cursedbelt-server 4.12.0 → 4.13.0

package/dist/server/master-lock/accountsPage.js

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE } from "./lockPage";
+import { MASTER_LOCK_DERIVE_SOURCE } from "./lockPage.js";
 /**
  * The page's own two assets.
  *

package/dist/server/master-lock/guard.d.ts

@@ -1,5 +1,5 @@
-import { type LockPageOptions } from "./lockPage";
-import type { MasterLock } from "./masterLock";
+import { type LockPageOptions } from "./lockPage.js";
+import type { MasterLock } from "./masterLock.js";
 export interface MasterLockGuardOptions extends LockPageOptions {
     /**
      * The lock this guard enforces.

package/dist/server/master-lock/guard.js

@@ -12,8 +12,8 @@
  * second wall, not a replacement for the first.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX, MASTER_LOCK_STATE_HEADER, masterLockCookieName, } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, accountsPageHtml, } from "./accountsPage";
-import { LOCK_SCRIPT, LOCK_STYLE, lockPageHtml } from "./lockPage";
+import { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, accountsPageHtml, } from "./accountsPage.js";
+import { LOCK_SCRIPT, LOCK_STYLE, lockPageHtml } from "./lockPage.js";
 const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma: "no-cache" };
 /**
  * The lock page's own CSP. Strict enough to stand in front of `apps/vault`'s wall without

package/dist/server/master-lock/index.d.ts

@@ -20,10 +20,10 @@
  * server-rendered surface under `/__lock/` reaches every app that mounts the guard with no
  * bundle, no framework version to migrate, and no app-local copy to drift.
  */
-export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage";
-export { MASTER_LOCK_CSP, type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard, } from "./guard";
-export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions, lockPageHtml, } from "./lockPage";
-export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, type MasterLockDirectoryOptions, masterLockPrincipalKey, } from "./principals";
-export { FIRST_ACCOUNT_ID, MasterLock, type MasterLockAccount, type MasterLockAddAccountResult, type MasterLockEnrollResult, type MasterLockOptions, type MasterLockRecord, type MasterLockStore, type MasterLockUnlockResult, readRecord, } from "./masterLock";
-export { DEFAULT_SEED_IDLE_MS, generateStagePassword, type MintMasterLockSeedOptions, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed";
-export { MASTER_LOCK_SETTING_KEY, MASTER_LOCK_STATE_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store";
+export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage.js";
+export { MASTER_LOCK_CSP, type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard, } from "./guard.js";
+export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions, lockPageHtml, } from "./lockPage.js";
+export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, type MasterLockDirectoryOptions, masterLockPrincipalKey, } from "./principals.js";
+export { FIRST_ACCOUNT_ID, MasterLock, type MasterLockAccount, type MasterLockAddAccountResult, type MasterLockEnrollResult, type MasterLockOptions, type MasterLockRecord, type MasterLockStore, type MasterLockUnlockResult, readRecord, } from "./masterLock.js";
+export { DEFAULT_SEED_IDLE_MS, generateStagePassword, type MintMasterLockSeedOptions, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed.js";
+export { MASTER_LOCK_SETTING_KEY, MASTER_LOCK_STATE_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store.js";

package/dist/server/master-lock/index.js

@@ -20,10 +20,10 @@
  * server-rendered surface under `/__lock/` reaches every app that mounts the guard with no
  * bundle, no framework version to migrate, and no app-local copy to drift.
  */
-export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage";
-export { MASTER_LOCK_CSP, createMasterLockGuard, } from "./guard";
-export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml, } from "./lockPage";
-export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, masterLockPrincipalKey, } from "./principals";
-export { FIRST_ACCOUNT_ID, MasterLock, readRecord, } from "./masterLock";
-export { DEFAULT_SEED_IDLE_MS, generateStagePassword, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed";
-export { MASTER_LOCK_SETTING_KEY, MASTER_LOCK_STATE_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store";
+export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage.js";
+export { MASTER_LOCK_CSP, createMasterLockGuard, } from "./guard.js";
+export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml, } from "./lockPage.js";
+export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, masterLockPrincipalKey, } from "./principals.js";
+export { FIRST_ACCOUNT_ID, MasterLock, readRecord, } from "./masterLock.js";
+export { DEFAULT_SEED_IDLE_MS, generateStagePassword, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed.js";
+export { MASTER_LOCK_SETTING_KEY, MASTER_LOCK_STATE_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store.js";

package/dist/server/master-lock/masterLock.js

@@ -48,6 +48,7 @@
  * one who has been guessing.
  */
 import { createHash } from "node:crypto";
+import { constantTimeEqual } from "cwip/constant-time";
 import { clampIdleMs, isMasterLockKdfParams, windowRemaining, } from "cursedbelt-core/master-lock";
 /** The id a legacy single-password record migrates to. Fixed, because the app that adopts
  *  this stamps its existing rows with it — a random id would orphan the library it is
@@ -865,14 +866,3 @@ function presentedTokens(req) {
     }
     return out;
 }
-function constantTimeEqual(a, b) {
-    const x = Buffer.from(a);
-    const y = Buffer.from(b);
-    // A length difference is already a non-match, and `timingSafeEqual` throws on one.
-    if (x.length !== y.length)
-        return false;
-    let diff = 0;
-    for (let i = 0; i < x.length; i += 1)
-        diff |= x[i] ^ y[i];
-    return diff === 0;
-}

