d.ts

@@ -1,5 +1,5 @@
-export * from './argon2Binding';
-export * from './passwordVerifier';
-export * from './verifier';
-export * from './revocationStore';
-export * from './sessionSigner';
+export * from './argon2Binding.js';
+export * from './passwordVerifier.js';
+export * from './verifier.js';
+export * from './revocationStore.js';
+export * from './sessionSigner.js';

package/dist/server/guard/index.js

@@ -1,7 +1,7 @@
 // The GuardEngine server wiring (02 §4): the argon2id binding adapter that arms
 // cwip's KDF seam, and the Ed25519 session signer that mints and revokes.
-export * from './argon2Binding';
-export * from './passwordVerifier';
-export * from './verifier';
-export * from './revocationStore';
-export * from './sessionSigner';
+export * from './argon2Binding.js';
+export * from './passwordVerifier.js';
+export * from './verifier.js';
+export * from './revocationStore.js';
+export * from './sessionSigner.js';

package/dist/server/guard/kdfWorker.d.ts

@@ -1,4 +1,4 @@
-import { createInProcessPasswordVerifier, type PasswordVerifierPort } from './passwordVerifier';
+import { createInProcessPasswordVerifier, type PasswordVerifierPort } from './passwordVerifier.js';
 /** Raised when the worker thread dies, fails to start, or is disposed mid-flight. */
 export declare const GUARD_KDF_WORKER_FAILED = "GUARD_KDF_WORKER_FAILED";
 /** Raised when the worker does not answer within the configured budget. */

package/dist/server/guard/kdfWorker.js

@@ -41,9 +41,9 @@
  * `createMarshalWorkerClient` documents in `core/wire/marshalWorker.ts`; it is
  * repeated here deliberately in the same shape so both read alike.
  */
-import { AppError } from '../errors';
-import { createInProcessPasswordVerifier, sealPasswordVerifier, verifyPasswordEnvelope, } from './passwordVerifier';
-import { registerNodeRsArgon2id } from './argon2Binding';
+import { AppError } from '../errors.js';
+import { createInProcessPasswordVerifier, sealPasswordVerifier, verifyPasswordEnvelope, } from './passwordVerifier.js';
+import { registerNodeRsArgon2id } from './argon2Binding.js';
 /** Raised when the worker thread dies, fails to start, or is disposed mid-flight. */
 export const GUARD_KDF_WORKER_FAILED = 'GUARD_KDF_WORKER_FAILED';
 /** Raised when the worker does not answer within the configured budget. */

package/dist/server/guard/kdfWorkerEntry.js

@@ -11,5 +11,5 @@
  * is not "start the loop" is code running on a thread with a live argon2id
  * binding and a plaintext password in scope.
  */
-import { serveKdfWorker } from './kdfWorker';
+import { serveKdfWorker } from './kdfWorker.js';
 await serveKdfWorker();

package/dist/server/guard/passwordVerifier.js

@@ -31,7 +31,7 @@
  */
 import { timingSafeEqual } from 'node:crypto';
 import { createSecretEnvelopeManager, mintEnvelopeSalt, parseSecretEnvelope, serializeSecretEnvelope, zeroize, } from 'cwip/guard';
-import { isAppError } from '../errors';
+import { isAppError } from '../errors.js';
 /**
  * The reserved AAD app namespace for password verifiers. `SecretEnvelope` forbids
  * a ':' in the appId (it separates the AAD fields), so this is a plain token; the

package/dist/server/guard/sessionSigner.d.ts

@@ -20,8 +20,8 @@
  */
 import { type KeyObject } from 'node:crypto';
 import { type CCUserClaims } from 'cursedbelt-core/session/claims';
-import type { GuardVerifier } from './verifier';
-import type { AsyncRevocationStore } from './revocationStore';
+import type { GuardVerifier } from './verifier.js';
+import type { AsyncRevocationStore } from './revocationStore.js';
 export interface SessionSignerOptions {
     /**
      * Ed25519 private key (PEM/DER/`KeyObject`). Omitted ⇒ an ephemeral pair is

package/dist/server/guard/sessionSigner.js

@@ -20,7 +20,7 @@
  */
 import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from 'node:crypto';
 import { CCUserClaimsSchema } from 'cursedbelt-core/session/claims';
-import { AppError } from '../errors';
+import { AppError } from '../errors.js';
 const b64url = (input) => Buffer.from(input).toString('base64url');
 /** Ceiling on a client-supplied device label — display text, not a payload. */
 const MAX_DEVICE_LABEL = 64;

package/dist/server/incidents/checks.d.ts

@@ -18,8 +18,8 @@
  * a sweep reports its own failures so the console can show a detector that has
  * stopped working, rather than showing an empty incident list and looking calm.
  */
-import type { IncidentStore } from "./store";
-import type { IncidentReport, IncidentTransitions } from "./types";
+import type { IncidentStore } from "./store.js";
+import type { IncidentReport, IncidentTransitions } from "./types.js";
 export interface IncidentCheck {
     /** Stable key. Owns every incident it has ever opened — see `reconcile`. */
     readonly key: string;

