cursedbelt-server 4.4.0 → 4.5.0

package/dist/server/analytics/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `cursedbelt-server/analytics` — where the fleet's web-analytics beacon is DEFINED, and the
+ * invariant that decides which responses may carry it.
+ *
+ * Two files, and the pairing is the point:
+ *
+ *  · `webAnalytics.ts` is the one copy of the tag. An app's public shell pastes it; nothing
+ *    generates ten of them.
+ *  · `injectedScripts.ts` is the general rule — nothing that arrives in a response's HTML may
+ *    be refused by the CSP on that same response — which is what makes "the wall never carries
+ *    the beacon" a CHECK rather than a sentence. `../master-lock/beaconNeverReachesTheWall.spec.ts`
+ *    is that check.
+ *
+ * Both are pure string work with no imports at all, so this subpath costs a consumer nothing
+ * and drags no peer.
+ */
+export { type InjectedScript, foreignScriptSources, scriptsRefusedByCsp, } from "./injectedScripts";
+export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsTag, } from "./webAnalytics";

package/dist/server/analytics/index.js

@@ -0,0 +1,18 @@
+/**
+ * `cursedbelt-server/analytics` — where the fleet's web-analytics beacon is DEFINED, and the
+ * invariant that decides which responses may carry it.
+ *
+ * Two files, and the pairing is the point:
+ *
+ *  · `webAnalytics.ts` is the one copy of the tag. An app's public shell pastes it; nothing
+ *    generates ten of them.
+ *  · `injectedScripts.ts` is the general rule — nothing that arrives in a response's HTML may
+ *    be refused by the CSP on that same response — which is what makes "the wall never carries
+ *    the beacon" a CHECK rather than a sentence. `../master-lock/beaconNeverReachesTheWall.spec.ts`
+ *    is that check.
+ *
+ * Both are pure string work with no imports at all, so this subpath costs a consumer nothing
+ * and drags no peer.
+ */
+export { foreignScriptSources, scriptsRefusedByCsp, } from "./injectedScripts";
+export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsTag, } from "./webAnalytics";

package/dist/server/analytics/injectedScripts.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Does a page's own CSP refuse a script that arrived in that page's own HTML?
+ *
+ * ## The invariant, which names no vendor
+ *
+ * > No script that reaches the browser inside a response's HTML may be refused by the CSP on
+ * > that same response.
+ *
+ * Every part of the arrangement may move and this stays right. Turn an edge injection off and
+ * the foreign scripts disappear — green. Decide a third-party script is wanted and allow its
+ * host — green. Harden a page with `script-src 'self'` while something is still injecting into
+ * it — RED, and it names the origin, which is the console line the owner would otherwise find
+ * himself during an incident.
+ *
+ * ## 🔴 Why it lives in this package
+ *
+ * It was written in `apps/collections` on 2026-09-18 and it was right there, but it could only
+ * ever see one app — and the response it was written about, the master-lock wall, is served by
+ * THIS package to every app that mounts the guard. One copy here is what makes the two halves
+ * of `webAnalytics.ts`'s decision checkable in the same place: the wall refuses the beacon, and
+ * a public shell carries it.
+ *
+ * ## 🔴 Conservative on purpose
+ *
+ * Every ambiguity resolves to PERMITTED. A source expression this file cannot parse, a
+ * `'strict-dynamic'` that changes what host lists even mean, a CSP with no script directive at
+ * all — all of them pass. A deployed smoke decides whether an app's `scripts/deploy.ts` rolls
+ * back; a false red there discards good work over a CSP grammar corner, so the only thing that
+ * fails here is a script with NO source expression that could admit it.
+ */
+/** An absolute script URL found in the HTML, with the origin already resolved. */
+export interface InjectedScript {
+    /** Exactly as it appeared in the markup, for the failure message. */
+    src: string;
+    /** `https://static.cloudflareinsights.com`, resolved against the page's own URL. */
+    origin: string;
+}
+/**
+ * Every `<script src=…>` in `html` whose origin is NOT `pageUrl`'s.
+ *
+ * Inline scripts are ignored: they are the page's own (most shells here ship one, a pre-paint
+ * colour-scheme script) and a CSP that refuses them is a different finding from this one.
+ * `data:` and `blob:` are ignored for the same reason — neither is a host anything could have
+ * injected.
+ */
+export declare function foreignScriptSources(html: string, pageUrl: string): InjectedScript[];
+/**
+ * Which of `scripts` the `content-security-policy` header would refuse.
+ *
+ * `null`/absent/empty header means no policy, which refuses nothing. The directive consulted
+ * is `script-src-elem`, then `script-src`, then `default-src` — the browser's own fallback
+ * order for a `<script src>` element.
+ */
+export declare function scriptsRefusedByCsp(csp: string | null | undefined, scripts: InjectedScript[], pageUrl: string): InjectedScript[];

package/dist/server/analytics/injectedScripts.js

@@ -0,0 +1,138 @@
+/**
+ * Does a page's own CSP refuse a script that arrived in that page's own HTML?
+ *
+ * ## The invariant, which names no vendor
+ *
+ * > No script that reaches the browser inside a response's HTML may be refused by the CSP on
+ * > that same response.
+ *
+ * Every part of the arrangement may move and this stays right. Turn an edge injection off and
+ * the foreign scripts disappear — green. Decide a third-party script is wanted and allow its
+ * host — green. Harden a page with `script-src 'self'` while something is still injecting into
+ * it — RED, and it names the origin, which is the console line the owner would otherwise find
+ * himself during an incident.
+ *
+ * ## 🔴 Why it lives in this package
+ *
+ * It was written in `apps/collections` on 2026-09-18 and it was right there, but it could only
+ * ever see one app — and the response it was written about, the master-lock wall, is served by
+ * THIS package to every app that mounts the guard. One copy here is what makes the two halves
+ * of `webAnalytics.ts`'s decision checkable in the same place: the wall refuses the beacon, and
+ * a public shell carries it.
+ *
+ * ## 🔴 Conservative on purpose
+ *
+ * Every ambiguity resolves to PERMITTED. A source expression this file cannot parse, a
+ * `'strict-dynamic'` that changes what host lists even mean, a CSP with no script directive at
+ * all — all of them pass. A deployed smoke decides whether an app's `scripts/deploy.ts` rolls
+ * back; a false red there discards good work over a CSP grammar corner, so the only thing that
+ * fails here is a script with NO source expression that could admit it.
+ */
+/**
+ * Every `<script src=…>` in `html` whose origin is NOT `pageUrl`'s.
+ *
+ * Inline scripts are ignored: they are the page's own (most shells here ship one, a pre-paint
+ * colour-scheme script) and a CSP that refuses them is a different finding from this one.
+ * `data:` and `blob:` are ignored for the same reason — neither is a host anything could have
+ * injected.
+ */
+export function foreignScriptSources(html, pageUrl) {
+    const page = new URL(pageUrl);
+    const found = [];
+    const seen = new Set();
+    const tag = /<script\b[^>]*?\bsrc\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/gi;
+    for (const match of html.matchAll(tag)) {
+        const raw = (match[1] ?? match[2] ?? match[3] ?? "").trim();
+        if (!raw)
+            continue;
+        let origin;
+        try {
+            const url = new URL(raw, page);
+            if (url.protocol !== "http:" && url.protocol !== "https:")
+                continue;
+            origin = url.origin;
+        }
+        catch {
+            continue; // not a URL this check can reason about — see the conservative note
+        }
+        if (origin === page.origin)
+            continue;
+        if (seen.has(origin + raw))
+            continue;
+        seen.add(origin + raw);
+        found.push({ src: raw, origin });
+    }
+    return found;
+}
+/**
+ * Which of `scripts` the `content-security-policy` header would refuse.
+ *
+ * `null`/absent/empty header means no policy, which refuses nothing. The directive consulted
+ * is `script-src-elem`, then `script-src`, then `default-src` — the browser's own fallback
+ * order for a `<script src>` element.
+ */
+export function scriptsRefusedByCsp(csp, scripts, pageUrl) {
+    if (!csp?.trim() || scripts.length === 0)
+        return [];
+    const directives = new Map();
+    for (const part of csp.split(";")) {
+        const tokens = part.trim().split(/\s+/).filter(Boolean);
+        const name = tokens.shift()?.toLowerCase();
+        if (name && !directives.has(name))
+            directives.set(name, tokens);
+    }
+    const sources = directives.get("script-src-elem") ??
+        directives.get("script-src") ??
+        directives.get("default-src");
+    if (!sources)
+        return [];
+    // `'strict-dynamic'` makes host allowlists inert in ways that depend on how the script was
+    // reached. Not decidable from the markup alone, so it is permitted — see the header.
+    if (sources.some((s) => s.toLowerCase() === "'strict-dynamic'"))
+        return [];
+    const self = new URL(pageUrl).origin;
+    return scripts.filter((script) => !sources.some((source) => sourceAdmits(source, script.origin, self)));
+}
+/** Does one CSP source expression admit `origin`? Unparseable ⇒ yes, deliberately. */
+function sourceAdmits(source, origin, self) {
+    const value = source.trim();
+    if (!value)
+        return false;
+    if (value === "*")
+        return true;
+    if (value.startsWith("'")) {
+        const keyword = value.toLowerCase();
+        if (keyword === "'self'")
+            return origin === self;
+        // `'none'`, `'unsafe-inline'`, `'nonce-…'`, `'sha256-…'`, `'report-sample'`: none of
+        // them admits a host, and `'none'` in particular must not.
+        return false;
+    }
+    let target;
+    try {
+        target = new URL(origin);
+    }
+    catch {
+        return true;
+    }
+    // A bare scheme source — `https:`, `data:`.
+    if (/^[a-z][a-z0-9+.-]*:$/i.test(value))
+        return value.toLowerCase() === target.protocol;
+    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+    let rest = value;
+    if (withScheme) {
+        if (withScheme[0].toLowerCase() !== `${target.protocol}//`)
+            return false;
+        rest = value.slice(withScheme[0].length);
+    }
+    // Port and path narrow a source; ignoring them can only ever ADMIT more, which is the
+    // direction this file errs in.
+    const host = rest.split("/")[0]?.split(":")[0]?.toLowerCase() ?? "";
+    if (!host)
+        return true;
+    if (host === "*")
+        return true;
+    if (host.startsWith("*."))
+        return target.hostname.toLowerCase().endsWith(host.slice(1));
+    return target.hostname.toLowerCase() === host;
+}

