cursedbelt-server 4.12.0 → 4.13.0

package/src/server/auth/csrf.spec.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test';
 import { Hono } from 'hono';
-import { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createCsrfMiddleware } from './csrf';
+import { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createCsrfMiddleware } from './csrf.js';
 
 const REQ = (path: string, init?: RequestInit) => new Request(`http://localhost${path}`, init);
 

package/src/server/auth/csrf.ts

@@ -1,6 +1,6 @@
 import type { MiddlewareHandler } from 'hono';
 import { getCookie, setCookie } from 'hono/cookie';
-import { ApiError, toErrorEnvelope } from '../errors';
+import { ApiError, toErrorEnvelope } from '../errors.js';
 
 /**
  * Double-submit CSRF guard for the cookie-auth + ctgr GET-tunnel model.

package/src/server/auth/fileTokenSigner.ts

@@ -1,5 +1,5 @@
 import { importPKCS8, SignJWT } from 'jose';
-import type { FileTokenClaims, FileTokenSigner } from '../storage/binaryServerStore';
+import type { FileTokenClaims, FileTokenSigner } from '../storage/binaryServerStore.js';
 
 // RS256 file-token signer for binary-server tenants. binary-server holds only the tenant's
 // PUBLIC key (resolved by the token's `iss` claim) and can verify but never mint; the app holds

package/src/server/auth/getOnly.spec.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from 'bun:test';
 import { Hono } from 'hono';
-import { getOnlyEnforcement, isGetOnlyViolation } from './getOnly';
-import type { AuthEnv, AuthUser } from './types';
+import { getOnlyEnforcement, isGetOnlyViolation } from './getOnly.js';
+import type { AuthEnv, AuthUser } from './types.js';
 
 const REQ = (path: string, init?: RequestInit) => new Request(`http://localhost${path}`, init);
 

package/src/server/auth/getOnly.ts

@@ -1,6 +1,6 @@
 import type { MiddlewareHandler } from 'hono';
-import { ApiError, toErrorEnvelope } from '../errors';
-import type { AuthEnv } from './types';
+import { ApiError, toErrorEnvelope } from '../errors.js';
+import type { AuthEnv } from './types.js';
 
 /**
  * `getOnly` enforcement — the server-side half of the `/f` GET-only session

package/src/server/auth/index.ts

@@ -8,14 +8,14 @@ export {
   clearAuthCookie,
   readAuthCookie,
   writeAuthCookie,
-} from './cookie';
-export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CsrfOptions, createCsrfMiddleware } from './csrf';
+} from './cookie.js';
+export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CsrfOptions, createCsrfMiddleware } from './csrf.js';
 export {
   createRs256FileTokenSigner,
   type Rs256FileTokenSignerOptions,
-} from './fileTokenSigner';
-export { getOnlyEnforcement, isGetOnlyViolation } from './getOnly';
-export { signToken, verifyPurposeToken, verifyToken } from './jwt';
+} from './fileTokenSigner.js';
+export { getOnlyEnforcement, isGetOnlyViolation } from './getOnly.js';
+export { signToken, verifyPurposeToken, verifyToken } from './jwt.js';
 export {
   clientKeyOf,
   clientKeyOfContext,
@@ -23,13 +23,13 @@ export {
   type LoginThrottle,
   type LoginThrottleOptions,
   type ThrottleVerdict,
-} from './loginThrottle';
-export { createAuthMiddleware } from './middleware';
-export { hashPassword, needsRehash, verifyPassword } from './password';
+} from './loginThrottle.js';
+export { createAuthMiddleware } from './middleware.js';
+export { hashPassword, needsRehash, verifyPassword } from './password.js';
 export {
   createSessionStore,
   type SessionStoreOptions,
-} from './sessionStore';
+} from './sessionStore.js';
 export {
   DEFAULT_TOTP_ISSUER,
   generateRecoveryCodes,
@@ -37,7 +37,7 @@ export {
   getTotpUri,
   verifyRecoveryCode,
   verifyTotpCode,
-} from './totp';
+} from './totp.js';
 export type {
   AppJwtPayload,
   AuthEnv,
@@ -47,5 +47,5 @@ export type {
   Session,
   SessionStore,
   TokenPurpose,
-} from './types';
-export { decryptVaultItem, deriveVaultKey, encryptVaultItem } from './vault';
+} from './types.js';
+export { decryptVaultItem, deriveVaultKey, encryptVaultItem } from './vault.js';

