cursedbelt-server 4.12.0 → 4.13.1

package/dist/server/_bunOnly.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/_bunOnly.js

@@ -0,0 +1,12 @@
+// Loaded only on non-Bun runtimes. Six export subpaths of this package — the root barrel,
+// `./guard`, `./guard/revocations`, `./sqlite`, `./middleware` and `./d1/backup-local` — are
+// Bun-only by construction: they reach `bun:sqlite` or the `Bun` global. Their export map routes
+// Bun (the "bun" condition) to the real module and everything else here, so importing one under
+// Node fails with THIS sentence instead of `ERR_UNSUPPORTED_ESM_URL_SCHEME … 'bun:'` from deep
+// inside the graph (measured by tools/proveInstall.ts, 2026-09-22). Same shape as `cwip/testing`.
+//
+// A Worker is served by the non-Bun subpaths (`./d1`, `./body-limit`, `./storage`, …), which
+// load anywhere; none of the six is in any Worker bundle this generation builds.
+throw new Error('This cursedbelt-server entry requires the Bun runtime — it reaches `bun:sqlite` or the `Bun` global. ' +
+    'Under Node or in a Worker, import a portable subpath instead (`cursedbelt-server/d1`, `/body-limit`, `/storage`, …).');
+export {};

package/dist/server/activity/index.d.ts

@@ -28,9 +28,9 @@
  * by category, and an audit trail of production deletions is precisely the data
  * a 14-day cutoff must not reach.
  */
-export { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations";
-export { shareEventsSource, type ShareEventsSourceOptions } from "./shareSource";
-export { createActivityLog } from "./store";
-export type { ActivityFacet, ActivityFacets, ActivityLog, ActivityLogOptions, ActivityPage, ActivityQuery, ActivitySource, } from "./store";
+export { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations.js";
+export { shareEventsSource, type ShareEventsSourceOptions } from "./shareSource.js";
+export { createActivityLog } from "./store.js";
+export type { ActivityFacet, ActivityFacets, ActivityLog, ActivityLogOptions, ActivityPage, ActivityQuery, ActivitySource, } from "./store.js";
 export { ACTIVITY_OUTCOMES, activityFromShareEvent, activitySubject, describeActivityEvent, describeActivityResource, isActivityAction, isActivityOutcome, } from "cursedbelt-core/activity/model";
 export type { ActivityEvent, ActivityEventInput, ActivityOutcome, ActivityResource, } from "cursedbelt-core/activity/model";

package/dist/server/activity/index.js

@@ -28,9 +28,9 @@
  * by category, and an audit trail of production deletions is precisely the data
  * a 14-day cutoff must not reach.
  */
-export { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations";
-export { shareEventsSource } from "./shareSource";
-export { createActivityLog } from "./store";
+export { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations.js";
+export { shareEventsSource } from "./shareSource.js";
+export { createActivityLog } from "./store.js";
 // Re-exported so a server consumer needs ONE import for the whole contract; the
 // pure entry (`cursedbelt-core/activity`) stays available for a browser or a spec.
 export { ACTIVITY_OUTCOMES, activityFromShareEvent, activitySubject, describeActivityEvent, describeActivityResource, isActivityAction, isActivityOutcome, } from "cursedbelt-core/activity/model";

package/dist/server/activity/migrations.d.ts

@@ -1,4 +1,4 @@
-import type { Migration } from "../migration/types";
+import type { Migration } from "../migration/types.js";
 /** The one table this primitive owns. Exported so an app can declare a retention
  *  target over it (see this module's `index.ts` for the recipe). */
 export declare const ACTIVITY_EVENTS_TABLE = "activity_events";

package/dist/server/activity/shareSource.d.ts

@@ -1,4 +1,4 @@
-import type { ActivitySource } from "./store";
+import type { ActivitySource } from "./store.js";
 export interface ShareEventsSourceOptions {
     /** The satellite this log speaks for — the same value passed to
      *  `createActivityLog`, used where a group event names no resource. */

package/dist/server/activity/shareSource.js

@@ -25,7 +25,7 @@
  * fleet-wide board merges on that column and an unlabeled row would be
  * unattributable.
  */
-import { SHARE_EVENTS_TABLE } from "../sharing/migrations";
+import { SHARE_EVENTS_TABLE } from "../sharing/migrations.js";
 export function shareEventsSource(options) {
     const table = options.table ?? SHARE_EVENTS_TABLE;
     const name = options.name ?? "share";

package/dist/server/activity/store.js

@@ -1,6 +1,6 @@
 import { isActivityAction, isActivityOutcome, } from "cursedbelt-core/activity/model";
-import { runMigrations } from "../migration/runner";
-import { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations";
+import { runMigrations } from "../migration/runner.js";
+import { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations.js";
 const DEFAULT_LIMIT = 100;
 const MAX_LIMIT = 1000;
 const MAX_FACET = 25;

