cursedbelt-server 4.12.0 → 4.13.1

package/src/server/d1/kysely.spec.ts

@@ -7,11 +7,11 @@
 import { Database } from 'bun:sqlite';
 import { describe, expect, test } from 'bun:test';
 import type { Kysely } from 'kysely';
-import { createFakeD1Binding } from './fakeD1';
-import { createD1Kysely } from './kysely';
-import { createLocalD1 } from './local';
-import { createRemoteD1 } from './remote';
-import { D1UnsupportedError, type D1LikeDatabase } from './types';
+import { createFakeD1Binding } from './fakeD1.js';
+import { createD1Kysely } from './kysely.js';
+import { createLocalD1 } from './local.js';
+import { createRemoteD1 } from './remote.js';
+import { D1UnsupportedError, type D1LikeDatabase } from './types.js';
 
 const DDL = `CREATE TABLE app_config (
   key TEXT PRIMARY KEY, value TEXT NOT NULL, updated_at TEXT NOT NULL, updated_by TEXT

package/src/server/d1/kysely.ts

@@ -41,9 +41,9 @@ import {
 	SqliteIntrospector,
 	SqliteQueryCompiler,
 } from 'kysely';
-import type { PlumbingSchema } from '../db/plumbingTypes';
-import { refuseInteractiveTransaction } from './local';
-import { type D1LikeBindable, type D1LikeDatabase, D1UnsupportedError } from './types';
+import type { PlumbingSchema } from '../db/plumbingTypes.js';
+import { refuseInteractiveTransaction } from './local.js';
+import { type D1LikeBindable, type D1LikeDatabase, D1UnsupportedError } from './types.js';
 
 /**
  * Kysely compiles to a parameter list that may contain values our seam refuses

package/src/server/d1/limits.spec.ts

@@ -1,8 +1,8 @@
 import { Database } from 'bun:sqlite';
 import { describe, expect, test } from 'bun:test';
-import { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits';
-import { createLocalD1 } from './local';
-import { D1LimitError } from './types';
+import { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits.js';
+import { createLocalD1 } from './local.js';
+import { D1LimitError } from './types.js';
 
 describe('D1 limits are enforced on the LOCAL driver too', () => {
 	// 🔴 The point of every test here: `bun:sqlite` has none of these caps, so without

package/src/server/d1/limits.ts

@@ -18,7 +18,7 @@
  * Values are the Workers **Paid** tier, which is what the owner already pays for.
  */
 
-import { D1LimitError, type D1LikeBindable } from './types';
+import { D1LimitError, type D1LikeBindable } from './types.js';
 
 export const LIMITS = {
 	/** Bound parameters in a single statement. */

package/src/server/d1/local.ts

@@ -15,7 +15,7 @@
  */
 
 import type { Database } from 'bun:sqlite';
-import { assertBatchSize, assertWithinLimits } from './limits';
+import { assertBatchSize, assertWithinLimits } from './limits.js';
 import {
 	type D1LikeBindable,
 	type D1LikeDatabase,
@@ -24,8 +24,8 @@ import {
 	type D1LikeStatement,
 	type D1LikeValue,
 	D1UnsupportedError,
-} from './types';
-import { isPureReadSql, makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values';
+} from './types.js';
+import { isPureReadSql, makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values.js';
 
 /** Shared clock, so `meta.duration` means the same thing on both sides of the seam. */
 const now = (): number => performance.now();

package/src/server/d1/localBackup.ts

@@ -35,9 +35,9 @@
 import type { Database } from 'bun:sqlite';
 import { existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { snapshotSqlite } from '../sqlite/backup';
-import type { BackupPoint, DatabaseBackup, TimeTravelOpts } from './backup';
-import { createTimeTravelBackup } from './backup';
+import { snapshotSqlite } from '../sqlite/backup.js';
+import type { BackupPoint, DatabaseBackup, TimeTravelOpts } from './backup.js';
+import { createTimeTravelBackup } from './backup.js';
 
 export interface LocalBackupOpts {
 	/** The live handle — checkpointed before the snapshot is taken. */

package/src/server/d1/remote.ts

@@ -15,7 +15,7 @@
  * fake that has no `workerd` in sight.
  */
 
-import { assertBatchSize, assertWithinLimits } from './limits';
+import { assertBatchSize, assertWithinLimits } from './limits.js';
 import {
 	type D1LikeBindable,
 	type D1LikeDatabase,
@@ -24,8 +24,8 @@ import {
 	type D1LikeStatement,
 	type D1LikeValue,
 	D1UnsupportedError,
-} from './types';
-import { makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values';
+} from './types.js';
+import { makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values.js';
 