package/src/server/auth/jwt.spec.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from 'bun:test';
 import { SignJWT } from 'jose';
-import { signToken, verifyPurposeToken, verifyToken } from './jwt';
-import type { AppJwtPayload } from './types';
+import { signToken, verifyPurposeToken, verifyToken } from './jwt.js';
+import type { AppJwtPayload } from './types.js';
 
 const SECRET = 'a-test-secret-at-least-32-chars-long!!';
 

package/src/server/auth/jwt.ts

@@ -1,5 +1,5 @@
 import { type JWTPayload, jwtVerify, SignJWT } from 'jose';
-import type { AppJwtPayload } from './types';
+import type { AppJwtPayload } from './types.js';
 
 /**
  * JWT sign/verify on `jose` (Web Crypto HMAC — native on Bun + Node, no native

package/src/server/auth/loginThrottle.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'bun:test';
-import { clientKeyOf, createLoginThrottle } from './loginThrottle';
+import { clientKeyOf, createLoginThrottle } from './loginThrottle.js';
 
 const clock = (start = 1_000_000) => {
   let t = start;

package/src/server/auth/middleware.spec.ts

@@ -1,13 +1,13 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { Hono } from 'hono';
-import { createKysely } from '../db/kysely';
-import { AUTH_COOKIE_NAME } from './cookie';
-import { getOnlyEnforcement } from './getOnly';
-import { signToken } from './jwt';
-import { createAuthMiddleware } from './middleware';
-import { createSessionStore } from './sessionStore';
-import type { AuthEnv, SessionStore } from './types';
+import { createKysely } from '../db/kysely.js';
+import { AUTH_COOKIE_NAME } from './cookie.js';
+import { getOnlyEnforcement } from './getOnly.js';
+import { signToken } from './jwt.js';
+import { createAuthMiddleware } from './middleware.js';
+import { createSessionStore } from './sessionStore.js';
+import type { AuthEnv, SessionStore } from './types.js';
 
 const SECRET = 'integration-test-secret-32-chars-min!';
 const REQ = (path: string, init?: RequestInit) => new Request(`http://localhost${path}`, init);

package/src/server/auth/middleware.ts

@@ -1,8 +1,8 @@
 import type { MiddlewareHandler } from 'hono';
-import { ApiError, toErrorEnvelope } from '../errors';
-import { readAuthCookie } from './cookie';
-import { verifyToken } from './jwt';
-import type { AppJwtPayload, AuthEnv, AuthUser, SessionStore } from './types';
+import { ApiError, toErrorEnvelope } from '../errors.js';
+import { readAuthCookie } from './cookie.js';
+import { verifyToken } from './jwt.js';
+import type { AppJwtPayload, AuthEnv, AuthUser, SessionStore } from './types.js';
 
 /**
  * The composed auth middleware. Reads the httpOnly `access_token` cookie, verifies

package/src/server/auth/password.spec.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test';
 import { pbkdf2Sync, randomBytes } from 'node:crypto';
-import { hashPassword, needsRehash, verifyPassword } from './password';
+import { hashPassword, needsRehash, verifyPassword } from './password.js';
 
