cursedbelt-server 4.12.0 → 4.13.1

package/src/server/index.ts

@@ -19,7 +19,7 @@ export {
   type UploadedFile,
 } from 'cursedbelt-core/ctgr';
 // ── HTTP app ────────────────────────────────────────────────────────────────
-export { type CreateAppOpts, createApp, type ServeBunOpts, serveBun } from './app';
+export { type CreateAppOpts, createApp, type ServeBunOpts, serveBun } from './app.js';
 // ── Auth toolkit (task 26): jose JWT, cookies, CSRF, getOnly, session store, ──
 //    login throttle, argon2id passwords, TOTP, vault crypto, the composed middleware.
 export {
@@ -65,11 +65,11 @@ export {
   verifyRecoveryCode,
   verifyToken,
   verifyTotpCode,
-} from './auth';
-export type { CursedbeltEnv, CursedbeltVariables } from './context';
-export { buildRoutes, CTGR_ROUTE_PATTERN, getCtgrDecoded, unGETify } from './ctgr';
+} from './auth/index.js';
+export type { CursedbeltEnv, CursedbeltVariables } from './context.js';
+export { buildRoutes, CTGR_ROUTE_PATTERN, getCtgrDecoded, unGETify } from './ctgr.js';
 // ── Kysely-typed plumbing tables ────────────────────────────────────────────
-export { createKysely, type PlumbingDb } from './db/kysely';
+export { createKysely, type PlumbingDb } from './db/kysely.js';
 export type {
   AppConfigRow,
   AuthSessionRow,
@@ -81,7 +81,7 @@ export type {
   PlumbingSchema,
   RequestMetricRow,
   SystemSampleRow,
-} from './db/plumbingTypes';
+} from './db/plumbingTypes.js';
 // ── Errors ──────────────────────────────────────────────────────────────────
 export {
   ApiError,
@@ -93,7 +93,7 @@ export {
   VALIDATION_ERROR_CODE,
   type ValidationIssue,
   validationEnvelope,
-} from './errors';
+} from './errors.js';
 // ── Jobs & scheduler (task 29): plainjob-backed cron runner + restart-aware ───
 //    pollers + the due-row fire queue. App job *definitions* stay business.
 export {
@@ -114,7 +114,7 @@ export {
   JobTimeoutError,
   type PollingJob,
   type PollingJobOpts,
-} from './jobs';
+} from './jobs/index.js';
 // ── Media adapter (task 19): image rendering via sharp (lazy/optional peer) + ──
 //    video trim / probe / thumbnail via native ffmpeg. Also at the dedicated
 //    media-bun entry below; sharp is imported lazily inside renderImage,
@@ -135,15 +135,15 @@ export {
   trimVideo,
   type VideoCodecPlan,
   videoCodecPlan,
-} from './media-bun';
+} from './media-bun/index.js';
 // ── Metrics ───────────────────────────────────────────────────────────────────
 export {
   createMetricsBuffer,
   type MetricRow,
   type MetricsBuffer,
   type MetricsBufferOptions,
-} from './metrics/metricsBuffer';
-export { normalizeRoute } from './metrics/normalizeRoute';
+} from './metrics/metricsBuffer.js';
+export { normalizeRoute } from './metrics/normalizeRoute.js';
 export {
   type AnalyticsEngineDataset,
   createTelemetrySink,
@@ -152,26 +152,26 @@ export {
   type TelemetrySink,
   type TelemetrySinkOptions,
   toDataPoint,
-} from './metrics/telemetrySink';
+} from './metrics/telemetrySink.js';
 // ── Middleware ────────────────────────────────────────────────────────────────
-export { correlationId } from './middleware/correlationId';
-export { type CorsOpts, corsAllowlist, corsOptsFromEnv } from './middleware/corsAllowlist';
-export { errorEnvelope } from './middleware/errorEnvelope';
-export { crossOriginRefusal } from './middleware/localOrigin';
-export { clientIp, createRateLimiter, type RateLimitOpts } from './middleware/rateLimit';
-export { type RequestLoggerOpts, requestLogger } from './middleware/requestLogger';
+export { correlationId } from './middleware/correlationId.js';
+export { type CorsOpts, corsAllowlist, corsOptsFromEnv } from './middleware/corsAllowlist.js';
+export { errorEnvelope } from './middleware/errorEnvelope.js';
+export { crossOriginRefusal } from './middleware/localOrigin.js';
+export { clientIp, createRateLimiter, type RateLimitOpts } from './middleware/rateLimit.js';
+export { type RequestLoggerOpts, requestLogger } from './middleware/requestLogger.js';
 export {
   type CspDirectives,
   type SecurityHeadersOpts,
   securityHeaders,
-} from './middleware/securityHeaders';
+} from './middleware/securityHeaders.js';
 // ── zod validation toolkit ────────────────────────────────────────────────────
 //    (the `validationEnvelope`/`toValidationIssues`/`ValidationIssue` builders now
 //     live with the canonical envelope in `./errors`, re-exported above.)
-export { type ZValidatorTarget, zValidator } from './middleware/zValidator';
+export { type ZValidatorTarget, zValidator } from './middleware/zValidator.js';
 // ── Migration runner ──────────────────────────────────────────────────────────
-export { addColumnIfMissing, applyRecommendedPragmas, columnExists, runMigrations } from './migration/runner';
-export type { Migration } from './migration/types';
+export { addColumnIfMissing, applyRecommendedPragmas, columnExists, runMigrations } from './migration/runner.js';
+export type { Migration } from './migration/types.js';
 // ── Audit log: the SQLite-backed AuditSink cursedshell's service dispatch ─────
 //    writes to (see `cwip/audit` for the storage-agnostic contract + the
 //    zero-config in-memory default).
@@ -181,7 +181,7 @@ export {
   auditStateAtVersion,
   auditStep,
   createSqliteAuditSink,
-} from './audit';
+} from './audit/index.js';
 // ── SQLite toolkit extras (task 30): FTS5 ranked search + DDL generator, the ───
 //    read-only DB viewer middleware, the VACUUM-INTO backup service, DB health probes.
 export {
@@ -232,7 +232,7 @@ export {
   type TableExportFormat,
   type TableStat,
   UnknownTableError,
-} from './sqlite';
+} from './sqlite/index.js';
 // ── WebSocket hub (task 28): Bun-native upgrade, channel registry, heartbeat, ──
 //    presence-as-a-view, room helpers, and the push-only event-bus subset (ru).
 export {
@@ -254,9 +254,9 @@ export {
   type WsHub,
   type WsHubOpts,
   type WsMessage,
-} from './ws';
+} from './ws/index.js';
 
