cursedbelt-core 1.0.0

package/dist/config/appConfig.js

@@ -0,0 +1,308 @@
+/**
+ * `app-config.json` — the single schema the compiler AND the runtime import
+ * (02-MASTER-ENGINES §2). Nothing else may re-declare this shape: a second copy
+ * is how `privateMedia` without `guard` parsed as valid for a year (J2-1).
+ *
+ * Two laws are encoded here rather than in prose:
+ *
+ * 1. `.strict()` end to end. An unknown key — including inside a per-engine
+ *    `features` block — is a parse ERROR (`unknown-config-key`), never silently
+ *    stripped. A typo'd flag that gets dropped reads as "the feature is off" at
+ *    runtime, which is indistinguishable from a bug in the feature.
+ * 2. `.superRefine()` cross-engine dependencies. `privateMedia` needs `guard`,
+ *    `oralHistory` needs `asset`, `auth.enabled` needs `guard`, and the saas
+ *    profile needs `guard` + `rbac:true`. These are structural: the config
+ *    references something that will not exist at runtime, so it dies at V0 —
+ *    fail-closed on structure (04 §0).
+ *
+ * Zod v4 notes: `z.record` requires an explicit key schema, and `addIssue` takes
+ * the literal `'custom'` code (the `ZodIssueCode` enum is gone).
+ */
+import { z } from 'zod';
+export const ENGINE_IDS = ['asset', 'knowledge', 'dev', 'guard', 'system'];
+export const EngineIdSchema = z.enum(ENGINE_IDS);
+/* ---------- per-engine feature schemas (STRICT: unknown key = V0 error) ---------- */
+export const AssetFeatures = z
+    .object({
+    gallery: z.boolean().default(true),
+    galleryLayouts: z.array(z.enum(['masonry', 'rows', 'columns', 'dense'])).min(1).default(['rows']),
+    video: z.boolean().default(true), // false ⇒ video ports REMOVED (fail-closed, V2)
+    hls: z.boolean().default(true), // false ⇒ ports stay, progressive resolver forced (V2 degrade)
+    editor: z.boolean().default(false), // lazy chunk; joins bundleKey
+    fileBrowser: z.boolean().default(false),
+    taggedFiles: z.boolean().default(false),
+    privateMedia: z.boolean().default(false), // requires guard engine — enforced in superRefine
+    vaultSource: z.boolean().default(false),
+    ocr: z.boolean().default(false),
+    imageStudio: z.boolean().default(false),
+})
+    .strict();
+export const KnowledgeFeatures = z
+    .object({
+    notes: z.boolean().default(true),
+    todos: z.boolean().default(true),
+    airtableStyleLists: z.boolean().default(false),
+    kanban: z.boolean().default(false),
+    contacts: z.boolean().default(false),
+    oralHistory: z.boolean().default(false), // requires asset engine — enforced in superRefine
+    textCompare: z.boolean().default(false),
+    ragChat: z.boolean().default(false),
+    ragDiskIndexing: z.boolean().default(false),
+    aiOrganizer: z.boolean().default(false),
+    bookmarks: z.boolean().default(false),
+    worklog: z.boolean().default(false),
+    family: z.boolean().default(false),
+    habits: z.boolean().default(false),
+    articles: z.boolean().default(false),
+})
+    .strict();
+export const DevFeatures = z
+    .object({
+    appRegistry: z.boolean().default(true),
+    configEditor: z.boolean().default(false), // PRIVILEGED: requires 'infra:write' claim (02 §4.4)
+    deploy: z.boolean().default(false),
+    fleet: z.boolean().default(false),
+    pipelines: z.boolean().default(false),
+    docs: z.boolean().default(true),
+    screenshots: z.boolean().default(false),
+    diskUsage: z.boolean().default(false),
+    dbAdmin: z.boolean().default(false), // PRIVILEGED: requires 'infra:write' claim (02 §4.4)
+    orchestration: z.boolean().default(false),
+})
+    .strict();
+/**
+ * Who may create an account (D33 — the commercial-launch gate). Ordered from
+ * most open to most closed; `effectiveSignupMode` picks the STRICTEST configured
+ * value, so two guard instances can never disagree in the open direction.