package/dist/server/analytics/webAnalytics.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Cloudflare Web Analytics — ONE definition of the beacon, for every app on the fleet.
+ *
+ * ## 🔴 Why this is here and not in each app's `index.html` alone
+ *
+ * Until 2026-09-18 the zone carried **Automatic Setup**: Cloudflare rewrote every HTML
+ * response leaving `cursedalchemy.com` and appended the beacon tag. Nothing in any repo
+ * asked for it, nothing in any repo could see it locally, and it arrived on pages that
+ * deliberately refuse third-party script — including the master-lock wall, where a master
+ * password is typed. The owner read a console during an outage on 2026-09-17 and the FIRST
+ * line was that tag being refused; it broke nothing and cost an agent the first minutes of
+ * the incident.
+ *
+ * His decision, 2026-09-18, in his words: *"do your recommendation with option c but not on
+ * the wall. If we can stop the console error that would be good since we are purposely
+ * blocking on that page and it makes it look like there is a mistake when it shows."* — and,
+ * on why the wall's CSP may not simply be loosened: *"I don't want to trust cloudflare with
+ * master password data that is typed in."*
+ *
+ * So the install method moves from automatic to MANUAL. Same site, same dashboard, same
+ * data; the difference is that the fleet now decides *which pages* carry it. Public shells
+ * do. {@link "../master-lock/guard".MASTER_LOCK_CSP the wall} does not — and under manual
+ * setup it is not injected into at all, so there is no refused script and no console line.
+ *
+ * ## 🔴 `token` is the site TOKEN, not the site TAG
+ *
+ * They are both 32 hex characters and they are not interchangeable. `site_tag`
+ * ({@link WEB_ANALYTICS_SITE_TAG}) is the id the RUM API addresses the site by;
+ * `site_token` ({@link WEB_ANALYTICS_SITE_TOKEN}) is what goes in `data-cf-beacon`. Putting
+ * the tag in the snippet does not error anywhere — the page loads, the beacon loads, and the
+ * data goes nowhere. Measured 2026-09-18 against
+ * `GET /accounts/<acct>/rum/site_info/list`, which returns both fields **and** the ready-made
+ * `snippet`; {@link WEB_ANALYTICS_TAG} is that snippet byte-for-byte, and the token in it is
+ * the same one the edge was injecting.
+ *
+ * Neither value is a secret: the token is served to every visitor inside every page's HTML,
+ * which is the whole mechanism. It is an identifier, not a credential.
+ */
+/** The host the beacon is fetched from — the origin a CSP would have to admit. */
+export declare const WEB_ANALYTICS_BEACON_ORIGIN = "https://static.cloudflareinsights.com";
+/** The beacon itself. Manual setup serves the unversioned path; the edge served a pinned one. */
+export declare const WEB_ANALYTICS_BEACON_SRC = "https://static.cloudflareinsights.com/beacon.min.js";
+/**
+ * The `cursedalchemy.com` site's id in the RUM API. **Not** what goes in the tag — see the
+ * module note. Kept beside the token so the next reader cannot pick the wrong one by accident.
+ */
+export declare const WEB_ANALYTICS_SITE_TAG = "d1bea8562544421fbd2db5f11b74d1cc";
+/** The `cursedalchemy.com` site's `data-cf-beacon` token. This is what the tag carries. */
+export declare const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
+/**
+ * The snippet, exactly as Cloudflare's own `site_info` endpoint spells it.
+ *
+ * 🔴 The single-quoted attributes and the space after `"token":` are Cloudflare's, not a
+ * style choice, and they are kept because this string is COMPARED against what an app's
+ * shell contains. `data-cf-beacon`'s value is JSON containing double quotes, so the attribute
+ * quoting cannot be flipped without escaping; leaving it identical to the vendor's text means
+ * a future reader can diff it against the dashboard in one glance.
+ *
+ * `type='module'` rather than `defer`: that is what the endpoint returns today and what the
+ * edge was injecting, so switching install methods changes nothing about how the page loads.
+ */
+export declare function webAnalyticsTag(token?: string): string;
+/** The fleet's tag, for the one site this generation serves. */
+export declare const WEB_ANALYTICS_TAG: string;
+/**
+ * Does `html` carry the beacon for this site?
+ *
+ * Deliberately NOT a substring test against {@link WEB_ANALYTICS_TAG}: a shell is authored by
+ * hand and a formatter is allowed to re-wrap the tag across lines or re-order its attributes.
+ * What must be true is that the beacon's source is there AND that it is carrying the right
+ * token — the two halves that decide whether a pageview is recorded at all.
+ */
+export declare function htmlCarriesWebAnalytics(html: string, token?: string): boolean;