package/dist/server/analytics/index.d.ts

@@ -14,5 +14,5 @@
  * Both are pure string work with no imports at all, so this subpath costs a consumer nothing
  * and drags no peer.
  */
-export { type InjectedScript, foreignScriptSources, scriptsRefusedByCsp, } from "./injectedScripts";
-export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_PUBLIC_HOST, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsBootstrap, webAnalyticsTag, } from "./webAnalytics";
+export { type InjectedScript, foreignScriptSources, scriptsRefusedByCsp, } from "./injectedScripts.js";
+export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_PUBLIC_HOST, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsBootstrap, webAnalyticsTag, } from "./webAnalytics.js";

package/dist/server/analytics/index.js

@@ -14,5 +14,5 @@
  * Both are pure string work with no imports at all, so this subpath costs a consumer nothing
  * and drags no peer.
  */
-export { foreignScriptSources, scriptsRefusedByCsp, } from "./injectedScripts";
-export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_PUBLIC_HOST, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsBootstrap, webAnalyticsTag, } from "./webAnalytics";
+export { foreignScriptSources, scriptsRefusedByCsp, } from "./injectedScripts.js";
+export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_PUBLIC_HOST, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsBootstrap, webAnalyticsTag, } from "./webAnalytics.js";

package/dist/server/app.d.ts

@@ -1,10 +1,10 @@
 import type { Database } from 'bun:sqlite';
 import type { Server, TLSOptions, WebSocketHandler } from 'bun';
 import { Hono } from 'hono';
-import type { CursedbeltEnv } from './context';
-import { type CorsOpts } from './middleware/corsAllowlist';
-import { type RateLimitOpts } from './middleware/rateLimit';
-import { type SecurityHeadersOpts } from './middleware/securityHeaders';
+import type { CursedbeltEnv } from './context.js';
+import { type CorsOpts } from './middleware/corsAllowlist.js';
+import { type RateLimitOpts } from './middleware/rateLimit.js';
+import { type SecurityHeadersOpts } from './middleware/securityHeaders.js';
 export interface CreateAppOpts {
     /** When provided, the request logger writes metrics/events to this DB. */
     db?: Database;

package/dist/server/app.js

@@ -1,10 +1,10 @@
 import { Hono } from 'hono';
-import { correlationId } from './middleware/correlationId';
-import { corsAllowlist } from './middleware/corsAllowlist';
-import { errorEnvelope } from './middleware/errorEnvelope';
-import { createRateLimiter } from './middleware/rateLimit';
-import { requestLogger } from './middleware/requestLogger';
-import { securityHeaders } from './middleware/securityHeaders';
+import { correlationId } from './middleware/correlationId.js';
+import { corsAllowlist } from './middleware/corsAllowlist.js';
+import { errorEnvelope } from './middleware/errorEnvelope.js';
+import { createRateLimiter } from './middleware/rateLimit.js';
+import { requestLogger } from './middleware/requestLogger.js';
+import { securityHeaders } from './middleware/securityHeaders.js';
 /**
  * Build the configured cursedbelt Hono app: correlation id → (optional) CORS →
  * security headers →

package/dist/server/audit/index.d.ts

@@ -1,2 +1,2 @@
-export { AUDIT_LOG_MIGRATIONS } from './migrations';
-export { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink';
+export { AUDIT_LOG_MIGRATIONS } from './migrations.js';
+export { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink.js';

package/dist/server/audit/index.js

@@ -1,2 +1,2 @@
-export { AUDIT_LOG_MIGRATIONS } from './migrations';
-export { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink';
+export { AUDIT_LOG_MIGRATIONS } from './migrations.js';
+export { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink.js';

package/dist/server/audit/migrations.d.ts

@@ -1,2 +1,2 @@
-import type { Migration } from '../migration/types';
+import type { Migration } from '../migration/types.js';
 export declare const AUDIT_LOG_MIGRATIONS: readonly Migration[];

package/dist/server/audit/sqliteSink.js

@@ -1,5 +1,5 @@
-import { runMigrations } from '../migration/runner';
-import { AUDIT_LOG_MIGRATIONS } from './migrations';
+import { runMigrations } from '../migration/runner.js';
+import { AUDIT_LOG_MIGRATIONS } from './migrations.js';
 function rowToRecord(row) {
     return {
         namespace: row.namespace,

package/dist/server/audit/sqliteSink.test.js

@@ -1,6 +1,6 @@
 import { Database } from 'bun:sqlite';
 import { beforeEach, describe, expect, it } from 'bun:test';
-import { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink';
+import { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink.js';
 let db;
 beforeEach(() => {
     db = new Database(':memory:');