package/dist/server/incidents/index.d.ts

@@ -41,11 +41,11 @@
  * await notifier.announce(result.transitions);   // usually sends nothing
  * ```
  */
-export { type ChannelMessage, type ChannelOutcome, type ChannelResult, createEmailChannel, createInAppChannel, createRelayEmailChannel, createTextChannel, type EmailChannelOptions, type IncidentChannel, type SendEmail, type TextChannelOptions, } from "./channels";
-export { type CheckOutcome, type IncidentCheck, runIncidentSweep, type SweepResult, } from "./checks";
-export { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations";
-export { type AnnounceResult, composeOpened, composeResolved, type CreateNotifierOptions, createIncidentNotifier, type IncidentNotifier, } from "./notifier";
-export { createIncidentReporter, type IncidentReporter, type IncidentReporterOptions, } from "./reporter";
-export { type IncidentRoutesOptions, mountIncidentMachineRoutes, mountIncidentOwnerRoutes, } from "./routes";
-export { assertNoContent, createIncidentStore, type IncidentStore, type ReconcileOptions, } from "./store";
-export { fingerprint, type Incident, type IncidentFact, type IncidentReport, type IncidentSeverity, type IncidentState, type IncidentTransitions, } from "./types";
+export { type ChannelMessage, type ChannelOutcome, type ChannelResult, createEmailChannel, createInAppChannel, createRelayEmailChannel, createTextChannel, type EmailChannelOptions, type IncidentChannel, type SendEmail, type TextChannelOptions, } from "./channels.js";
+export { type CheckOutcome, type IncidentCheck, runIncidentSweep, type SweepResult, } from "./checks.js";
+export { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations.js";
+export { type AnnounceResult, composeOpened, composeResolved, type CreateNotifierOptions, createIncidentNotifier, type IncidentNotifier, } from "./notifier.js";
+export { createIncidentReporter, type IncidentReporter, type IncidentReporterOptions, } from "./reporter.js";
+export { type IncidentRoutesOptions, mountIncidentMachineRoutes, mountIncidentOwnerRoutes, } from "./routes.js";
+export { assertNoContent, createIncidentStore, type IncidentStore, type ReconcileOptions, } from "./store.js";
+export { fingerprint, type Incident, type IncidentFact, type IncidentReport, type IncidentSeverity, type IncidentState, type IncidentTransitions, } from "./types.js";

package/dist/server/incidents/index.js

@@ -41,11 +41,11 @@
  * await notifier.announce(result.transitions);   // usually sends nothing
  * ```
  */
-export { createEmailChannel, createInAppChannel, createRelayEmailChannel, createTextChannel, } from "./channels";
-export { runIncidentSweep, } from "./checks";
-export { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations";
-export { composeOpened, composeResolved, createIncidentNotifier, } from "./notifier";
-export { createIncidentReporter, } from "./reporter";
-export { mountIncidentMachineRoutes, mountIncidentOwnerRoutes, } from "./routes";
-export { assertNoContent, createIncidentStore, } from "./store";
-export { fingerprint, } from "./types";
+export { createEmailChannel, createInAppChannel, createRelayEmailChannel, createTextChannel, } from "./channels.js";
+export { runIncidentSweep, } from "./checks.js";
+export { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations.js";
+export { composeOpened, composeResolved, createIncidentNotifier, } from "./notifier.js";
+export { createIncidentReporter, } from "./reporter.js";
+export { mountIncidentMachineRoutes, mountIncidentOwnerRoutes, } from "./routes.js";
+export { assertNoContent, createIncidentStore, } from "./store.js";
+export { fingerprint, } from "./types.js";

package/dist/server/incidents/migrations.d.ts

@@ -1,4 +1,4 @@
-import type { Migration } from "../migration/types";
+import type { Migration } from "../migration/types.js";
 /** The one table this primitive owns. */
 export declare const INCIDENTS_TABLE = "incidents";
 /**

package/dist/server/incidents/notifier.d.ts

@@ -28,9 +28,9 @@
  * the store (`assertNoContent`). A text message is the least private surface
  * this fleet has and several of its apps are private by construction.
  */
-import type { ChannelMessage, ChannelResult, IncidentChannel } from "./channels";
-import type { IncidentStore } from "./store";
-import type { Incident, IncidentTransitions } from "./types";
+import type { ChannelMessage, ChannelResult, IncidentChannel } from "./channels.js";
+import type { IncidentStore } from "./store.js";
+import type { Incident, IncidentTransitions } from "./types.js";
 export interface IncidentNotifier {
     /** Send for every transition in `t`. Returns one result per message sent. */
     announce: (t: IncidentTransitions) => Promise<AnnounceResult[]>;