package/dist/server/master-lock/principals.d.ts

@@ -1,4 +1,4 @@
-import { MasterLock } from "./masterLock";
+import { MasterLock } from "./masterLock.js";
 /** Namespace for every per-person record, so one glance at the table says what they are. */
 export declare const MASTER_LOCK_PRINCIPAL_KEY_PREFIX = "master_lock:principal:";
 /**

package/dist/server/master-lock/principals.js

@@ -46,7 +46,7 @@
  * record is stored under, which is the only thing it ever really was.
  */
 import { createHash } from "node:crypto";
-import { MasterLock, readRecord } from "./masterLock";
+import { MasterLock, readRecord } from "./masterLock.js";
 /** Namespace for every per-person record, so one glance at the table says what they are. */
 export const MASTER_LOCK_PRINCIPAL_KEY_PREFIX = "master_lock:principal:";
 /**

package/dist/server/master-lock/seed.d.ts

@@ -1,5 +1,5 @@
 import { type MasterLockKdfParams } from "cursedbelt-core/master-lock/kdf";
-import { type MasterLockRecord } from "./masterLock";
+import { type MasterLockRecord } from "./masterLock.js";
 /**
  * The idle window a freshly minted lock starts with.
  *

package/dist/server/master-lock/seed.js

@@ -24,7 +24,7 @@
  */
 import { DEFAULT_IDLE_MS } from "cursedbelt-core/master-lock/policy";
 import { deriveMasterLockVerifier, newMasterLockKdfParams, } from "cursedbelt-core/master-lock/kdf";
-import { FIRST_ACCOUNT_ID } from "./masterLock";
+import { FIRST_ACCOUNT_ID } from "./masterLock.js";
 /**
  * The idle window a freshly minted lock starts with.
  *

package/dist/server/master-lock/store.d.ts

@@ -6,7 +6,7 @@
  * `app_settings`, a `Map` in a test. Asking for a whole table would be asking each adopter
  * to write a migration for three fields.
  */
-import type { MasterLockStore } from "./masterLock";
+import type { MasterLockStore } from "./masterLock.js";
 /** The default key, so two apps' rows look the same when somebody goes looking. */
 export declare const MASTER_LOCK_SETTING_KEY = "master_lock:record";
 /**

package/dist/server/media-bun/index.d.ts

@@ -1,4 +1,4 @@
 export { buildProbeArgs, buildThumbnailArgs, buildTrimArgs, ffmpegTimeToSeconds, type ProbeResult, parseFfmpegProgress, parseFfprobe, type VideoCodecPlan, videoCodecPlan, } from 'cursedbelt-core/media/ffmpeg';
-export { renderImage } from './image';
-export { aacWebAudioArgs, buildFrameJpegArgs, buildSpriteVtt, buildStreamProbeArgs, canStreamCopy, EMPTY_PROBE, FASTSTART, faststartArgs, h264WebVideoArgs, hlsLadderArgs, imageThumbnailArgs, LIBRARY_CRF, LIBRARY_SCALE, parseProgressMicros, parseStreamProbe, planSprite, posterArgs, resolveLadder, type SpritePlan, spriteArgs, type VideoProbe, } from './streaming';
-export { extractFrameJpeg, extractThumbnail, isFfmpegAvailable, isFfprobeAvailable, probeMedia, probeVideoStream, runFfmpegProgress, trimVideo, } from './video';
+export { renderImage } from './image.js';
+export { aacWebAudioArgs, buildFrameJpegArgs, buildSpriteVtt, buildStreamProbeArgs, canStreamCopy, EMPTY_PROBE, FASTSTART, faststartArgs, h264WebVideoArgs, hlsLadderArgs, imageThumbnailArgs, LIBRARY_CRF, LIBRARY_SCALE, parseProgressMicros, parseStreamProbe, planSprite, posterArgs, resolveLadder, type SpritePlan, spriteArgs, type VideoProbe, } from './streaming.js';
+export { extractFrameJpeg, extractThumbnail, isFfmpegAvailable, isFfprobeAvailable, probeMedia, probeVideoStream, runFfmpegProgress, trimVideo, } from './video.js';