package/dist/server/auth/csrf.js

@@ -1,5 +1,5 @@
 import { getCookie, setCookie } from 'hono/cookie';
-import { ApiError, toErrorEnvelope } from '../errors';
+import { ApiError, toErrorEnvelope } from '../errors.js';
 export const CSRF_COOKIE_NAME = 'csrf_token';
 export const CSRF_HEADER_NAME = 'x-csrf-token';
 const isProd = () => process.env.NODE_ENV === 'production';

package/dist/server/auth/fileTokenSigner.d.ts

@@ -1,4 +1,4 @@
-import type { FileTokenSigner } from '../storage/binaryServerStore';
+import type { FileTokenSigner } from '../storage/binaryServerStore.js';
 export type Rs256FileTokenSignerOptions = {
     /** PKCS8 PEM private key. `\n` escape sequences are accepted (env-var friendly). */
     privateKeyPem: string;

package/dist/server/auth/getOnly.d.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from 'hono';
-import type { AuthEnv } from './types';
+import type { AuthEnv } from './types.js';
 /**
  * `getOnly` enforcement — the server-side half of the `/f` GET-only session
  * guarantee. A getOnly session (the obfuscated `/f` login) may read freely and may

package/dist/server/auth/getOnly.js

@@ -1,4 +1,4 @@
-import { ApiError, toErrorEnvelope } from '../errors';
+import { ApiError, toErrorEnvelope } from '../errors.js';
 /**
  * `getOnly` enforcement — the server-side half of the `/f` GET-only session
  * guarantee. A getOnly session (the obfuscated `/f` login) may read freely and may

package/dist/server/auth/index.d.ts

@@ -1,12 +1,12 @@
-export { AUTH_COOKIE_NAME, clearAuthCookie, readAuthCookie, writeAuthCookie, } from './cookie';
-export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CsrfOptions, createCsrfMiddleware } from './csrf';
-export { createRs256FileTokenSigner, type Rs256FileTokenSignerOptions, } from './fileTokenSigner';
-export { getOnlyEnforcement, isGetOnlyViolation } from './getOnly';
-export { signToken, verifyPurposeToken, verifyToken } from './jwt';
-export { clientKeyOf, clientKeyOfContext, createLoginThrottle, type LoginThrottle, type LoginThrottleOptions, type ThrottleVerdict, } from './loginThrottle';
-export { createAuthMiddleware } from './middleware';
-export { hashPassword, needsRehash, verifyPassword } from './password';
-export { createSessionStore, type SessionStoreOptions, } from './sessionStore';
-export { DEFAULT_TOTP_ISSUER, generateRecoveryCodes, generateTotpSecret, getTotpUri, verifyRecoveryCode, verifyTotpCode, } from './totp';
-export type { AppJwtPayload, AuthEnv, AuthUser, AuthVariables, CreateSessionInput, Session, SessionStore, TokenPurpose, } from './types';
-export { decryptVaultItem, deriveVaultKey, encryptVaultItem } from './vault';
+export { AUTH_COOKIE_NAME, clearAuthCookie, readAuthCookie, writeAuthCookie, } from './cookie.js';
+export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CsrfOptions, createCsrfMiddleware } from './csrf.js';
+export { createRs256FileTokenSigner, type Rs256FileTokenSignerOptions, } from './fileTokenSigner.js';
+export { getOnlyEnforcement, isGetOnlyViolation } from './getOnly.js';
+export { signToken, verifyPurposeToken, verifyToken } from './jwt.js';
+export { clientKeyOf, clientKeyOfContext, createLoginThrottle, type LoginThrottle, type LoginThrottleOptions, type ThrottleVerdict, } from './loginThrottle.js';
+export { createAuthMiddleware } from './middleware.js';
+export { hashPassword, needsRehash, verifyPassword } from './password.js';
+export { createSessionStore, type SessionStoreOptions, } from './sessionStore.js';
+export { DEFAULT_TOTP_ISSUER, generateRecoveryCodes, generateTotpSecret, getTotpUri, verifyRecoveryCode, verifyTotpCode, } from './totp.js';
+export type { AppJwtPayload, AuthEnv, AuthUser, AuthVariables, CreateSessionInput, Session, SessionStore, TokenPurpose, } from './types.js';
+export { decryptVaultItem, deriveVaultKey, encryptVaultItem } from './vault.js';