package/dist/server/analytics/webAnalytics.js

@@ -0,0 +1,80 @@
+/**
+ * Cloudflare Web Analytics — ONE definition of the beacon, for every app on the fleet.
+ *
+ * ## 🔴 Why this is here and not in each app's `index.html` alone
+ *
+ * Until 2026-09-18 the zone carried **Automatic Setup**: Cloudflare rewrote every HTML
+ * response leaving `cursedalchemy.com` and appended the beacon tag. Nothing in any repo
+ * asked for it, nothing in any repo could see it locally, and it arrived on pages that
+ * deliberately refuse third-party script — including the master-lock wall, where a master
+ * password is typed. The owner read a console during an outage on 2026-09-17 and the FIRST
+ * line was that tag being refused; it broke nothing and cost an agent the first minutes of
+ * the incident.
+ *
+ * His decision, 2026-09-18, in his words: *"do your recommendation with option c but not on
+ * the wall. If we can stop the console error that would be good since we are purposely
+ * blocking on that page and it makes it look like there is a mistake when it shows."* — and,
+ * on why the wall's CSP may not simply be loosened: *"I don't want to trust cloudflare with
+ * master password data that is typed in."*
+ *
+ * So the install method moves from automatic to MANUAL. Same site, same dashboard, same
+ * data; the difference is that the fleet now decides *which pages* carry it. Public shells
+ * do. {@link "../master-lock/guard".MASTER_LOCK_CSP the wall} does not — and under manual
+ * setup it is not injected into at all, so there is no refused script and no console line.
+ *
+ * ## 🔴 `token` is the site TOKEN, not the site TAG
+ *
+ * They are both 32 hex characters and they are not interchangeable. `site_tag`
+ * ({@link WEB_ANALYTICS_SITE_TAG}) is the id the RUM API addresses the site by;
+ * `site_token` ({@link WEB_ANALYTICS_SITE_TOKEN}) is what goes in `data-cf-beacon`. Putting
+ * the tag in the snippet does not error anywhere — the page loads, the beacon loads, and the
+ * data goes nowhere. Measured 2026-09-18 against
+ * `GET /accounts/<acct>/rum/site_info/list`, which returns both fields **and** the ready-made
+ * `snippet`; {@link WEB_ANALYTICS_TAG} is that snippet byte-for-byte, and the token in it is
+ * the same one the edge was injecting.
+ *
+ * Neither value is a secret: the token is served to every visitor inside every page's HTML,
+ * which is the whole mechanism. It is an identifier, not a credential.
+ */
+/** The host the beacon is fetched from — the origin a CSP would have to admit. */
+export const WEB_ANALYTICS_BEACON_ORIGIN = "https://static.cloudflareinsights.com";
+/** The beacon itself. Manual setup serves the unversioned path; the edge served a pinned one. */
+export const WEB_ANALYTICS_BEACON_SRC = `${WEB_ANALYTICS_BEACON_ORIGIN}/beacon.min.js`;
+/**
+ * The `cursedalchemy.com` site's id in the RUM API. **Not** what goes in the tag — see the
+ * module note. Kept beside the token so the next reader cannot pick the wrong one by accident.
+ */
+export const WEB_ANALYTICS_SITE_TAG = "d1bea8562544421fbd2db5f11b74d1cc";
+/** The `cursedalchemy.com` site's `data-cf-beacon` token. This is what the tag carries. */
+export const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
+/**
+ * The snippet, exactly as Cloudflare's own `site_info` endpoint spells it.
+ *
+ * 🔴 The single-quoted attributes and the space after `"token":` are Cloudflare's, not a
+ * style choice, and they are kept because this string is COMPARED against what an app's
+ * shell contains. `data-cf-beacon`'s value is JSON containing double quotes, so the attribute
+ * quoting cannot be flipped without escaping; leaving it identical to the vendor's text means
+ * a future reader can diff it against the dashboard in one glance.
+ *
+ * `type='module'` rather than `defer`: that is what the endpoint returns today and what the
+ * edge was injecting, so switching install methods changes nothing about how the page loads.
+ */
+export function webAnalyticsTag(token = WEB_ANALYTICS_SITE_TOKEN) {
+    return ("<!-- Cloudflare Web Analytics -->" +
+        `<script type='module' src='${WEB_ANALYTICS_BEACON_SRC}' ` +
+        `data-cf-beacon='{"token": "${token}"}'></script>` +
+        "<!-- End Cloudflare Web Analytics -->");
+}
+/** The fleet's tag, for the one site this generation serves. */
+export const WEB_ANALYTICS_TAG = webAnalyticsTag();
+/**
+ * Does `html` carry the beacon for this site?
+ *
+ * Deliberately NOT a substring test against {@link WEB_ANALYTICS_TAG}: a shell is authored by
+ * hand and a formatter is allowed to re-wrap the tag across lines or re-order its attributes.
+ * What must be true is that the beacon's source is there AND that it is carrying the right
+ * token — the two halves that decide whether a pageview is recorded at all.
+ */
+export function htmlCarriesWebAnalytics(html, token = WEB_ANALYTICS_SITE_TOKEN) {
+    return html.includes(WEB_ANALYTICS_BEACON_SRC) && html.includes(token);
+}

package/dist/server/master-lock/guard.d.ts

@@ -46,6 +46,20 @@ export interface MasterLockGuardOptions extends LockPageOptions {
      */
     secure?: (url: URL, req: Request) => boolean;
 }
+/**
+ * The lock page's own CSP. Strict enough to stand in front of `apps/vault`'s wall without
+ * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
+ * script does the POST), and the page cannot be framed.
+ *
+ * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
+ * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
+ * without anything going red. It is also what
+ * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
+ * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
+ * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18:
+ * *"I don't want to trust cloudflare with master password data that is typed in."*
+ */
+export declare const MASTER_LOCK_CSP: string;
 export interface MasterLockGuard {
     /** `Response` when handled, `null` when the app should serve the request. */
     handle(req: Request): Promise<Response | null>;

package/dist/server/master-lock/guard.js

@@ -19,8 +19,16 @@ const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma
  * The lock page's own CSP. Strict enough to stand in front of `apps/vault`'s wall without
  * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
  * script does the POST), and the page cannot be framed.
+ *
+ * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
+ * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
+ * without anything going red. It is also what
+ * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
+ * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
+ * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18:
+ * *"I don't want to trust cloudflare with master password data that is typed in."*
  */
-const LOCK_CSP = "default-src 'none'; style-src 'self'; script-src 'self'; connect-src 'self'; " +
+export const MASTER_LOCK_CSP = "default-src 'none'; style-src 'self'; script-src 'self'; connect-src 'self'; " +
     "img-src data:; form-action 'none'; base-uri 'none'; frame-ancestors 'none'";
 export function createMasterLockGuard(options) {
     const resolve = typeof options.lock === "function" ? options.lock : () => options.lock;
@@ -256,7 +264,7 @@ function lockPage(options, lock) {
         status: 200,
         headers: {
             "content-type": "text/html; charset=utf-8",
-            "content-security-policy": LOCK_CSP,
+            "content-security-policy": MASTER_LOCK_CSP,
             "x-content-type-options": "nosniff",
             [MASTER_LOCK_STATE_HEADER]: "locked",
             ...noStore,
@@ -275,7 +283,7 @@ function accountsPage(options) {
         status: 200,
         headers: {
             "content-type": "text/html; charset=utf-8",
-            "content-security-policy": LOCK_CSP,
+            "content-security-policy": MASTER_LOCK_CSP,
             "x-content-type-options": "nosniff",
             ...noStore,
         },

package/dist/server/master-lock/index.d.ts

@@ -21,7 +21,7 @@
  * bundle, no framework version to migrate, and no app-local copy to drift.
  */
 export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage";
-export { type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard } from "./guard";
+export { MASTER_LOCK_CSP, type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard, } from "./guard";
 export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions, lockPageHtml, } from "./lockPage";
 export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, type MasterLockDirectoryOptions, masterLockPrincipalKey, } from "./principals";
 export { FIRST_ACCOUNT_ID, MasterLock, type MasterLockAccount, type MasterLockAddAccountResult, type MasterLockEnrollResult, type MasterLockOptions, type MasterLockRecord, type MasterLockStore, type MasterLockUnlockResult, readRecord, } from "./masterLock";