 // Reproduce the OLD app's legacy hash shape: PBKDF2-SHA512 @ 1000 iterations, the
 // salt + derived hex joined as "<salt>:<hex>" (what the ETL stores in the password

package/src/server/auth/sessionStore.spec.ts

@@ -1,8 +1,8 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { createKysely, type PlumbingDb } from '../db/kysely';
-import { createSessionStore } from './sessionStore';
-import type { SessionStore } from './types';
+import { createKysely, type PlumbingDb } from '../db/kysely.js';
+import { createSessionStore } from './sessionStore.js';
+import type { SessionStore } from './types.js';
 
 const DDL = `CREATE TABLE auth_sessions (
   session_id TEXT PRIMARY KEY,

package/src/server/auth/sessionStore.ts

@@ -1,6 +1,6 @@
-import type { PlumbingDb } from '../db/kysely';
-import type { AuthSessionRow } from '../db/plumbingTypes';
-import type { CreateSessionInput, Session, SessionStore } from './types';
+import type { PlumbingDb } from '../db/kysely.js';
+import type { AuthSessionRow } from '../db/plumbingTypes.js';
+import type { CreateSessionInput, Session, SessionStore } from './types.js';
 
 /**
  * Kysely-backed, revocable, restart-surviving session store (task 26).

package/src/server/auth/totp.spec.ts

@@ -6,7 +6,7 @@ import {
   getTotpUri,
   verifyRecoveryCode,
   verifyTotpCode,
-} from './totp';
+} from './totp.js';
 
 describe('TOTP', () => {
   test('generates a base32 secret', () => {

package/src/server/auth/types.ts

@@ -1,5 +1,5 @@
 import type { JWTPayload } from 'jose';
-import type { CursedbeltVariables } from '../context';
+import type { CursedbeltVariables } from '../context.js';
 
 /**
  * Shared auth types for the cursedbelt server auth toolkit.

package/src/server/auth/vault.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test';
-import { decryptVaultItem, deriveVaultKey, encryptVaultItem } from './vault';
+import { decryptVaultItem, deriveVaultKey, encryptVaultItem } from './vault.js';
 
 const SECRET = 'server-secret-used-for-vault-key-derivation';
 

package/src/server/bench/assert.ts

@@ -6,8 +6,8 @@
  * a build instead of adding a line to a log nobody opens.
  */
 
-import { DEFAULT_ROUTE_CPU_BUDGET_MS } from './budget';
-import type { CpuBudgetReport, RouteCpuStats } from './recorder';
+import { DEFAULT_ROUTE_CPU_BUDGET_MS } from './budget.js';
+import type { CpuBudgetReport, RouteCpuStats } from './recorder.js';
 
 export type CpuViolationKind =
   /** p99 above the route's declared (or default) budget. */

package/src/server/bench/budget.spec.ts

@@ -9,8 +9,8 @@ import {
   resolveBudget,
   validateCpuBudgetConfig,
   WORKERS_PAID_INCLUDED_CPU_MS,
-} from './budget';
-import { percentile } from './recorder';
+} from './budget.js';
+import { percentile } from './recorder.js';
 
 describe('the derivation', () => {
   it('derives 9.9 CPU-ms from the Workers Paid allowance and the projected traffic', () => {

package/src/server/bench/cpuBudget.spec.ts

@@ -1,16 +1,16 @@
 import { describe, expect, it } from 'bun:test';
 import { Hono } from 'hono';
-import { assertCpuBudgets, checkCpuBudgets, formatCpuBudgetReport } from './assert';
-import { type CpuBudgetConfig, DEFAULT_ROUTE_CPU_BUDGET_MS } from './budget';
-import { cpuBudget } from './cpuBudget';
+import { assertCpuBudgets, checkCpuBudgets, formatCpuBudgetReport } from './assert.js';
+import { type CpuBudgetConfig, DEFAULT_ROUTE_CPU_BUDGET_MS } from './budget.js';
+import { cpuBudget } from './cpuBudget.js';
 import {
   fixedCpuClock,
   processCpuClock,
   unavailableCpuClock,
   workerCpuClock,
-} from './cpuClock';
-import { createCpuRecorder } from './recorder';
-import { BENCH_ORIGIN, runCpuBench } from './runBench';
+} from './cpuClock.js';
+import { createCpuRecorder } from './recorder.js';
+import { BENCH_ORIGIN, runCpuBench } from './runBench.js';
 