package/dist/server/incidents/reporter.d.ts

@@ -28,7 +28,7 @@
  * than one with no alerting. Every failure here is logged and swallowed, and the
  * console notices the silence by other means (the service's own health probe).
  */
-import type { IncidentReport } from "./types";
+import type { IncidentReport } from "./types.js";
 export interface IncidentReporterOptions {
     /** e.g. `http://127.0.0.1:3024/api/station/incidents/report`. */
     url: string;

package/dist/server/incidents/routes.d.ts

@@ -35,10 +35,10 @@
  * correct.
  */
 import type { Hono } from "hono";
-import type { IncidentChannel } from "./channels";
-import type { IncidentNotifier } from "./notifier";
-import { type IncidentStore } from "./store";
-import type { SweepResult } from "./checks";
+import type { IncidentChannel } from "./channels.js";
+import type { IncidentNotifier } from "./notifier.js";
+import { type IncidentStore } from "./store.js";
+import type { SweepResult } from "./checks.js";
 export interface IncidentRoutesOptions {
     store: IncidentStore;
     /** Owner-only gate for the read + write surface. Return false to 403. */

package/dist/server/incidents/routes.js

@@ -1,4 +1,4 @@
-import { assertNoContent } from "./store";
+import { assertNoContent } from "./store.js";
 const noStore = { "cache-control": "no-store" };
 /** Long enough for three real sentences, short enough that nobody pastes a log in. */
 const MAX_FIELD = 600;

package/dist/server/incidents/store.d.ts

@@ -28,7 +28,7 @@
  * of all across the restart a deploy of the console itself performs.
  */
 import type { Database } from "bun:sqlite";
-import { type Incident, type IncidentReport, type IncidentTransitions } from "./types";
+import { type Incident, type IncidentReport, type IncidentTransitions } from "./types.js";
 /**
  * The privacy gate, enforced rather than reviewed. `facts` is for numbers —
  * bytes free, items failed, commits behind — and a string slipping in there is

package/dist/server/incidents/store.js

@@ -1,6 +1,6 @@
-import { runMigrations } from "../migration/runner";
-import { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations";
-import { fingerprint, } from "./types";
+import { runMigrations } from "../migration/runner.js";
+import { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations.js";
+import { fingerprint, } from "./types.js";
 const toIncident = (r) => ({
     fingerprint: r.fingerprint,
     source: r.source,