 /** What D1 reports back about a statement. Its `meta` is richer than the local driver's. */
 export interface D1BindingMeta {

package/src/server/d1/sameShape.spec.ts

@@ -16,10 +16,10 @@
 
 import { Database } from 'bun:sqlite';
 import { beforeEach, describe, expect, test } from 'bun:test';
-import { createFakeD1Binding } from './fakeD1';
-import { createLocalD1 } from './local';
-import { createRemoteD1 } from './remote';
-import { D1BindError, type D1LikeBindable, type D1LikeDatabase } from './types';
+import { createFakeD1Binding } from './fakeD1.js';
+import { createLocalD1 } from './local.js';
+import { createRemoteD1 } from './remote.js';
+import { D1BindError, type D1LikeBindable, type D1LikeDatabase } from './types.js';
 
 const DDL = `CREATE TABLE t (
   id INTEGER PRIMARY KEY,

package/src/server/d1/scheduling.spec.ts

@@ -6,7 +6,7 @@ import {
 	type PortableJob,
 	toCronTriggers,
 	toFiveField,
-} from './scheduling';
+} from './scheduling.js';
 
 const job = (name: string, shape: PortableJob['shape']): PortableJob => ({
 	name,

package/src/server/d1/scheduling.ts

@@ -34,7 +34,7 @@
  * a minute, which would change behaviour in production and nowhere else.
  */
 
-import type { D1LikeDatabase } from './types';
+import type { D1LikeDatabase } from './types.js';
 
 /** The Workers primitive a piece of scheduled work maps onto. */
 export type WorkersPrimitive = 'cron-trigger' | 'queue' | 'durable-object-alarm' | 'unportable';

package/src/server/d1/values.ts

@@ -12,7 +12,7 @@
  * recalled: the probe wrote each type into a `CREATE TABLE t (v)` column and read it back.
  */
 
-import { D1BindError, type D1LikeBindable, type D1LikeMeta, type D1LikeValue } from './types';
+import { D1BindError, type D1LikeBindable, type D1LikeMeta, type D1LikeValue } from './types.js';
 
 /**
  * The largest integer a JS number holds exactly. A `bigint` beyond this cannot survive the

package/src/server/db/kysely.spec.ts

@@ -1,6 +1,6 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { createKysely, type PlumbingDb } from './kysely';
+import { createKysely, type PlumbingDb } from './kysely.js';
 
 const AUTH_SESSIONS_DDL = `CREATE TABLE auth_sessions (
   session_id TEXT PRIMARY KEY, user_id TEXT NOT NULL, created_at TEXT NOT NULL,

package/src/server/db/kysely.ts

@@ -1,7 +1,7 @@
 import type { Database } from 'bun:sqlite';
 import { Kysely } from 'kysely';
 import { BunSqliteDialect } from 'kysely-bun-sqlite';
-import type { PlumbingSchema } from './plumbingTypes';
+import type { PlumbingSchema } from './plumbingTypes.js';
 
 /**
  * A Kysely query builder typed to the {@link PlumbingSchema} plumbing tables, on the

package/src/server/dropzone/index.ts

@@ -21,10 +21,10 @@ export {
 	type DroppedFile,
 	type ScanOptions,
 	type SweepReport,
-} from "./scan";
+} from "./scan.js";
 export {
 	askBinaryServerAboutDuplicate,
 	hashFile,
 	type DuplicateVerdict,
 	type DuplicateQuestion,
-} from "./duplicates";
+} from "./duplicates.js";

package/src/server/dropzone/scan.spec.ts

@@ -10,7 +10,7 @@ import {
 	sweepDropzone,
 	type DropOutcome,
 	type DroppedFile,
-} from "./scan";
+} from "./scan.js";
 