package/dist/server/media-bun/index.js

@@ -3,8 +3,8 @@
 // via native ffmpeg/ffprobe. App handlers keep auth, FsNode lookup, quota, and
 // storeFile; this owns the actual pixel/codec work.
 export { buildProbeArgs, buildThumbnailArgs, buildTrimArgs, ffmpegTimeToSeconds, parseFfmpegProgress, parseFfprobe, videoCodecPlan, } from 'cursedbelt-core/media/ffmpeg';
-export { renderImage } from './image';
+export { renderImage } from './image.js';
 // Streaming pipeline: faststart remux, HLS adaptive-bitrate ladder, scrub sprite + WebVTT,
 // poster, codec-aware probe — pure builders/parsers (testable without ffmpeg).
-export { aacWebAudioArgs, buildFrameJpegArgs, buildSpriteVtt, buildStreamProbeArgs, canStreamCopy, EMPTY_PROBE, FASTSTART, faststartArgs, h264WebVideoArgs, hlsLadderArgs, imageThumbnailArgs, LIBRARY_CRF, LIBRARY_SCALE, parseProgressMicros, parseStreamProbe, planSprite, posterArgs, resolveLadder, spriteArgs, } from './streaming';
-export { extractFrameJpeg, extractThumbnail, isFfmpegAvailable, isFfprobeAvailable, probeMedia, probeVideoStream, runFfmpegProgress, trimVideo, } from './video';
+export { aacWebAudioArgs, buildFrameJpegArgs, buildSpriteVtt, buildStreamProbeArgs, canStreamCopy, EMPTY_PROBE, FASTSTART, faststartArgs, h264WebVideoArgs, hlsLadderArgs, imageThumbnailArgs, LIBRARY_CRF, LIBRARY_SCALE, parseProgressMicros, parseStreamProbe, planSprite, posterArgs, resolveLadder, spriteArgs, } from './streaming.js';
+export { extractFrameJpeg, extractThumbnail, isFfmpegAvailable, isFfprobeAvailable, probeMedia, probeVideoStream, runFfmpegProgress, trimVideo, } from './video.js';

package/dist/server/media-bun/video.d.ts

@@ -1,6 +1,6 @@
 import { type VideoProgressEvent, type VideoTrimSpec } from 'cursedbelt-core/media';
 import { type ProbeResult } from 'cursedbelt-core/media/ffmpeg';
-import { type VideoProbe } from './streaming';
+import { type VideoProbe } from './streaming.js';
 /** Is ffmpeg runnable? Cheap probe used to skip server media ops / tests cleanly. */
 export declare function isFfmpegAvailable(bin?: string): Promise<boolean>;
 /** Is ffprobe runnable? */

package/dist/server/media-bun/video.js

@@ -4,7 +4,7 @@
 // `FFMPEG_PATH` / `FFPROBE_PATH`. Replaces ca's hand-rolled spawn boilerplate.
 import { assertValidVideoTrimSpec, } from 'cursedbelt-core/media';
 import { buildProbeArgs, buildThumbnailArgs, buildTrimArgs, parseFfmpegProgress, parseFfprobe, } from 'cursedbelt-core/media/ffmpeg';
-import { buildFrameJpegArgs, buildStreamProbeArgs, EMPTY_PROBE, parseProgressMicros, parseStreamProbe, } from './streaming';
+import { buildFrameJpegArgs, buildStreamProbeArgs, EMPTY_PROBE, parseProgressMicros, parseStreamProbe, } from './streaming.js';
 const FFMPEG = process.env.FFMPEG_PATH || 'ffmpeg';
 const FFPROBE = process.env.FFPROBE_PATH || 'ffprobe';
 /** Is ffmpeg runnable? Cheap probe used to skip server media ops / tests cleanly. */

package/dist/server/metrics/telemetrySink.d.ts

@@ -1,5 +1,5 @@
 import type { Database } from 'bun:sqlite';
-import { type MetricRow } from './metricsBuffer';
+import { type MetricRow } from './metricsBuffer.js';
 /**
  * ONE seam for "this app served a request", with two backends and no third.
  *

package/dist/server/metrics/telemetrySink.js

@@ -1,4 +1,4 @@
-import { createMetricsBuffer } from './metricsBuffer';
+import { createMetricsBuffer } from './metricsBuffer.js';
 /**
  * 🔴 **The data-point layout is a WIRE FORMAT.** Analytics Engine columns are
  * positional (`blob1`, `double1`, …), so every saved SQL query breaks if a

package/dist/server/middleware/correlationId.d.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from 'hono';
-import type { CursedbeltEnv } from '../context';
+import type { CursedbeltEnv } from '../context.js';
 /**
  * Assign every request a correlation id: reuse a safe inbound `x-correlation-id`
  * (so a trace survives the proxy hop), else mint a `crypto.randomUUID()`. Stored on

package/dist/server/middleware/errorEnvelope.d.ts

@@ -1,5 +1,5 @@
 import type { ErrorHandler } from 'hono';
-import type { CursedbeltEnv } from '../context';
+import type { CursedbeltEnv } from '../context.js';
 /**
  * Hono `onError` handler. Converts ANY thrown value into the ONE canonical rich
  * envelope — `{ error: { name, message, code?, status?, category?, context?,

package/dist/server/middleware/errorEnvelope.js

@@ -1,5 +1,5 @@
 import { HTTPException } from 'hono/http-exception';
-import { ApiError, isAppError, toErrorEnvelope } from '../errors';
+import { ApiError, isAppError, toErrorEnvelope } from '../errors.js';
 /**
  * Hono `onError` handler. Converts ANY thrown value into the ONE canonical rich
  * envelope — `{ error: { name, message, code?, status?, category?, context?,