package/dist/server/index.d.ts

@@ -1,27 +1,27 @@
 export { ChunkStore, type ChunkStoreOpts, CTGR_WIRE_VERSION, type CtgrDecoded, type CtgrMethod, decodeRequest, type EncodedRequest, type EncodeOpts, encodeRequest, type UploadedFile, } from 'cursedbelt-core/ctgr';
-export { type CreateAppOpts, createApp, type ServeBunOpts, serveBun } from './app';
-export { type AppJwtPayload, AUTH_COOKIE_NAME, type AuthEnv, type AuthUser, type AuthVariables, type CreateSessionInput, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CsrfOptions, clearAuthCookie, createAuthMiddleware, createCsrfMiddleware, clientKeyOf, clientKeyOfContext, createLoginThrottle, createSessionStore, createRs256FileTokenSigner, DEFAULT_TOTP_ISSUER, decryptVaultItem, deriveVaultKey, encryptVaultItem, generateRecoveryCodes, generateTotpSecret, getOnlyEnforcement, getTotpUri, hashPassword, isGetOnlyViolation, type LoginThrottle, type LoginThrottleOptions, type ThrottleVerdict, needsRehash, type Rs256FileTokenSignerOptions, type Session, type SessionStore, type SessionStoreOptions, signToken, type TokenPurpose, verifyPassword, verifyPurposeToken, verifyRecoveryCode, verifyToken, verifyTotpCode, } from './auth';
-export type { CursedbeltEnv, CursedbeltVariables } from './context';
-export { buildRoutes, CTGR_ROUTE_PATTERN, getCtgrDecoded, unGETify } from './ctgr';
-export { createKysely, type PlumbingDb } from './db/kysely';
-export type { AppConfigRow, AuthSessionRow, EmailFailureRow, EventLogRow, JobRunRow, JobStateRow, MigrationRow, PlumbingSchema, RequestMetricRow, SystemSampleRow, } from './db/plumbingTypes';
-export { ApiError, type ApiErrorOptions, type ErrorEnvelope, isApiError, toErrorEnvelope, toValidationIssues, VALIDATION_ERROR_CODE, type ValidationIssue, validationEnvelope, } from './errors';
-export { type CreateJobRunnerOptions, createFireQueue, createJobRunner, createPollingJob, DEFAULT_FIRE_INTERVAL_MS, DEFAULT_JOB_TIMEOUT_MS, defaultJobLogger, type FireQueue, type FireQueueOpts, type JobContext, type JobDef, type JobLogger, type JobRunner, type JobRunRecord, JobTimeoutError, type PollingJob, type PollingJobOpts, } from './jobs';
-export { buildProbeArgs, buildThumbnailArgs, buildTrimArgs, extractThumbnail, ffmpegTimeToSeconds, isFfmpegAvailable, isFfprobeAvailable, type ProbeResult, parseFfmpegProgress, parseFfprobe, probeMedia, renderImage, trimVideo, type VideoCodecPlan, videoCodecPlan, } from './media-bun';
-export { createMetricsBuffer, type MetricRow, type MetricsBuffer, type MetricsBufferOptions, } from './metrics/metricsBuffer';
-export { normalizeRoute } from './metrics/normalizeRoute';
-export { type AnalyticsEngineDataset, createTelemetrySink, TELEMETRY_POINT_VERSION, type TelemetryEvent, type TelemetrySink, type TelemetrySinkOptions, toDataPoint, } from './metrics/telemetrySink';
-export { correlationId } from './middleware/correlationId';
-export { type CorsOpts, corsAllowlist, corsOptsFromEnv } from './middleware/corsAllowlist';
-export { errorEnvelope } from './middleware/errorEnvelope';
-export { crossOriginRefusal } from './middleware/localOrigin';
-export { clientIp, createRateLimiter, type RateLimitOpts } from './middleware/rateLimit';
-export { type RequestLoggerOpts, requestLogger } from './middleware/requestLogger';
-export { type CspDirectives, type SecurityHeadersOpts, securityHeaders, } from './middleware/securityHeaders';
-export { type ZValidatorTarget, zValidator } from './middleware/zValidator';
-export { addColumnIfMissing, applyRecommendedPragmas, columnExists, runMigrations } from './migration/runner';
-export type { Migration } from './migration/types';
-export { AUDIT_LOG_MIGRATIONS, auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink, } from './audit';
-export { applyFtsSchema, type BackupInfo, buildFtsSchema, clampLimit, clampOffset, collectSqliteStats, createFts5Search, createSqliteBackupService, createSqliteHealthChecks, createSqliteViewerMiddleware, type DbStats, exportSqliteSnapshot, exportSqliteTable, type Fts5Search, type FtsHighlightOpts, type FtsResult, type FtsSearchOpts, type FtsSnippetOpts, type FtsTableSpec, type ImportMode, type ImportResult, importRowsIntoSqliteTable, isKnownTable, isReadOnlySql, listSqliteTables, NotReadOnlyError, quoteIdent, type RestoreResult, readSqliteTable, restoreSqliteSnapshot, runReadonlySqlite, type SnapshotExport, type SqliteBackupOpts, type SqliteBackupS3Opts, type SqliteBackupService, type SqliteHealthCheck, type SqliteHealthOpts, type SqliteHealthResult, type SqliteHealthStatus, type SqliteTableInfo, type SqliteTablePage, sanitizeFtsQuery, snapshotSqlite, type TableExport, type TableExportFormat, type TableStat, UnknownTableError, } from './sqlite';
-export { computePresence, createEventBus, createWsHub, type EventBus, type EventBusData, joinRoom, leaveRoom, type PresenceEntry, type PresenceState, ROOM_META_KEY, roomOf, type WsChannel, type WsClient, type WsData, type WsHandshake, type WsHub, type WsHubOpts, type WsMessage, } from './ws';
