cursedbelt-server 4.12.0 → 4.13.0

package/dist/server/storage/s3ObjectStore.js

@@ -29,7 +29,7 @@
  * this module has no ambient authority and a test can hand it a fake client.
  */
 import { assertObjectKey } from 'cwip/storage';
-import { AppError } from '../errors';
+import { AppError } from '../errors.js';
 const DEFAULT_PART_SIZE = 8 * 1024 * 1024;
 const DEFAULT_EXPIRES_IN_SECONDS = 300;
 const MAX_EXPIRES_IN_SECONDS = 86_400;

package/dist/server/storage/sources.d.ts

@@ -1,6 +1,6 @@
 import type { ProcessingStatus } from 'cursedbelt-core/media';
-import type { StreamTokenService } from './streamToken';
-import { type MediaCtx, type MediaSource, type MediaStore } from './types';
+import type { StreamTokenService } from './streamToken.js';
+import { type MediaCtx, type MediaSource, type MediaStore } from './types.js';
 export interface MediaUrls {
     build(ctx: MediaCtx, sourceId: string, videoId: string): Promise<{
         streamUrl: string;

package/dist/server/storage/sources.js

@@ -1,5 +1,5 @@
-import { fsMp4Key, fsPosterKey, fsSourceKey, fsSpriteKey, fsVttKey, } from './types';
-import { processVideo } from './videoProcessor';
+import { fsMp4Key, fsPosterKey, fsSourceKey, fsSpriteKey, fsVttKey, } from './types.js';
+import { processVideo } from './videoProcessor.js';
 export function createMediaUrls(opts) {
     const ownerOf = opts.owner ?? ((c) => c.tenantId);
     // Trim a trailing slash so 'https://api…/_media/' and '/_media' behave identically.

package/dist/server/storage/streamRange.d.ts

@@ -1,4 +1,4 @@
-import type { MediaStore } from './types';
+import type { MediaStore } from './types.js';
 export type RangeDecision = {
     kind: 'full';
 } | {

package/dist/server/storage/streamToken.js

@@ -5,7 +5,7 @@
 // to install a one-time-password library for code it never calls. Import the leaf module that
 // has what you need; never the index that has everything. `src/leafSubpathsImportNothing.spec.ts`
 // fails if this file (or anything else the storage barrel reaches) undoes it.
-import { signToken, verifyPurposeToken } from '../auth/jwt';
+import { signToken, verifyPurposeToken } from '../auth/jwt.js';
 // ── Stream tokens ───────────────────────────────────────────────────────────────
 // Media bytes are loaded by <video>/hls.js/<img>, which cannot send the platform Bearer
 // header an app's auth uses. So byte-serving routes live OUTSIDE the guarded API and

package/dist/server/storage/videoProcessor.d.ts

@@ -1,5 +1,5 @@
 import type { ProcessingStatus } from 'cursedbelt-core/media';
-import { type MediaStore } from './types';
+import { type MediaStore } from './types.js';
 export type ProcessProgress = (status: ProcessingStatus, pct: number) => void;
 export type ProcessResult = {
     status: ProcessingStatus;

package/dist/server/storage/videoProcessor.js

@@ -1,7 +1,7 @@
 import { mkdir, readdir, rm } from 'node:fs/promises';
 import path from 'node:path';
-import { buildSpriteVtt, canStreamCopy, faststartArgs, hlsLadderArgs, isFfmpegAvailable, LIBRARY_CRF, planSprite, posterArgs, probeVideoStream, resolveLadder, runFfmpegProgress, spriteArgs, } from '../media-bun';
-import { fsHlsFileKey, fsHlsMasterKey, fsMp4Key, fsPosterKey, fsSpriteKey, fsVttKey, } from './types';
+import { buildSpriteVtt, canStreamCopy, faststartArgs, hlsLadderArgs, isFfmpegAvailable, LIBRARY_CRF, planSprite, posterArgs, probeVideoStream, resolveLadder, runFfmpegProgress, spriteArgs, } from '../media-bun/index.js';
+import { fsHlsFileKey, fsHlsMasterKey, fsMp4Key, fsPosterKey, fsSpriteKey, fsVttKey, } from './types.js';
 // Stream a produced local file into the store under `key` (no full heap copy).
 async function uploadFile(store, localPath, key, mime) {
     const file = Bun.file(localPath);