package/dist/server/middleware/index.d.ts

@@ -1,10 +1,10 @@
-export { correlationId } from './correlationId';
-export { type CorsOpts, corsAllowlist, corsOptsFromEnv } from './corsAllowlist';
-export { errorEnvelope } from './errorEnvelope';
-export { crossOriginRefusal } from './localOrigin';
-export { clientIp, createRateLimiter, type RateLimitOpts } from './rateLimit';
-export { type RequestLoggerOpts, requestLogger } from './requestLogger';
-export { type AnalyticsEngineDataset, createTelemetrySink, type TelemetryEvent, type TelemetrySink, type TelemetrySinkOptions, } from '../metrics/telemetrySink';
-export { type CspDirectives, type SecurityHeadersOpts, securityHeaders, } from './securityHeaders';
-export { toValidationIssues, VALIDATION_ERROR_CODE, type ValidationIssue, validationEnvelope, } from '../errors';
-export { type ZValidatorTarget, zValidator } from './zValidator';
+export { correlationId } from './correlationId.js';
+export { type CorsOpts, corsAllowlist, corsOptsFromEnv } from './corsAllowlist.js';
+export { errorEnvelope } from './errorEnvelope.js';
+export { crossOriginRefusal } from './localOrigin.js';
+export { clientIp, createRateLimiter, type RateLimitOpts } from './rateLimit.js';
+export { type RequestLoggerOpts, requestLogger } from './requestLogger.js';
+export { type AnalyticsEngineDataset, createTelemetrySink, type TelemetryEvent, type TelemetrySink, type TelemetrySinkOptions, } from '../metrics/telemetrySink.js';
+export { type CspDirectives, type SecurityHeadersOpts, securityHeaders, } from './securityHeaders.js';
+export { toValidationIssues, VALIDATION_ERROR_CODE, type ValidationIssue, validationEnvelope, } from '../errors.js';
+export { type ZValidatorTarget, zValidator } from './zValidator.js';

package/dist/server/middleware/index.js

@@ -1,13 +1,13 @@
 // The cross-cutting cursedbelt server middleware set.
-export { correlationId } from './correlationId';
-export { corsAllowlist, corsOptsFromEnv } from './corsAllowlist';
-export { errorEnvelope } from './errorEnvelope';
-export { crossOriginRefusal } from './localOrigin';
-export { clientIp, createRateLimiter } from './rateLimit';
-export { requestLogger } from './requestLogger';
+export { correlationId } from './correlationId.js';
+export { corsAllowlist, corsOptsFromEnv } from './corsAllowlist.js';
+export { errorEnvelope } from './errorEnvelope.js';
+export { crossOriginRefusal } from './localOrigin.js';
+export { clientIp, createRateLimiter } from './rateLimit.js';
+export { requestLogger } from './requestLogger.js';
 // The telemetry seam `requestLogger` writes through — re-exported here so a caller
 // that reaches `./middleware` for the logger can bind Analytics Engine in the same import.
-export { createTelemetrySink, } from '../metrics/telemetrySink';
-export { securityHeaders, } from './securityHeaders';
-export { toValidationIssues, VALIDATION_ERROR_CODE, validationEnvelope, } from '../errors';
-export { zValidator } from './zValidator';
+export { createTelemetrySink, } from '../metrics/telemetrySink.js';
+export { securityHeaders, } from './securityHeaders.js';
+export { toValidationIssues, VALIDATION_ERROR_CODE, validationEnvelope, } from '../errors.js';
+export { zValidator } from './zValidator.js';

package/dist/server/middleware/rateLimit.js

@@ -1,5 +1,5 @@
 import { getConnInfo } from 'hono/bun';
-import { ApiError, toErrorEnvelope } from '../errors';
+import { ApiError, toErrorEnvelope } from '../errors.js';
 /**
  * The client IP for rate-limiting / logging.
  *

package/dist/server/middleware/requestLogger.d.ts

@@ -1,8 +1,8 @@
 import type { Database } from 'bun:sqlite';
 import type { MiddlewareHandler } from 'hono';
-import type { CursedbeltEnv } from '../context';
-import type { MetricsBuffer } from '../metrics/metricsBuffer';
-import { type AnalyticsEngineDataset, type TelemetrySink } from '../metrics/telemetrySink';
+import type { CursedbeltEnv } from '../context.js';
+import type { MetricsBuffer } from '../metrics/metricsBuffer.js';
+import { type AnalyticsEngineDataset, type TelemetrySink } from '../metrics/telemetrySink.js';
 /**
  * Structured request/response logging. After each request it records one
  * telemetry event through the {@link TelemetrySink} (off the hot path) and, for

package/dist/server/middleware/requestLogger.js

@@ -1,7 +1,7 @@
 import { HTTPException } from 'hono/http-exception';
-import { isApiError } from '../errors';
-import { normalizeRoute } from '../metrics/normalizeRoute';
-import { createTelemetrySink, } from '../metrics/telemetrySink';
+import { isApiError } from '../errors.js';
+import { normalizeRoute } from '../metrics/normalizeRoute.js';
+import { createTelemetrySink, } from '../metrics/telemetrySink.js';
 function statusOfThrown(err) {
     if (isApiError(err))
         return err.status;