-export { resolveAppDataHome } from './paths/appDataHome';
+export { type CreateAppOpts, createApp, type ServeBunOpts, serveBun } from './app.js';
+export { type AppJwtPayload, AUTH_COOKIE_NAME, type AuthEnv, type AuthUser, type AuthVariables, type CreateSessionInput, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CsrfOptions, clearAuthCookie, createAuthMiddleware, createCsrfMiddleware, clientKeyOf, clientKeyOfContext, createLoginThrottle, createSessionStore, createRs256FileTokenSigner, DEFAULT_TOTP_ISSUER, decryptVaultItem, deriveVaultKey, encryptVaultItem, generateRecoveryCodes, generateTotpSecret, getOnlyEnforcement, getTotpUri, hashPassword, isGetOnlyViolation, type LoginThrottle, type LoginThrottleOptions, type ThrottleVerdict, needsRehash, type Rs256FileTokenSignerOptions, type Session, type SessionStore, type SessionStoreOptions, signToken, type TokenPurpose, verifyPassword, verifyPurposeToken, verifyRecoveryCode, verifyToken, verifyTotpCode, } from './auth/index.js';
+export type { CursedbeltEnv, CursedbeltVariables } from './context.js';
+export { buildRoutes, CTGR_ROUTE_PATTERN, getCtgrDecoded, unGETify } from './ctgr.js';
+export { createKysely, type PlumbingDb } from './db/kysely.js';
+export type { AppConfigRow, AuthSessionRow, EmailFailureRow, EventLogRow, JobRunRow, JobStateRow, MigrationRow, PlumbingSchema, RequestMetricRow, SystemSampleRow, } from './db/plumbingTypes.js';
+export { ApiError, type ApiErrorOptions, type ErrorEnvelope, isApiError, toErrorEnvelope, toValidationIssues, VALIDATION_ERROR_CODE, type ValidationIssue, validationEnvelope, } from './errors.js';
+export { type CreateJobRunnerOptions, createFireQueue, createJobRunner, createPollingJob, DEFAULT_FIRE_INTERVAL_MS, DEFAULT_JOB_TIMEOUT_MS, defaultJobLogger, type FireQueue, type FireQueueOpts, type JobContext, type JobDef, type JobLogger, type JobRunner, type JobRunRecord, JobTimeoutError, type PollingJob, type PollingJobOpts, } from './jobs/index.js';
+export { buildProbeArgs, buildThumbnailArgs, buildTrimArgs, extractThumbnail, ffmpegTimeToSeconds, isFfmpegAvailable, isFfprobeAvailable, type ProbeResult, parseFfmpegProgress, parseFfprobe, probeMedia, renderImage, trimVideo, type VideoCodecPlan, videoCodecPlan, } from './media-bun/index.js';
+export { createMetricsBuffer, type MetricRow, type MetricsBuffer, type MetricsBufferOptions, } from './metrics/metricsBuffer.js';
+export { normalizeRoute } from './metrics/normalizeRoute.js';
+export { type AnalyticsEngineDataset, createTelemetrySink, TELEMETRY_POINT_VERSION, type TelemetryEvent, type TelemetrySink, type TelemetrySinkOptions, toDataPoint, } from './metrics/telemetrySink.js';
+export { correlationId } from './middleware/correlationId.js';
+export { type CorsOpts, corsAllowlist, corsOptsFromEnv } from './middleware/corsAllowlist.js';
+export { errorEnvelope } from './middleware/errorEnvelope.js';
+export { crossOriginRefusal } from './middleware/localOrigin.js';
+export { clientIp, createRateLimiter, type RateLimitOpts } from './middleware/rateLimit.js';
+export { type RequestLoggerOpts, requestLogger } from './middleware/requestLogger.js';
+export { type CspDirectives, type SecurityHeadersOpts, securityHeaders, } from './middleware/securityHeaders.js';
+export { type ZValidatorTarget, zValidator } from './middleware/zValidator.js';
+export { addColumnIfMissing, applyRecommendedPragmas, columnExists, runMigrations } from './migration/runner.js';
+export type { Migration } from './migration/types.js';
+export { AUDIT_LOG_MIGRATIONS, auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink, } from './audit/index.js';
+export { applyFtsSchema, type BackupInfo, buildFtsSchema, clampLimit, clampOffset, collectSqliteStats, createFts5Search, createSqliteBackupService, createSqliteHealthChecks, createSqliteViewerMiddleware, type DbStats, exportSqliteSnapshot, exportSqliteTable, type Fts5Search, type FtsHighlightOpts, type FtsResult, type FtsSearchOpts, type FtsSnippetOpts, type FtsTableSpec, type ImportMode, type ImportResult, importRowsIntoSqliteTable, isKnownTable, isReadOnlySql, listSqliteTables, NotReadOnlyError, quoteIdent, type RestoreResult, readSqliteTable, restoreSqliteSnapshot, runReadonlySqlite, type SnapshotExport, type SqliteBackupOpts, type SqliteBackupS3Opts, type SqliteBackupService, type SqliteHealthCheck, type SqliteHealthOpts, type SqliteHealthResult, type SqliteHealthStatus, type SqliteTableInfo, type SqliteTablePage, sanitizeFtsQuery, snapshotSqlite, type TableExport, type TableExportFormat, type TableStat, UnknownTableError, } from './sqlite/index.js';
+export { computePresence, createEventBus, createWsHub, type EventBus, type EventBusData, joinRoom, leaveRoom, type PresenceEntry, type PresenceState, ROOM_META_KEY, roomOf, type WsChannel, type WsClient, type WsData, type WsHandshake, type WsHub, type WsHubOpts, type WsMessage, } from './ws/index.js';
+export { resolveAppDataHome } from './paths/appDataHome.js';