package/dist/server/sync/engine.d.ts

@@ -13,8 +13,8 @@
  * instead of wedging with an error that reads like corruption. Nothing is dropped —
  * the moment the peer is upgraded, the next push resumes from exactly that op.
  */
-import type { OpLog } from "./opLog";
-import { type ApplyContext, type ApplyOne, type ApplyReport, type PeerInfo, type RemoteApi, type SyncOp, type SyncSummary } from "./types";
+import type { OpLog } from "./opLog.js";
+import { type ApplyContext, type ApplyOne, type ApplyReport, type PeerInfo, type RemoteApi, type SyncOp, type SyncSummary } from "./types.js";
 /** Kit-owned dedupe + ledger insert around the app's per-op merge logic. Everything
  *  for one op happens in one transaction: state change AND ledger insert, so a crash
  *  can never apply without recording (double-apply) or record without applying

package/dist/server/sync/engine.js

@@ -1,4 +1,4 @@
-import { StopBatch, } from "./types";
+import { StopBatch, } from "./types.js";
 const BATCH = 500;
 /** Kit-owned dedupe + ledger insert around the app's per-op merge logic. Everything
  *  for one op happens in one transaction: state change AND ledger insert, so a crash

package/dist/server/sync/http.d.ts

@@ -9,9 +9,9 @@
  * probe.
  */
 import { Hono } from "hono";
-import type { OpLog } from "./opLog";
-import type { ApplyOne, ApplyReport, RemoteApi } from "./types";
-import { type SyncSignalHub } from "./signal";
+import type { OpLog } from "./opLog.js";
+import type { ApplyOne, ApplyReport, RemoteApi } from "./types.js";
+import { type SyncSignalHub } from "./signal.js";
 /**
  * Trim a page to the byte budget, keeping it a PREFIX so `cursor` stays the seq
  * of the last op actually returned. Anything else silently drops ops: the caller
@@ -74,7 +74,7 @@ export interface ReceiverOptions {
  * served a single integer — "was Sync now pressed here?" — and existed only to be
  * asked, every 20 seconds, by a dialer that otherwise had nothing to say. That made
  * it **68 % of `vault`'s entire traffic**. A receiver with news now says so over
- * {@link import("./signal")} instead of waiting to be asked; deleting the route is
+ * {@link import("./signal.js")} instead of waiting to be asked; deleting the route is
  * what stops a stale consumer from keeping the poll alive against a new build.
  */
 export declare function createSyncReceiver(options: ReceiverOptions): Hono;

package/dist/server/sync/http.js

@@ -9,8 +9,8 @@
  * probe.
  */
 import { Hono } from "hono";
-import { createSyncApplier } from "./engine";
-import { signalResponse } from "./signal";
+import { createSyncApplier } from "./engine.js";
+import { signalResponse } from "./signal.js";
 const noStore = { "cache-control": "no-store" };
 const SYNC_PAGE = 500;
 /**
@@ -60,7 +60,7 @@ function peerIdOf(header, query) {
  * served a single integer — "was Sync now pressed here?" — and existed only to be
  * asked, every 20 seconds, by a dialer that otherwise had nothing to say. That made
  * it **68 % of `vault`'s entire traffic**. A receiver with news now says so over
- * {@link import("./signal")} instead of waiting to be asked; deleting the route is
+ * {@link import("./signal.js")} instead of waiting to be asked; deleting the route is
  * what stops a stale consumer from keeping the poll alive against a new build.
  */
 export function createSyncReceiver(options) {