+ *
+ *   - `open`   — anyone signs up (saas: minting their own tenant as OWNER).
+ *   - `invite` — a valid invitation token is required; token-less signup is a
+ *     403. This is the "coming soon" launch posture: the operator invites
+ *     trusted testers while the public sees a closed door.
+ *   - `closed` — no signups at all, invitation or not.
+ */
+export const SIGNUP_MODES = ['open', 'invite', 'closed'];
+export const GuardFeatures = z
+    .object({
+    privateMode: z.boolean().default(true),
+    secretsPanel: z.boolean().default(false), // station-style credential management UI
+    accounts: z.boolean().default(true), // username/password change (ex-Admin)
+    rbac: z.boolean().default(false), // SaaS profile forces true — superRefine (e)
+    sessionTtlMinutes: z.number().int().min(1).max(720).default(30),
+    signupMode: z.enum(SIGNUP_MODES).default('open'), // D33 launch gate — see SIGNUP_MODES
+    // D36: db-stored marketing-copy overrides + the owner-only editor panel.
+    // OFF by default: an app that is not THE commercial deployment has no
+    // marketing page to feed, and a public copy endpoint on it would be noise.
+    siteCopy: z.boolean().default(false),
+})
+    .strict();
+export const SystemFeatures = z
+    .object({
+    dashboard: z.boolean().default(false),
+    calendar: z.boolean().default(false),
+    notifications: z.boolean().default(true),
+    stopwatch: z.boolean().default(false),
+    timeOff: z.boolean().default(false),
+    formatLab: z.boolean().default(false),
+    lineFilter: z.boolean().default(false),
+    httpClient: z.boolean().default(false),
+    budgets: z.boolean().default(false),
+    subscriptions: z.boolean().default(false),
+})
+    .strict();
+export const FeaturesByEngine = {
+    asset: AssetFeatures,
+    knowledge: KnowledgeFeatures,
+    dev: DevFeatures,
+    guard: GuardFeatures,
+    system: SystemFeatures,
+};
+/**
+ * The signup gate a whole app enforces (D33). The STRICTEST configured value
+ * wins across guard instances — with two instances, `open` beside `invite`
+ * must mean invite-only, or adding a second guard instance would silently
+ * reopen a closed door. Apps with no guard instance have no signup surface at
+ * all, so the returned default is never enforced anywhere.
+ */
+export const effectiveSignupMode = (instances) => {
+    let strictest = 'open';
+    for (const instance of instances) {
+        if (instance.engine !== 'guard')
+            continue;
+        const raw = instance.effective.signupMode;
+        const mode = raw === 'invite' || raw === 'closed' ? raw : 'open';
+        if (SIGNUP_MODES.indexOf(mode) > SIGNUP_MODES.indexOf(strictest))
+            strictest = mode;
+    }
+    return strictest;
+};
+/* ---------- instances, wires, routes, fills ---------- */
+/**
+ * Client SPA path (03 §3): kebab-case literal segments, camelCase `:params`.
+ * `/chat/:conversationId` is the canonical example, so param names must admit
+ * capitals while literal segments stay lowercase — a `/Chat` vs `/chat` pair is
+ * two routes on a case-sensitive router and one route on a case-insensitive one.
