cursedbelt-server 4.24.0 → 4.24.1

package/dist/server/worker-argon2/_nodeRefuses.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/worker-argon2/_nodeRefuses.js

@@ -0,0 +1,13 @@
+// Loaded only under Node — the `node` condition of `cursedbelt-server/worker-argon2`.
+//
+// This subpath's two `.wasm` files are STATIC imports, which is the one shape workerd will run
+// (`./argon2.ts`). Node 24 reads the same import through its WebAssembly ESM integration and
+// instantiates the module itself, resolving its imports from a package called `env` — so the
+// real module fails under Node with `ERR_MODULE_NOT_FOUND: Cannot find package 'env'`, deep in
+// `argon2id/dist/no-simd.wasm` (measured by tools/proveInstall.ts publishing 4.24.0, 2026-09-23).
+// Nothing in this generation runs it on Node: a Worker gets it through wrangler (`workerd`
+// resolves `import`), a Mac server through Bun (`bun`), and a Mac server already HAS
+// `Bun.password`. So Node gets this sentence instead. Same shape as `../_bunOnly.ts`.
+throw new Error("cursedbelt-server/worker-argon2 runs on workerd (through wrangler) and Bun — not Node, which cannot load its static `.wasm` imports. " +
+    "A Node server should hash with a native argon2 (`@node-rs/argon2`).");
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.24.0",
+	"version": "4.24.1",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -219,6 +219,7 @@
 			"types": "./dist/server/worker-argon2/index.d.ts",
 			"bun": "./src/server/worker-argon2/index.ts",
 			"source": "./src/server/worker-argon2/index.ts",
+			"node": "./dist/server/worker-argon2/_nodeRefuses.js",
 			"import": "./dist/server/worker-argon2/index.js"
 		},
 		"./request-log": {

package/src/server/telemetryIsWorkerSafe.spec.ts

@@ -58,6 +58,20 @@ describe('🔴 cursedbelt-server/worker-argon2 — it exists to be imported by a
 		};
 		expect(pkg.exports['./worker-argon2']?.import).toBe('./dist/server/worker-argon2/index.js');
 	});
+
+	test('Node is refused by name — its WebAssembly ESM integration cannot load the static `.wasm` imports', async () => {
+		// 4.24.0 published with no `node` condition and failed proveInstall: node read the `.wasm`
+		// as an ES module and died on `Cannot find package 'env'`. wrangler never activates `node`
+		// (a dry-run bundle of the probe Worker carries both `.wasm` modules), so this costs a Worker nothing.
+		const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', '..', 'package.json'), 'utf8')) as {
+			exports: Record<string, Record<string, string>>;
+		};
+		const conditions = Object.keys(pkg.exports['./worker-argon2'] ?? {});
+		expect(pkg.exports['./worker-argon2']?.node).toBe('./dist/server/worker-argon2/_nodeRefuses.js');
+		expect(conditions.indexOf('node')).toBeLessThan(conditions.indexOf('import'));
+		expect(conditions.indexOf('bun')).toBeLessThan(conditions.indexOf('node'));
+		await expect(import('./worker-argon2/_nodeRefuses.ts')).rejects.toThrow('not Node');
+	});
 });
 
 describe('cursedbelt-server/telemetry', () => {

package/src/server/worker-argon2/_nodeRefuses.ts

@@ -0,0 +1,16 @@
+// Loaded only under Node — the `node` condition of `cursedbelt-server/worker-argon2`.
+//
+// This subpath's two `.wasm` files are STATIC imports, which is the one shape workerd will run
+// (`./argon2.ts`). Node 24 reads the same import through its WebAssembly ESM integration and
+// instantiates the module itself, resolving its imports from a package called `env` — so the
+// real module fails under Node with `ERR_MODULE_NOT_FOUND: Cannot find package 'env'`, deep in
+// `argon2id/dist/no-simd.wasm` (measured by tools/proveInstall.ts publishing 4.24.0, 2026-09-23).
+// Nothing in this generation runs it on Node: a Worker gets it through wrangler (`workerd`
+// resolves `import`), a Mac server through Bun (`bun`), and a Mac server already HAS
+// `Bun.password`. So Node gets this sentence instead. Same shape as `../_bunOnly.ts`.
+throw new Error(
+	"cursedbelt-server/worker-argon2 runs on workerd (through wrangler) and Bun — not Node, which cannot load its static `.wasm` imports. " +
+		"A Node server should hash with a native argon2 (`@node-rs/argon2`).",
+);
+
+export {};