package/dist/server/middleware/zValidator.d.ts

@@ -1,6 +1,6 @@
 import type { Env, MiddlewareHandler } from 'hono';
 import type { ZodType, z } from 'zod';
-import type { CursedbeltEnv } from '../context';
+import type { CursedbeltEnv } from '../context.js';
 /** The request locations a schema can validate. Mirrors Hono's body/non-body split. */
 export type ZValidatorTarget = 'json' | 'form' | 'query' | 'param';
 /**

package/dist/server/middleware/zValidator.js

@@ -1,4 +1,4 @@
-import { validationEnvelope } from '../errors';
+import { validationEnvelope } from '../errors.js';
 /**
  * Read the value a target validates against. The body targets (`json`/`form`) prefer
  * the ctgr-decoded body so a tunnelled mutation validates its real payload; the

package/dist/server/migration/runner.d.ts

@@ -1,5 +1,5 @@
 import type { Database } from 'bun:sqlite';
-import type { Migration } from './types';
+import type { Migration } from './types.js';
 /**
  * The versioned SQLite migration runner — a tiny `_migrations`-sentinel runner, NOT
  * a schema-first ORM. It replaces the old scattered guarded-`ALTER` /

package/dist/server/net/outboundGuard.js

@@ -33,7 +33,7 @@
  */
 import { isIP } from 'node:net';
 import { lookup } from 'node:dns/promises';
-import { AppError } from '../errors';
+import { AppError } from '../errors.js';
 export const OUTBOUND_URL_BLOCKED = 'OUTBOUND_URL_BLOCKED';
 const blocked = (reason, context) => new AppError(`Outbound request refused: ${reason}.`, {
     code: OUTBOUND_URL_BLOCKED,

package/dist/server/notifications/index.d.ts

@@ -36,12 +36,12 @@
  *    route that notifies somebody else; producing is server-side code calling
  *    `center.notify*`.
  */
-export { createNotificationHub } from "./hub";
-export type { NotificationHub, NotificationHubEvent, NotificationHubListener, NotificationHubOptions, } from "./hub";
-export { NOTIFICATION_MIGRATIONS, NOTIFICATIONS_TABLE } from "./migrations";
-export { mountNotificationRoutes } from "./routes";
-export type { NotificationRouteCenter, NotificationRoutesOptions } from "./routes";
-export { createNotificationService } from "./service";
-export type { CreateNotificationServiceOptions, NotificationService, NotificationServiceMountOptions, } from "./service";
+export { createNotificationHub } from "./hub.js";
+export type { NotificationHub, NotificationHubEvent, NotificationHubListener, NotificationHubOptions, } from "./hub.js";
+export { NOTIFICATION_MIGRATIONS, NOTIFICATIONS_TABLE } from "./migrations.js";
+export { mountNotificationRoutes } from "./routes.js";
+export type { NotificationRouteCenter, NotificationRoutesOptions } from "./routes.js";
+export { createNotificationService } from "./service.js";
+export type { CreateNotificationServiceOptions, NotificationService, NotificationServiceMountOptions, } from "./service.js";
 export { createNotificationCenter, createMemoryNotificationStore, createSqliteNotificationStore, migrateNotificationsSchema, } from "cwip/notifications";
 export type { AppNotification, ListNotificationsQuery, NotificationAudience, NotificationCenter, NotificationCenterOptions, NotificationDraft, NotificationFilter, NotificationPage, NotificationSeverity, NotificationSink, NotificationStore, Notifier, } from "cwip/notifications";

package/dist/server/notifications/index.js

@@ -36,10 +36,10 @@
  *    route that notifies somebody else; producing is server-side code calling
  *    `center.notify*`.
  */
-export { createNotificationHub } from "./hub";
-export { NOTIFICATION_MIGRATIONS, NOTIFICATIONS_TABLE } from "./migrations";
-export { mountNotificationRoutes } from "./routes";
-export { createNotificationService } from "./service";
+export { createNotificationHub } from "./hub.js";
+export { NOTIFICATION_MIGRATIONS, NOTIFICATIONS_TABLE } from "./migrations.js";
+export { mountNotificationRoutes } from "./routes.js";
+export { createNotificationService } from "./service.js";
 // Re-exported so a server consumer needs ONE import for the whole contract —
 // the same courtesy `server/sharing` extends over `cursedbelt-core/sharing`. The
 // engine remains cwip's; this is a door, not a copy.

package/dist/server/notifications/migrations.d.ts

@@ -1,4 +1,4 @@
-import type { Migration } from "../migration/types";
+import type { Migration } from "../migration/types.js";
 export declare const NOTIFICATIONS_TABLE = "notifications";
 /**
  * Ordered migrations for the notification table.

