cursedbelt-server 4.17.1 → 4.18.1

package/dist/server/d1/pullD1.js

@@ -82,6 +82,8 @@ export async function servedRuntime(url, { attempts = 3, sleep = (ms) => new Pro
     }
     return null;
 }
+/** How many times one table's export is asked for when wrangler says success and writes nothing. */
+const EXPORT_ATTEMPTS = 3;
 /**
  * The tables a snapshot carries, from D1's own `sqlite_master` rows — every real table, and
  * none of what cannot or must not be re-inserted: a virtual table and its shadows (`_config`,
@@ -123,12 +125,23 @@ export async function pullD1ToSqlite(options) {
     let sql = '';
     for (const table of tables) {
         const dump = `${destination}.${table}.sql`;
-        const exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
+        // 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
+        // collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
+        // command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
+        // asked for again, twice, before it is a refusal; a failure that persists still refuses,
+        // because a snapshot missing a table is not a backup.
+        let exported = { code: 1, stdout: '', stderr: 'not attempted' };
+        for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
+            exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
+            if (exported.code !== 0 || existsSync(dump))
+                break;
+        }
         if (exported.code !== 0) {
             throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
         }
-        if (!existsSync(dump))
-            throw new Error(`wrangler d1 export --table ${table} reported success and wrote no file at ${dump}`);
+        if (!existsSync(dump)) {
+            throw new Error(`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`);
+        }
         sql += `${readFileSync(dump, 'utf8')}\n`;
     }
     if (!/INSERT INTO/i.test(sql)) {

package/dist/server/telemetry.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `cursedbelt-server/telemetry` — the telemetry seam, from a WORKER.
+ *
+ * `requestLogger` and `createTelemetrySink` are built for exactly one host that most needs them:
+ * a Worker, where a row per request in D1 is the one line on Cloudflare's price list with a
+ * dollar-scale overage and Workers Analytics Engine is the purpose-built sink
+ * (`./metrics/telemetrySink.ts`). Until 2026-09-23 the only door to them was
+ * `cursedbelt-server/middleware`, whose export map sends every non-Bun importer to
+ * `_bunOnly.js` because the barrel carries Bun-only middleware beside them — so `wrangler`
+ * refused the import (`No matching export … for import "requestLogger"`, measured on `music`'s
+ * first attempt to mount it) and the seam could reach every host except the one it was for.
+ *
+ * Everything here is runtime-safe on workerd: `bun:sqlite` appears only as a TYPE (a Mac host
+ * passes its `Database`; a Worker passes `null` and an `analytics` binding).
+ * `telemetryIsWorkerSafe.spec.ts` walks this file's runtime import graph and fails on any
+ * `bun:` import, so it stays that way.
+ */
+export { type RequestLoggerOpts, requestLogger } from './middleware/requestLogger.js';
+export { type AnalyticsEngineDataset, createTelemetrySink, TELEMETRY_POINT_VERSION, type TelemetryEvent, type TelemetrySink, type TelemetrySinkOptions, toDataPoint, } from './metrics/telemetrySink.js';