package/dist/server/auth/index.js

@@ -2,14 +2,14 @@
 // gate, a Kysely-backed session store, login throttle, argon2id passwords, TOTP, and
 // Web-Crypto vault item crypto. The *mechanism* lives here; the *model* (roles,
 // sharing, the `/f`-vs-`/login` policy, session semantics) stays in the apps.
-export { AUTH_COOKIE_NAME, clearAuthCookie, readAuthCookie, writeAuthCookie, } from './cookie';
-export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createCsrfMiddleware } from './csrf';
-export { createRs256FileTokenSigner, } from './fileTokenSigner';
-export { getOnlyEnforcement, isGetOnlyViolation } from './getOnly';
-export { signToken, verifyPurposeToken, verifyToken } from './jwt';
-export { clientKeyOf, clientKeyOfContext, createLoginThrottle, } from './loginThrottle';
-export { createAuthMiddleware } from './middleware';
-export { hashPassword, needsRehash, verifyPassword } from './password';
-export { createSessionStore, } from './sessionStore';
-export { DEFAULT_TOTP_ISSUER, generateRecoveryCodes, generateTotpSecret, getTotpUri, verifyRecoveryCode, verifyTotpCode, } from './totp';
-export { decryptVaultItem, deriveVaultKey, encryptVaultItem } from './vault';
+export { AUTH_COOKIE_NAME, clearAuthCookie, readAuthCookie, writeAuthCookie, } from './cookie.js';
+export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createCsrfMiddleware } from './csrf.js';
+export { createRs256FileTokenSigner, } from './fileTokenSigner.js';
+export { getOnlyEnforcement, isGetOnlyViolation } from './getOnly.js';
+export { signToken, verifyPurposeToken, verifyToken } from './jwt.js';
+export { clientKeyOf, clientKeyOfContext, createLoginThrottle, } from './loginThrottle.js';
+export { createAuthMiddleware } from './middleware.js';
+export { hashPassword, needsRehash, verifyPassword } from './password.js';
+export { createSessionStore, } from './sessionStore.js';
+export { DEFAULT_TOTP_ISSUER, generateRecoveryCodes, generateTotpSecret, getTotpUri, verifyRecoveryCode, verifyTotpCode, } from './totp.js';
+export { decryptVaultItem, deriveVaultKey, encryptVaultItem } from './vault.js';

package/dist/server/auth/jwt.d.ts

@@ -1,5 +1,5 @@
 import { type JWTPayload } from 'jose';
-import type { AppJwtPayload } from './types';
+import type { AppJwtPayload } from './types.js';
 /**
  * Sign an HS256 token. `expiresIn` is a jose duration string (`'15m'`, `'24h'`) or a
  * number of seconds-from-now. `iat`/`exp` are set automatically — pass everything

package/dist/server/auth/middleware.d.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from 'hono';
-import type { AuthEnv, SessionStore } from './types';
+import type { AuthEnv, SessionStore } from './types.js';
 /**
  * The composed auth middleware. Reads the httpOnly `access_token` cookie, verifies
  * the JWT, checks the session is live (present, not revoked, inside its sliding

package/dist/server/auth/middleware.js

@@ -1,6 +1,6 @@
-import { ApiError, toErrorEnvelope } from '../errors';
-import { readAuthCookie } from './cookie';
-import { verifyToken } from './jwt';
+import { ApiError, toErrorEnvelope } from '../errors.js';
+import { readAuthCookie } from './cookie.js';
+import { verifyToken } from './jwt.js';
 /**
  * The composed auth middleware. Reads the httpOnly `access_token` cookie, verifies
  * the JWT, checks the session is live (present, not revoked, inside its sliding

package/dist/server/auth/password.js

@@ -1,4 +1,5 @@
-import { pbkdf2 as pbkdf2Cb, timingSafeEqual } from 'node:crypto';
+import { pbkdf2 as pbkdf2Cb } from 'node:crypto';
+import { constantTimeEqual } from 'cwip/constant-time';
 import { promisify } from 'node:util';
 /**
  * Password hashing on `Bun.password` (argon2id — memory-hard, thread-pooled, zero
@@ -49,11 +50,8 @@ export async function verifyPassword(plain, stored) {
     if (!salt || !expectedHex)
         return false;
     const derived = (await pbkdf2(plain, salt, LEGACY_ITERATIONS, LEGACY_KEYLEN, LEGACY_DIGEST)).toString('hex');
-    // timingSafeEqual throws on length mismatch; a length diff is already a non-match
-    // and short-circuiting leaks nothing a compare wouldn't.
-    if (derived.length !== expectedHex.length)
-        return false;
-    return timingSafeEqual(Buffer.from(derived), Buffer.from(expectedHex));
+    // cwip's fold: no length guard to own, no early exit (task 322).
+    return constantTimeEqual(derived, expectedHex);
 }
 /**
  * True when a stored hash is a legacy (non-argon2id) digest and should be upgraded.