 // The app-data root resolver. Exported at the root (2026-09-15, task 148) because
 // `cursedbelt-cc`'s localHost needs it and it answers a question about the HOST, not
 // about any one subsystem — so no subpath barrel is its natural home.
-export { resolveAppDataHome } from './paths/appDataHome';
+export { resolveAppDataHome } from './paths/appDataHome.js';

package/src/server/jobs/fireQueue.spec.ts

@@ -1,6 +1,6 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { createFireQueue } from './fireQueue';
+import { createFireQueue } from './fireQueue.js';
 
 const JOB_STATE_DDL = `CREATE TABLE job_state (name TEXT PRIMARY KEY, last_run_at TEXT, meta TEXT)`;
 const sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));

package/src/server/jobs/fireQueue.ts

@@ -1,6 +1,6 @@
-import { defaultJobLogger } from './logger';
-import { createPollingJob } from './polling';
-import { DEFAULT_FIRE_INTERVAL_MS, type FireQueue, type FireQueueOpts } from './types';
+import { defaultJobLogger } from './logger.js';
+import { createPollingJob } from './polling.js';
+import { DEFAULT_FIRE_INTERVAL_MS, type FireQueue, type FireQueueOpts } from './types.js';
 
 /**
  * The "select due rows → deliver each → mark sent" pattern, as a {@link PollingJob}.

package/src/server/jobs/index.ts

@@ -3,12 +3,12 @@
 // restart-aware pollers, the due-row fire queue, run auditing); app job
 // *definitions* stay business and consume these primitives.
 