package/dist/server/telemetry.js

@@ -0,0 +1,19 @@
+/**
+ * `cursedbelt-server/telemetry` — the telemetry seam, from a WORKER.
+ *
+ * `requestLogger` and `createTelemetrySink` are built for exactly one host that most needs them:
+ * a Worker, where a row per request in D1 is the one line on Cloudflare's price list with a
+ * dollar-scale overage and Workers Analytics Engine is the purpose-built sink
+ * (`./metrics/telemetrySink.ts`). Until 2026-09-23 the only door to them was
+ * `cursedbelt-server/middleware`, whose export map sends every non-Bun importer to
+ * `_bunOnly.js` because the barrel carries Bun-only middleware beside them — so `wrangler`
+ * refused the import (`No matching export … for import "requestLogger"`, measured on `music`'s
+ * first attempt to mount it) and the seam could reach every host except the one it was for.
+ *
+ * Everything here is runtime-safe on workerd: `bun:sqlite` appears only as a TYPE (a Mac host
+ * passes its `Database`; a Worker passes `null` and an `analytics` binding).
+ * `telemetryIsWorkerSafe.spec.ts` walks this file's runtime import graph and fails on any
+ * `bun:` import, so it stays that way.
+ */
+export { requestLogger } from './middleware/requestLogger.js';
+export { createTelemetrySink, TELEMETRY_POINT_VERSION, toDataPoint, } from './metrics/telemetrySink.js';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.17.1",
+	"version": "4.18.1",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -163,6 +163,12 @@
 			"source": "./src/server/master-lock/index.ts",
 			"import": "./dist/server/master-lock/index.js"
 		},
+		"./telemetry": {
+			"types": "./dist/server/telemetry.d.ts",
+			"bun": "./src/server/telemetry.ts",
+			"source": "./src/server/telemetry.ts",
+			"import": "./dist/server/telemetry.js"
+		},
 		"./middleware": {
 			"types": "./dist/server/middleware/index.d.ts",
 			"bun": "./src/server/middleware/index.ts",

package/src/server/d1/pullD1.spec.ts

@@ -172,6 +172,26 @@ describe('pulling D1 down — table by table, because a whole-database export re
 		).rejects.toThrow(/lists no `tracks` table/);
 	});
 
+	test('an export that says success and writes NO file is asked again — and refuses if it never does', async () => {
+		const dir = scratch();
+		let flaky = 1;
+		const run: Wrangler = (args) => {
+			if (args[1] === 'execute') return { code: 0, stdout: JSON.stringify([{ results: MASTER }]), stderr: '' };
+			const table = args[args.indexOf('--table') + 1] as string;
+			const out = args[args.indexOf('--output') + 1] as string;
+			// `meta` "succeeds" once without writing — measured on collections, 2026-09-23.
+			if (table === 'meta' && flaky-- > 0) return { code: 0, stdout: 'Downloaded successfully', stderr: '' };
+			writeFileSync(out, table === 'items' ? "INSERT INTO items (id) VALUES ('i1');" : '');
+			return { code: 0, stdout: '', stderr: '' };
+		};
+		await pull(dir, run);
+		const never: Wrangler = (args) =>
+			args[1] === 'execute'
+				? { code: 0, stdout: JSON.stringify([{ results: MASTER }]), stderr: '' }
+				: { code: 0, stdout: 'Downloaded successfully', stderr: '' };
+		await expect(pull(scratch(), never)).rejects.toThrow(/reported success 3 times and wrote no file/);
+	});
+
 	test('🔴 one table failing to export THROWS — never a snapshot missing that table', async () => {
 		const dir = scratch();
 		const { run } = fake((table) => (table === 'meta' ? null : "INSERT INTO items (id) VALUES ('x');"));

package/src/server/d1/pullD1.ts

@@ -97,6 +97,9 @@ export async function servedRuntime(
 	return null;
 }
 
+/** How many times one table's export is asked for when wrangler says success and writes nothing. */
+const EXPORT_ATTEMPTS = 3;
+
 /** One `wrangler` invocation, as {@link pullD1ToSqlite} needs it. Injected so a spec runs none. */
 export type Wrangler = (args: string[]) => { code: number; stdout: string; stderr: string };
 
@@ -160,11 +163,24 @@ export async function pullD1ToSqlite(options: PullD1Options): Promise<void> {
 	let sql = '';
 	for (const table of tables) {
 		const dump = `${destination}.${table}.sql`;
-		const exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
+		// 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
+		// collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
+		// command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
+		// asked for again, twice, before it is a refusal; a failure that persists still refuses,
+		// because a snapshot missing a table is not a backup.
+		let exported = { code: 1, stdout: '', stderr: 'not attempted' };
+		for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
+			exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
+			if (exported.code !== 0 || existsSync(dump)) break;
+		}
 		if (exported.code !== 0) {
 			throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
 		}
-		if (!existsSync(dump)) throw new Error(`wrangler d1 export --table ${table} reported success and wrote no file at ${dump}`);
+		if (!existsSync(dump)) {
+			throw new Error(
+				`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`,
+			);
+		}
 		sql += `${readFileSync(dump, 'utf8')}\n`;
 	}
 	if (!/INSERT INTO/i.test(sql)) {