package/dist/server/master-lock/index.js

@@ -21,7 +21,7 @@
  * bundle, no framework version to migrate, and no app-local copy to drift.
  */
 export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage";
-export { createMasterLockGuard } from "./guard";
+export { MASTER_LOCK_CSP, createMasterLockGuard, } from "./guard";
 export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml, } from "./lockPage";
 export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, masterLockPrincipalKey, } from "./principals";
 export { FIRST_ACCOUNT_ID, MasterLock, readRecord, } from "./masterLock";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.4.0",
+	"version": "4.5.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -48,6 +48,12 @@
 			"source": "./src/server/context.ts",
 			"import": "./dist/server/context.js"
 		},
+		"./analytics": {
+			"types": "./dist/server/analytics/index.d.ts",
+			"bun": "./src/server/analytics/index.ts",
+			"source": "./src/server/analytics/index.ts",
+			"import": "./dist/server/analytics/index.js"
+		},
 		"./bench": {
 			"types": "./dist/server/bench/index.d.ts",
 			"bun": "./src/server/bench/index.ts",

package/src/server/analytics/index.ts

@@ -0,0 +1,30 @@
+/**
+ * `cursedbelt-server/analytics` — where the fleet's web-analytics beacon is DEFINED, and the
+ * invariant that decides which responses may carry it.
+ *
+ * Two files, and the pairing is the point:
+ *
+ *  · `webAnalytics.ts` is the one copy of the tag. An app's public shell pastes it; nothing
+ *    generates ten of them.
+ *  · `injectedScripts.ts` is the general rule — nothing that arrives in a response's HTML may
+ *    be refused by the CSP on that same response — which is what makes "the wall never carries
+ *    the beacon" a CHECK rather than a sentence. `../master-lock/beaconNeverReachesTheWall.spec.ts`
+ *    is that check.
+ *
+ * Both are pure string work with no imports at all, so this subpath costs a consumer nothing
+ * and drags no peer.
+ */
+export {
+	type InjectedScript,
+	foreignScriptSources,
+	scriptsRefusedByCsp,
+} from "./injectedScripts";
+export {
+	WEB_ANALYTICS_BEACON_ORIGIN,
+	WEB_ANALYTICS_BEACON_SRC,
+	WEB_ANALYTICS_SITE_TAG,
+	WEB_ANALYTICS_SITE_TOKEN,
+	WEB_ANALYTICS_TAG,
+	htmlCarriesWebAnalytics,
+	webAnalyticsTag,
+} from "./webAnalytics";

package/src/server/analytics/injectedScripts.spec.ts

@@ -0,0 +1,144 @@
+import { describe, expect, test } from "bun:test";
+import { foreignScriptSources, scriptsRefusedByCsp } from "./injectedScripts";
+import { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_TAG } from "./webAnalytics";
+
+const PAGE = "https://collections.cursedalchemy.com/";
+
+/**
+ * The tag Cloudflare's Automatic Setup appended, byte-for-byte as the zone emitted it on
+ * 2026-09-18 — pinned path, integrity hash, `crossorigin` and all. It is kept in its
+ * AUTOMATIC spelling on purpose: this is the shape that was arriving unasked-for, and a
+ * checker that only recognised the manual snippet would go quiet the moment somebody turned
+ * auto-install back on.
+ */
+const BEACON =
+	`<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495"` +
+	` integrity="sha512-iIg7k2xntmwu6/uSb5tpc/hySgZc4eoL31yB29W6tJFo2akwjPWcEqnCEdJvGexCL0KEQwVYv5BlowfhVz26hg=="` +
+	` data-cf-beacon='{"version":"2024.11.0","token":"bd88d63678b64bc89f9702f48846bc88","r":1,"spa":2}' crossorigin="anonymous"></script>`;
+
+/** A real app shell: one inline script, one same-origin module. Neither is foreign. */
+const SHELL = `<!doctype html><html><head>
+	<script>try { document.documentElement.classList.toggle("dark", true); } catch (e) {}</script>
+	<script type="module" crossorigin src="/assets/index-edXXbfEe.js"></script>
+</head><body><div id="root"></div></body></html>`;
+
+describe("foreignScriptSources", () => {
+	test("an app's own shell has none — inline and same-origin are not findings", () => {
+		expect(foreignScriptSources(SHELL, PAGE)).toEqual([]);
+	});
+
+	test("finds the beacon the edge appended, single-quoted attribute and all", () => {
+		const found = foreignScriptSources(SHELL.replace("</head>", `${BEACON}</head>`), PAGE);
+		expect(found).toHaveLength(1);
+		expect(found[0]?.origin).toBe(WEB_ANALYTICS_BEACON_ORIGIN);
+	});
+
+	test("the MANUAL snippet is found too, and names the same origin", () => {
+		const found = foreignScriptSources(SHELL.replace("</head>", `${WEB_ANALYTICS_TAG}</head>`), PAGE);
+		expect(found).toHaveLength(1);
+		expect(found[0]?.origin).toBe(WEB_ANALYTICS_BEACON_ORIGIN);
+	});
+
+	test("an absolute URL back to this app's own origin is not foreign", () => {
+		const html = `<script src="https://collections.cursedalchemy.com/assets/x.js"></script>`;
+		expect(foreignScriptSources(html, PAGE)).toEqual([]);
+	});
+
+	test("data: and blob: sources are skipped — no host was injected", () => {
+		const html = `<script src="data:text/javascript,void 0"></script><script src=blob:https://x/y></script>`;
+		expect(foreignScriptSources(html, PAGE)).toEqual([]);
+	});
+
+	test("two tags naming the same foreign origin are reported once per src", () => {
+		const html = `${BEACON}${BEACON}<script src="https://static.cloudflareinsights.com/other.js"></script>`;
+		expect(foreignScriptSources(html, PAGE)).toHaveLength(2);
+	});
+});
+
+describe("scriptsRefusedByCsp", () => {
+	const beacon = foreignScriptSources(BEACON, PAGE);
+
+	/**
+	 * 🔴 The failure path this whole file exists for — the owner's console line, turned into a
+	 * refusal. `script-src 'self'` with something injecting is exactly what he pasted.
+	 */
+	test("script-src 'self' refuses the injected beacon and names its origin", () => {
+		const refused = scriptsRefusedByCsp(
+			"default-src 'none'; style-src 'self'; script-src 'self'; connect-src 'self'; " +
+				"img-src data:; form-action 'none'; base-uri 'none'; frame-ancestors 'none'",
+			beacon,
+			PAGE,
+		);
+		expect(refused.map((s) => s.origin)).toEqual([WEB_ANALYTICS_BEACON_ORIGIN]);
+	});
+
+	test("allowing the host in script-src clears it", () => {
+		const csp = "default-src 'none'; script-src 'self' https://static.cloudflareinsights.com";
+		expect(scriptsRefusedByCsp(csp, beacon, PAGE)).toEqual([]);
+	});
+
+	test("a wildcard subdomain source clears it", () => {
+		expect(scriptsRefusedByCsp("script-src 'self' *.cloudflareinsights.com", beacon, PAGE)).toEqual(
+			[],
+		);
+	});
+
+	test("no CSP header at all refuses nothing — today's public shell", () => {
+		expect(scriptsRefusedByCsp(null, beacon, PAGE)).toEqual([]);
+		expect(scriptsRefusedByCsp("", beacon, PAGE)).toEqual([]);
+	});
+
+	test("a CSP with no script directive and no default-src refuses nothing", () => {
+		expect(scriptsRefusedByCsp("frame-ancestors 'none'; base-uri 'none'", beacon, PAGE)).toEqual([]);
+	});
+
+	test("default-src is the fallback when script-src is absent", () => {
+		expect(scriptsRefusedByCsp("default-src 'self'", beacon, PAGE)).toHaveLength(1);
+		expect(scriptsRefusedByCsp("default-src https:", beacon, PAGE)).toEqual([]);
+	});
+
+	test("script-src-elem wins over script-src, which wins over default-src", () => {
+		const csp =
+			"default-src 'none'; script-src 'self'; script-src-elem https://static.cloudflareinsights.com";
+		expect(scriptsRefusedByCsp(csp, beacon, PAGE)).toEqual([]);
+		expect(scriptsRefusedByCsp("default-src https:; script-src 'self'", beacon, PAGE)).toHaveLength(
+			1,
+		);
+	});
+
+	test("'none' admits nothing, even alongside a scheme in another directive", () => {
+		expect(scriptsRefusedByCsp("script-src 'none'", beacon, PAGE)).toHaveLength(1);
+	});
+
+	test("a scheme source only matches its own scheme", () => {
+		expect(scriptsRefusedByCsp("script-src http:", beacon, PAGE)).toHaveLength(1);
+		expect(scriptsRefusedByCsp("script-src https:", beacon, PAGE)).toEqual([]);
+	});
+
+	test("an http:// host source does not admit an https origin", () => {
+		expect(
+			scriptsRefusedByCsp("script-src http://static.cloudflareinsights.com", beacon, PAGE),
+		).toHaveLength(1);
+	});
+
+	test("a port or path on the source narrows nothing — the conservative direction", () => {
+		const csp = "script-src https://static.cloudflareinsights.com:443/beacon.min.js";
+		expect(scriptsRefusedByCsp(csp, beacon, PAGE)).toEqual([]);
+	});
+
+	test("'strict-dynamic' is undecidable from markup, so it permits", () => {
+		expect(scriptsRefusedByCsp("script-src 'self' 'strict-dynamic' 'nonce-abc'", beacon, PAGE)).toEqual(
+			[],
+		);
+	});
+
+	test("* permits, and 'self' still matches this app's own origin", () => {
+		expect(scriptsRefusedByCsp("script-src *", beacon, PAGE)).toEqual([]);
+		const own = [{ src: "/assets/x.js", origin: "https://collections.cursedalchemy.com" }];
+		expect(scriptsRefusedByCsp("script-src 'self'", own, PAGE)).toEqual([]);
+	});
+
+	test("nothing injected means nothing refused, however strict the policy", () => {
+		expect(scriptsRefusedByCsp("script-src 'none'", [], PAGE)).toEqual([]);
+	});
+});