 /**
  * 🔴 **The assertion must fire in BOTH directions or it is decoration.** A gate that can

package/src/server/bench/cpuBudget.ts

@@ -1,9 +1,9 @@
 import type { MiddlewareHandler } from 'hono';
-import type { CursedbeltEnv } from '../context';
-import { normalizeRoute } from '../metrics/normalizeRoute';
-import type { CpuBudgetConfig } from './budget';
-import { type CpuClock, processCpuClock } from './cpuClock';
-import { type CpuRecorder, createCpuRecorder } from './recorder';
+import type { CursedbeltEnv } from '../context.js';
+import { normalizeRoute } from '../metrics/normalizeRoute.js';
+import type { CpuBudgetConfig } from './budget.js';
+import { type CpuClock, processCpuClock } from './cpuClock.js';
+import { type CpuRecorder, createCpuRecorder } from './recorder.js';
 
 /**
  * Per-route CPU attribution, mounted like any other cursedbelt middleware.

package/src/server/bench/cpuClock.spec.ts

@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it } from 'bun:test';
 import { Hono } from 'hono';
-import { cpuBudget } from './cpuBudget';
-import { processCpuClock } from './cpuClock';
+import { cpuBudget } from './cpuBudget.js';
+import { processCpuClock } from './cpuClock.js';
 
 /**
  * 🔴 **The runtime this file exists for is the one `bun test` is not.**

package/src/server/bench/index.ts

@@ -40,7 +40,7 @@ export {
   type CpuViolation,
   type CpuViolationKind,
   formatCpuBudgetReport,
-} from './assert';
+} from './assert.js';
 export {
   type CpuBudgetConfig,
   type CpuBudgetExemption,
@@ -60,8 +60,8 @@ export {
   WORKERS_PAID_INCLUDED_REQUESTS,
   WORKERS_PAID_USD_PER_MILLION_CPU_MS,
   WORKERS_PAID_USD_PER_MILLION_REQUESTS,
-} from './budget';
-export { type CpuBudgetOpts, cpuBudget } from './cpuBudget';
+} from './budget.js';
+export { type CpuBudgetOpts, cpuBudget } from './cpuBudget.js';
 export {
   type CpuClock,
   type CpuSpan,
@@ -70,7 +70,7 @@ export {
   resolveCpuClock,
   unavailableCpuClock,
   workerCpuClock,
-} from './cpuClock';
+} from './cpuClock.js';
 export {
   type CpuBudgetReport,
   type CpuRecorder,
@@ -78,5 +78,5 @@ export {
   createCpuRecorder,
   percentile,
   type RouteCpuStats,
-} from './recorder';
-export { BENCH_ORIGIN, type BenchCase, runCpuBench, type RunCpuBenchOpts } from './runBench';
+} from './recorder.js';
+export { BENCH_ORIGIN, type BenchCase, runCpuBench, type RunCpuBenchOpts } from './runBench.js';

package/src/server/bench/recorder.ts

@@ -11,8 +11,8 @@ import {
   type ResolvedBudget,
   resolveBudget,
   validateCpuBudgetConfig,
-} from './budget';
-import type { CpuClock } from './cpuClock';
+} from './budget.js';
+import type { CpuClock } from './cpuClock.js';
 
 /**
  * Nearest-rank percentile over an ASCENDING-sorted array: the smallest value at or below

package/src/server/bench/runBench.ts

@@ -1,5 +1,5 @@
-import type { CpuRecorder } from './recorder';
-import type { CpuBudgetReport } from './recorder';
+import type { CpuRecorder } from './recorder.js';
+import type { CpuBudgetReport } from './recorder.js';
 
 /**
  * Drive a Hono app's routes and measure what each costs in CPU.