+ */
+export const ROUTE_PATH_RE = /^\/(?:[a-z0-9-]+|:[a-zA-Z][a-zA-Z0-9]*)?(?:\/(?:[a-z0-9-]+|:[a-zA-Z][a-zA-Z0-9]*))*$/;
+export const RouteDeclSchema = z
+    .object({
+    path: z.string().regex(ROUTE_PATH_RE),
+    view: z.string().min(1), // engine view id; checked against the export index at V1
+    aliases: z.array(z.string()).default([]),
+    deepLinkEntity: z.string().optional(), // token id whose payloads resolve here (03 §4)
+})
+    .strict();
+export const FillDeclSchema = z
+    .object({
+    slot: z.string().min(1), // must exist in the SlotRegistry — V1 `slot-unknown`
+    component: z.string().min(1), // exported fill id of this instance's engine
+    order: z.number().int().default(0),
+    requiredFeatures: z.array(z.string()).default([]), // J2-3: pure boolean lookup, no predicates
+})
+    .strict();
+export const InstanceSchema = z
+    .object({
+    engine: EngineIdSchema,
+    id: z.string().regex(/^[a-z][a-z0-9-]*$/), // unique per app — V1 `duplicate-instance-id`
+    title: z.string().optional(),
+    features: z.record(z.string(), z.unknown()).default({}), // validated per-engine in superRefine
+    options: z.record(z.string(), z.unknown()).default({}),
+    routes: z.array(RouteDeclSchema).default([]),
+    fills: z.array(FillDeclSchema).default([]),
+    cssIsolation: z.enum(['none', 'scope', 'shadow']).default('none'), // 02 §5.2
+})
+    .strict();
+/** '<instanceId>:<portId>' or 'data:<sourceId>'. */
+export const ENDPOINT_RE = /^[a-z][a-z0-9-]*:[a-z0-9\-:]+$/;
+export const ConnectionSchema = z
+    .object({
+    from: z.string().regex(ENDPOINT_RE),
+    to: z.string().regex(ENDPOINT_RE),
+    cyclic: z.boolean().default(false),
+})
+    .strict();
+/* ---------- the app config ---------- */
+export const AppConfigSchema = z
+    .object({
+    configVersion: z.literal(1), // unknown version ⇒ V0 `config-version-unknown`
+    app: z
+        .object({
+        id: z.string().regex(/^[a-z0-9-]+$/),
+        title: z.string().min(1),
+        port: z.number().int().min(1024).max(65535).optional(), // registry precedence (01 §3.2)
+        kind: z.enum(['app', 'test', 'demo']).default('app'),
+    })
+        .strict(),
+    profile: z.enum(['local', 'saas']).default('local'),
+    deployTarget: z
+        .object({
+        // context-aware capability branching input (04 V2 / J4-B)
+        capabilities: z.record(z.string(), z.boolean()).default({}), // e.g. { ffmpeg: true, mps: true }
+    })
+        .strict()
+        .default({ capabilities: {} }),
+    engines: z.array(EngineIdSchema).min(1), // ACTIVE MASTER ENGINE ARRAY — drives server mixins
+    instances: z.array(InstanceSchema).min(1),
+    connections: z.array(ConnectionSchema).default([]),
+    auth: z
+        .object({
+        enabled: z.boolean().default(false),
+        authUI: z
+            .object({
+            showLogout: z.boolean().default(true),
+            placement: z.enum(['header-right', 'header-left', 'sidebar-footer']).default('header-right'),
+            icon: z.string().default('LogOut'),
+            variant: z.enum(['ghost', 'outline', 'default']).default('ghost'),
+        })
+            .strict()
+            .default({ showLogout: true, placement: 'header-right', icon: 'LogOut', variant: 'ghost' }),
+    })
+        .strict()
+        .default({
+        enabled: false,
+        authUI: { showLogout: true, placement: 'header-right', icon: 'LogOut', variant: 'ghost' },
+    }),
+    theme: z
+        .object({
+        preset: z.string().default('cc-default'),
+        /**
+         * CSS custom-property map (02 §5.1), emitted into the generated app's
+         * `client/styles.css` as a `:root` block by `emitStylesCss`.
+         *
+         * **Both halves are validated because both are written verbatim into a
+         * stylesheet.** A property name is restricted to `--` plus
+         * word/dash characters, and a value may not contain the characters that
+         * would end the declaration or the rule (`;` `{` `}`) or open a comment.