package/dist/server/notifications/routes.d.ts

@@ -35,7 +35,7 @@
  */
 import type { Context, Hono } from "hono";
 import type { NotificationCenter } from "cwip/notifications";
-import type { NotificationHub } from "./hub";
+import type { NotificationHub } from "./hub.js";
 /** The slice of the center these routes use — `createNotificationCenter(...)`
  *  satisfies it, and so does any app-specific facade over one. */
 export type NotificationRouteCenter = Pick<NotificationCenter, "list" | "get" | "unreadCount" | "markRead" | "markAllRead" | "setDone" | "doneAll" | "remove">;

package/dist/server/notifications/service.d.ts

@@ -15,7 +15,7 @@
 import type { Database } from "bun:sqlite";
 import { type NotificationCenter, type NotificationStore } from "cwip/notifications";
 import type { Context, Hono } from "hono";
-import { type NotificationHub } from "./hub";
+import { type NotificationHub } from "./hub.js";
 export interface CreateNotificationServiceOptions {
     /** The app's own database — the table lands beside its rows. */
     db: Database;

package/dist/server/notifications/service.js

@@ -1,6 +1,6 @@
 import { createNotificationCenter, createSqliteNotificationStore, } from "cwip/notifications";
-import { createNotificationHub } from "./hub";
-import { mountNotificationRoutes } from "./routes";
+import { createNotificationHub } from "./hub.js";
+import { mountNotificationRoutes } from "./routes.js";
 export function createNotificationService(options) {
     const onError = options.onError ??
         ((error, context) => console.error(`[notifications] ${context}:`, error instanceof Error ? error.message : error));

package/dist/server/resume/index.d.ts

@@ -1,2 +1,2 @@
-export { createSqliteResumeStore, MAX_LOCATION_LENGTH, type ResumeRecord, type ResumeStore, type ResumeStoreOptions, } from './store';
-export { mountResumeRoutes, RESUME_KEY_PATTERN, type ResumeRoutesOptions } from './routes';
+export { createSqliteResumeStore, MAX_LOCATION_LENGTH, type ResumeRecord, type ResumeStore, type ResumeStoreOptions, } from './store.js';
+export { mountResumeRoutes, RESUME_KEY_PATTERN, type ResumeRoutesOptions } from './routes.js';

package/dist/server/resume/index.js

@@ -1,2 +1,2 @@
-export { createSqliteResumeStore, MAX_LOCATION_LENGTH, } from './store';
-export { mountResumeRoutes, RESUME_KEY_PATTERN } from './routes';
+export { createSqliteResumeStore, MAX_LOCATION_LENGTH, } from './store.js';
+export { mountResumeRoutes, RESUME_KEY_PATTERN } from './routes.js';

package/dist/server/resume/routes.d.ts

@@ -17,7 +17,7 @@
  * screen it names.
  */
 import type { Context, Hono } from 'hono';
-import { type ResumeStore } from './store';
+import { type ResumeStore } from './store.js';
 export interface ResumeRoutesOptions {
     store: ResumeStore;
     /** Resolve the caller to a user id, or null to refuse. */

package/dist/server/resume/routes.js

@@ -1,4 +1,4 @@
-import { MAX_LOCATION_LENGTH } from './store';
+import { MAX_LOCATION_LENGTH } from './store.js';
 const NO_STORE = { 'cache-control': 'no-store, private' };
 /**
  * What a `?key=` may look like. 🔴 EXPORTED because a client that builds a key

package/dist/server/retention/archive.js

@@ -44,7 +44,7 @@
 import { createHash } from "node:crypto";
 import { appendFileSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, writeSync, } from "node:fs";
 import { join } from "node:path";
-import { APP_DATA_HOME_ENV, resolveAppDataHome } from "../paths/appDataHome";
+import { APP_DATA_HOME_ENV, resolveAppDataHome } from "../paths/appDataHome.js";
 /** The default budget of uncollected archive on a staged (deployed-box) home.
  *  Generous next to the tables it governs — notes' whole `ops` log is ~15 MB —
  *  and small next to a 6.7 GB root. Reached only if the collector has stopped. */

package/dist/server/retention/fleet.d.ts

@@ -9,8 +9,8 @@
  * up as data that vanished earlier than the screen said it would — which is the
  * one failure mode that would make the owner stop trusting the control.
  */
-import type { EffectiveRetentionPolicy, RetentionOverride } from "./policy";
-import type { PublishedResource } from "./store";
+import type { EffectiveRetentionPolicy, RetentionOverride } from "./policy.js";
+import type { PublishedResource } from "./store.js";
 export interface RetentionFleetRow extends PublishedResource {
     key: string;
     app: string;

package/dist/server/retention/fleet.js

@@ -1,5 +1,5 @@
-import { RETENTION_CATEGORIES, resolveRetentionPolicy } from "./policy";
-import { readRetentionOverrides, readRetentionRegistry, resolveRetentionHome } from "./store";
+import { RETENTION_CATEGORIES, resolveRetentionPolicy } from "./policy.js";
+import { readRetentionOverrides, readRetentionRegistry, resolveRetentionHome } from "./store.js";
 export function buildRetentionFleetView(options = {}) {
     const home = options.home ?? resolveRetentionHome();
     const publications = readRetentionRegistry(home);