package/dist/server/sync/index.d.ts

@@ -29,14 +29,14 @@
  * `bun:sqlite` and `node:crypto` only resolve on this side of the split. The
  * directory decides the types; the `exports` key decides the spelling.
  */
-export { StopBatch, type ApplyContext, type ApplyOne, type ApplyReport, type PeerInfo, type RemoteApi, type SyncOp, type SyncSummary, } from "./types";
-export { createOpLog, type OpLog } from "./opLog";
-export { createTokenStore, type DeviceToken, type TokenStore } from "./tokens";
-export { createSyncApplier, pushToRemote, pullFromRemote, runSync, type EngineOptions, type ExportPolicy, type PeerRefusal, } from "./engine";
-export { capPageBytes, createHttpRemote, createSyncReceiver, type ReceiverHooks, type ReceiverOptions, } from "./http";
-export { DEFAULT_LOOP, isUnreachable, planNextSync, type SyncLoopConfig, type SyncLoopState, type SyncPlan, } from "./planner";
-export { SIGNAL_SSE_HEADERS, connectSyncSignal, createSyncSignalHub, encodeNewsFrame, parseNewsFrame, signalResponse, signalStream, type SignalClient, type SignalClientOptions, type SignalStreamOptions, type SyncNews, type SyncSignalHub, } from "./signal";
-export { OFFLINE_STATUS, PEER_CONTACT_WRITE_MS, createSyncStatusReporter, type SyncStatus, type SyncStatusReporter, type SyncStatusStore, } from "./status";
+export { StopBatch, type ApplyContext, type ApplyOne, type ApplyReport, type PeerInfo, type RemoteApi, type SyncOp, type SyncSummary, } from "./types.js";
+export { createOpLog, type OpLog } from "./opLog.js";
+export { createTokenStore, type DeviceToken, type TokenStore } from "./tokens.js";
+export { createSyncApplier, pushToRemote, pullFromRemote, runSync, type EngineOptions, type ExportPolicy, type PeerRefusal, } from "./engine.js";
+export { capPageBytes, createHttpRemote, createSyncReceiver, type ReceiverHooks, type ReceiverOptions, } from "./http.js";
+export { DEFAULT_LOOP, isUnreachable, planNextSync, type SyncLoopConfig, type SyncLoopState, type SyncPlan, } from "./planner.js";
+export { SIGNAL_SSE_HEADERS, connectSyncSignal, createSyncSignalHub, encodeNewsFrame, parseNewsFrame, signalResponse, signalStream, type SignalClient, type SignalClientOptions, type SignalStreamOptions, type SyncNews, type SyncSignalHub, } from "./signal.js";
+export { OFFLINE_STATUS, PEER_CONTACT_WRITE_MS, createSyncStatusReporter, type SyncStatus, type SyncStatusReporter, type SyncStatusStore, } from "./status.js";
 /**
  * 🔴 `REQUEST_POLL_MS` was exported from here until 2026-09-15 and is GONE — that
  * removal is why this package went to 2.0.0. It was a 20-second dial at a configured
@@ -44,6 +44,6 @@ export { OFFLINE_STATUS, PEER_CONTACT_WRITE_MS, createSyncStatusReporter, type S
  * deleting it would have been a breaking change rather than an edit. `./timer`'s
  * header has the ruling and the measurement; `./signal` is what replaced it.
  */
-export { startSyncTimer, type SyncTimerDeps, type SyncTimerHandle, type WakeReason } from "./timer";
-export { createSyncAlarm, type AlarmOutcome, type SyncAlarm, type SyncAlarmOptions } from "./alarm";
-export { DEFAULT_HOLD_MS, createCommandQueue, createCommandReceiver, createCommandRemote, startCommandWorker, type CommandQueue, type CommandRemote, type CommandRoutesOptions, type CommandStatus, type CommandWorkerDeps, type CommandWorkerHandle, type SyncCommand, } from "./commands";
+export { startSyncTimer, type SyncTimerDeps, type SyncTimerHandle, type WakeReason } from "./timer.js";
+export { createSyncAlarm, type AlarmOutcome, type SyncAlarm, type SyncAlarmOptions } from "./alarm.js";
+export { DEFAULT_HOLD_MS, createCommandQueue, createCommandReceiver, createCommandRemote, startCommandWorker, type CommandQueue, type CommandRemote, type CommandRoutesOptions, type CommandStatus, type CommandWorkerDeps, type CommandWorkerHandle, type SyncCommand, } from "./commands.js";