package/src/server/ctgr.spec.ts

@@ -3,8 +3,8 @@ import { Hono } from 'hono';
 import { toBase64 } from 'cursedbelt-core/ctgr';
 import { ChunkStore } from 'cursedbelt-core/ctgr/chunk-store';
 import { encodeRequest } from 'cursedbelt-core/ctgr';
-import type { CursedbeltEnv } from './context';
-import { buildRoutes, CTGR_ROUTE_PATTERN, getCtgrDecoded, unGETify } from './ctgr';
+import type { CursedbeltEnv } from './context.js';
+import { buildRoutes, CTGR_ROUTE_PATTERN, getCtgrDecoded, unGETify } from './ctgr.js';
 
 const ORIGIN = 'http://localhost';
 const fetchChunk = (app: Hono<CursedbeltEnv>, url: string, init?: RequestInit) =>

package/src/server/ctgr.ts

@@ -19,8 +19,8 @@ import {
   METHOD_TO_ABBREV,
 } from 'cursedbelt-core/ctgr/types';
 import { V0ChunkStore } from 'cursedbelt-core/ctgr/v0compat';
-import type { CursedbeltEnv } from './context';
-import { ApiError, toErrorEnvelope } from './errors';
+import type { CursedbeltEnv } from './context.js';
+import { ApiError, toErrorEnvelope } from './errors.js';
 
 /**
  * The path pattern that matches EVERY ctgr GET twin (`/ctgr<XX>...`) and nothing

package/src/server/d1/backup.spec.ts

@@ -3,10 +3,10 @@ import { afterEach, describe, expect, test } from 'bun:test';
 import { existsSync, mkdtempSync, rmSync, statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createTimeTravelBackup } from './backup';
+import { createTimeTravelBackup } from './backup.js';
 // The local half is a separate module on purpose — it reaches `bun:sqlite`, so it may not
 // sit in the `./d1` barrel a Worker imports. See `./localBackup.ts`'s header.
-import { backupFor, checkpointWal, createLocalBackup } from './localBackup';
+import { backupFor, checkpointWal, createLocalBackup } from './localBackup.js';
 
 const dirs: string[] = [];
 const scratch = (): string => {

package/src/server/d1/fakeD1.ts

@@ -35,8 +35,8 @@
  */
 
 import type { Database } from 'bun:sqlite';
-import type { D1BindingLike, D1BindingResult, D1BindingStatement } from './remote';
-import { isPureReadSql } from './values';
+import type { D1BindingLike, D1BindingResult, D1BindingStatement } from './remote.js';
+import { isPureReadSql } from './values.js';
 
 /** The bind types a real D1 binding accepts. Everything else throws. */
 function assertD1Bindable(value: unknown, index: number): void {

package/src/server/d1/index.ts

@@ -20,7 +20,7 @@ export {
 	createTimeTravelBackup,
 	type DatabaseBackup,
 	type TimeTravelOpts,
-} from './backup';
+} from './backup.js';
 // 🔴 `./localBackup` is deliberately NOT re-exported here — import `checkpointWal`,
 // `createLocalBackup`, `LocalBackupOpts` and `backupFor` from
 // `cursedbelt-server/d1/backup-local`. It reaches `bun:sqlite` for real (via
@@ -39,16 +39,16 @@ export {
 // that does not use the query builder — which per `../db/kysely.ts`'s own header is most
 // of them, since business tables stay on raw statements. Measured 2026-09-18 against the
 // published 4.3.0 tarball. `barrelsReachNoOptionalPeer.spec.ts` is what keeps it out.
-export { createPendingWrites, type InvocationD1, type PendingWrites, perInvocation, type WriteCollector } from './invocation';
-export { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits';
-export { createLocalD1, refuseInteractiveTransaction } from './local';
+export { createPendingWrites, type InvocationD1, type PendingWrites, perInvocation, type WriteCollector } from './invocation.js';
+export { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits.js';
+export { createLocalD1, refuseInteractiveTransaction } from './local.js';
 export {
 	createRemoteD1,
 	type D1BindingLike,
 	type D1BindingMeta,
 	type D1BindingResult,
 	type D1BindingStatement,
-} from './remote';
+} from './remote.js';
 export {
 	classifySchedule,
 	cronFieldCount,
@@ -60,7 +60,7 @@ export {
 	toFiveField,
 	type TriggerShape,
 	type WorkersPrimitive,
-} from './scheduling';
+} from './scheduling.js';
 export {
 	D1BindError,
 	type D1LikeBindable,
@@ -72,5 +72,5 @@ export {
 	type D1LikeValue,
 	D1LimitError,
 	D1UnsupportedError,
-} from './types';
-export { makeMeta, normalizeBind, normalizeBinds, normalizeRow, normalizeRows, normalizeValue } from './values';
+} from './types.js';
+export { makeMeta, normalizeBind, normalizeBinds, normalizeRow, normalizeRows, normalizeValue } from './values.js';