-export { createFireQueue } from './fireQueue';
-export { defaultJobLogger } from './logger';
-export { createPlainjobConnection } from './plainjobAdapter';
-export { createPollingJob } from './polling';
-export { createJobRunner } from './runner';
-export { JobTimeoutError } from './timeout';
+export { createFireQueue } from './fireQueue.js';
+export { defaultJobLogger } from './logger.js';
+export { createPlainjobConnection } from './plainjobAdapter.js';
+export { createPollingJob } from './polling.js';
+export { createJobRunner } from './runner.js';
+export { JobTimeoutError } from './timeout.js';
 export {
   type CreateJobRunnerOptions,
   DEFAULT_FIRE_INTERVAL_MS,
@@ -24,4 +24,4 @@ export {
   type JobRunRecord,
   type PollingJob,
   type PollingJobOpts,
-} from './types';
+} from './types.js';

package/src/server/jobs/logger.ts

@@ -1,4 +1,4 @@
-import type { JobLogger } from './types';
+import type { JobLogger } from './types.js';
 
 /**
  * The default job logger: warn/info/error go to the console, `debug` is a no-op.

package/src/server/jobs/plainjobAdapter.spec.ts

@@ -1,6 +1,6 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { createPlainjobConnection } from './plainjobAdapter';
+import { createPlainjobConnection } from './plainjobAdapter.js';
 
 describe('createPlainjobConnection', () => {
   let db: Database;

package/src/server/jobs/polling.spec.ts

@@ -1,6 +1,6 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { createPollingJob } from './polling';
+import { createPollingJob } from './polling.js';
 
 const JOB_STATE_DDL = `CREATE TABLE job_state (
   name TEXT PRIMARY KEY,

package/src/server/jobs/polling.ts

@@ -1,5 +1,5 @@
-import { defaultJobLogger } from './logger';
-import type { JobContext, PollingJob, PollingJobOpts } from './types';
+import { defaultJobLogger } from './logger.js';
+import type { JobContext, PollingJob, PollingJobOpts } from './types.js';
 
 /**
  * A periodic, restart-aware poller — the engine behind ca's `setInterval`

package/src/server/jobs/runner.spec.ts

@@ -1,8 +1,8 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { ApiError } from '../errors';
-import { createJobRunner } from './runner';
-import { JobTimeoutError } from './timeout';
+import { ApiError } from '../errors.js';
+import { createJobRunner } from './runner.js';
+import { JobTimeoutError } from './timeout.js';
 
 const JOB_RUNS_DDL = `CREATE TABLE job_runs (
   id TEXT PRIMARY KEY,

package/src/server/jobs/runner.ts

@@ -1,9 +1,9 @@
 import type { Database } from 'bun:sqlite';
 import { defineQueue, defineWorker, type Queue, type Worker } from 'plainjob';
-import { ApiError } from '../errors';
-import { defaultJobLogger } from './logger';
-import { createPlainjobConnection } from './plainjobAdapter';
-import { withTimeout } from './timeout';
+import { ApiError } from '../errors.js';
+import { defaultJobLogger } from './logger.js';
+import { createPlainjobConnection } from './plainjobAdapter.js';
+import { withTimeout } from './timeout.js';
 import {
   type CreateJobRunnerOptions,
   DEFAULT_JOB_RETENTION,
@@ -13,7 +13,7 @@ import {
   type JobLogger,
   type JobRunner,
   type JobRunRecord,
-} from './types';
+} from './types.js';
 
 /**
  * Create the durable cron job runner — a thin facade over **plainjob** (MIT,

package/src/server/jobs/timeout.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test';
-import { JobTimeoutError, withTimeout } from './timeout';
+import { JobTimeoutError, withTimeout } from './timeout.js';
 
 const sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));
 

package/src/server/master-lock/accounts.spec.ts

@@ -20,8 +20,8 @@ import {
 	type MasterLockKdfParams,
 	deriveMasterLockVerifier,
 } from "cursedbelt-core/master-lock";
-import { FIRST_ACCOUNT_ID, MasterLock, readRecord } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
+import { FIRST_ACCOUNT_ID, MasterLock, readRecord } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 /** `iter: 1` — the ROUND COUNT is pinned in `cursedbelt-core`'s `kdf.spec.ts`; 600k × N
  *  argon2 verifies here would be minutes of gate for nothing this file is testing. */

package/src/server/master-lock/accountsPage.spec.ts

@@ -22,10 +22,10 @@ import {
 	MASTER_LOCK_ACCOUNTS_SCRIPT,
 	MASTER_LOCK_ACCOUNTS_STYLE,
 	accountsPageHtml,
-} from "./accountsPage";
-import { createMasterLockGuard } from "./guard";
-import { MasterLock } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
+} from "./accountsPage.js";
+import { createMasterLockGuard } from "./guard.js";
+import { MasterLock } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,

package/src/server/master-lock/accountsPage.ts

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions } from "./lockPage";
+import { MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions } from "./lockPage.js";
 