package/dist/server/auth/sessionStore.d.ts

@@ -1,5 +1,5 @@
-import type { PlumbingDb } from '../db/kysely';
-import type { SessionStore } from './types';
+import type { PlumbingDb } from '../db/kysely.js';
+import type { SessionStore } from './types.js';
 export interface SessionStoreOptions {
     /** Sliding refresh window — how long after the last activity a session stays
      * valid. Default 7 days. */

package/dist/server/auth/types.d.ts

@@ -1,5 +1,5 @@
 import type { JWTPayload } from 'jose';
-import type { CursedbeltVariables } from '../context';
+import type { CursedbeltVariables } from '../context.js';
 /**
  * Shared auth types for the cursedbelt server auth toolkit.
  *

package/dist/server/bench/assert.d.ts

@@ -5,7 +5,7 @@
  * replace. {@link assertCpuBudgets} THROWS, so a route that grows past its budget reddens
  * a build instead of adding a line to a log nobody opens.
  */
-import type { CpuBudgetReport } from './recorder';
+import type { CpuBudgetReport } from './recorder.js';
 export type CpuViolationKind = 
 /** p99 above the route's declared (or default) budget. */
 'over-budget'

package/dist/server/bench/assert.js

@@ -5,7 +5,7 @@
  * replace. {@link assertCpuBudgets} THROWS, so a route that grows past its budget reddens
  * a build instead of adding a line to a log nobody opens.
  */
-import { DEFAULT_ROUTE_CPU_BUDGET_MS } from './budget';
+import { DEFAULT_ROUTE_CPU_BUDGET_MS } from './budget.js';
 const fmt = (n) => (Number.isFinite(n) ? n.toFixed(2) : 'n/a');
 /** Compute violations without throwing. {@link assertCpuBudgets} is this plus a throw. */
 export function checkCpuBudgets(report, opts = {}) {

package/dist/server/bench/cpuBudget.d.ts

@@ -1,8 +1,8 @@
 import type { MiddlewareHandler } from 'hono';
-import type { CursedbeltEnv } from '../context';
-import type { CpuBudgetConfig } from './budget';
-import { type CpuClock } from './cpuClock';
-import { type CpuRecorder } from './recorder';
+import type { CursedbeltEnv } from '../context.js';
+import type { CpuBudgetConfig } from './budget.js';
+import { type CpuClock } from './cpuClock.js';
+import { type CpuRecorder } from './recorder.js';
 /**
  * Per-route CPU attribution, mounted like any other cursedbelt middleware.
  *

package/dist/server/bench/cpuBudget.js

@@ -1,6 +1,6 @@
-import { normalizeRoute } from '../metrics/normalizeRoute';
-import { processCpuClock } from './cpuClock';
-import { createCpuRecorder } from './recorder';
+import { normalizeRoute } from '../metrics/normalizeRoute.js';
+import { processCpuClock } from './cpuClock.js';
+import { createCpuRecorder } from './recorder.js';
 export function cpuBudget(opts = {}) {
     const recorder = opts.recorder ??
         createCpuRecorder({ clock: opts.clock ?? processCpuClock(), config: opts.config });

package/dist/server/bench/index.d.ts

@@ -32,9 +32,9 @@
  * Every report carries `proxy: true` and every formatted report says so, because the
  * alternative is a number that gets quoted as a billing fact.
  */
-export { type AssertCpuBudgetsOpts, assertCpuBudgets, checkCpuBudgets, type CpuViolation, type CpuViolationKind, formatCpuBudgetReport, } from './assert';
-export { type CpuBudgetConfig, type CpuBudgetExemption, type CpuBudgetLimit, DAYS_PER_MONTH, DEFAULT_ROUTE_CPU_BUDGET_MS, deriveCpuBudgetMs, isExemption, MEASURED_FLEET_REQUESTS_PER_DAY, monthlyOverageUsd, OWNER_PROJECTED_REQUESTS_PER_DAY, type ResolvedBudget, resolveBudget, type RouteBudget, validateCpuBudgetConfig, WORKERS_PAID_INCLUDED_CPU_MS, WORKERS_PAID_INCLUDED_REQUESTS, WORKERS_PAID_USD_PER_MILLION_CPU_MS, WORKERS_PAID_USD_PER_MILLION_REQUESTS, } from './budget';
-export { type CpuBudgetOpts, cpuBudget } from './cpuBudget';
-export { type CpuClock, type CpuSpan, fixedCpuClock, processCpuClock, resolveCpuClock, unavailableCpuClock, workerCpuClock, } from './cpuClock';
-export { type CpuBudgetReport, type CpuRecorder, type CpuRecorderOpts, createCpuRecorder, percentile, type RouteCpuStats, } from './recorder';
-export { BENCH_ORIGIN, type BenchCase, runCpuBench, type RunCpuBenchOpts } from './runBench';
+export { type AssertCpuBudgetsOpts, assertCpuBudgets, checkCpuBudgets, type CpuViolation, type CpuViolationKind, formatCpuBudgetReport, } from './assert.js';
+export { type CpuBudgetConfig, type CpuBudgetExemption, type CpuBudgetLimit, DAYS_PER_MONTH, DEFAULT_ROUTE_CPU_BUDGET_MS, deriveCpuBudgetMs, isExemption, MEASURED_FLEET_REQUESTS_PER_DAY, monthlyOverageUsd, OWNER_PROJECTED_REQUESTS_PER_DAY, type ResolvedBudget, resolveBudget, type RouteBudget, validateCpuBudgetConfig, WORKERS_PAID_INCLUDED_CPU_MS, WORKERS_PAID_INCLUDED_REQUESTS, WORKERS_PAID_USD_PER_MILLION_CPU_MS, WORKERS_PAID_USD_PER_MILLION_REQUESTS, } from './budget.js';
+export { type CpuBudgetOpts, cpuBudget } from './cpuBudget.js';
+export { type CpuClock, type CpuSpan, fixedCpuClock, processCpuClock, resolveCpuClock, unavailableCpuClock, workerCpuClock, } from './cpuClock.js';
+export { type CpuBudgetReport, type CpuRecorder, type CpuRecorderOpts, createCpuRecorder, percentile, type RouteCpuStats, } from './recorder.js';
+export { BENCH_ORIGIN, type BenchCase, runCpuBench, type RunCpuBenchOpts } from './runBench.js';