package/dist/server/sync/index.js

@@ -29,14 +29,14 @@
  * `bun:sqlite` and `node:crypto` only resolve on this side of the split. The
  * directory decides the types; the `exports` key decides the spelling.
  */
-export { StopBatch, } from "./types";
-export { createOpLog } from "./opLog";
-export { createTokenStore } from "./tokens";
-export { createSyncApplier, pushToRemote, pullFromRemote, runSync, } from "./engine";
-export { capPageBytes, createHttpRemote, createSyncReceiver, } from "./http";
-export { DEFAULT_LOOP, isUnreachable, planNextSync, } from "./planner";
-export { SIGNAL_SSE_HEADERS, connectSyncSignal, createSyncSignalHub, encodeNewsFrame, parseNewsFrame, signalResponse, signalStream, } from "./signal";
-export { OFFLINE_STATUS, PEER_CONTACT_WRITE_MS, createSyncStatusReporter, } from "./status";
+export { StopBatch, } from "./types.js";
+export { createOpLog } from "./opLog.js";
+export { createTokenStore } from "./tokens.js";
+export { createSyncApplier, pushToRemote, pullFromRemote, runSync, } from "./engine.js";
+export { capPageBytes, createHttpRemote, createSyncReceiver, } from "./http.js";
+export { DEFAULT_LOOP, isUnreachable, planNextSync, } from "./planner.js";
+export { SIGNAL_SSE_HEADERS, connectSyncSignal, createSyncSignalHub, encodeNewsFrame, parseNewsFrame, signalResponse, signalStream, } from "./signal.js";
+export { OFFLINE_STATUS, PEER_CONTACT_WRITE_MS, createSyncStatusReporter, } from "./status.js";
 /**
  * 🔴 `REQUEST_POLL_MS` was exported from here until 2026-09-15 and is GONE — that
  * removal is why this package went to 2.0.0. It was a 20-second dial at a configured
@@ -44,6 +44,6 @@ export { OFFLINE_STATUS, PEER_CONTACT_WRITE_MS, createSyncStatusReporter, } from
  * deleting it would have been a breaking change rather than an edit. `./timer`'s
  * header has the ruling and the measurement; `./signal` is what replaced it.
  */
-export { startSyncTimer } from "./timer";
-export { createSyncAlarm } from "./alarm";
-export { DEFAULT_HOLD_MS, createCommandQueue, createCommandReceiver, createCommandRemote, startCommandWorker, } from "./commands";
+export { startSyncTimer } from "./timer.js";
+export { createSyncAlarm } from "./alarm.js";
+export { DEFAULT_HOLD_MS, createCommandQueue, createCommandReceiver, createCommandRemote, startCommandWorker, } from "./commands.js";

package/dist/server/sync/opLog.d.ts

@@ -9,7 +9,7 @@
  * stream every peer pages over.
  */
 import type { Database } from "bun:sqlite";
-import type { SyncOp } from "./types";
+import type { SyncOp } from "./types.js";
 export interface OpLog {
     /** This instance's stable id (minted once, persisted in sync_meta). */
     instanceId(): string;

package/dist/server/sync/signal.d.ts

@@ -117,7 +117,7 @@ export interface SignalClientOptions {
     /** This instance's id, echoed as `x-sync-peer` so the far side can label us. */
     selfId: string;
     /**
-     * The peer has news. Wire this to {@link import("./timer").SyncTimerHandle.syncNow}
+     * The peer has news. Wire this to {@link import("./timer.js").SyncTimerHandle.syncNow}
      * — the whole point is that a reconciliation now happens for a REASON.
      */
     onNews: (news: SyncNews) => void;

package/dist/server/sync/timer.d.ts

@@ -41,9 +41,9 @@
  * `syncNow()` / `markDirty()` rather than by a timer that was watching for it —
  * call `syncNow()` after a link and it is immediate.
  */
-import { type SyncLoopConfig } from "./planner";
-import type { SyncStatusReporter } from "./status";
-import type { SyncSummary } from "./types";
+import { type SyncLoopConfig } from "./planner.js";
+import type { SyncStatusReporter } from "./status.js";
+import type { SyncSummary } from "./types.js";
 /**
  * 🔴 Every reason this loop is allowed to wake up. There is deliberately no
  * `"interval"` / `"poll"` member, and adding one is the change this whole file

package/dist/server/sync/timer.js

@@ -41,7 +41,7 @@
  * `syncNow()` / `markDirty()` rather than by a timer that was watching for it —
  * call `syncNow()` after a link and it is immediate.
  */
-import { isUnreachable, DEFAULT_LOOP, planNextSync, } from "./planner";
+import { isUnreachable, DEFAULT_LOOP, planNextSync, } from "./planner.js";
 /**
  * One reconciliation shortly after start: catch up on whatever happened while this
  * process was down. A single shot at boot, not a cadence — the same catch-up a push