+         * Without that, an override value of `red; } body { background: url(…)`
+         * escapes its own declaration and appends arbitrary rules to the app's
+         * first-party stylesheet — CSS is not inert (it fetches URLs and can
+         * hide or overlay UI). This is `.strict()`-doctrine fail-closed on
+         * STRUCTURE: an unusable custom property is a malformed config, not a
+         * capability to degrade.
+         */
+        overrides: z
+            .record(z
+            .string()
+            .regex(/^--[A-Za-z0-9_-]+$/, 'a theme override key must be a CSS custom property, e.g. "--accent"'), z
+            .string()
+            .min(1)
+            .refine((value) => !/[;{}]|\/\*|\*\//.test(value), {
+            message: 'a theme override value may not contain ";", "{", "}" or a CSS comment',
+        }))
+            .default({}),
+    })
+        .strict()
+        .default({ preset: 'cc-default', overrides: {} }),
+    ignoreExistingData: z.boolean().default(false), // the ONLY registry bypass; always logs
+})
+    .strict()
+    .superRefine((config, ctx) => {
+    const engineSet = new Set(config.engines);
+    // `ccCode` rides along in params so V0 can map each cross-engine issue onto
+    // its diagnostic code without pattern-matching on English message text.
+    const issue = (path, message, ccCode = 'engine-dependency-missing') => ctx.addIssue({ code: 'custom', path, message, params: { ccCode } });
+    config.instances.forEach((inst, i) => {
+        // (a) instance engine must be activated
+        if (!engineSet.has(inst.engine))
+            issue(['instances', i, 'engine'], `Instance '${inst.id}' uses engine '${inst.engine}' which is absent from engines[].`);
+        // (b) features parse against the FULL per-engine schema — typos die here, not at boot
+        const parsed = FeaturesByEngine[inst.engine].safeParse(inst.features);
+        if (!parsed.success) {
+            for (const e of parsed.error.issues) {
+                const keys = e.code === 'unrecognized_keys' ? e.keys : [];
+                const suffix = keys.length > 0 ? keys.map(String) : e.path.map(String);
+                issue(['instances', i, 'features', ...suffix], e.message, e.code === 'unrecognized_keys' ? 'unknown-config-key' : 'config-invalid-value');
+            }
+            return;
+        }
+        const f = parsed.data;
+        // (c) cross-engine dependencies — hard blocks, not comments (J2-1)
+        if (inst.engine === 'asset' && f.privateMedia === true && !engineSet.has('guard'))
+            issue(['instances', i, 'features', 'privateMedia'], `'privateMedia' requires the 'guard' engine in engines[] (engine-dependency-missing).`);
+        if (inst.engine === 'knowledge' && f.oralHistory === true && !engineSet.has('asset'))
+            issue(['instances', i, 'features', 'oralHistory'], `'oralHistory' requires the 'asset' engine for its media player tier (engine-dependency-missing).`);
+    });
+    // (d) auth requires guard
+    if (config.auth.enabled && !engineSet.has('guard'))
+        issue(['auth', 'enabled'], `auth.enabled requires the 'guard' engine (engine-dependency-missing).`);
+    // (e) SaaS guardrails: guard engine present, rbac on
+    if (config.profile === 'saas') {
+        if (!engineSet.has('guard'))
+            issue(['engines'], `profile 'saas' structurally requires the 'guard' engine (engine-dependency-missing).`);
+        const guardInst = config.instances.find((x) => x.engine === 'guard');
+        if (guardInst && guardInst.features.rbac !== true)
+            issue(['instances', config.instances.indexOf(guardInst), 'features', 'rbac'], `profile 'saas' structurally requires 'features.rbac: true' on the guard instance.`);
+    }
+});
+/**
+ * Resolve one instance's declared features through the FULL (non-partial) engine
+ * schema — the "full-resolution preview" of V0.3. Defaults land here, so a
+ * missing required option surfaces at design time instead of at first boot.