package/dist/server/bench/index.js

@@ -32,9 +32,9 @@
  * Every report carries `proxy: true` and every formatted report says so, because the
  * alternative is a number that gets quoted as a billing fact.
  */
-export { assertCpuBudgets, checkCpuBudgets, formatCpuBudgetReport, } from './assert';
-export { DAYS_PER_MONTH, DEFAULT_ROUTE_CPU_BUDGET_MS, deriveCpuBudgetMs, isExemption, MEASURED_FLEET_REQUESTS_PER_DAY, monthlyOverageUsd, OWNER_PROJECTED_REQUESTS_PER_DAY, resolveBudget, validateCpuBudgetConfig, WORKERS_PAID_INCLUDED_CPU_MS, WORKERS_PAID_INCLUDED_REQUESTS, WORKERS_PAID_USD_PER_MILLION_CPU_MS, WORKERS_PAID_USD_PER_MILLION_REQUESTS, } from './budget';
-export { cpuBudget } from './cpuBudget';
-export { fixedCpuClock, processCpuClock, resolveCpuClock, unavailableCpuClock, workerCpuClock, } from './cpuClock';
-export { createCpuRecorder, percentile, } from './recorder';
-export { BENCH_ORIGIN, runCpuBench } from './runBench';
+export { assertCpuBudgets, checkCpuBudgets, formatCpuBudgetReport, } from './assert.js';
+export { DAYS_PER_MONTH, DEFAULT_ROUTE_CPU_BUDGET_MS, deriveCpuBudgetMs, isExemption, MEASURED_FLEET_REQUESTS_PER_DAY, monthlyOverageUsd, OWNER_PROJECTED_REQUESTS_PER_DAY, resolveBudget, validateCpuBudgetConfig, WORKERS_PAID_INCLUDED_CPU_MS, WORKERS_PAID_INCLUDED_REQUESTS, WORKERS_PAID_USD_PER_MILLION_CPU_MS, WORKERS_PAID_USD_PER_MILLION_REQUESTS, } from './budget.js';
+export { cpuBudget } from './cpuBudget.js';
+export { fixedCpuClock, processCpuClock, resolveCpuClock, unavailableCpuClock, workerCpuClock, } from './cpuClock.js';
+export { createCpuRecorder, percentile, } from './recorder.js';
+export { BENCH_ORIGIN, runCpuBench } from './runBench.js';

package/dist/server/bench/recorder.d.ts

@@ -5,8 +5,8 @@
  * reports ~4 ms and looks healthy. The number that decides whether a route is safe to
  * make common is its tail, so the mean is reported beside p99 and never instead of it.
  */
-import { type CpuBudgetConfig } from './budget';
-import type { CpuClock } from './cpuClock';
+import { type CpuBudgetConfig } from './budget.js';
+import type { CpuClock } from './cpuClock.js';
 /**
  * Nearest-rank percentile over an ASCENDING-sorted array: the smallest value at or below
  * which at least `p`% of samples fall. No interpolation — an interpolated p99 reports a

package/dist/server/bench/recorder.js

@@ -5,7 +5,7 @@
  * reports ~4 ms and looks healthy. The number that decides whether a route is safe to
  * make common is its tail, so the mean is reported beside p99 and never instead of it.
  */
-import { resolveBudget, validateCpuBudgetConfig, } from './budget';
+import { resolveBudget, validateCpuBudgetConfig, } from './budget.js';
 /**
  * Nearest-rank percentile over an ASCENDING-sorted array: the smallest value at or below
  * which at least `p`% of samples fall. No interpolation — an interpolated p99 reports a