package/dist/server/index.js

@@ -7,52 +7,52 @@
 // ── ctgr (isomorphic codec re-exports + the Hono GET-tunnel transport) ───────
 export { ChunkStore, CTGR_WIRE_VERSION, decodeRequest, encodeRequest, } from 'cursedbelt-core/ctgr';
 // ── HTTP app ────────────────────────────────────────────────────────────────
-export { createApp, serveBun } from './app';
+export { createApp, serveBun } from './app.js';
 // ── Auth toolkit (task 26): jose JWT, cookies, CSRF, getOnly, session store, ──
 //    login throttle, argon2id passwords, TOTP, vault crypto, the composed middleware.
-export { AUTH_COOKIE_NAME, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, clearAuthCookie, createAuthMiddleware, createCsrfMiddleware, clientKeyOf, clientKeyOfContext, createLoginThrottle, createSessionStore, createRs256FileTokenSigner, DEFAULT_TOTP_ISSUER, decryptVaultItem, deriveVaultKey, encryptVaultItem, generateRecoveryCodes, generateTotpSecret, getOnlyEnforcement, getTotpUri, hashPassword, isGetOnlyViolation, needsRehash, signToken, verifyPassword, verifyPurposeToken, verifyRecoveryCode, verifyToken, verifyTotpCode, } from './auth';
-export { buildRoutes, CTGR_ROUTE_PATTERN, getCtgrDecoded, unGETify } from './ctgr';
+export { AUTH_COOKIE_NAME, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, clearAuthCookie, createAuthMiddleware, createCsrfMiddleware, clientKeyOf, clientKeyOfContext, createLoginThrottle, createSessionStore, createRs256FileTokenSigner, DEFAULT_TOTP_ISSUER, decryptVaultItem, deriveVaultKey, encryptVaultItem, generateRecoveryCodes, generateTotpSecret, getOnlyEnforcement, getTotpUri, hashPassword, isGetOnlyViolation, needsRehash, signToken, verifyPassword, verifyPurposeToken, verifyRecoveryCode, verifyToken, verifyTotpCode, } from './auth/index.js';
+export { buildRoutes, CTGR_ROUTE_PATTERN, getCtgrDecoded, unGETify } from './ctgr.js';
 // ── Kysely-typed plumbing tables ────────────────────────────────────────────
-export { createKysely } from './db/kysely';
+export { createKysely } from './db/kysely.js';
 // ── Errors ──────────────────────────────────────────────────────────────────
-export { ApiError, isApiError, toErrorEnvelope, toValidationIssues, VALIDATION_ERROR_CODE, validationEnvelope, } from './errors';
+export { ApiError, isApiError, toErrorEnvelope, toValidationIssues, VALIDATION_ERROR_CODE, validationEnvelope, } from './errors.js';
 // ── Jobs & scheduler (task 29): plainjob-backed cron runner + restart-aware ───
 //    pollers + the due-row fire queue. App job *definitions* stay business.
-export { createFireQueue, createJobRunner, createPollingJob, DEFAULT_FIRE_INTERVAL_MS, DEFAULT_JOB_TIMEOUT_MS, defaultJobLogger, JobTimeoutError, } from './jobs';
+export { createFireQueue, createJobRunner, createPollingJob, DEFAULT_FIRE_INTERVAL_MS, DEFAULT_JOB_TIMEOUT_MS, defaultJobLogger, JobTimeoutError, } from './jobs/index.js';
 // ── Media adapter (task 19): image rendering via sharp (lazy/optional peer) + ──
 //    video trim / probe / thumbnail via native ffmpeg. Also at the dedicated
 //    media-bun entry below; sharp is imported lazily inside renderImage,
 //    so importing this barrel never loads the native binary.
-export { buildProbeArgs, buildThumbnailArgs, buildTrimArgs, extractThumbnail, ffmpegTimeToSeconds, isFfmpegAvailable, isFfprobeAvailable, parseFfmpegProgress, parseFfprobe, probeMedia, renderImage, trimVideo, videoCodecPlan, } from './media-bun';
+export { buildProbeArgs, buildThumbnailArgs, buildTrimArgs, extractThumbnail, ffmpegTimeToSeconds, isFfmpegAvailable, isFfprobeAvailable, parseFfmpegProgress, parseFfprobe, probeMedia, renderImage, trimVideo, videoCodecPlan, } from './media-bun/index.js';
 // ── Metrics ───────────────────────────────────────────────────────────────────
-export { createMetricsBuffer, } from './metrics/metricsBuffer';
-export { normalizeRoute } from './metrics/normalizeRoute';
-export { createTelemetrySink, TELEMETRY_POINT_VERSION, toDataPoint, } from './metrics/telemetrySink';
+export { createMetricsBuffer, } from './metrics/metricsBuffer.js';
+export { normalizeRoute } from './metrics/normalizeRoute.js';