 /**
  * The drop-folder scraper.

package/src/server/errors.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test';
-import { ApiError, isApiError, toErrorEnvelope } from './errors';
+import { ApiError, isApiError, toErrorEnvelope } from './errors.js';
 
 /** ISO-8601 timestamp check + strip, so the dynamic field doesn't break equality. */
 const withoutTimestamp = (env: ReturnType<typeof toErrorEnvelope>) => {

package/src/server/guard/argon2Binding.spec.ts

@@ -21,7 +21,7 @@ import {
   resolveArgon2idDeriver,
   setArgon2idDeriver,
 } from 'cwip/guard';
-import { argon2idDeriverFrom, nodeRsArgon2idBinding, type RawArgon2idBinding, registerNodeRsArgon2id } from './argon2Binding';
+import { argon2idDeriverFrom, nodeRsArgon2idBinding, type RawArgon2idBinding, registerNodeRsArgon2id } from './argon2Binding.js';
 
 /** Cheap parameters — this suite proves the WIRING, not the cost calibration. */
 const FAST = { m: 8_192, t: 1, p: 1 };

package/src/server/guard/argon2Binding.ts

@@ -29,7 +29,7 @@ import {
   CC_ARGON2ID_VERSION,
   setArgon2idDeriver,
 } from 'cwip/guard';
-import { AppError } from '../errors';
+import { AppError } from '../errors.js';
 
 /**
  * The shape of a raw, synchronous argon2id binding, in the REFERENCE

package/src/server/guard/argon2Kat.spec.ts

@@ -43,7 +43,7 @@ import { afterEach, describe, expect, it } from 'bun:test';
 import { deriveArgon2idKey, resolveArgon2idDeriver, setArgon2idDeriver } from 'cwip/guard';
 import { type Algorithm, hashRawSync, type Version } from '@node-rs/argon2';
 
-import { argon2idDeriverFrom, nodeRsArgon2idBinding, registerNodeRsArgon2id } from './argon2Binding';
+import { argon2idDeriverFrom, nodeRsArgon2idBinding, registerNodeRsArgon2id } from './argon2Binding.js';
 /*
  * `Algorithm` and `Version` are declared as AMBIENT CONST ENUMS in the binding's
  * `.d.ts`, and `verbatimModuleSyntax` refuses to read a member off one — the

package/src/server/guard/guard.spec.ts

@@ -12,9 +12,9 @@
 import { generateKeyPairSync } from 'node:crypto';
 import { afterEach, describe, expect, it } from 'bun:test';
 import { deriveArgon2idKey, hasArgon2idDeriver, setArgon2idDeriver } from 'cwip/guard';
-import { ARGON2ID_ALGORITHM, argon2idDeriverFrom, registerArgon2idBinding, type RawArgon2idBinding } from './argon2Binding';
-import { createMemoryAsyncRevocationStore } from './revocationStore';
-import { createSessionSigner } from './sessionSigner';
+import { ARGON2ID_ALGORITHM, argon2idDeriverFrom, registerArgon2idBinding, type RawArgon2idBinding } from './argon2Binding.js';
+import { createMemoryAsyncRevocationStore } from './revocationStore.js';
+import { createSessionSigner } from './sessionSigner.js';
 
 afterEach(() => {
   setArgon2idDeriver(null);

package/src/server/guard/index.ts

@@ -1,7 +1,7 @@
 // The GuardEngine server wiring (02 §4): the argon2id binding adapter that arms
 // cwip's KDF seam, and the Ed25519 session signer that mints and revokes.
-export * from './argon2Binding';
-export * from './passwordVerifier';
-export * from './verifier';
-export * from './revocationStore';
-export * from './sessionSigner';
+export * from './argon2Binding.js';
+export * from './passwordVerifier.js';
+export * from './verifier.js';
+export * from './revocationStore.js';
+export * from './sessionSigner.js';