 /**
  * The page's own two assets.

package/src/server/master-lock/beaconNeverReachesTheWall.spec.ts

@@ -12,10 +12,10 @@ import {
 	foreignScriptSources,
 	htmlCarriesWebAnalytics,
 	scriptsRefusedByCsp,
-} from "../analytics";
-import { MASTER_LOCK_CSP, createMasterLockGuard } from "./guard";
-import { MasterLock } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
+} from "../analytics/index.js";
+import { MASTER_LOCK_CSP, createMasterLockGuard } from "./guard.js";
+import { MasterLock } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 /**
  * 🔴 **The wall never carries the beacon, and the public shells always do.** Both halves, in

package/src/server/master-lock/guard.spec.ts

@@ -13,9 +13,9 @@ import {
 	deriveMasterLockVerifier,
 	newMasterLockKdfParams,
 } from "cursedbelt-core/master-lock";
-import { createMasterLockGuard } from "./guard";
-import { MasterLock } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
+import { createMasterLockGuard } from "./guard.js";
+import { MasterLock } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,

package/src/server/master-lock/guard.ts

@@ -22,9 +22,9 @@ import {
 	MASTER_LOCK_ACCOUNTS_SCRIPT,
 	MASTER_LOCK_ACCOUNTS_STYLE,
 	accountsPageHtml,
-} from "./accountsPage";
-import { LOCK_SCRIPT, LOCK_STYLE, type LockPageOptions, lockPageHtml } from "./lockPage";
-import type { MasterLock } from "./masterLock";
+} from "./accountsPage.js";
+import { LOCK_SCRIPT, LOCK_STYLE, type LockPageOptions, lockPageHtml } from "./lockPage.js";
+import type { MasterLock } from "./masterLock.js";
 
 export interface MasterLockGuardOptions extends LockPageOptions {
 	/**

package/src/server/master-lock/index.ts

@@ -26,26 +26,26 @@ export {
 	MASTER_LOCK_ACCOUNTS_STYLE,
 	MASTER_LOCK_MIN_PASSWORD_LENGTH,
 	accountsPageHtml,
-} from "./accountsPage";
+} from "./accountsPage.js";
 export {
 	MASTER_LOCK_CSP,
 	type MasterLockGuard,
 	type MasterLockGuardOptions,
 	createMasterLockGuard,
-} from "./guard";
+} from "./guard.js";
 export {
 	LOCK_SCRIPT,
 	LOCK_STYLE,
 	MASTER_LOCK_DERIVE_SOURCE,
 	type LockPageOptions,
 	lockPageHtml,
-} from "./lockPage";
+} from "./lockPage.js";
 export {
 	MASTER_LOCK_PRINCIPAL_KEY_PREFIX,
 	MasterLockDirectory,
 	type MasterLockDirectoryOptions,
 	masterLockPrincipalKey,
-} from "./principals";
+} from "./principals.js";
 export {
 	FIRST_ACCOUNT_ID,
 	MasterLock,
@@ -57,17 +57,17 @@ export {
 	type MasterLockStore,
 	type MasterLockUnlockResult,
 	readRecord,
-} from "./masterLock";
+} from "./masterLock.js";
 export {
 	DEFAULT_SEED_IDLE_MS,
 	generateStagePassword,
 	type MintMasterLockSeedOptions,
 	mintMasterLockSeed,
 	serializeMasterLockSeed,
-} from "./seed";
+} from "./seed.js";
 export {
 	MASTER_LOCK_SETTING_KEY,
 	MASTER_LOCK_STATE_KEY,
 	createKvMasterLockStore,
 	createMemoryMasterLockStore,
-} from "./store";
+} from "./store.js";

package/src/server/master-lock/lockPage.spec.ts

@@ -13,8 +13,8 @@
  */
 import { describe, expect, test } from "bun:test";
 import { MASTER_LOCK_PATHS, type MasterLockKdfParams, deriveMasterLockVerifier } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_ACCOUNTS_SCRIPT } from "./accountsPage";
-import { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml } from "./lockPage";
+import { MASTER_LOCK_ACCOUNTS_SCRIPT } from "./accountsPage.js";
+import { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml } from "./lockPage.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,

package/src/server/master-lock/masterLock.spec.ts

@@ -13,8 +13,8 @@ import {
 	deriveMasterLockVerifier,
 	newMasterLockKdfParams,
 } from "cursedbelt-core/master-lock";
-import { MasterLock, readRecord } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
+import { MasterLock, readRecord } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,