package/src/server/analytics/injectedScripts.ts

@@ -0,0 +1,139 @@
+/**
+ * Does a page's own CSP refuse a script that arrived in that page's own HTML?
+ *
+ * ## The invariant, which names no vendor
+ *
+ * > No script that reaches the browser inside a response's HTML may be refused by the CSP on
+ * > that same response.
+ *
+ * Every part of the arrangement may move and this stays right. Turn an edge injection off and
+ * the foreign scripts disappear — green. Decide a third-party script is wanted and allow its
+ * host — green. Harden a page with `script-src 'self'` while something is still injecting into
+ * it — RED, and it names the origin, which is the console line the owner would otherwise find
+ * himself during an incident.
+ *
+ * ## 🔴 Why it lives in this package
+ *
+ * It was written in `apps/collections` on 2026-09-18 and it was right there, but it could only
+ * ever see one app — and the response it was written about, the master-lock wall, is served by
+ * THIS package to every app that mounts the guard. One copy here is what makes the two halves
+ * of `webAnalytics.ts`'s decision checkable in the same place: the wall refuses the beacon, and
+ * a public shell carries it.
+ *
+ * ## 🔴 Conservative on purpose
+ *
+ * Every ambiguity resolves to PERMITTED. A source expression this file cannot parse, a
+ * `'strict-dynamic'` that changes what host lists even mean, a CSP with no script directive at
+ * all — all of them pass. A deployed smoke decides whether an app's `scripts/deploy.ts` rolls
+ * back; a false red there discards good work over a CSP grammar corner, so the only thing that
+ * fails here is a script with NO source expression that could admit it.
+ */
+
+/** An absolute script URL found in the HTML, with the origin already resolved. */
+export interface InjectedScript {
+	/** Exactly as it appeared in the markup, for the failure message. */
+	src: string;
+	/** `https://static.cloudflareinsights.com`, resolved against the page's own URL. */
+	origin: string;
+}
+
+/**
+ * Every `<script src=…>` in `html` whose origin is NOT `pageUrl`'s.
+ *
+ * Inline scripts are ignored: they are the page's own (most shells here ship one, a pre-paint
+ * colour-scheme script) and a CSP that refuses them is a different finding from this one.
+ * `data:` and `blob:` are ignored for the same reason — neither is a host anything could have
+ * injected.
+ */
+export function foreignScriptSources(html: string, pageUrl: string): InjectedScript[] {
+	const page = new URL(pageUrl);
+	const found: InjectedScript[] = [];
+	const seen = new Set<string>();
+	const tag = /<script\b[^>]*?\bsrc\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/gi;
+	for (const match of html.matchAll(tag)) {
+		const raw = (match[1] ?? match[2] ?? match[3] ?? "").trim();
+		if (!raw) continue;
+		let origin: string;
+		try {
+			const url = new URL(raw, page);
+			if (url.protocol !== "http:" && url.protocol !== "https:") continue;
+			origin = url.origin;
+		} catch {
+			continue; // not a URL this check can reason about — see the conservative note
+		}
+		if (origin === page.origin) continue;
+		if (seen.has(origin + raw)) continue;
+		seen.add(origin + raw);
+		found.push({ src: raw, origin });
+	}
+	return found;
+}
+
+/**
+ * Which of `scripts` the `content-security-policy` header would refuse.
+ *
+ * `null`/absent/empty header means no policy, which refuses nothing. The directive consulted
+ * is `script-src-elem`, then `script-src`, then `default-src` — the browser's own fallback
+ * order for a `<script src>` element.
+ */
+export function scriptsRefusedByCsp(
+	csp: string | null | undefined,
+	scripts: InjectedScript[],
+	pageUrl: string,
+): InjectedScript[] {
+	if (!csp?.trim() || scripts.length === 0) return [];
+	const directives = new Map<string, string[]>();
+	for (const part of csp.split(";")) {
+		const tokens = part.trim().split(/\s+/).filter(Boolean);
+		const name = tokens.shift()?.toLowerCase();
+		if (name && !directives.has(name)) directives.set(name, tokens);
+	}
+	const sources =
+		directives.get("script-src-elem") ??
+		directives.get("script-src") ??
+		directives.get("default-src");
+	if (!sources) return [];
+	// `'strict-dynamic'` makes host allowlists inert in ways that depend on how the script was
+	// reached. Not decidable from the markup alone, so it is permitted — see the header.
+	if (sources.some((s) => s.toLowerCase() === "'strict-dynamic'")) return [];
+	const self = new URL(pageUrl).origin;
+	return scripts.filter(
+		(script) => !sources.some((source) => sourceAdmits(source, script.origin, self)),
+	);
+}
+
+/** Does one CSP source expression admit `origin`? Unparseable ⇒ yes, deliberately. */
+function sourceAdmits(source: string, origin: string, self: string): boolean {
+	const value = source.trim();
+	if (!value) return false;
+	if (value === "*") return true;
+	if (value.startsWith("'")) {
+		const keyword = value.toLowerCase();
+		if (keyword === "'self'") return origin === self;
+		// `'none'`, `'unsafe-inline'`, `'nonce-…'`, `'sha256-…'`, `'report-sample'`: none of
+		// them admits a host, and `'none'` in particular must not.
+		return false;
+	}
+	let target: URL;
+	try {
+		target = new URL(origin);
+	} catch {
+		return true;
+	}
+	// A bare scheme source — `https:`, `data:`.
+	if (/^[a-z][a-z0-9+.-]*:$/i.test(value)) return value.toLowerCase() === target.protocol;
+
+	const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+	let rest = value;
+	if (withScheme) {
+		if (withScheme[0].toLowerCase() !== `${target.protocol}//`) return false;
+		rest = value.slice(withScheme[0].length);
+	}
+	// Port and path narrow a source; ignoring them can only ever ADMIT more, which is the
+	// direction this file errs in.
+	const host = rest.split("/")[0]?.split(":")[0]?.toLowerCase() ?? "";
+	if (!host) return true;
+	if (host === "*") return true;
+	if (host.startsWith("*.")) return target.hostname.toLowerCase().endsWith(host.slice(1));
+	return target.hostname.toLowerCase() === host;
+}