package/dist/server/retention/index.d.ts

@@ -30,9 +30,9 @@
  * the owner would miss (which is exactly why billing evidence is NOT a category
  * and lives in `retentionPolicy.ts` instead).
  */
-export { archiveStamp, createJsonlArchive, DEFAULT_PENDING_ARCHIVE_BUDGET_BYTES, resolveArchiveHome, verifyArchive, type ArchiveHome, type ArchiveSegment, type ArchiveSink, type JsonlArchiveOptions, } from "./archive";
-export { ARCHIVING_RETENTION_CATEGORIES, assertRetentionDeclaration, categoryArchivesBeforeDelete, cutoffFor, DAY_MS, FLEET_DEFAULT_RETENTION_DAYS, RETENTION_CATEGORIES, RETENTION_CATEGORY_KEYS, RETENTION_MAX_DAYS, RETENTION_MIN_DAYS, resolveRetentionPolicy, retentionKey, type EffectiveRetentionPolicy, type RetentionPolicy, type RetentionCategory, type RetentionDeclaration, type RetentionFieldSource, type RetentionOverride, type RetentionUnit, } from "./policy";
-export { publishRetention, readRetentionOverrides, readRetentionRegistry, resolveRetentionHome, setRetentionHomeForTests, writeRetentionOverride, type PublishedResource, type RetentionMeasurement, type RetentionOverridesFile, type RetentionPublication, type RetentionSweepReport, } from "./store";
-export { createArchivingSqliteTableTarget, createFileDirTarget, createSqliteTableTarget, type ArchivingSqliteTableTargetOptions, type FileDirTargetOptions, type RetentionPreview, type RetentionTarget, type SqliteTableTargetOptions, } from "./target";
-export { createRetentionSweeper, DEFAULT_SWEEP_INTERVAL_MS, OVERRIDES_PULSE_MS, type CreateRetentionSweeperOptions, type ResourceOutcome, type RetentionRunReport, type RetentionSweeper, } from "./sweeper";
-export { buildRetentionFleetView, type RetentionFleetRow, type RetentionFleetView } from "./fleet";
+export { archiveStamp, createJsonlArchive, DEFAULT_PENDING_ARCHIVE_BUDGET_BYTES, resolveArchiveHome, verifyArchive, type ArchiveHome, type ArchiveSegment, type ArchiveSink, type JsonlArchiveOptions, } from "./archive.js";
+export { ARCHIVING_RETENTION_CATEGORIES, assertRetentionDeclaration, categoryArchivesBeforeDelete, cutoffFor, DAY_MS, FLEET_DEFAULT_RETENTION_DAYS, RETENTION_CATEGORIES, RETENTION_CATEGORY_KEYS, RETENTION_MAX_DAYS, RETENTION_MIN_DAYS, resolveRetentionPolicy, retentionKey, type EffectiveRetentionPolicy, type RetentionPolicy, type RetentionCategory, type RetentionDeclaration, type RetentionFieldSource, type RetentionOverride, type RetentionUnit, } from "./policy.js";
+export { publishRetention, readRetentionOverrides, readRetentionRegistry, resolveRetentionHome, setRetentionHomeForTests, writeRetentionOverride, type PublishedResource, type RetentionMeasurement, type RetentionOverridesFile, type RetentionPublication, type RetentionSweepReport, } from "./store.js";
+export { createArchivingSqliteTableTarget, createFileDirTarget, createSqliteTableTarget, type ArchivingSqliteTableTargetOptions, type FileDirTargetOptions, type RetentionPreview, type RetentionTarget, type SqliteTableTargetOptions, } from "./target.js";
+export { createRetentionSweeper, DEFAULT_SWEEP_INTERVAL_MS, OVERRIDES_PULSE_MS, type CreateRetentionSweeperOptions, type ResourceOutcome, type RetentionRunReport, type RetentionSweeper, } from "./sweeper.js";
+export { buildRetentionFleetView, type RetentionFleetRow, type RetentionFleetView } from "./fleet.js";

package/dist/server/retention/index.js

@@ -30,9 +30,9 @@
  * the owner would miss (which is exactly why billing evidence is NOT a category
  * and lives in `retentionPolicy.ts` instead).
  */
-export { archiveStamp, createJsonlArchive, DEFAULT_PENDING_ARCHIVE_BUDGET_BYTES, resolveArchiveHome, verifyArchive, } from "./archive";
-export { ARCHIVING_RETENTION_CATEGORIES, assertRetentionDeclaration, categoryArchivesBeforeDelete, cutoffFor, DAY_MS, FLEET_DEFAULT_RETENTION_DAYS, RETENTION_CATEGORIES, RETENTION_CATEGORY_KEYS, RETENTION_MAX_DAYS, RETENTION_MIN_DAYS, resolveRetentionPolicy, retentionKey, } from "./policy";
-export { publishRetention, readRetentionOverrides, readRetentionRegistry, resolveRetentionHome, setRetentionHomeForTests, writeRetentionOverride, } from "./store";
-export { createArchivingSqliteTableTarget, createFileDirTarget, createSqliteTableTarget, } from "./target";
-export { createRetentionSweeper, DEFAULT_SWEEP_INTERVAL_MS, OVERRIDES_PULSE_MS, } from "./sweeper";
-export { buildRetentionFleetView } from "./fleet";
+export { archiveStamp, createJsonlArchive, DEFAULT_PENDING_ARCHIVE_BUDGET_BYTES, resolveArchiveHome, verifyArchive, } from "./archive.js";
+export { ARCHIVING_RETENTION_CATEGORIES, assertRetentionDeclaration, categoryArchivesBeforeDelete, cutoffFor, DAY_MS, FLEET_DEFAULT_RETENTION_DAYS, RETENTION_CATEGORIES, RETENTION_CATEGORY_KEYS, RETENTION_MAX_DAYS, RETENTION_MIN_DAYS, resolveRetentionPolicy, retentionKey, } from "./policy.js";
+export { publishRetention, readRetentionOverrides, readRetentionRegistry, resolveRetentionHome, setRetentionHomeForTests, writeRetentionOverride, } from "./store.js";
+export { createArchivingSqliteTableTarget, createFileDirTarget, createSqliteTableTarget, } from "./target.js";
+export { createRetentionSweeper, DEFAULT_SWEEP_INTERVAL_MS, OVERRIDES_PULSE_MS, } from "./sweeper.js";
+export { buildRetentionFleetView } from "./fleet.js";