+ */
+export function resolveInstanceFeatures(engine, declared) {
+    return FeaturesByEngine[engine].parse(declared);
+}
+/** The declared feature key set of an engine — used by V1 `unknown-required-feature`. */
+export function featureKeysOf(engine) {
+    return Object.keys(FeaturesByEngine[engine].shape);
+}

package/dist/core/activity/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `cursedbelt-core/activity` — the fleet's activity/audit vocabulary, pure.
+ *
+ * The storage + query half is `cursedbelt-server/activity`; this entry is what a
+ * browser, a spec or a wire type can import without pulling `bun:sqlite` in.
+ */
+export { ACTIVITY_OUTCOMES, activityFromShareEvent, activitySubject, describeActivityEvent, describeActivityResource, isActivityAction, isActivityOutcome, } from "./model";
+export type { ActivityEvent, ActivityEventInput, ActivityOutcome, ActivityResource, } from "./model";

package/dist/core/activity/index.js

@@ -0,0 +1,7 @@
+/**
+ * `cursedbelt-core/activity` — the fleet's activity/audit vocabulary, pure.
+ *
+ * The storage + query half is `cursedbelt-server/activity`; this entry is what a
+ * browser, a spec or a wire type can import without pulling `bun:sqlite` in.
+ */
+export { ACTIVITY_OUTCOMES, activityFromShareEvent, activitySubject, describeActivityEvent, describeActivityResource, isActivityAction, isActivityOutcome, } from "./model";

package/dist/core/activity/model.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The fleet's ACTIVITY vocabulary — who did what, to which record, when, and how
+ * it went. One shape, so twelve apps' event streams can be read as one.
+ *
+ * ── Why this is not a second audit shape ────────────────────────────────────
+ * `cursedbelt-core/sharing` already had to answer this question for grants, and its
+ * `ShareEvent` is the shape that survived review: an ISO-8601 `at`, an `actor`
+ * that is always an account and never a session, a `(app, kind, id)` resource
+ * triple, a dotted `action`, and a free `note` for whoever reads it six months
+ * later. This vocabulary is deliberately the SAME five fields plus an outcome —
+ * `activityFromShareEvent` below is the proof, and it is a total function.
+ *
+ * So a consumer never has to choose between two audit trails:
+ *  - a sharing grant is `share.grant` in the stream, projected out of
+ *    `share_events` by `cursedbelt-server/activity`'s `shareEventsSource` — the
+ *    same rows, never a copy, so the two can never disagree;
+ *  - everything else an app wants remembered is `record()`d into
+ *    `activity_events`.
+ *
+ * ── The rules the shape enforces ────────────────────────────────────────────
+ *  - **`at` is an ISO-8601 string**, matching `share_events` and the fleet's
+ *    audit vocabulary. An audit trail is read by humans far more often than it
+ *    is sorted by a machine, and a sortable string is both.
+ *  - **`actor` is required and is never optional.** An event that cannot say who
+ *    is a log line, not an audit trail. Apps with no session pass a label that
+ *    says so (`"curt@… (dev-open)"`), which is honest rather than empty.
+ *  - **`action` is `subject.verb`**, lowercase and dotted — `note.create`,
+ *    `backup.delete`, `share.grant`. The prefix is what makes "everything that
+ *    happened to backups" a filter rather than a regex.
+ *  - **`id` is source-qualified** (`log:41`, `share:12`), because the stream is a
+ *    UNION over more than one table and two tables' autoincrements collide at 1.
+ */
+import type { ShareEvent } from "../sharing/model";
+/** How it went. `denied` is its own outcome rather than an `error`: a refused
+ *  action is the single most interesting row in an audit trail, and one that
+ *  reads as a crash gets triaged as one. */
+export type ActivityOutcome = "ok" | "denied" | "error";
+export declare const ACTIVITY_OUTCOMES: readonly ActivityOutcome[];
+export declare const isActivityOutcome: (value: unknown) => value is ActivityOutcome;
+/**
+ * What was acted on: `(app, kind, id)` — deliberately identical to
+ * {@link import("../sharing/model").ShareResource}, so a resource can be handed
+ * from one primitive to the other without a translation layer.