package/src/server/analytics/webAnalytics.spec.ts

@@ -0,0 +1,68 @@
+import { describe, expect, test } from "bun:test";
+import {
+	WEB_ANALYTICS_BEACON_ORIGIN,
+	WEB_ANALYTICS_BEACON_SRC,
+	WEB_ANALYTICS_SITE_TAG,
+	WEB_ANALYTICS_SITE_TOKEN,
+	WEB_ANALYTICS_TAG,
+	htmlCarriesWebAnalytics,
+	webAnalyticsTag,
+} from "./webAnalytics";
+
+/**
+ * 🔴 The snippet, as Cloudflare's own `GET /accounts/<acct>/rum/site_info/list` returned it on
+ * 2026-09-18 for `cursedalchemy.com`, unescaped. Pinning it byte-for-byte is the point: this
+ * is the thing a shell pastes, and the day it drifts from the vendor's text is a day nobody
+ * would otherwise notice until a dashboard stopped filling.
+ */
+const FROM_CLOUDFLARE =
+	`<!-- Cloudflare Web Analytics --><script type='module' src='https://static.cloudflareinsights.com/beacon.min.js' ` +
+	`data-cf-beacon='{"token": "bd88d63678b64bc89f9702f48846bc88"}'></script><!-- End Cloudflare Web Analytics -->`;
+
+describe("the fleet's beacon", () => {
+	test("is exactly the snippet Cloudflare hands out for this site", () => {
+		expect(WEB_ANALYTICS_TAG).toBe(FROM_CLOUDFLARE);
+	});
+
+	test("carries the site TOKEN, never the site TAG", () => {
+		// Both are 32 hex characters and swapping them errors nowhere — the page loads, the
+		// beacon loads, and the pageview is recorded against nothing.
+		expect(WEB_ANALYTICS_TAG).toContain(WEB_ANALYTICS_SITE_TOKEN);
+		expect(WEB_ANALYTICS_TAG).not.toContain(WEB_ANALYTICS_SITE_TAG);
+		expect(WEB_ANALYTICS_SITE_TAG).not.toBe(WEB_ANALYTICS_SITE_TOKEN);
+	});
+
+	test("the src is under the origin a CSP would have to admit", () => {
+		expect(WEB_ANALYTICS_BEACON_SRC.startsWith(`${WEB_ANALYTICS_BEACON_ORIGIN}/`)).toBe(true);
+		expect(new URL(WEB_ANALYTICS_BEACON_SRC).origin).toBe(WEB_ANALYTICS_BEACON_ORIGIN);
+	});
+
+	test("another site's token produces that site's tag and nothing else changes", () => {
+		const other = webAnalyticsTag("0".repeat(32));
+		expect(other).toContain(WEB_ANALYTICS_BEACON_SRC);
+		expect(other).not.toContain(WEB_ANALYTICS_SITE_TOKEN);
+	});
+});
+
+describe("htmlCarriesWebAnalytics", () => {
+	test("true for the tag as authored, and for a re-wrapped copy of it", () => {
+		expect(htmlCarriesWebAnalytics(`<head>${WEB_ANALYTICS_TAG}</head>`)).toBe(true);
+		// A formatter is allowed to break the attributes across lines; the check must survive it.
+		const rewrapped =
+			`<script\n\ttype="module"\n\tsrc="${WEB_ANALYTICS_BEACON_SRC}"\n` +
+			`\tdata-cf-beacon='{"token": "${WEB_ANALYTICS_SITE_TOKEN}"}'\n></script>`;
+		expect(htmlCarriesWebAnalytics(rewrapped)).toBe(true);
+	});
+
+	test("false for a shell with no beacon at all", () => {
+		expect(htmlCarriesWebAnalytics("<head><title>Vault</title></head>")).toBe(false);
+	});
+
+	test("false when the src is right but the token is somebody else's", () => {
+		expect(htmlCarriesWebAnalytics(webAnalyticsTag("0".repeat(32)))).toBe(false);
+	});
+
+	test("false when the token is right but the src is not the beacon", () => {
+		expect(htmlCarriesWebAnalytics(`<!-- ${WEB_ANALYTICS_SITE_TOKEN} -->`)).toBe(false);
+	});
+});