package/dist/server/retention/store.d.ts

@@ -1,4 +1,4 @@
-import type { RetentionDeclaration, RetentionOverride } from "./policy";
+import type { RetentionDeclaration, RetentionOverride } from "./policy.js";
 /** What one sweep of one resource did. Published so the UI can show it. */
 export interface RetentionSweepReport {
     at: number;

package/dist/server/retention/store.js

@@ -46,8 +46,8 @@
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
-import { APP_DATA_HOME_ENV, resolveAppDataHome } from "../paths/appDataHome";
-import { retentionKey } from "./policy";
+import { APP_DATA_HOME_ENV, resolveAppDataHome } from "../paths/appDataHome.js";
+import { retentionKey } from "./policy.js";
 /**
  * A FUNCTION, not a shared constant. `writeRetentionOverride` mutates what
  * `readRetentionOverrides` hands it, so a module-level empty object would be

package/dist/server/retention/sweeper.d.ts

@@ -1,6 +1,6 @@
-import type { EffectiveRetentionPolicy } from "./policy";
-import type { RetentionSweepReport } from "./store";
-import type { RetentionTarget } from "./target";
+import type { EffectiveRetentionPolicy } from "./policy.js";
+import type { RetentionSweepReport } from "./store.js";
+import type { RetentionTarget } from "./target.js";
 /** Default cadence. Diagnostic data is not urgent; four sweeps a day is plenty. */
 export declare const DEFAULT_SWEEP_INTERVAL_MS: number;
 /** How often to notice an overrides edit. */

package/dist/server/retention/sweeper.js

@@ -19,8 +19,8 @@
  */
 import { statSync } from "node:fs";
 import { join } from "node:path";
-import { assertRetentionDeclaration, resolveRetentionPolicy, retentionKey } from "./policy";
-import { publishRetention, readRetentionOverrides, resolveRetentionHome } from "./store";
+import { assertRetentionDeclaration, resolveRetentionPolicy, retentionKey } from "./policy.js";
+import { publishRetention, readRetentionOverrides, resolveRetentionHome } from "./store.js";
 /** Default cadence. Diagnostic data is not urgent; four sweeps a day is plenty. */
 export const DEFAULT_SWEEP_INTERVAL_MS = 6 * 60 * 60 * 1000;
 /** How often to notice an overrides edit. */

package/dist/server/retention/target.d.ts

@@ -15,9 +15,9 @@
  * were correct on the day they were written.
  */
 import type { Database } from "bun:sqlite";
-import type { ArchiveSink } from "./archive";
-import type { EffectiveRetentionPolicy, RetentionDeclaration } from "./policy";
-import type { RetentionMeasurement, RetentionSweepReport } from "./store";
+import type { ArchiveSink } from "./archive.js";
+import type { EffectiveRetentionPolicy, RetentionDeclaration } from "./policy.js";
+import type { RetentionMeasurement, RetentionSweepReport } from "./store.js";
 export interface RetentionPreview {
     /** Items the age rule would remove. */
     aged: number;

package/dist/server/retention/target.js

@@ -1,7 +1,7 @@
 import { readdirSync, rmSync, statSync } from "node:fs";
 import { join } from "node:path";
-import { DEFAULT_PENDING_ARCHIVE_BUDGET_BYTES } from "./archive";
-import { categoryArchivesBeforeDelete, cutoffFor, retentionKey } from "./policy";
+import { DEFAULT_PENDING_ARCHIVE_BUDGET_BYTES } from "./archive.js";
+import { categoryArchivesBeforeDelete, cutoffFor, retentionKey } from "./policy.js";
 /**
  * Table and column names cannot be bound as parameters, so they are
  * interpolated — and therefore must be proven safe rather than trusted. Every

package/dist/server/search/index.d.ts

@@ -1,2 +1,2 @@
-export { createPgSearchProvider, type PgSearchProviderOptions } from './pgSearchProvider';
-export { ensureSaasSearchSchema, PG_RANK_WEIGHTS, PG_SEARCH_CHUNKS_DDL, PG_SEARCH_DDL, PG_SEARCH_DOCS_DDL, } from './pgSearchSchema';
+export { createPgSearchProvider, type PgSearchProviderOptions } from './pgSearchProvider.js';
+export { ensureSaasSearchSchema, PG_RANK_WEIGHTS, PG_SEARCH_CHUNKS_DDL, PG_SEARCH_DDL, PG_SEARCH_DOCS_DDL, } from './pgSearchSchema.js';