package/dist/server/ws/eventBus.d.ts

@@ -1,4 +1,4 @@
-import type { EventBus } from './types';
+import type { EventBus } from './types.js';
 /**
  * The push-only subset ru uses: broadcast-to-all, no auth, no inbound routing. ru
  * mounts one bus and pushes from its task queue / caSync / Forge workers

package/dist/server/ws/hub.d.ts

@@ -1,4 +1,4 @@
-import type { WsChannel, WsClient, WsHub, WsHubOpts } from './types';
+import type { WsChannel, WsClient, WsHub, WsHubOpts } from './types.js';
 /**
  * The heartbeat sweep, factored out as a pure function so it's testable without faking
  * timers: ping every live client, close (don't delete — let the `close` handler fire

package/dist/server/ws/hub.js

@@ -1,6 +1,6 @@
-import { ApiError, toErrorEnvelope } from '../errors';
-import { computePresence } from './presence';
-import { joinRoom, ROOM_META_KEY } from './room';
+import { ApiError, toErrorEnvelope } from '../errors.js';
+import { computePresence } from './presence.js';
+import { joinRoom, ROOM_META_KEY } from './room.js';
 const DEFAULT_HEARTBEAT_MS = 30_000;
 const DEFAULT_STALE_MS = 120_000;
 /** Bun's `idleTimeout` ceiling (seconds). */

package/dist/server/ws/index.d.ts

@@ -1,5 +1,5 @@
-export { createEventBus } from './eventBus';
-export { createWsHub } from './hub';
-export { computePresence } from './presence';
-export { joinRoom, leaveRoom, ROOM_META_KEY, roomOf } from './room';
-export type { EventBus, EventBusData, PresenceEntry, PresenceState, WsChannel, WsClient, WsData, WsHandshake, WsHub, WsHubOpts, WsMessage, } from './types';
+export { createEventBus } from './eventBus.js';
+export { createWsHub } from './hub.js';
+export { computePresence } from './presence.js';
+export { joinRoom, leaveRoom, ROOM_META_KEY, roomOf } from './room.js';
+export type { EventBus, EventBusData, PresenceEntry, PresenceState, WsChannel, WsClient, WsData, WsHandshake, WsHub, WsHubOpts, WsMessage, } from './types.js';

package/dist/server/ws/index.js

@@ -1,7 +1,7 @@
 // cursedbelt-server WS hub — Bun-native upgrade, typed channel registry, heartbeat,
 // presence-as-a-view, and the push-only event-bus subset. Pairs with the partysocket
 // client in `cursedbelt/client`.
-export { createEventBus } from './eventBus';
-export { createWsHub } from './hub';
-export { computePresence } from './presence';
-export { joinRoom, leaveRoom, ROOM_META_KEY, roomOf } from './room';
+export { createEventBus } from './eventBus.js';
+export { createWsHub } from './hub.js';
+export { computePresence } from './presence.js';
+export { joinRoom, leaveRoom, ROOM_META_KEY, roomOf } from './room.js';

package/dist/server/ws/presence.d.ts

@@ -1,4 +1,4 @@
-import type { PresenceState, WsClient } from './types';
+import type { PresenceState, WsClient } from './types.js';
 /**
  * Presence is a *view* over the live client map, not a tracked structure — there is no
  * `PresenceTracker` class to keep in sync. The hub's `getPresence(channel)` delegates

package/dist/server/ws/room.d.ts

@@ -1,4 +1,4 @@
-import type { WsClient } from './types';
+import type { WsClient } from './types.js';
 /**
  * Rooms are not a separate stateful abstraction — they are a typed convention over
  * {@link WsClient.meta}. A channel puts a client in a room with {@link joinRoom}; the