package/src/server/d1/invocation.spec.ts

@@ -1,11 +1,11 @@
 import { Database } from 'bun:sqlite';
 import { beforeEach, describe, expect, test } from 'bun:test';
-import { createFakeD1Binding } from './fakeD1';
-import { createPendingWrites, perInvocation } from './invocation';
-import { LIMITS } from './limits';
-import { createLocalD1 } from './local';
-import { createRemoteD1 } from './remote';
-import { D1LimitError, type D1LikeDatabase } from './types';
+import { createFakeD1Binding } from './fakeD1.js';
+import { createPendingWrites, perInvocation } from './invocation.js';
+import { LIMITS } from './limits.js';
+import { createLocalD1 } from './local.js';
+import { createRemoteD1 } from './remote.js';
+import { D1LimitError, type D1LikeDatabase } from './types.js';
 
 /**
  * 🔴 Every test here would have passed against the seam as published in 4.2.0, because

package/src/server/d1/invocation.ts

@@ -49,8 +49,8 @@
  * here on 2026-09-19.
  */
 
-import { LIMITS } from './limits';
-import { D1LimitError, type D1LikeBindable, type D1LikeDatabase, type D1LikeResult, type D1LikeRow, type D1LikeStatement, type D1LikeValue } from './types';
+import { LIMITS } from './limits.js';
+import { D1LimitError, type D1LikeBindable, type D1LikeDatabase, type D1LikeResult, type D1LikeRow, type D1LikeStatement, type D1LikeValue } from './types.js';
 
 /**
  * A database handle that knows how much of its invocation budget it has spent.

package/src/server/d1/kysely.spec.ts

@@ -7,11 +7,11 @@
 import { Database } from 'bun:sqlite';
 import { describe, expect, test } from 'bun:test';
 import type { Kysely } from 'kysely';
-import { createFakeD1Binding } from './fakeD1';
-import { createD1Kysely } from './kysely';
-import { createLocalD1 } from './local';
-import { createRemoteD1 } from './remote';
-import { D1UnsupportedError, type D1LikeDatabase } from './types';
+import { createFakeD1Binding } from './fakeD1.js';
+import { createD1Kysely } from './kysely.js';
+import { createLocalD1 } from './local.js';
+import { createRemoteD1 } from './remote.js';
+import { D1UnsupportedError, type D1LikeDatabase } from './types.js';
 
 const DDL = `CREATE TABLE app_config (
   key TEXT PRIMARY KEY, value TEXT NOT NULL, updated_at TEXT NOT NULL, updated_by TEXT

package/src/server/d1/kysely.ts

@@ -41,9 +41,9 @@ import {
 	SqliteIntrospector,
 	SqliteQueryCompiler,
 } from 'kysely';
-import type { PlumbingSchema } from '../db/plumbingTypes';
-import { refuseInteractiveTransaction } from './local';
-import { type D1LikeBindable, type D1LikeDatabase, D1UnsupportedError } from './types';
+import type { PlumbingSchema } from '../db/plumbingTypes.js';
+import { refuseInteractiveTransaction } from './local.js';
+import { type D1LikeBindable, type D1LikeDatabase, D1UnsupportedError } from './types.js';
 