package/src/server/telemetry.ts

@@ -0,0 +1,27 @@
+/**
+ * `cursedbelt-server/telemetry` — the telemetry seam, from a WORKER.
+ *
+ * `requestLogger` and `createTelemetrySink` are built for exactly one host that most needs them:
+ * a Worker, where a row per request in D1 is the one line on Cloudflare's price list with a
+ * dollar-scale overage and Workers Analytics Engine is the purpose-built sink
+ * (`./metrics/telemetrySink.ts`). Until 2026-09-23 the only door to them was
+ * `cursedbelt-server/middleware`, whose export map sends every non-Bun importer to
+ * `_bunOnly.js` because the barrel carries Bun-only middleware beside them — so `wrangler`
+ * refused the import (`No matching export … for import "requestLogger"`, measured on `music`'s
+ * first attempt to mount it) and the seam could reach every host except the one it was for.
+ *
+ * Everything here is runtime-safe on workerd: `bun:sqlite` appears only as a TYPE (a Mac host
+ * passes its `Database`; a Worker passes `null` and an `analytics` binding).
+ * `telemetryIsWorkerSafe.spec.ts` walks this file's runtime import graph and fails on any
+ * `bun:` import, so it stays that way.
+ */
+export { type RequestLoggerOpts, requestLogger } from './middleware/requestLogger.js';
+export {
+	type AnalyticsEngineDataset,
+	createTelemetrySink,
+	TELEMETRY_POINT_VERSION,
+	type TelemetryEvent,
+	type TelemetrySink,
+	type TelemetrySinkOptions,
+	toDataPoint,
+} from './metrics/telemetrySink.js';

package/src/server/telemetryIsWorkerSafe.spec.ts

@@ -0,0 +1,42 @@
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+
+/**
+ * `cursedbelt-server/telemetry` must be importable by a Worker: nothing reachable from it at
+ * RUNTIME may import `bun:*`. A `import type` / `export type` is erased and does not count.
+ */
+const RUNTIME_IMPORT = /^\s*(?:import|export)\s+(?!type\b)(?:[^'"]*?from\s+)?['"]([^'"]+)['"]/gm;
+
+function runtimeGraph(entry: string): { files: string[]; bunImports: string[] } {
+	const seen = new Set<string>();
+	const bunImports: string[] = [];
+	const walk = (file: string): void => {
+		if (seen.has(file)) return;
+		seen.add(file);
+		const source = readFileSync(file, 'utf8');
+		for (const match of source.matchAll(RUNTIME_IMPORT)) {
+			const spec = match[1] as string;
+			if (spec.startsWith('bun:')) bunImports.push(`${file.split('/src/')[1]} → ${spec}`);
+			if (spec.startsWith('.')) walk(resolve(dirname(file), spec.replace(/\.js$/, '.ts')));
+		}
+	};
+	walk(entry);
+	return { files: [...seen], bunImports };
+}
+
+describe('cursedbelt-server/telemetry', () => {
+	test('🔴 reaches no `bun:` module at runtime — a Worker can import it', () => {
+		const { files, bunImports } = runtimeGraph(join(import.meta.dir, 'telemetry.ts'));
+		expect(bunImports).toEqual([]);
+		// Not vacuous: the logger and the sink are both in the graph.
+		expect(files.some((f) => f.endsWith('requestLogger.ts'))).toBe(true);
+		expect(files.some((f) => f.endsWith('telemetrySink.ts'))).toBe(true);
+	});
+
+	test('the walk goes red on the shape it exists for', () => {
+		const regex = new RegExp(RUNTIME_IMPORT.source, RUNTIME_IMPORT.flags);
+		const found = [..."import { Database } from 'bun:sqlite';\nimport type { X } from 'bun:sqlite';".matchAll(regex)].map((m) => m[1]);
+		expect(found).toEqual(['bun:sqlite']);
+	});
+});