package/dist/server/bench/runBench.d.ts

@@ -1,5 +1,5 @@
-import type { CpuRecorder } from './recorder';
-import type { CpuBudgetReport } from './recorder';
+import type { CpuRecorder } from './recorder.js';
+import type { CpuBudgetReport } from './recorder.js';
 /**
  * Drive a Hono app's routes and measure what each costs in CPU.
  *

package/dist/server/ctgr.d.ts

@@ -2,7 +2,7 @@ import type { Context, Hono, MiddlewareHandler } from 'hono';
 import type { H } from 'hono/types';
 import type { ChunkStore } from 'cursedbelt-core/ctgr/chunk-store';
 import { type CtgrDecoded, type CtgrMethod } from 'cursedbelt-core/ctgr/types';
-import type { CursedbeltEnv } from './context';
+import type { CursedbeltEnv } from './context.js';
 /**
  * The path pattern that matches EVERY ctgr GET twin (`/ctgr<XX>...`) and nothing
  * else — mount the decode + CSRF + getOnly middleware on this. NOTE: Hono's router

package/dist/server/ctgr.js

@@ -1,6 +1,6 @@
 import { ABBREV_TO_METHOD, METHOD_TO_ABBREV, } from 'cursedbelt-core/ctgr/types';
 import { V0ChunkStore } from 'cursedbelt-core/ctgr/v0compat';
-import { ApiError, toErrorEnvelope } from './errors';
+import { ApiError, toErrorEnvelope } from './errors.js';
 /**
  * The path pattern that matches EVERY ctgr GET twin (`/ctgr<XX>...`) and nothing
  * else — mount the decode + CSRF + getOnly middleware on this. NOTE: Hono's router

package/dist/server/d1/fakeD1.d.ts

@@ -34,7 +34,7 @@
  * it.
  */
 import type { Database } from 'bun:sqlite';
-import type { D1BindingLike } from './remote';
+import type { D1BindingLike } from './remote.js';
 /**
  * Wrap a real `bun:sqlite` database in D1's API and D1's restrictions.
  *

package/dist/server/d1/fakeD1.js

@@ -33,7 +33,7 @@
  * makes a port testable on a laptop, and `190`'s Worker preview is the thing that proves
  * it.
  */
-import { isPureReadSql } from './values';
+import { isPureReadSql } from './values.js';
 /** The bind types a real D1 binding accepts. Everything else throws. */
 function assertD1Bindable(value, index) {
     if (value === null)

package/dist/server/d1/index.d.ts

@@ -14,11 +14,11 @@
  * const ky  = createD1Kysely(db);
  * ```
  */
-export { type BackupPoint, createTimeTravelBackup, type DatabaseBackup, type TimeTravelOpts, } from './backup';
-export { createPendingWrites, type InvocationD1, type PendingWrites, perInvocation, type WriteCollector } from './invocation';
-export { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits';
-export { createLocalD1, refuseInteractiveTransaction } from './local';
-export { createRemoteD1, type D1BindingLike, type D1BindingMeta, type D1BindingResult, type D1BindingStatement, } from './remote';
-export { classifySchedule, cronFieldCount, jobsForCron, type PortableJob, type PortableJobContext, type ScheduleVerdict, toCronTriggers, toFiveField, type TriggerShape, type WorkersPrimitive, } from './scheduling';
-export { D1BindError, type D1LikeBindable, type D1LikeDatabase, type D1LikeMeta, type D1LikeResult, type D1LikeRow, type D1LikeStatement, type D1LikeValue, D1LimitError, D1UnsupportedError, } from './types';
-export { makeMeta, normalizeBind, normalizeBinds, normalizeRow, normalizeRows, normalizeValue } from './values';
+export { type BackupPoint, createTimeTravelBackup, type DatabaseBackup, type TimeTravelOpts, } from './backup.js';
+export { createPendingWrites, type InvocationD1, type PendingWrites, perInvocation, type WriteCollector } from './invocation.js';
+export { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits.js';
+export { createLocalD1, refuseInteractiveTransaction } from './local.js';
+export { createRemoteD1, type D1BindingLike, type D1BindingMeta, type D1BindingResult, type D1BindingStatement, } from './remote.js';
+export { classifySchedule, cronFieldCount, jobsForCron, type PortableJob, type PortableJobContext, type ScheduleVerdict, toCronTriggers, toFiveField, type TriggerShape, type WorkersPrimitive, } from './scheduling.js';
+export { D1BindError, type D1LikeBindable, type D1LikeDatabase, type D1LikeMeta, type D1LikeResult, type D1LikeRow, type D1LikeStatement, type D1LikeValue, D1LimitError, D1UnsupportedError, } from './types.js';
+export { makeMeta, normalizeBind, normalizeBinds, normalizeRow, normalizeRows, normalizeValue } from './values.js';

package/dist/server/d1/index.js

@@ -14,7 +14,7 @@
  * const ky  = createD1Kysely(db);
  * ```
  */
-export { createTimeTravelBackup, } from './backup';
+export { createTimeTravelBackup, } from './backup.js';
 // 🔴 `./localBackup` is deliberately NOT re-exported here — import `checkpointWal`,
 // `createLocalBackup`, `LocalBackupOpts` and `backupFor` from
 // `cursedbelt-server/d1/backup-local`. It reaches `bun:sqlite` for real (via
@@ -33,10 +33,10 @@ export { createTimeTravelBackup, } from './backup';
 // that does not use the query builder — which per `../db/kysely.ts`'s own header is most
 // of them, since business tables stay on raw statements. Measured 2026-09-18 against the
 // published 4.3.0 tarball. `barrelsReachNoOptionalPeer.spec.ts` is what keeps it out.
-export { createPendingWrites, perInvocation } from './invocation';
-export { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits';
-export { createLocalD1, refuseInteractiveTransaction } from './local';
-export { createRemoteD1, } from './remote';
-export { classifySchedule, cronFieldCount, jobsForCron, toCronTriggers, toFiveField, } from './scheduling';
-export { D1BindError, D1LimitError, D1UnsupportedError, } from './types';
-export { makeMeta, normalizeBind, normalizeBinds, normalizeRow, normalizeRows, normalizeValue } from './values';
+export { createPendingWrites, perInvocation } from './invocation.js';
+export { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits.js';
+export { createLocalD1, refuseInteractiveTransaction } from './local.js';
+export { createRemoteD1, } from './remote.js';
+export { classifySchedule, cronFieldCount, jobsForCron, toCronTriggers, toFiveField, } from './scheduling.js';
+export { D1BindError, D1LimitError, D1UnsupportedError, } from './types.js';
+export { makeMeta, normalizeBind, normalizeBinds, normalizeRow, normalizeRows, normalizeValue } from './values.js';