 /**
  * Kysely compiles to a parameter list that may contain values our seam refuses

package/src/server/d1/limits.spec.ts

@@ -1,8 +1,8 @@
 import { Database } from 'bun:sqlite';
 import { describe, expect, test } from 'bun:test';
-import { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits';
-import { createLocalD1 } from './local';
-import { D1LimitError } from './types';
+import { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits.js';
+import { createLocalD1 } from './local.js';
+import { D1LimitError } from './types.js';
 
 describe('D1 limits are enforced on the LOCAL driver too', () => {
 	// 🔴 The point of every test here: `bun:sqlite` has none of these caps, so without

package/src/server/d1/limits.ts

@@ -18,7 +18,7 @@
  * Values are the Workers **Paid** tier, which is what the owner already pays for.
  */
 
-import { D1LimitError, type D1LikeBindable } from './types';
+import { D1LimitError, type D1LikeBindable } from './types.js';
 
 export const LIMITS = {
 	/** Bound parameters in a single statement. */

package/src/server/d1/local.ts

@@ -15,7 +15,7 @@
  */
 
 import type { Database } from 'bun:sqlite';
-import { assertBatchSize, assertWithinLimits } from './limits';
+import { assertBatchSize, assertWithinLimits } from './limits.js';
 import {
 	type D1LikeBindable,
 	type D1LikeDatabase,
@@ -24,8 +24,8 @@ import {
 	type D1LikeStatement,
 	type D1LikeValue,
 	D1UnsupportedError,
-} from './types';
-import { isPureReadSql, makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values';
+} from './types.js';
+import { isPureReadSql, makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values.js';
 
 /** Shared clock, so `meta.duration` means the same thing on both sides of the seam. */
 const now = (): number => performance.now();

package/src/server/d1/localBackup.ts

@@ -35,9 +35,9 @@
 import type { Database } from 'bun:sqlite';
 import { existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { snapshotSqlite } from '../sqlite/backup';
-import type { BackupPoint, DatabaseBackup, TimeTravelOpts } from './backup';
-import { createTimeTravelBackup } from './backup';
+import { snapshotSqlite } from '../sqlite/backup.js';
+import type { BackupPoint, DatabaseBackup, TimeTravelOpts } from './backup.js';
+import { createTimeTravelBackup } from './backup.js';
 
 export interface LocalBackupOpts {
 	/** The live handle — checkpointed before the snapshot is taken. */

package/src/server/d1/remote.ts

@@ -15,7 +15,7 @@
  * fake that has no `workerd` in sight.
  */
 
-import { assertBatchSize, assertWithinLimits } from './limits';
+import { assertBatchSize, assertWithinLimits } from './limits.js';
 import {
 	type D1LikeBindable,
 	type D1LikeDatabase,
@@ -24,8 +24,8 @@ import {
 	type D1LikeStatement,
 	type D1LikeValue,
 	D1UnsupportedError,
-} from './types';
-import { makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values';
+} from './types.js';
+import { makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values.js';
 
 /** What D1 reports back about a statement. Its `meta` is richer than the local driver's. */
 export interface D1BindingMeta {

package/src/server/d1/sameShape.spec.ts

@@ -16,10 +16,10 @@
 
 import { Database } from 'bun:sqlite';
 import { beforeEach, describe, expect, test } from 'bun:test';
-import { createFakeD1Binding } from './fakeD1';
-import { createLocalD1 } from './local';
-import { createRemoteD1 } from './remote';
-import { D1BindError, type D1LikeBindable, type D1LikeDatabase } from './types';
+import { createFakeD1Binding } from './fakeD1.js';
+import { createLocalD1 } from './local.js';
+import { createRemoteD1 } from './remote.js';
+import { D1BindError, type D1LikeBindable, type D1LikeDatabase } from './types.js';
 
 const DDL = `CREATE TABLE t (
   id INTEGER PRIMARY KEY,

package/src/server/d1/scheduling.spec.ts

@@ -6,7 +6,7 @@ import {
 	type PortableJob,
 	toCronTriggers,
 	toFiveField,
-} from './scheduling';
+} from './scheduling.js';
 
 const job = (name: string, shape: PortableJob['shape']): PortableJob => ({
 	name,