package/src/server/analytics/webAnalytics.ts

@@ -0,0 +1,92 @@
+/**
+ * Cloudflare Web Analytics — ONE definition of the beacon, for every app on the fleet.
+ *
+ * ## 🔴 Why this is here and not in each app's `index.html` alone
+ *
+ * Until 2026-09-18 the zone carried **Automatic Setup**: Cloudflare rewrote every HTML
+ * response leaving `cursedalchemy.com` and appended the beacon tag. Nothing in any repo
+ * asked for it, nothing in any repo could see it locally, and it arrived on pages that
+ * deliberately refuse third-party script — including the master-lock wall, where a master
+ * password is typed. The owner read a console during an outage on 2026-09-17 and the FIRST
+ * line was that tag being refused; it broke nothing and cost an agent the first minutes of
+ * the incident.
+ *
+ * His decision, 2026-09-18, in his words: *"do your recommendation with option c but not on
+ * the wall. If we can stop the console error that would be good since we are purposely
+ * blocking on that page and it makes it look like there is a mistake when it shows."* — and,
+ * on why the wall's CSP may not simply be loosened: *"I don't want to trust cloudflare with
+ * master password data that is typed in."*
+ *
+ * So the install method moves from automatic to MANUAL. Same site, same dashboard, same
+ * data; the difference is that the fleet now decides *which pages* carry it. Public shells
+ * do. {@link "../master-lock/guard".MASTER_LOCK_CSP the wall} does not — and under manual
+ * setup it is not injected into at all, so there is no refused script and no console line.
+ *
+ * ## 🔴 `token` is the site TOKEN, not the site TAG
+ *
+ * They are both 32 hex characters and they are not interchangeable. `site_tag`
+ * ({@link WEB_ANALYTICS_SITE_TAG}) is the id the RUM API addresses the site by;
+ * `site_token` ({@link WEB_ANALYTICS_SITE_TOKEN}) is what goes in `data-cf-beacon`. Putting
+ * the tag in the snippet does not error anywhere — the page loads, the beacon loads, and the
+ * data goes nowhere. Measured 2026-09-18 against
+ * `GET /accounts/<acct>/rum/site_info/list`, which returns both fields **and** the ready-made
+ * `snippet`; {@link WEB_ANALYTICS_TAG} is that snippet byte-for-byte, and the token in it is
+ * the same one the edge was injecting.
+ *
+ * Neither value is a secret: the token is served to every visitor inside every page's HTML,
+ * which is the whole mechanism. It is an identifier, not a credential.
+ */
+
+/** The host the beacon is fetched from — the origin a CSP would have to admit. */
+export const WEB_ANALYTICS_BEACON_ORIGIN = "https://static.cloudflareinsights.com";
+
+/** The beacon itself. Manual setup serves the unversioned path; the edge served a pinned one. */
+export const WEB_ANALYTICS_BEACON_SRC = `${WEB_ANALYTICS_BEACON_ORIGIN}/beacon.min.js`;
+
+/**
+ * The `cursedalchemy.com` site's id in the RUM API. **Not** what goes in the tag — see the
+ * module note. Kept beside the token so the next reader cannot pick the wrong one by accident.
+ */
+export const WEB_ANALYTICS_SITE_TAG = "d1bea8562544421fbd2db5f11b74d1cc";
+
+/** The `cursedalchemy.com` site's `data-cf-beacon` token. This is what the tag carries. */
+export const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
+
+/**
+ * The snippet, exactly as Cloudflare's own `site_info` endpoint spells it.
+ *
+ * 🔴 The single-quoted attributes and the space after `"token":` are Cloudflare's, not a
+ * style choice, and they are kept because this string is COMPARED against what an app's
+ * shell contains. `data-cf-beacon`'s value is JSON containing double quotes, so the attribute
+ * quoting cannot be flipped without escaping; leaving it identical to the vendor's text means
+ * a future reader can diff it against the dashboard in one glance.
+ *
+ * `type='module'` rather than `defer`: that is what the endpoint returns today and what the
+ * edge was injecting, so switching install methods changes nothing about how the page loads.
+ */
+export function webAnalyticsTag(token: string = WEB_ANALYTICS_SITE_TOKEN): string {
+	return (
+		"<!-- Cloudflare Web Analytics -->" +
+		`<script type='module' src='${WEB_ANALYTICS_BEACON_SRC}' ` +
+		`data-cf-beacon='{"token": "${token}"}'></script>` +
+		"<!-- End Cloudflare Web Analytics -->"
+	);
+}
+
+/** The fleet's tag, for the one site this generation serves. */
+export const WEB_ANALYTICS_TAG = webAnalyticsTag();
+
+/**
+ * Does `html` carry the beacon for this site?
+ *
+ * Deliberately NOT a substring test against {@link WEB_ANALYTICS_TAG}: a shell is authored by
+ * hand and a formatter is allowed to re-wrap the tag across lines or re-order its attributes.
+ * What must be true is that the beacon's source is there AND that it is carrying the right
+ * token — the two halves that decide whether a pageview is recorded at all.
+ */
+export function htmlCarriesWebAnalytics(
+	html: string,
+	token: string = WEB_ANALYTICS_SITE_TOKEN,
+): boolean {
+	return html.includes(WEB_ANALYTICS_BEACON_SRC) && html.includes(token);
+}