package/src/server/guard/kdfWorker.spec.ts

@@ -28,9 +28,9 @@ import {
   type KdfWorkerResponse,
   kdfWorkerEntryUrl,
   serveKdfWorker,
-} from './kdfWorker';
-import { createInProcessPasswordVerifier, verifyPasswordEnvelope } from './passwordVerifier';
-import { registerNodeRsArgon2id } from './argon2Binding';
+} from './kdfWorker.js';
+import { createInProcessPasswordVerifier, verifyPasswordEnvelope } from './passwordVerifier.js';
+import { registerNodeRsArgon2id } from './argon2Binding.js';
 
 const password = (value: string): Uint8Array => new TextEncoder().encode(value);
 

package/src/server/guard/kdfWorker.ts

@@ -41,14 +41,14 @@
  * `createMarshalWorkerClient` documents in `core/wire/marshalWorker.ts`; it is
  * repeated here deliberately in the same shape so both read alike.
  */
-import { AppError } from '../errors';
+import { AppError } from '../errors.js';
 import {
   createInProcessPasswordVerifier,
   type PasswordVerifierPort,
   sealPasswordVerifier,
   verifyPasswordEnvelope,
-} from './passwordVerifier';
-import { registerNodeRsArgon2id } from './argon2Binding';
+} from './passwordVerifier.js';
+import { registerNodeRsArgon2id } from './argon2Binding.js';
 
 /** Raised when the worker thread dies, fails to start, or is disposed mid-flight. */
 export const GUARD_KDF_WORKER_FAILED = 'GUARD_KDF_WORKER_FAILED';

package/src/server/guard/kdfWorkerEntry.ts

@@ -11,6 +11,6 @@
  * is not "start the loop" is code running on a thread with a live argon2id
  * binding and a plaintext password in scope.
  */
-import { serveKdfWorker } from './kdfWorker';
+import { serveKdfWorker } from './kdfWorker.js';
 
 await serveKdfWorker();

package/src/server/guard/passwordVerifier.spec.ts

@@ -8,7 +8,7 @@
  */
 import { describe, expect, it } from 'bun:test';
 import type { Argon2idDeriver } from 'cwip/guard';
-import { sealPasswordVerifier, verifyPasswordEnvelope } from './passwordVerifier';
+import { sealPasswordVerifier, verifyPasswordEnvelope } from './passwordVerifier.js';
 
 // A deterministic, PASSWORD-SENSITIVE stand-in for argon2id (the real seam mixes
 // far more): the output must depend on the password, or a "wrong password" would

package/src/server/guard/passwordVerifier.ts

@@ -29,7 +29,7 @@
  *     every path including a thrown KDF. Callers hand over ownership and must not
  *     touch the buffer afterwards.
  */
-import { timingSafeEqual } from 'node:crypto';
+import { constantTimeEqualBytes } from 'cwip/constant-time';
 import {
   type Argon2idDeriver,
   createSecretEnvelopeManager,
@@ -38,7 +38,7 @@ import {
   serializeSecretEnvelope,
   zeroize,
 } from 'cwip/guard';
-import { isAppError } from '../errors';
+import { isAppError } from '../errors.js';
 
 /**
  * The reserved AAD app namespace for password verifiers. `SecretEnvelope` forbids
@@ -79,7 +79,7 @@ export function sealPasswordVerifier(userId: string, password: Uint8Array, deriv
  * stored envelope is corruption, not a wrong password, and re-throws.
  *
  * The comparison is constant-time in the sensitive part: argon2id derivation
- * dominates the timing, and GCM tag verification plus the final `timingSafeEqual`
+ * dominates the timing, and GCM tag verification plus the final `constantTimeEqualBytes`
  * are constant-time, so a right and a wrong password of equal length are
  * indistinguishable by timing.
  */
@@ -106,7 +106,7 @@ export function verifyPasswordEnvelope(
     // openWithPassphrase re-derives a one-shot key from the envelope's own salt +
     // the presented password, opens, and zeroizes `password` on every path.
     opened = manager.openWithPassphrase(envelope, refFor(userId), password);
-    return opened.byteLength === VERIFIER_PLAINTEXT.byteLength && timingSafeEqual(opened, VERIFIER_PLAINTEXT);
+    return constantTimeEqualBytes(opened, VERIFIER_PLAINTEXT);
   } catch (error) {
     // GCM's rejection is the wrong-password verdict — the ONLY error we swallow.
     if (isAppError(error) && error.code === 'SECRET_ENVELOPE_AUTH_FAILED') return false;

