fix: preserve node:sqlite import in bundle; add dist boot smoke test

tsup's removeNodeProtocol stripped the node: prefix from the bundled
node:sqlite import, crashing the server with ERR_MODULE_NOT_FOUND when
DB_PATH was set (node:sqlite is a prefix-only builtin). Disable it via
tsup.config.ts and add a build-time smoke that boots the bundled CLI with
persistence so the regression fails the build. Release v0.2.1.

Author: Kukks

CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.2.1 - 2026-06-04
+
+### Fixed
+- Server crashed at startup with `ERR_MODULE_NOT_FOUND: Cannot find package 'sqlite'` whenever `DB_PATH` was set: tsup's `removeNodeProtocol` stripped the `node:` prefix from the bundled `node:sqlite` import, and `node:sqlite` is a prefix-only builtin (there is no bare `sqlite`). Disabled prefix stripping (`tsup.config.ts`) and added a build-time smoke test that boots the bundled CLI with persistence enabled, so a mangled builtin import fails the build/release instead of reaching production.
+
 ## 0.2.0 - 2026-06-04
 
 ### Added

Dockerfile

@@ -11,8 +11,9 @@ RUN pnpm install --frozen-lockfile --prod=false
 
 # Build
 FROM deps AS build
-COPY tsconfig.json tsconfig.ui.json vite.config.ts ./
+COPY tsconfig.json tsconfig.ui.json vite.config.ts tsup.config.ts ./
 COPY src/ ./src/
+COPY scripts/ ./scripts/
 RUN pnpm build
 
 # Production

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arkade-os/lnurl",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "LNURL service for amountless Lightning receives via Arkade swaps",
   "type": "module",
   "main": "dist/index.js",
@@ -12,7 +12,7 @@
     }
   },
   "scripts": {
-    "build": "tsup src/index.ts src/cli.ts src/admin-server.ts --format esm --dts && vite build",
+    "build": "tsup && vite build && node scripts/smoke-dist.mjs",
     "dev": "cross-env NODE_OPTIONS=--experimental-sqlite tsx watch src/cli.ts",
     "start": "node --experimental-sqlite dist/cli.js",
     "test": "cross-env NODE_OPTIONS=--experimental-sqlite vitest run",

scripts/smoke-dist.mjs

@@ -0,0 +1,53 @@
+// Build-time smoke test: boot the BUNDLED dist/cli.js with persistence enabled and
+// confirm the node:sqlite-backed DB layer loads. Tests run against TS source, so a
+// bundler mangling the `node:sqlite` import (e.g. stripping the `node:` prefix) only
+// surfaces at runtime in the built artifact — exactly what broke v0.2.0. Chaining this
+// into `pnpm build` makes such a regression fail the build (and the Docker release).
+import { spawn } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+
+const dir = mkdtempSync(join(tmpdir(), "lnurl-smoke-"));
+const SUCCESS = "persistence: enabled"; // cli logs this only after the DB layer loads + migrates
+const TIMEOUT_MS = 20_000;
+
+const child = spawn(process.execPath, ["--experimental-sqlite", "dist/cli.js"], {
+  stdio: ["ignore", "pipe", "pipe"],
+  env: {
+    ...process.env,
+    DB_PATH: join(dir, "smoke.db"),
+    TOKEN_ENCRYPTION_KEY: randomBytes(32).toString("hex"),
+    BOOTSTRAP_DOMAIN: "smoke.test",
+    // High, unlikely-to-conflict ports (PORT=0 would fall back to 3000 via `|| default`).
+    PORT: "39080",
+    ADMIN_PORT: "39081",
+    ADMIN_BIND: "127.0.0.1",
+  },
+});
+
+let out = "";
+let settled = false;
+const finish = (ok, msg) => {
+  if (settled) return;
+  settled = true;
+  clearTimeout(timer);
+  try { child.kill("SIGKILL"); } catch { /* already gone */ }
+  // Best-effort cleanup: on Windows the just-killed child may still hold the SQLite
+  // file handle briefly, so retry and never let a cleanup failure change the result.
+  try { rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 }); } catch { /* temp dir; OS will reap */ }
+  if (ok) {
+    console.log("✓ dist smoke: bundled CLI initialized node:sqlite persistence");
+    process.exit(0);
+  }
+  console.error(`✗ dist smoke FAILED: ${msg}\n--- cli output ---\n${out}`);
+  process.exit(1);
+};
+
+const timer = setTimeout(() => finish(false, "timed out waiting for startup"), TIMEOUT_MS);
+const onData = (d) => { out += d.toString(); if (out.includes(SUCCESS)) finish(true); };
+child.stdout.on("data", onData);
+child.stderr.on("data", onData); // capture errors (e.g. ERR_MODULE_NOT_FOUND)
+child.on("exit", (code) => finish(false, `CLI exited before startup (code ${code})`));
+child.on("error", (err) => finish(false, `failed to spawn CLI: ${err.message}`));

src/openapi.ts

@@ -7,7 +7,7 @@ export const openApiSpec = {
       "Wallets open an SSE session to get an LNURL, and payers use " +
       "standard LNURL-pay (LUD-06) to request invoices. The wallet " +
       "creates reverse swaps on-the-fly and returns bolt11 invoices.",
-    version: "0.2.0",
+    version: "0.2.1",
     license: { name: "MIT" },
   },
   servers: [{ url: "/" }],

tsup.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from "tsup";
+
+export default defineConfig({
+  entry: ["src/index.ts", "src/cli.ts", "src/admin-server.ts"],
+  format: ["esm"],
+  dts: true,
+  // tsup strips the `node:` protocol prefix by default (removeNodeProtocol: true),
+  // rewriting e.g. `node:sqlite` → `sqlite`. That is fatal for prefix-only builtins
+  // like node:sqlite (there is no bare `sqlite` builtin), so disable it.
+  removeNodeProtocol: false,
+});