package/src/server/master-lock/beaconNeverReachesTheWall.spec.ts

@@ -0,0 +1,227 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import {
+	MASTER_LOCK_PATHS,
+	type MasterLockKdfParams,
+	deriveMasterLockVerifier,
+} from "cursedbelt-core/master-lock";
+import {
+	WEB_ANALYTICS_BEACON_ORIGIN,
+	WEB_ANALYTICS_BEACON_SRC,
+	WEB_ANALYTICS_SITE_TOKEN,
+	WEB_ANALYTICS_TAG,
+	foreignScriptSources,
+	htmlCarriesWebAnalytics,
+	scriptsRefusedByCsp,
+} from "../analytics";
+import { MASTER_LOCK_CSP, createMasterLockGuard } from "./guard";
+import { MasterLock } from "./masterLock";
+import { createMemoryMasterLockStore } from "./store";
+
+/**
+ * 🔴 **The wall never carries the beacon, and the public shells always do.** Both halves, in
+ * one file, because half of this decision is an ABSENCE and an absence is what nobody notices
+ * has stopped being true.
+ *
+ * ## The decision this proves
+ *
+ * Cloudflare Web Analytics was on `cursedalchemy.com` with **Automatic Setup**: the edge
+ * appended its beacon to every HTML response on the zone, including the master-lock wall —
+ * the one page whose entire job is to take a master password with nothing else on it. The
+ * wall's {@link MASTER_LOCK_CSP} refused the tag, correctly, and the refusal printed in the
+ * console. The owner read that console during an outage on 2026-09-17 and it was the first
+ * line he saw.
+ *
+ * Three ways out were put to him. He took none of them as written (2026-09-18):
+ *
+ * > *"do your recommendation with option c but not on the wall. If we can stop the console
+ * > error that would be good since we are purposely blocking on that page and it makes it look
+ * > like there is a mistake when it shows."*
+ *
+ * and, on why the CSP does not simply gain the host:
+ *
+ * > *"I don't want to trust cloudflare with master password data that is typed in."*
+ *
+ * So: manual install, the snippet in the public shells, nothing on the wall — and no console
+ * error, because under manual setup nothing is injected into the wall to be refused.
+ *
+ * ## Why the check lives HERE
+ *
+ * The wall is served by this package to every app that mounts the guard, and the CSP is one
+ * shared constant. An app-local check can only ever see one app's shell, and the deployed
+ * smoke that `apps/collections` gained on 2026-09-18 cannot see the wall at all — it runs with
+ * no credentials and the wall is behind SSO. The seam that covers every app is this one, next
+ * to the policy itself.
+ *
+ * ## What would turn this red
+ *
+ *  · somebody adds `static.cloudflareinsights.com` to {@link MASTER_LOCK_CSP} — the thing he
+ *    refused;
+ *  · somebody pastes the analytics tag into `lockPage.ts` or `accountsPage.ts`;
+ *  · the wall starts serving any cross-origin script its own policy would refuse, beacon or
+ *    not — the general invariant, which names no vendor.
+ */
+const KDF: MasterLockKdfParams = {
+	v: 1,
+	alg: "PBKDF2-SHA256",
+	iter: 1,
+	salt: "AAECAwQFBgcICQoLDA0ODw",
+};
+const PAGE = "https://collections.cursedalchemy.com/";
+
+let VERIFIER = "";
+let SEED = "";
+
+beforeAll(async () => {
+	VERIFIER = await deriveMasterLockVerifier("open sesame", KDF);
+	SEED = JSON.stringify({
+		kdf: KDF,
+		verifierHash: await Bun.password.hash(VERIFIER, { algorithm: "argon2id" }),
+	});
+});
+
+function build() {
+	const lock = new MasterLock({ store: createMemoryMasterLockStore(), seedJson: SEED });
+	return createMasterLockGuard({ lock, appLabel: "Test App" });
+}
+
+const doc = (path: string, cookie?: string): Request =>
+	new Request(`https://collections.cursedalchemy.com${path}`, {
+		headers: { "sec-fetch-dest": "document", ...(cookie ? { cookie } : {}) },
+	});
+
+/** Unlock, and hand back the cookie pair a browser would send with the next request. */
+async function open(guard: ReturnType<typeof build>): Promise<string> {
+	const res = await guard.handle(
+		new Request(`https://collections.cursedalchemy.com${MASTER_LOCK_PATHS.unlock}`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ verifier: VERIFIER }),
+		}),
+	);
+	expect(res?.status).toBe(200);
+	return (res?.headers.get("set-cookie") ?? "").split(";")[0] ?? "";
+}
+
+/** Every HTML surface the wall can answer a browser with, as real responses. */
+async function wallPages(): Promise<{ label: string; html: string; csp: string | null }[]> {
+	const guard = build();
+	const locked = await guard.handle(doc("/some/deep/page"));
+	expect(locked?.status).toBe(200);
+	const cookie = await open(guard);
+	const accounts = await guard.handle(doc(MASTER_LOCK_PATHS.accounts, cookie));
+	expect(accounts?.status).toBe(200);
+	const pages = [
+		{ label: "lock page", res: locked as Response },
+		{ label: "accounts page", res: accounts as Response },
+	];
+	return Promise.all(
+		pages.map(async ({ label, res }) => ({
+			label,
+			html: await res.text(),
+			csp: res.headers.get("content-security-policy"),
+		})),
+	);
+}
+
+describe("the wall, as it is actually served", () => {
+	test("every HTML surface answers with the shared CSP", async () => {
+		for (const page of await wallPages()) {
+			expect(page.csp, `${page.label} must carry the wall's CSP`).toBe(MASTER_LOCK_CSP);
+		}
+	});
+
+	test("carries NO cross-origin script — beacon or otherwise", async () => {
+		for (const page of await wallPages()) {
+			expect(foreignScriptSources(page.html, PAGE), `${page.label} pulled in a foreign script`).toEqual(
+				[],
+			);
+		}
+	});
+
+	test("does not mention the analytics beacon anywhere in its markup", async () => {
+		for (const page of await wallPages()) {
+			expect(page.html).not.toContain(WEB_ANALYTICS_BEACON_SRC);
+			expect(page.html).not.toContain(WEB_ANALYTICS_SITE_TOKEN);
+			expect(htmlCarriesWebAnalytics(page.html)).toBe(false);
+		}
+	});
+
+	/** The general invariant: nothing that arrives may be refused by the policy on that response. */
+	test("nothing it serves is refused by its own CSP", async () => {
+		for (const page of await wallPages()) {
+			const refused = scriptsRefusedByCsp(page.csp, foreignScriptSources(page.html, PAGE), PAGE);
+			expect(refused.map((s) => s.origin), `${page.label} serves a script it then refuses`).toEqual(
+				[],
+			);
+		}
+	});
+});
+
+describe("the CSP keeps the beacon out by construction", () => {
+	test("MASTER_LOCK_CSP never names the beacon's host", () => {
+		expect(MASTER_LOCK_CSP).not.toContain("cloudflareinsights");
+		expect(MASTER_LOCK_CSP).toContain("script-src 'self'");
+	});
+
+	/**
+	 * 🔴 The coupling, and the reason this is one file rather than two assertions in two repos:
+	 * the wall's policy REFUSES the tag. So "the wall carries no beacon" cannot quietly become
+	 * "the wall carries a beacon that works" — reaching that state means somebody loosened the
+	 * policy, and the assertion above is what catches them.
+	 */
+	test("the tag, pasted into the wall, would be refused — and this names the origin", () => {
+		const refused = scriptsRefusedByCsp(
+			MASTER_LOCK_CSP,
+			foreignScriptSources(WEB_ANALYTICS_TAG, PAGE),
+			PAGE,
+		);
+		expect(refused.map((s) => s.origin)).toEqual([WEB_ANALYTICS_BEACON_ORIGIN]);
+	});
+
+	test("the failure path: allowing the host is what would make it load", () => {
+		const loosened = `${MASTER_LOCK_CSP}; script-src-elem 'self' ${WEB_ANALYTICS_BEACON_ORIGIN}`;
+		expect(scriptsRefusedByCsp(loosened, foreignScriptSources(WEB_ANALYTICS_TAG, PAGE), PAGE)).toEqual(
+			[],
+		);
+	});
+});
+
+describe("the other half — a public shell that carries it", () => {
+	/**
+	 * The shell an app ships: inline colour-scheme bootstrap, its own bundle, and the beacon.
+	 * An app asserts this about ITS OWN `index.html` (rule 3 — a repo's gate proves that repo);
+	 * what this package owes it is a helper pair that cannot disagree with the wall's.
+	 */
+	const SHELL = `<!doctype html><html><head>
+	<script>try { document.documentElement.classList.toggle("dark", true); } catch (e) {}</script>
+	${WEB_ANALYTICS_TAG}
+</head><body><div id="root"></div><script type="module" src="/src/main.tsx"></script></body></html>`;
+
+	test("the helper recognises the tag, and says no when it is missing", () => {
+		expect(htmlCarriesWebAnalytics(SHELL)).toBe(true);
+		expect(htmlCarriesWebAnalytics(SHELL.replace(WEB_ANALYTICS_TAG, ""))).toBe(false);
+	});
+
+	test("a shell carrying the RIGHT src but the site TAG as its token is not carrying it", () => {
+		// The trap `webAnalytics.ts` documents: tag and token are both 32 hex characters, the
+		// page still loads, and the data goes nowhere.
+		const wrong = SHELL.replace(WEB_ANALYTICS_SITE_TOKEN, "d1bea8562544421fbd2db5f11b74d1cc");
+		expect(htmlCarriesWebAnalytics(wrong)).toBe(false);
+	});
+
+	test("with no CSP the beacon is permitted — the public shells' actual state", () => {
+		expect(scriptsRefusedByCsp(null, foreignScriptSources(SHELL, PAGE), PAGE)).toEqual([]);
+	});
+
+	/**
+	 * 🔴 `apps/vault` is the exception, and it is an exception the general rule already gets
+	 * right without knowing the app's name: vault serves `script-src 'self'` on its PUBLIC
+	 * shell, so the beacon does not belong there either. Measured live on 2026-09-18 — vault's
+	 * shell was the one host on the zone the edge's injection never reached.
+	 */
+	test("a shell with a strict CSP must NOT carry it, and the check says why", () => {
+		const strict = "default-src 'self'; script-src 'self'; frame-ancestors 'none'";
+		const refused = scriptsRefusedByCsp(strict, foreignScriptSources(SHELL, PAGE), PAGE);
+		expect(refused.map((s) => s.origin)).toEqual([WEB_ANALYTICS_BEACON_ORIGIN]);
+	});
+});

package/src/server/master-lock/guard.ts

@@ -79,8 +79,16 @@ const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma
  * The lock page's own CSP. Strict enough to stand in front of `apps/vault`'s wall without
  * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
  * script does the POST), and the page cannot be framed.
+ *
+ * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
+ * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
+ * without anything going red. It is also what
+ * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
+ * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
+ * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18:
+ * *"I don't want to trust cloudflare with master password data that is typed in."*
  */
-const LOCK_CSP =
+export const MASTER_LOCK_CSP =
 	"default-src 'none'; style-src 'self'; script-src 'self'; connect-src 'self'; " +
 	"img-src data:; form-action 'none'; base-uri 'none'; frame-ancestors 'none'";
 
@@ -357,7 +365,7 @@ function lockPage(options: LockPageOptions, lock: MasterLock): Response {
 		status: 200,
 		headers: {
 			"content-type": "text/html; charset=utf-8",
-			"content-security-policy": LOCK_CSP,
+			"content-security-policy": MASTER_LOCK_CSP,
 			"x-content-type-options": "nosniff",
 			[MASTER_LOCK_STATE_HEADER]: "locked",
 			...noStore,
@@ -377,7 +385,7 @@ function accountsPage(options: LockPageOptions): Response {
 		status: 200,
 		headers: {
 			"content-type": "text/html; charset=utf-8",
-			"content-security-policy": LOCK_CSP,
+			"content-security-policy": MASTER_LOCK_CSP,
 			"x-content-type-options": "nosniff",
 			...noStore,
 		},

package/src/server/master-lock/index.ts

@@ -27,7 +27,12 @@ export {
 	MASTER_LOCK_MIN_PASSWORD_LENGTH,
 	accountsPageHtml,
 } from "./accountsPage";
-export { type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard } from "./guard";
+export {
+	MASTER_LOCK_CSP,
+	type MasterLockGuard,
+	type MasterLockGuardOptions,
+	createMasterLockGuard,
+} from "./guard";
 export {
 	LOCK_SCRIPT,
 	LOCK_STYLE,