+export { createTelemetrySink, TELEMETRY_POINT_VERSION, toDataPoint, } from './metrics/telemetrySink.js';
 // ── Middleware ────────────────────────────────────────────────────────────────
-export { correlationId } from './middleware/correlationId';
-export { corsAllowlist, corsOptsFromEnv } from './middleware/corsAllowlist';
-export { errorEnvelope } from './middleware/errorEnvelope';
-export { crossOriginRefusal } from './middleware/localOrigin';
-export { clientIp, createRateLimiter } from './middleware/rateLimit';
-export { requestLogger } from './middleware/requestLogger';
-export { securityHeaders, } from './middleware/securityHeaders';
+export { correlationId } from './middleware/correlationId.js';
+export { corsAllowlist, corsOptsFromEnv } from './middleware/corsAllowlist.js';
+export { errorEnvelope } from './middleware/errorEnvelope.js';
+export { crossOriginRefusal } from './middleware/localOrigin.js';
+export { clientIp, createRateLimiter } from './middleware/rateLimit.js';
+export { requestLogger } from './middleware/requestLogger.js';
+export { securityHeaders, } from './middleware/securityHeaders.js';
 // ── zod validation toolkit ────────────────────────────────────────────────────
 //    (the `validationEnvelope`/`toValidationIssues`/`ValidationIssue` builders now
 //     live with the canonical envelope in `./errors`, re-exported above.)
-export { zValidator } from './middleware/zValidator';
+export { zValidator } from './middleware/zValidator.js';
 // ── Migration runner ──────────────────────────────────────────────────────────
-export { addColumnIfMissing, applyRecommendedPragmas, columnExists, runMigrations } from './migration/runner';
+export { addColumnIfMissing, applyRecommendedPragmas, columnExists, runMigrations } from './migration/runner.js';
 // ── Audit log: the SQLite-backed AuditSink cursedshell's service dispatch ─────
 //    writes to (see `cwip/audit` for the storage-agnostic contract + the
 //    zero-config in-memory default).
-export { AUDIT_LOG_MIGRATIONS, auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink, } from './audit';
+export { AUDIT_LOG_MIGRATIONS, auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink, } from './audit/index.js';
 // ── SQLite toolkit extras (task 30): FTS5 ranked search + DDL generator, the ───
 //    read-only DB viewer middleware, the VACUUM-INTO backup service, DB health probes.
-export { applyFtsSchema, buildFtsSchema, clampLimit, clampOffset, collectSqliteStats, createFts5Search, createSqliteBackupService, createSqliteHealthChecks, createSqliteViewerMiddleware, exportSqliteSnapshot, exportSqliteTable, importRowsIntoSqliteTable, isKnownTable, isReadOnlySql, listSqliteTables, NotReadOnlyError, quoteIdent, readSqliteTable, restoreSqliteSnapshot, runReadonlySqlite, sanitizeFtsQuery, snapshotSqlite, UnknownTableError, } from './sqlite';
+export { applyFtsSchema, buildFtsSchema, clampLimit, clampOffset, collectSqliteStats, createFts5Search, createSqliteBackupService, createSqliteHealthChecks, createSqliteViewerMiddleware, exportSqliteSnapshot, exportSqliteTable, importRowsIntoSqliteTable, isKnownTable, isReadOnlySql, listSqliteTables, NotReadOnlyError, quoteIdent, readSqliteTable, restoreSqliteSnapshot, runReadonlySqlite, sanitizeFtsQuery, snapshotSqlite, UnknownTableError, } from './sqlite/index.js';
 // ── WebSocket hub (task 28): Bun-native upgrade, channel registry, heartbeat, ──
 //    presence-as-a-view, room helpers, and the push-only event-bus subset (ru).
-export { computePresence, createEventBus, createWsHub, joinRoom, leaveRoom, ROOM_META_KEY, roomOf, } from './ws';
+export { computePresence, createEventBus, createWsHub, joinRoom, leaveRoom, ROOM_META_KEY, roomOf, } from './ws/index.js';
 // The app-data root resolver. Exported at the root (2026-09-15, task 148) because
 // `cursedbelt-cc`'s localHost needs it and it answers a question about the HOST, not
 // about any one subsystem — so no subpath barrel is its natural home.
-export { resolveAppDataHome } from './paths/appDataHome';
+export { resolveAppDataHome } from './paths/appDataHome.js';