package/dist/server/ws/types.d.ts

@@ -1,6 +1,6 @@
 import type { ServerWebSocket, WebSocketHandler } from 'bun';
 import type { MiddlewareHandler } from 'hono';
-import type { AuthUser } from '../auth/types';
+import type { AuthUser } from '../auth/types.js';
 /**
  * Shared types for the cursedbelt WebSocket hub.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.12.0",
+	"version": "4.13.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -34,7 +34,7 @@
 			"types": "./dist/server/index.d.ts",
 			"bun": "./src/server/index.ts",
 			"source": "./src/server/index.ts",
-			"import": "./dist/server/index.js"
+			"import": "./dist/server/_bunOnly.js"
 		},
 		"./activity": {
 			"types": "./dist/server/activity/index.d.ts",
@@ -88,7 +88,7 @@
 			"types": "./dist/server/d1/localBackup.d.ts",
 			"bun": "./src/server/d1/localBackup.ts",
 			"source": "./src/server/d1/localBackup.ts",
-			"import": "./dist/server/d1/localBackup.js"
+			"import": "./dist/server/_bunOnly.js"
 		},
 		"./d1/kysely": {
 			"types": "./dist/server/d1/kysely.d.ts",
@@ -118,13 +118,13 @@
 			"types": "./dist/server/guard/index.d.ts",
 			"bun": "./src/server/guard/index.ts",
 			"source": "./src/server/guard/index.ts",
-			"import": "./dist/server/guard/index.js"
+			"import": "./dist/server/_bunOnly.js"
 		},
 		"./guard/revocations": {
 			"types": "./dist/server/guard/revocationStore.d.ts",
 			"bun": "./src/server/guard/revocationStore.ts",
 			"source": "./src/server/guard/revocationStore.ts",
-			"import": "./dist/server/guard/revocationStore.js"
+			"import": "./dist/server/_bunOnly.js"
 		},
 		"./incidents": {
 			"types": "./dist/server/incidents/index.d.ts",
@@ -160,7 +160,7 @@
 			"types": "./dist/server/middleware/index.d.ts",
 			"bun": "./src/server/middleware/index.ts",
 			"source": "./src/server/middleware/index.ts",
-			"import": "./dist/server/middleware/index.js"
+			"import": "./dist/server/_bunOnly.js"
 		},
 		"./migration": {
 			"types": "./dist/server/migration/runner.d.ts",
@@ -208,7 +208,7 @@
 			"types": "./dist/server/sqlite/index.d.ts",
 			"bun": "./src/server/sqlite/index.ts",
 			"source": "./src/server/sqlite/index.ts",
-			"import": "./dist/server/sqlite/index.js"
+			"import": "./dist/server/_bunOnly.js"
 		},
 		"./storage": {
 			"types": "./dist/server/storage/index.d.ts",
@@ -236,8 +236,8 @@
 		}
 	},
 	"dependencies": {
-		"cursedbelt-core": "^2.0.0",
-		"cwip": "^4.1.0",
+		"cursedbelt-core": "^2.1.1",
+		"cwip": "^4.6.0",
 		"jose": "^6.2.3"
 	},
 	"peerDependencies": {

package/src/publicSurface.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'bun:test';
-import { run } from '../scripts/publicSurface';
+import { run } from '../scripts/publicSurface.js';
 
 /**
  * The public-surface ratchet, wired into `bun run verify` at its cheapest correct

package/src/server/_bunOnly.ts

@@ -0,0 +1,15 @@
+// Loaded only on non-Bun runtimes. Six export subpaths of this package — the root barrel,
+// `./guard`, `./guard/revocations`, `./sqlite`, `./middleware` and `./d1/backup-local` — are
+// Bun-only by construction: they reach `bun:sqlite` or the `Bun` global. Their export map routes
+// Bun (the "bun" condition) to the real module and everything else here, so importing one under
+// Node fails with THIS sentence instead of `ERR_UNSUPPORTED_ESM_URL_SCHEME … 'bun:'` from deep
+// inside the graph (measured by tools/proveInstall.ts, 2026-09-22). Same shape as `cwip/testing`.
+//
+// A Worker is served by the non-Bun subpaths (`./d1`, `./body-limit`, `./storage`, …), which
+// load anywhere; none of the six is in any Worker bundle this generation builds.
+throw new Error(
+  'This cursedbelt-server entry requires the Bun runtime — it reaches `bun:sqlite` or the `Bun` global. ' +
+    'Under Node or in a Worker, import a portable subpath instead (`cursedbelt-server/d1`, `/body-limit`, `/storage`, …).',
+);
+
+export {};