package/src/server/guard/revocationStore.spec.ts

@@ -4,7 +4,7 @@ import {
   createMemoryAsyncRevocationStore,
   createMemoryRevocationStore,
   createSqliteRevocationStore,
-} from './revocationStore';
+} from './revocationStore.js';
 
 describe('sync memory revocation store', () => {
   it('records, answers, and sweeps by ms expiry', () => {
@@ -119,7 +119,7 @@ describe('async-backed revocation store (the cross-node bridge)', () => {
 
   it('a backing failure is reported, never thrown out of the request path', async () => {
     const ops: string[] = [];
-    const boom: import('./revocationStore').AsyncRevocationStore = {
+    const boom: import('./revocationStore.js').AsyncRevocationStore = {
       set: () => Promise.reject(new Error('set failed')),
       get: () => Promise.reject(new Error('get failed')),
       prune: () => Promise.reject(new Error('prune failed')),

package/src/server/guard/sessionSigner.ts

@@ -20,9 +20,9 @@
  */
 import { createPrivateKey, createPublicKey, generateKeyPairSync, type KeyObject, sign, verify } from 'node:crypto';
 import { type CCUserClaims, CCUserClaimsSchema } from 'cursedbelt-core/session/claims';
-import { AppError } from '../errors';
-import type { GuardVerification, GuardVerifier } from './verifier';
-import type { AsyncRevocationStore } from './revocationStore';
+import { AppError } from '../errors.js';
+import type { GuardVerification, GuardVerifier } from './verifier.js';
+import type { AsyncRevocationStore } from './revocationStore.js';
 
 export interface SessionSignerOptions {
   /**

package/src/server/incidents/checks.ts

@@ -18,8 +18,8 @@
  * a sweep reports its own failures so the console can show a detector that has
  * stopped working, rather than showing an empty incident list and looking calm.
  */
-import type { IncidentStore } from "./store";
-import type { IncidentReport, IncidentTransitions } from "./types";
+import type { IncidentStore } from "./store.js";
+import type { IncidentReport, IncidentTransitions } from "./types.js";
 
 export interface IncidentCheck {
 	/** Stable key. Owns every incident it has ever opened — see `reconcile`. */

package/src/server/incidents/incidents.spec.ts

@@ -14,13 +14,13 @@
  */
 import { Database } from "bun:sqlite";
 import { beforeEach, describe, expect, test } from "bun:test";
-import type { ChannelMessage, ChannelResult, IncidentChannel } from "./channels";
-import { createTextChannel } from "./channels";
-import { type IncidentCheck, runIncidentSweep } from "./checks";
-import { createIncidentNotifier, UNDELIVERED_RETRY_MS } from "./notifier";
-import { createIncidentReporter } from "./reporter";
-import { createIncidentStore, type IncidentStore } from "./store";
-import type { IncidentReport } from "./types";
+import type { ChannelMessage, ChannelResult, IncidentChannel } from "./channels.js";
+import { createTextChannel } from "./channels.js";
+import { type IncidentCheck, runIncidentSweep } from "./checks.js";
+import { createIncidentNotifier, UNDELIVERED_RETRY_MS } from "./notifier.js";
+import { createIncidentReporter } from "./reporter.js";
+import { createIncidentStore, type IncidentStore } from "./store.js";
+import type { IncidentReport } from "./types.js";
 