package/dist/server/jobs/fireQueue.d.ts

@@ -1,4 +1,4 @@
-import { type FireQueue, type FireQueueOpts } from './types';
+import { type FireQueue, type FireQueueOpts } from './types.js';
 /**
  * The "select due rows → deliver each → mark sent" pattern, as a {@link PollingJob}.
  * This is ca's `event_reminders` / `alarms` delivery loop generalized: each poll

package/dist/server/jobs/fireQueue.js

@@ -1,6 +1,6 @@
-import { defaultJobLogger } from './logger';
-import { createPollingJob } from './polling';
-import { DEFAULT_FIRE_INTERVAL_MS } from './types';
+import { defaultJobLogger } from './logger.js';
+import { createPollingJob } from './polling.js';
+import { DEFAULT_FIRE_INTERVAL_MS } from './types.js';
 /**
  * The "select due rows → deliver each → mark sent" pattern, as a {@link PollingJob}.
  * This is ca's `event_reminders` / `alarms` delivery loop generalized: each poll

package/dist/server/jobs/index.d.ts

@@ -1,7 +1,7 @@
-export { createFireQueue } from './fireQueue';
-export { defaultJobLogger } from './logger';
-export { createPlainjobConnection } from './plainjobAdapter';
-export { createPollingJob } from './polling';
-export { createJobRunner } from './runner';
-export { JobTimeoutError } from './timeout';
-export { type CreateJobRunnerOptions, DEFAULT_FIRE_INTERVAL_MS, DEFAULT_JOB_RETENTION, DEFAULT_JOB_TIMEOUT_MS, type FireQueue, type FireQueueOpts, type JobContext, type JobDef, type JobLogger, type JobRetentionOptions, type JobRunner, type JobRunRecord, type PollingJob, type PollingJobOpts, } from './types';
+export { createFireQueue } from './fireQueue.js';
+export { defaultJobLogger } from './logger.js';
+export { createPlainjobConnection } from './plainjobAdapter.js';
+export { createPollingJob } from './polling.js';
+export { createJobRunner } from './runner.js';
+export { JobTimeoutError } from './timeout.js';
+export { type CreateJobRunnerOptions, DEFAULT_FIRE_INTERVAL_MS, DEFAULT_JOB_RETENTION, DEFAULT_JOB_TIMEOUT_MS, type FireQueue, type FireQueueOpts, type JobContext, type JobDef, type JobLogger, type JobRetentionOptions, type JobRunner, type JobRunRecord, type PollingJob, type PollingJobOpts, } from './types.js';

package/dist/server/jobs/index.js

@@ -2,10 +2,10 @@
 // ca + ru. cursedbelt owns the mechanism (durable cron scheduling via plainjob,
 // restart-aware pollers, the due-row fire queue, run auditing); app job
 // *definitions* stay business and consume these primitives.
-export { createFireQueue } from './fireQueue';
-export { defaultJobLogger } from './logger';
-export { createPlainjobConnection } from './plainjobAdapter';
-export { createPollingJob } from './polling';
-export { createJobRunner } from './runner';
-export { JobTimeoutError } from './timeout';
-export { DEFAULT_FIRE_INTERVAL_MS, DEFAULT_JOB_RETENTION, DEFAULT_JOB_TIMEOUT_MS, } from './types';
+export { createFireQueue } from './fireQueue.js';
+export { defaultJobLogger } from './logger.js';
+export { createPlainjobConnection } from './plainjobAdapter.js';
+export { createPollingJob } from './polling.js';
+export { createJobRunner } from './runner.js';
+export { JobTimeoutError } from './timeout.js';
+export { DEFAULT_FIRE_INTERVAL_MS, DEFAULT_JOB_RETENTION, DEFAULT_JOB_TIMEOUT_MS, } from './types.js';

package/dist/server/jobs/logger.d.ts

@@ -1,4 +1,4 @@
-import type { JobLogger } from './types';
+import type { JobLogger } from './types.js';
 /**
  * The default job logger: warn/info/error go to the console, `debug` is a no-op.
  *

package/dist/server/jobs/polling.d.ts

@@ -1,4 +1,4 @@
-import type { PollingJob, PollingJobOpts } from './types';
+import type { PollingJob, PollingJobOpts } from './types.js';
 /**
  * A periodic, restart-aware poller — the engine behind ca's `setInterval`
  * scheduler, alarm check, and metrics flush. On each tick it runs the handler and,

package/dist/server/jobs/polling.js

@@ -1,4 +1,4 @@
-import { defaultJobLogger } from './logger';
+import { defaultJobLogger } from './logger.js';
 /**
  * A periodic, restart-aware poller — the engine behind ca's `setInterval`
  * scheduler, alarm check, and metrics flush. On each tick it runs the handler and,

package/dist/server/jobs/runner.d.ts

@@ -1,5 +1,5 @@
 import type { Database } from 'bun:sqlite';
-import { type CreateJobRunnerOptions, type JobRunner } from './types';
+import { type CreateJobRunnerOptions, type JobRunner } from './types.js';
 /**
  * Create the durable cron job runner — a thin facade over **plainjob** (MIT,
  * SQLite-backed, no Redis). It generalizes ca's scattered `setInterval` cron-ish

package/dist/server/jobs/runner.js

@@ -1,9 +1,9 @@
 import { defineQueue, defineWorker } from 'plainjob';
-import { ApiError } from '../errors';
-import { defaultJobLogger } from './logger';
-import { createPlainjobConnection } from './plainjobAdapter';
-import { withTimeout } from './timeout';
-import { DEFAULT_JOB_RETENTION, DEFAULT_JOB_TIMEOUT_MS, } from './types';
+import { ApiError } from '../errors.js';
+import { defaultJobLogger } from './logger.js';
+import { createPlainjobConnection } from './plainjobAdapter.js';
+import { withTimeout } from './timeout.js';
+import { DEFAULT_JOB_RETENTION, DEFAULT_JOB_TIMEOUT_MS, } from './types.js';
 /**
  * Create the durable cron job runner — a thin facade over **plainjob** (MIT,
  * SQLite-backed, no Redis). It generalizes ca's scattered `setInterval` cron-ish

package/dist/server/master-lock/accountsPage.d.ts

@@ -1,4 +1,4 @@
-import { type LockPageOptions } from "./lockPage";
+import { type LockPageOptions } from "./lockPage.js";
 /**
  * The page's own two assets.
  *