package/src/server/activity/index.ts

@@ -28,9 +28,9 @@
  * by category, and an audit trail of production deletions is precisely the data
  * a 14-day cutoff must not reach.
  */
-export { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations";
-export { shareEventsSource, type ShareEventsSourceOptions } from "./shareSource";
-export { createActivityLog } from "./store";
+export { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations.js";
+export { shareEventsSource, type ShareEventsSourceOptions } from "./shareSource.js";
+export { createActivityLog } from "./store.js";
 export type {
 	ActivityFacet,
 	ActivityFacets,
@@ -39,7 +39,7 @@ export type {
 	ActivityPage,
 	ActivityQuery,
 	ActivitySource,
-} from "./store";
+} from "./store.js";
 // Re-exported so a server consumer needs ONE import for the whole contract; the
 // pure entry (`cursedbelt-core/activity`) stays available for a browser or a spec.
 export {

package/src/server/activity/migrations.ts

@@ -1,5 +1,5 @@
 import type { Database } from "bun:sqlite";
-import type { Migration } from "../migration/types";
+import type { Migration } from "../migration/types.js";
 
 /** The one table this primitive owns. Exported so an app can declare a retention
  *  target over it (see this module's `index.ts` for the recipe). */

package/src/server/activity/shareSource.ts

@@ -25,8 +25,8 @@
  * fleet-wide board merges on that column and an unlabeled row would be
  * unattributable.
  */
-import { SHARE_EVENTS_TABLE } from "../sharing/migrations";
-import type { ActivitySource } from "./store";
+import { SHARE_EVENTS_TABLE } from "../sharing/migrations.js";
+import type { ActivitySource } from "./store.js";
 
 export interface ShareEventsSourceOptions {
 	/** The satellite this log speaks for — the same value passed to

package/src/server/activity/store.spec.ts

@@ -15,9 +15,9 @@
 import { Database } from "bun:sqlite";
 import { describe, expect, test } from "bun:test";
 import { activityFromShareEvent } from "cursedbelt-core/activity/model";
-import { createShareStore, user } from "../sharing/store";
-import { shareEventsSource } from "./shareSource";
-import { createActivityLog } from "./store";
+import { createShareStore, user } from "../sharing/store.js";
+import { shareEventsSource } from "./shareSource.js";
+import { createActivityLog } from "./store.js";
 
 const open = (): Database => new Database(":memory:");
 

package/src/server/activity/store.ts

@@ -41,8 +41,8 @@ import {
 	isActivityAction,
 	isActivityOutcome,
 } from "cursedbelt-core/activity/model";
-import { runMigrations } from "../migration/runner";
-import { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations";
+import { runMigrations } from "../migration/runner.js";
+import { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations.js";
 
 /**
  * A read-only stream contributor: a SELECT projecting some other table into the

package/src/server/analytics/index.ts

@@ -18,7 +18,7 @@ export {
 	type InjectedScript,
 	foreignScriptSources,
 	scriptsRefusedByCsp,
-} from "./injectedScripts";
+} from "./injectedScripts.js";
 export {
 	WEB_ANALYTICS_BEACON_ORIGIN,
 	WEB_ANALYTICS_BEACON_SRC,
@@ -29,4 +29,4 @@ export {
 	htmlCarriesWebAnalytics,
 	webAnalyticsBootstrap,
 	webAnalyticsTag,
-} from "./webAnalytics";
+} from "./webAnalytics.js";

package/src/server/analytics/injectedScripts.spec.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "bun:test";
-import { foreignScriptSources, scriptsRefusedByCsp } from "./injectedScripts";
-import { MASTER_LOCK_CSP } from "../master-lock/guard";
-import { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_TAG } from "./webAnalytics";
+import { foreignScriptSources, scriptsRefusedByCsp } from "./injectedScripts.js";
+import { MASTER_LOCK_CSP } from "../master-lock/guard.js";
+import { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_TAG } from "./webAnalytics.js";
 
 const PAGE = "https://collections.cursedalchemy.com/";
 

package/src/server/analytics/webAnalytics.spec.ts

@@ -11,7 +11,7 @@ import {
 	webAnalyticsBeaconConfig,
 	webAnalyticsBootstrap,
 	webAnalyticsTag,
-} from "./webAnalytics";
+} from "./webAnalytics.js";
 