 const stuckIngest = (failed = 42): IncidentReport => ({
 	source: "station",

package/src/server/incidents/index.ts

@@ -53,14 +53,14 @@ export {
 	type IncidentChannel,
 	type SendEmail,
 	type TextChannelOptions,
-} from "./channels";
+} from "./channels.js";
 export {
 	type CheckOutcome,
 	type IncidentCheck,
 	runIncidentSweep,
 	type SweepResult,
-} from "./checks";
-export { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations";
+} from "./checks.js";
+export { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations.js";
 export {
 	type AnnounceResult,
 	composeOpened,
@@ -68,23 +68,23 @@ export {
 	type CreateNotifierOptions,
 	createIncidentNotifier,
 	type IncidentNotifier,
-} from "./notifier";
+} from "./notifier.js";
 export {
 	createIncidentReporter,
 	type IncidentReporter,
 	type IncidentReporterOptions,
-} from "./reporter";
+} from "./reporter.js";
 export {
 	type IncidentRoutesOptions,
 	mountIncidentMachineRoutes,
 	mountIncidentOwnerRoutes,
-} from "./routes";
+} from "./routes.js";
 export {
 	assertNoContent,
 	createIncidentStore,
 	type IncidentStore,
 	type ReconcileOptions,
-} from "./store";
+} from "./store.js";
 export {
 	fingerprint,
 	type Incident,
@@ -93,4 +93,4 @@ export {
 	type IncidentSeverity,
 	type IncidentState,
 	type IncidentTransitions,
-} from "./types";
+} from "./types.js";

package/src/server/incidents/migrations.ts

@@ -1,5 +1,5 @@
 import type { Database } from "bun:sqlite";
-import type { Migration } from "../migration/types";
+import type { Migration } from "../migration/types.js";
 
 /** The one table this primitive owns. */
 export const INCIDENTS_TABLE = "incidents";

package/src/server/incidents/notifier.ts

@@ -28,9 +28,9 @@
  * the store (`assertNoContent`). A text message is the least private surface
  * this fleet has and several of its apps are private by construction.
  */
-import type { ChannelMessage, ChannelResult, IncidentChannel } from "./channels";
-import type { IncidentStore } from "./store";
-import type { Incident, IncidentTransitions } from "./types";
+import type { ChannelMessage, ChannelResult, IncidentChannel } from "./channels.js";
+import type { IncidentStore } from "./store.js";
+import type { Incident, IncidentTransitions } from "./types.js";
 
 export interface IncidentNotifier {
 	/** Send for every transition in `t`. Returns one result per message sent. */

package/src/server/incidents/reporter.ts

@@ -28,7 +28,7 @@
  * than one with no alerting. Every failure here is logged and swallowed, and the
  * console notices the silence by other means (the service's own health probe).
  */
-import type { IncidentReport } from "./types";
+import type { IncidentReport } from "./types.js";
 
 export interface IncidentReporterOptions {
 	/** e.g. `http://127.0.0.1:3024/api/station/incidents/report`. */

package/src/server/incidents/routes.ts

@@ -35,11 +35,11 @@
  * correct.
  */
 import type { Hono } from "hono";
-import type { IncidentChannel } from "./channels";
-import type { IncidentNotifier } from "./notifier";
-import { assertNoContent, type IncidentStore } from "./store";
-import type { IncidentReport, IncidentSeverity } from "./types";
-import type { SweepResult } from "./checks";
+import type { IncidentChannel } from "./channels.js";
+import type { IncidentNotifier } from "./notifier.js";
+import { assertNoContent, type IncidentStore } from "./store.js";
+import type { IncidentReport, IncidentSeverity } from "./types.js";
+import type { SweepResult } from "./checks.js";
 
 const noStore = { "cache-control": "no-store" } as const;
 

package/src/server/incidents/store.ts

@@ -28,15 +28,15 @@
  * of all across the restart a deploy of the console itself performs.
  */
 import type { Database } from "bun:sqlite";
-import { runMigrations } from "../migration/runner";
-import { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations";
+import { runMigrations } from "../migration/runner.js";
+import { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations.js";
 import {
 	fingerprint,
 	type Incident,
 	type IncidentFact,
 	type IncidentReport,
 	type IncidentTransitions,
-} from "./types";
+} from "./types.js";
 
 interface Row {
 	fingerprint: string;