package/dist/server/d1/invocation.d.ts

@@ -48,7 +48,7 @@
  * the same breath — so it lives in the same file. See its own header for why it was moved
  * here on 2026-09-19.
  */
-import { type D1LikeDatabase } from './types';
+import { type D1LikeDatabase } from './types.js';
 /**
  * A database handle that knows how much of its invocation budget it has spent.
  *

package/dist/server/d1/invocation.js

@@ -48,8 +48,8 @@
  * the same breath — so it lives in the same file. See its own header for why it was moved
  * here on 2026-09-19.
  */
-import { LIMITS } from './limits';
-import { D1LimitError } from './types';
+import { LIMITS } from './limits.js';
+import { D1LimitError } from './types.js';
 /**
  * The statements a wrapper handed out, mapped back to the driver's own.
  *

package/dist/server/d1/kysely.d.ts

@@ -27,8 +27,8 @@
  * moved; this is the one to reach for when it does.
  */
 import { type DatabaseIntrospector, type Dialect, type DialectAdapter, type Driver, Kysely, type QueryCompiler } from 'kysely';
-import type { PlumbingSchema } from '../db/plumbingTypes';
-import { type D1LikeDatabase } from './types';
+import type { PlumbingSchema } from '../db/plumbingTypes.js';
+import { type D1LikeDatabase } from './types.js';
 /** The dialect itself — SQLite's adapter, compiler and introspector over our driver. */
 export declare class D1LikeDialect implements Dialect {
     private readonly db;

package/dist/server/d1/kysely.js

@@ -27,8 +27,8 @@
  * moved; this is the one to reach for when it does.
  */
 import { Kysely, SqliteAdapter, SqliteIntrospector, SqliteQueryCompiler, } from 'kysely';
-import { refuseInteractiveTransaction } from './local';
-import { D1UnsupportedError } from './types';
+import { refuseInteractiveTransaction } from './local.js';
+import { D1UnsupportedError } from './types.js';
 /**
  * Kysely compiles to a parameter list that may contain values our seam refuses
  * (`undefined` from an optional column, a `Date` from a careless caller). Passing them

package/dist/server/d1/limits.d.ts

@@ -17,7 +17,7 @@
  *
  * Values are the Workers **Paid** tier, which is what the owner already pays for.
  */
-import { type D1LikeBindable } from './types';
+import { type D1LikeBindable } from './types.js';
 export declare const LIMITS: {
     /** Bound parameters in a single statement. */
     readonly boundParams: 100;

package/dist/server/d1/limits.js

@@ -17,7 +17,7 @@
  *
  * Values are the Workers **Paid** tier, which is what the owner already pays for.
  */
-import { D1LimitError } from './types';
+import { D1LimitError } from './types.js';
 export const LIMITS = {
     /** Bound parameters in a single statement. */
     boundParams: 100,