 /**
  * 🔴 The snippet, as Cloudflare's own `GET /accounts/<acct>/rum/site_info/list` returned it on

package/src/server/app.spec.ts

@@ -1,15 +1,15 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, describe, expect, test } from 'bun:test';
 import { Hono } from 'hono';
-import { createApp, serveBun } from './app';
-import type { CursedbeltEnv } from './context';
-import { ApiError } from './errors';
-import { createMetricsBuffer } from './metrics/metricsBuffer';
-import { correlationId } from './middleware/correlationId';
-import { errorEnvelope } from './middleware/errorEnvelope';
-import { createRateLimiter } from './middleware/rateLimit';
-import { requestLogger } from './middleware/requestLogger';
-import { securityHeaders } from './middleware/securityHeaders';
+import { createApp, serveBun } from './app.js';
+import type { CursedbeltEnv } from './context.js';
+import { ApiError } from './errors.js';
+import { createMetricsBuffer } from './metrics/metricsBuffer.js';
+import { correlationId } from './middleware/correlationId.js';
+import { errorEnvelope } from './middleware/errorEnvelope.js';
+import { createRateLimiter } from './middleware/rateLimit.js';
+import { requestLogger } from './middleware/requestLogger.js';
+import { securityHeaders } from './middleware/securityHeaders.js';
 
 const REQ = (path: string, init?: RequestInit) => new Request(`http://localhost${path}`, init);
 

package/src/server/app.ts

@@ -1,13 +1,13 @@
 import type { Database } from 'bun:sqlite';
 import type { Server, TLSOptions, WebSocketHandler } from 'bun';
 import { Hono } from 'hono';
-import type { CursedbeltEnv } from './context';
-import { correlationId } from './middleware/correlationId';
-import { type CorsOpts, corsAllowlist } from './middleware/corsAllowlist';
-import { errorEnvelope } from './middleware/errorEnvelope';
-import { createRateLimiter, type RateLimitOpts } from './middleware/rateLimit';
-import { requestLogger } from './middleware/requestLogger';
-import { type SecurityHeadersOpts, securityHeaders } from './middleware/securityHeaders';
+import type { CursedbeltEnv } from './context.js';
+import { correlationId } from './middleware/correlationId.js';
+import { type CorsOpts, corsAllowlist } from './middleware/corsAllowlist.js';
+import { errorEnvelope } from './middleware/errorEnvelope.js';
+import { createRateLimiter, type RateLimitOpts } from './middleware/rateLimit.js';
+import { requestLogger } from './middleware/requestLogger.js';
+import { type SecurityHeadersOpts, securityHeaders } from './middleware/securityHeaders.js';
 
 export interface CreateAppOpts {
   /** When provided, the request logger writes metrics/events to this DB. */

package/src/server/audit/index.ts

@@ -1,2 +1,2 @@
-export { AUDIT_LOG_MIGRATIONS } from './migrations';
-export { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink';
+export { AUDIT_LOG_MIGRATIONS } from './migrations.js';
+export { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink.js';

package/src/server/audit/migrations.ts

@@ -1,5 +1,5 @@
 import type { Database } from 'bun:sqlite';
-import type { Migration } from '../migration/types';
+import type { Migration } from '../migration/types.js';
 
 // ONE shared append-only table backs every namespace's audit trail — not a
 // shadow table per business table. cursedshell's `defineService` mutations

package/src/server/audit/sqliteSink.test.ts

@@ -1,6 +1,6 @@
 import { Database } from 'bun:sqlite';
 import { beforeEach, describe, expect, it } from 'bun:test';
-import { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink';
+import { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink.js';
 
 let db: Database;
 

package/src/server/audit/sqliteSink.ts

@@ -1,7 +1,7 @@
 import type { Database } from 'bun:sqlite';
 import type { AuditEntryInput, AuditOperation, AuditRecord } from 'cwip/audit';
-import { runMigrations } from '../migration/runner';
-import { AUDIT_LOG_MIGRATIONS } from './migrations';
+import { runMigrations } from '../migration/runner.js';
+import { AUDIT_LOG_MIGRATIONS } from './migrations.js';
 
 interface AuditLogRow {
   namespace: string;

package/src/server/auth/cookie.spec.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test';
 import { Hono } from 'hono';
-import { AUTH_COOKIE_NAME, clearAuthCookie, readAuthCookie, writeAuthCookie } from './cookie';
+import { AUTH_COOKIE_NAME, clearAuthCookie, readAuthCookie, writeAuthCookie } from './cookie.js';
 
 const REQ = (path: string, init?: RequestInit) => new Request(`http://localhost${path}`, init);