package/src/server/master-lock/masterLock.ts

@@ -48,6 +48,7 @@
  * one who has been guessing.
  */
 import { createHash } from "node:crypto";
+import { constantTimeEqual } from "cwip/constant-time";
 import {
 	type MasterLockAccountSummary,
 	type MasterLockKdfParams,
@@ -1064,13 +1065,3 @@ function presentedTokens(req: Request): string[] {
 	}
 	return out;
 }
-
-function constantTimeEqual(a: string, b: string): boolean {
-	const x = Buffer.from(a);
-	const y = Buffer.from(b);
-	// A length difference is already a non-match, and `timingSafeEqual` throws on one.
-	if (x.length !== y.length) return false;
-	let diff = 0;
-	for (let i = 0; i < x.length; i += 1) diff |= x[i] ^ y[i];
-	return diff === 0;
-}

package/src/server/master-lock/principals.spec.ts

@@ -22,10 +22,10 @@ import {
 	deriveMasterLockVerifier,
 	newMasterLockKdfParams,
 } from "cursedbelt-core/master-lock";
-import { createMasterLockGuard } from "./guard";
-import { MasterLock, type MasterLockStore } from "./masterLock";
-import { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, masterLockPrincipalKey } from "./principals";
-import { createMemoryMasterLockStore } from "./store";
+import { createMasterLockGuard } from "./guard.js";
+import { MasterLock, type MasterLockStore } from "./masterLock.js";
+import { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, masterLockPrincipalKey } from "./principals.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,

package/src/server/master-lock/principals.ts

@@ -46,7 +46,7 @@
  * record is stored under, which is the only thing it ever really was.
  */
 import { createHash } from "node:crypto";
-import { MasterLock, type MasterLockStore, readRecord } from "./masterLock";
+import { MasterLock, type MasterLockStore, readRecord } from "./masterLock.js";
 
 /** Namespace for every per-person record, so one glance at the table says what they are. */
 export const MASTER_LOCK_PRINCIPAL_KEY_PREFIX = "master_lock:principal:";

package/src/server/master-lock/seed.spec.ts

@@ -1,8 +1,8 @@
 import { describe, expect, it } from "bun:test";
 import { deriveMasterLockVerifier } from "cursedbelt-core/master-lock/kdf";
-import { MasterLock, readRecord } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
-import { generateStagePassword, mintMasterLockSeed, serializeMasterLockSeed } from "./seed";
+import { MasterLock, readRecord } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
+import { generateStagePassword, mintMasterLockSeed, serializeMasterLockSeed } from "./seed.js";
 
 describe("mintMasterLockSeed", () => {
 	// The whole point: a seed minted here must UNLOCK, through the real engine,

package/src/server/master-lock/seed.ts

@@ -28,7 +28,7 @@ import {
 	deriveMasterLockVerifier,
 	newMasterLockKdfParams,
 } from "cursedbelt-core/master-lock/kdf";
-import { FIRST_ACCOUNT_ID, type MasterLockRecord } from "./masterLock";
+import { FIRST_ACCOUNT_ID, type MasterLockRecord } from "./masterLock.js";
 
 /**
  * The idle window a freshly minted lock starts with.

package/src/server/master-lock/store.ts

@@ -6,7 +6,7 @@
  * `app_settings`, a `Map` in a test. Asking for a whole table would be asking each adopter
  * to write a migration for three fields.
  */
-import type { MasterLockStore } from "./masterLock";
+import type { MasterLockStore } from "./masterLock.js";
 
 /** The default key, so two apps' rows look the same when somebody goes looking. */
 export const MASTER_LOCK_SETTING_KEY = "master_lock:record";

package/src/server/media-bun/image.spec.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test';
 import type { ImagePipelineSpec } from 'cursedbelt-core/media';
-import { renderImage } from './image';
+import { renderImage } from './image.js';
 