+ */
+export interface ActivityResource {
+    app: string;
+    kind: string;
+    id: string;
+}
+/** One line of the stream, as read. */
+export interface ActivityEvent {
+    /** `"<source>:<row id>"`. Stable, and unique across the union. */
+    id: string;
+    /** Which table it came from — `log`, `share`, or a source an app registered. */
+    source: string;
+    /** ISO-8601, UTC. */
+    at: string;
+    /** The satellite. Present on every row so a fleet-wide merge stays labeled. */
+    app: string;
+    actor: string;
+    /** `subject.verb`, lowercase. */
+    action: string;
+    /** Null when the action is about no single record (a sign-in, a sweep). */
+    resource: ActivityResource | null;
+    outcome: ActivityOutcome;
+    /** Why, in the words of whoever did it. */
+    note: string;
+    /** Anything else worth keeping, as JSON. Never indexed, never queried on. */
+    data: Record<string, unknown> | null;
+}
+/** One line of the stream, as written. The store supplies `app`, `id` and `source`. */
+export interface ActivityEventInput {
+    actor: string;
+    action: string;
+    /** The `app` half is supplied by the store, so a caller cannot write an event
+     *  into another app's name. */
+    resource?: {
+        kind: string;
+        id: string;
+    } | null;
+    outcome?: ActivityOutcome;
+    note?: string;
+    data?: Record<string, unknown> | null;
+    /** ISO-8601. Defaults to now — passed explicitly only by tests and importers. */
+    at?: string;
+}
+/** `note.create` → `note`. The half a filter groups on. */
+export declare const activitySubject: (action: string) => string;
+export declare const isActivityAction: (value: unknown) => value is string;
+/** `family · person 3f2` — the resource, for a row that has one. */
+export declare const describeActivityResource: (resource: ActivityResource | null) => string;
+/**
+ * One sentence for a person. Deliberately generic — an app that wants its own
+ * wording for its own actions renders it itself; this is what the fleet-wide
+ * board shows for an action it has never seen before, and it must never be
+ * empty.
+ */
+export declare function describeActivityEvent(event: ActivityEvent): string;
+/**
+ * 🔴 THE coordination point with `cursedbelt-core/sharing`.
+ *
+ * A sharing grant is already audited, in `share_events`, by a store that
+ * guarantees no grant can be made without one. This maps that row into the
+ * activity vocabulary so the fleet's event stream can INCLUDE it rather than
+ * ask every consumer to write a second copy — the "coordinate the shape rather
+ * than invent a second one" rule, as code.
+ *
+ * `cursedbelt-server/activity`'s `shareEventsSource` is the SQL form of exactly
+ * this mapping, and `store.spec.ts` asserts the two agree field for field. This
+ * function is the one to use from a `ShareStore`'s `onEvent` hook when an app
+ * genuinely wants a copy (a different database, say); an app whose share events
+ * live beside its activity table should register the SQL source instead and
+ * keep one row.
+ */
+export declare function activityFromShareEvent(event: ShareEvent): ActivityEventInput;

package/dist/core/activity/model.js

@@ -0,0 +1,63 @@
+export const ACTIVITY_OUTCOMES = ["ok", "denied", "error"];
+export const isActivityOutcome = (value) => value === "ok" || value === "denied" || value === "error";
+/** `note.create` → `note`. The half a filter groups on. */
+export const activitySubject = (action) => action.split(".")[0] ?? action;
+/**
+ * A well-formed action: `subject.verb`, optionally deeper (`share.group.create`),
+ * lowercase, dots and dashes only.
+ *
+ * Enforced at the WRITE (see the store), not merely documented — an action
+ * vocabulary that drifts to `Note Created` on one screen and `note.create` on
+ * another cannot be filtered, and a filter is the whole point of the column.
