fix(P1s): GTM backward compat, settings-form conflict detection, sandbox bundling, package exports

- loadLegacyTrackingDocument: infer gtmEnabled from presence of gtmId for
  existing installs that predate the enabled flag (prevents GTM going dark on upgrade)
- saveTrackingSettings: detect when a /tracking save body carries stale canonical
  values for fields that settings-schema has since updated, and reject with conflict
- tsdown.config: add noExternal: [/.*/] to sandbox-entry build so all deps are
  inlined (Cloudflare isolate has no module resolver for peer deps)
- package.json exports: update all paths from .js/.d.ts to .mjs/.d.mts to match
  tsdown's actual output filenames

Author: Jmosier69

package.json

@@ -5,19 +5,19 @@
   "type": "module",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
     },
     "./descriptor": {
-      "types": "./dist/descriptor.d.ts",
-      "import": "./dist/descriptor.js"
+      "types": "./dist/descriptor.d.mts",
+      "import": "./dist/descriptor.mjs"
     },
     "./admin": {
-      "types": "./dist/admin.d.ts",
-      "import": "./dist/admin.js"
+      "types": "./dist/admin.d.mts",
+      "import": "./dist/admin.mjs"
     },
     "./sandbox": {
-      "import": "./dist/sandbox-entry.js"
+      "import": "./dist/sandbox-entry.mjs"
     }
   },
   "files": [

src/lib/trackingSettingsDocument.ts

@@ -95,7 +95,9 @@ export async function loadLegacyTrackingDocument(
 
   return {
     settingsRevision: settingsRevision ?? 0,
-    gtmEnabled: gtmEnabled ?? false,
+    // Backward compat: existing installs have settings:gtmId but not settings:gtmEnabled.
+    // Infer enabled from presence of an ID so GTM keeps injecting after upgrade.
+    gtmEnabled: gtmEnabled ?? (!!gtmId),
     gtmId: gtmId ?? '',
     ga4Enabled: ga4Enabled ?? false,
     ga4Id: ga4Id ?? '',
@@ -178,6 +180,27 @@ export async function saveTrackingSettings(
       return { ok: false, conflict: true, settingsRevision: current.settingsRevision };
     }
 
+    // Detect settings-schema edits that the body would silently overwrite.
+    // The settings-schema form writes settings:* without bumping settingsRevision,
+    // so the revision check above cannot catch this race. Compare each body field
+    // against the live settings:* value; if they diverge and body still carries the
+    // stale canonical value, the /tracking snapshot is out of date — reject it.
+    if (expectedRaw !== null) {
+      const canonicalDoc = JSON.parse(expectedRaw) as TrackingSettingsDocument;
+      const wouldClobber = (
+        ['gtmEnabled','gtmId','ga4Enabled','ga4Id','metaEnabled','metaId',
+         'linkedinEnabled','linkedinId','tiktokEnabled','tiktokId','bingEnabled','bingId',
+         'pinterestEnabled','pinterestId','nextdoorEnabled','nextdoorId'] as const
+      ).some(
+        (field) =>
+          current[field] !== canonicalDoc[field] &&
+          (body as Record<string, unknown>)[field] === (canonicalDoc as Record<string, unknown>)[field],
+      );
+      if (wouldClobber) {
+        return { ok: false, conflict: true, settingsRevision: current.settingsRevision };
+      }
+    }
+
     const nextDoc: TrackingSettingsDocument = {
       ...current,
       gtmEnabled: body.gtmEnabled,

tsdown.config.ts

@@ -32,6 +32,7 @@ export default defineConfig([
     entry: { 'sandbox-entry': 'src/index.ts' },
     format: 'esm',
     dts: false,
+    noExternal: [/.*/],
     outDir: 'dist',
   },
 ]);