 // sharp is an OPTIONAL peer — skip this whole suite cleanly when it isn't installed.
 let sharpFactory: typeof import('sharp').default | null = null;

package/src/server/media-bun/index.ts

@@ -14,7 +14,7 @@ export {
   type VideoCodecPlan,
   videoCodecPlan,
 } from 'cursedbelt-core/media/ffmpeg';
-export { renderImage } from './image';
+export { renderImage } from './image.js';
 // Streaming pipeline: faststart remux, HLS adaptive-bitrate ladder, scrub sprite + WebVTT,
 // poster, codec-aware probe — pure builders/parsers (testable without ffmpeg).
 export {
@@ -39,7 +39,7 @@ export {
   type SpritePlan,
   spriteArgs,
   type VideoProbe,
-} from './streaming';
+} from './streaming.js';
 export {
   extractFrameJpeg,
   extractThumbnail,
@@ -49,4 +49,4 @@ export {
   probeVideoStream,
   runFfmpegProgress,
   trimVideo,
-} from './video';
+} from './video.js';

package/src/server/media-bun/streaming.spec.ts

@@ -9,7 +9,7 @@ import {
   planSprite,
   resolveLadder,
   type VideoProbe,
-} from './streaming';
+} from './streaming.js';
 
 const probe = (over: Partial<VideoProbe> = {}): VideoProbe => ({
   duration: 100,

package/src/server/media-bun/video.spec.ts

@@ -3,7 +3,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { VideoProgressEvent } from 'cursedbelt-core/media';
-import { extractThumbnail, isFfmpegAvailable, probeMedia, trimVideo } from './video';
+import { extractThumbnail, isFfmpegAvailable, probeMedia, trimVideo } from './video.js';
 
 // ffmpeg/ffprobe are required for these; skip cleanly if absent (CI without them).
 const haveFfmpeg = await isFfmpegAvailable();

package/src/server/media-bun/video.ts

@@ -23,7 +23,7 @@ import {
   parseProgressMicros,
   parseStreamProbe,
   type VideoProbe,
-} from './streaming';
+} from './streaming.js';
 
 const FFMPEG = process.env.FFMPEG_PATH || 'ffmpeg';
 const FFPROBE = process.env.FFPROBE_PATH || 'ffprobe';

package/src/server/metrics/normalizeRoute.spec.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test';
 import { Hono } from 'hono';
-import { normalizeRoute } from './normalizeRoute';
+import { normalizeRoute } from './normalizeRoute.js';
 
 // Probe through a real Hono app so `c.req.routePath` is the genuine matched pattern.
 async function labelFor(register: (app: Hono) => void, request: Request): Promise<string> {

package/src/server/metrics/telemetrySink.spec.ts

@@ -1,14 +1,14 @@
 import { Database } from 'bun:sqlite';
 import { beforeEach, describe, expect, it } from 'bun:test';
 import { Hono } from 'hono';
-import { type RequestLoggerOpts, requestLogger } from '../middleware/requestLogger';
-import { createMetricsBuffer } from './metricsBuffer';
+import { type RequestLoggerOpts, requestLogger } from '../middleware/requestLogger.js';
+import { createMetricsBuffer } from './metricsBuffer.js';
 import {
   type AnalyticsEngineDataset,
   createTelemetrySink,
   type TelemetrySink,
   toDataPoint,
-} from './telemetrySink';
+} from './telemetrySink.js';
 
 /**
  * The two claims the seam makes, and nothing else:

package/src/server/metrics/telemetrySink.ts

@@ -1,5 +1,5 @@
 import type { Database } from 'bun:sqlite';
-import { createMetricsBuffer, type MetricRow, type MetricsBuffer } from './metricsBuffer';
+import { createMetricsBuffer, type MetricRow, type MetricsBuffer } from './metricsBuffer.js';
 
 /**
  * ONE seam for "this app served a request", with two backends and no third.

package/src/server/middleware/bodyLimit.spec.ts

@@ -7,7 +7,7 @@ import {
   readBoundedJson,
   readBoundedText,
   refuseOversizedBody,
-} from './bodyLimit';
+} from './bodyLimit.js';
 
 /**
  * 🔴 A guard that is the LAST line of defense ships with the test of its failure path,

package/src/server/middleware/correlationId.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from 'hono';
-import type { CursedbeltEnv } from '../context';
+import type { CursedbeltEnv } from '../context.js';
 
 const HEADER = 'x-correlation-id';
 // Accept a client-supplied id only if it is a sane, header-safe token (no CRLF /

package/src/server/middleware/corsAllowlist.spec.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test';
-import { createApp } from '../app';
-import { corsAllowlist, corsOptsFromEnv } from './corsAllowlist';
+import { createApp } from '../app.js';
+import { corsAllowlist, corsOptsFromEnv } from './corsAllowlist.js';
 
 const SITE = 'example.com';
 const APEX = 'https://example.com';