cursedbelt-server 4.17.1 → 4.18.0

package/dist/server/telemetry.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `cursedbelt-server/telemetry` — the telemetry seam, from a WORKER.
+ *
+ * `requestLogger` and `createTelemetrySink` are built for exactly one host that most needs them:
+ * a Worker, where a row per request in D1 is the one line on Cloudflare's price list with a
+ * dollar-scale overage and Workers Analytics Engine is the purpose-built sink
+ * (`./metrics/telemetrySink.ts`). Until 2026-09-23 the only door to them was
+ * `cursedbelt-server/middleware`, whose export map sends every non-Bun importer to
+ * `_bunOnly.js` because the barrel carries Bun-only middleware beside them — so `wrangler`
+ * refused the import (`No matching export … for import "requestLogger"`, measured on `music`'s
+ * first attempt to mount it) and the seam could reach every host except the one it was for.
+ *
+ * Everything here is runtime-safe on workerd: `bun:sqlite` appears only as a TYPE (a Mac host
+ * passes its `Database`; a Worker passes `null` and an `analytics` binding).
+ * `telemetryIsWorkerSafe.spec.ts` walks this file's runtime import graph and fails on any
+ * `bun:` import, so it stays that way.
+ */
+export { type RequestLoggerOpts, requestLogger } from './middleware/requestLogger.js';
+export { type AnalyticsEngineDataset, createTelemetrySink, TELEMETRY_POINT_VERSION, type TelemetryEvent, type TelemetrySink, type TelemetrySinkOptions, toDataPoint, } from './metrics/telemetrySink.js';

package/dist/server/telemetry.js

@@ -0,0 +1,19 @@
+/**
+ * `cursedbelt-server/telemetry` — the telemetry seam, from a WORKER.
+ *
+ * `requestLogger` and `createTelemetrySink` are built for exactly one host that most needs them:
+ * a Worker, where a row per request in D1 is the one line on Cloudflare's price list with a
+ * dollar-scale overage and Workers Analytics Engine is the purpose-built sink
+ * (`./metrics/telemetrySink.ts`). Until 2026-09-23 the only door to them was
+ * `cursedbelt-server/middleware`, whose export map sends every non-Bun importer to
+ * `_bunOnly.js` because the barrel carries Bun-only middleware beside them — so `wrangler`
+ * refused the import (`No matching export … for import "requestLogger"`, measured on `music`'s
+ * first attempt to mount it) and the seam could reach every host except the one it was for.
+ *
+ * Everything here is runtime-safe on workerd: `bun:sqlite` appears only as a TYPE (a Mac host
+ * passes its `Database`; a Worker passes `null` and an `analytics` binding).
+ * `telemetryIsWorkerSafe.spec.ts` walks this file's runtime import graph and fails on any
+ * `bun:` import, so it stays that way.
+ */
+export { requestLogger } from './middleware/requestLogger.js';
+export { createTelemetrySink, TELEMETRY_POINT_VERSION, toDataPoint, } from './metrics/telemetrySink.js';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.17.1",
+	"version": "4.18.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -163,6 +163,12 @@
 			"source": "./src/server/master-lock/index.ts",
 			"import": "./dist/server/master-lock/index.js"
 		},
+		"./telemetry": {
+			"types": "./dist/server/telemetry.d.ts",
+			"bun": "./src/server/telemetry.ts",
+			"source": "./src/server/telemetry.ts",
+			"import": "./dist/server/telemetry.js"
+		},
 		"./middleware": {
 			"types": "./dist/server/middleware/index.d.ts",
 			"bun": "./src/server/middleware/index.ts",

package/src/server/telemetry.ts

@@ -0,0 +1,27 @@
+/**
+ * `cursedbelt-server/telemetry` — the telemetry seam, from a WORKER.
+ *
+ * `requestLogger` and `createTelemetrySink` are built for exactly one host that most needs them:
+ * a Worker, where a row per request in D1 is the one line on Cloudflare's price list with a
+ * dollar-scale overage and Workers Analytics Engine is the purpose-built sink
+ * (`./metrics/telemetrySink.ts`). Until 2026-09-23 the only door to them was
+ * `cursedbelt-server/middleware`, whose export map sends every non-Bun importer to
+ * `_bunOnly.js` because the barrel carries Bun-only middleware beside them — so `wrangler`
+ * refused the import (`No matching export … for import "requestLogger"`, measured on `music`'s
+ * first attempt to mount it) and the seam could reach every host except the one it was for.
+ *
+ * Everything here is runtime-safe on workerd: `bun:sqlite` appears only as a TYPE (a Mac host
+ * passes its `Database`; a Worker passes `null` and an `analytics` binding).
+ * `telemetryIsWorkerSafe.spec.ts` walks this file's runtime import graph and fails on any
+ * `bun:` import, so it stays that way.
+ */
+export { type RequestLoggerOpts, requestLogger } from './middleware/requestLogger.js';
+export {
+	type AnalyticsEngineDataset,
+	createTelemetrySink,
+	TELEMETRY_POINT_VERSION,
+	type TelemetryEvent,
+	type TelemetrySink,
+	type TelemetrySinkOptions,
+	toDataPoint,
+} from './metrics/telemetrySink.js';

package/src/server/telemetryIsWorkerSafe.spec.ts

@@ -0,0 +1,42 @@
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+
+/**
+ * `cursedbelt-server/telemetry` must be importable by a Worker: nothing reachable from it at
+ * RUNTIME may import `bun:*`. A `import type` / `export type` is erased and does not count.
+ */
+const RUNTIME_IMPORT = /^\s*(?:import|export)\s+(?!type\b)(?:[^'"]*?from\s+)?['"]([^'"]+)['"]/gm;
+
+function runtimeGraph(entry: string): { files: string[]; bunImports: string[] } {
+	const seen = new Set<string>();
+	const bunImports: string[] = [];
+	const walk = (file: string): void => {
+		if (seen.has(file)) return;
+		seen.add(file);
+		const source = readFileSync(file, 'utf8');
+		for (const match of source.matchAll(RUNTIME_IMPORT)) {
+			const spec = match[1] as string;
+			if (spec.startsWith('bun:')) bunImports.push(`${file.split('/src/')[1]} → ${spec}`);
+			if (spec.startsWith('.')) walk(resolve(dirname(file), spec.replace(/\.js$/, '.ts')));
+		}
+	};
+	walk(entry);
+	return { files: [...seen], bunImports };
+}
+
+describe('cursedbelt-server/telemetry', () => {
+	test('🔴 reaches no `bun:` module at runtime — a Worker can import it', () => {
+		const { files, bunImports } = runtimeGraph(join(import.meta.dir, 'telemetry.ts'));
+		expect(bunImports).toEqual([]);
+		// Not vacuous: the logger and the sink are both in the graph.
+		expect(files.some((f) => f.endsWith('requestLogger.ts'))).toBe(true);
+		expect(files.some((f) => f.endsWith('telemetrySink.ts'))).toBe(true);
+	});
+
+	test('the walk goes red on the shape it exists for', () => {
+		const regex = new RegExp(RUNTIME_IMPORT.source, RUNTIME_IMPORT.flags);
+		const found = [..."import { Database } from 'bun:sqlite';\nimport type { X } from 'bun:sqlite';".matchAll(regex)].map((m) => m[1]);
+		expect(found).toEqual(['bun:sqlite']);
+	});
+});