+ */
+const ACTION_RE = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/;
+export const isActivityAction = (value) => typeof value === "string" && value.length <= 64 && ACTION_RE.test(value);
+/** `family · person 3f2` — the resource, for a row that has one. */
+export const describeActivityResource = (resource) => resource ? `${resource.kind} ${resource.id}` : "—";
+/**
+ * One sentence for a person. Deliberately generic — an app that wants its own
+ * wording for its own actions renders it itself; this is what the fleet-wide
+ * board shows for an action it has never seen before, and it must never be
+ * empty.
+ */
+export function describeActivityEvent(event) {
+    const what = event.resource
+        ? `${event.resource.kind} ${event.resource.id}`
+        : `${event.app}`;
+    const verb = event.action.replace(/\./g, " ");
+    const how = event.outcome === "ok" ? "" : event.outcome === "denied" ? " — refused" : " — failed";
+    const why = event.note ? ` (${event.note})` : "";
+    return `${event.actor} ${verb} ${what}${how}${why}`;
+}
+/**
+ * 🔴 THE coordination point with `cursedbelt-core/sharing`.
+ *
+ * A sharing grant is already audited, in `share_events`, by a store that
+ * guarantees no grant can be made without one. This maps that row into the
+ * activity vocabulary so the fleet's event stream can INCLUDE it rather than
+ * ask every consumer to write a second copy — the "coordinate the shape rather
+ * than invent a second one" rule, as code.
+ *
+ * `cursedbelt-server/activity`'s `shareEventsSource` is the SQL form of exactly
+ * this mapping, and `store.spec.ts` asserts the two agree field for field. This
+ * function is the one to use from a `ShareStore`'s `onEvent` hook when an app
+ * genuinely wants a copy (a different database, say); an app whose share events
+ * live beside its activity table should register the SQL source instead and
+ * keep one row.
+ */
+export function activityFromShareEvent(event) {
+    return {
+        at: event.at,
+        actor: event.actor,
+        action: `share.${event.action}`,
+        resource: event.resource ? { kind: event.resource.kind, id: event.resource.id } : null,
+        outcome: "ok",
+        note: event.note,
+        data: {
+            subjectType: event.subject.type,
+            subjectId: event.subject.id,
+            level: event.level,
+            previousLevel: event.previousLevel,
+        },
+    };
+}

package/dist/core/analytics/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `cursedbelt-core/analytics` — the framework-free half of an analytics surface.
+ *
+ * Framework-free because BOTH sides need it: a server buckets a series before it
+ * ships it, and the browser renders the same buckets. They must agree exactly or
+ * a chart's x-axis disagrees with its own tooltip — so this half must not pull
+ * React in.
+ *
+ * - `range` — the time vocabulary (today/week/…/custom), local-day bucketing,
+ *   and the baseline window every comparison is measured against.
+ * - `schedule` — list scheduling with resource exclusion and a contention term:
+ *   how long a backlog takes to drain, whether another worker helps, and when a
+ *   budget runs out at each fleet size.
+ *
+ * The React furniture that renders it lives in `cursedbelt/react/analytics`.
+ */
+export * from './range';
+export * from './schedule';

package/dist/core/analytics/index.js

@@ -0,0 +1,18 @@
+/**
+ * `cursedbelt-core/analytics` — the framework-free half of an analytics surface.
+ *
+ * Framework-free because BOTH sides need it: a server buckets a series before it
+ * ships it, and the browser renders the same buckets. They must agree exactly or
+ * a chart's x-axis disagrees with its own tooltip — so this half must not pull
+ * React in.
+ *
+ * - `range` — the time vocabulary (today/week/…/custom), local-day bucketing,
+ *   and the baseline window every comparison is measured against.
+ * - `schedule` — list scheduling with resource exclusion and a contention term:
+ *   how long a backlog takes to drain, whether another worker helps, and when a
+ *   budget runs out at each fleet size.
+ *
+ * The React furniture that renders it lives in `cursedbelt/react/analytics`.
+ */
+export * from './range';
+export * from './schedule';