cursedbelt-server 4.4.0 → 4.6.0

package/dist/server/analytics/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `cursedbelt-server/analytics` — where the fleet's web-analytics beacon is DEFINED, and the
+ * invariant that decides which responses may carry it.
+ *
+ * Two files, and the pairing is the point:
+ *
+ *  · `webAnalytics.ts` is the one copy of the tag. An app's public shell pastes it; nothing
+ *    generates ten of them.
+ *  · `injectedScripts.ts` is the general rule — nothing that arrives in a response's HTML may
+ *    be refused by the CSP on that same response — which is what makes "the wall never carries
+ *    the beacon" a CHECK rather than a sentence. `../master-lock/beaconNeverReachesTheWall.spec.ts`
+ *    is that check.
+ *
+ * Both are pure string work with no imports at all, so this subpath costs a consumer nothing
+ * and drags no peer.
+ */
+export { type InjectedScript, foreignScriptSources, scriptsRefusedByCsp, } from "./injectedScripts";
+export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_PUBLIC_HOST, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsBootstrap, webAnalyticsTag, } from "./webAnalytics";

package/dist/server/analytics/index.js

@@ -0,0 +1,18 @@
+/**
+ * `cursedbelt-server/analytics` — where the fleet's web-analytics beacon is DEFINED, and the
+ * invariant that decides which responses may carry it.
+ *
+ * Two files, and the pairing is the point:
+ *
+ *  · `webAnalytics.ts` is the one copy of the tag. An app's public shell pastes it; nothing
+ *    generates ten of them.
+ *  · `injectedScripts.ts` is the general rule — nothing that arrives in a response's HTML may
+ *    be refused by the CSP on that same response — which is what makes "the wall never carries
+ *    the beacon" a CHECK rather than a sentence. `../master-lock/beaconNeverReachesTheWall.spec.ts`
+ *    is that check.
+ *
+ * Both are pure string work with no imports at all, so this subpath costs a consumer nothing
+ * and drags no peer.
+ */
+export { foreignScriptSources, scriptsRefusedByCsp, } from "./injectedScripts";
+export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_PUBLIC_HOST, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsBootstrap, webAnalyticsTag, } from "./webAnalytics";

package/dist/server/analytics/injectedScripts.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Does a page's own CSP refuse a script that arrived in that page's own HTML?
+ *
+ * ## The invariant, which names no vendor
+ *
+ * > No script that reaches the browser inside a response's HTML may be refused by the CSP on
+ * > that same response.
+ *
+ * Every part of the arrangement may move and this stays right. Turn an edge injection off and
+ * the foreign scripts disappear — green. Decide a third-party script is wanted and allow its
+ * host — green. Harden a page with `script-src 'self'` while something is still injecting into
+ * it — RED, and it names the origin, which is the console line the owner would otherwise find
+ * himself during an incident.
+ *
+ * ## 🔴 Why it lives in this package
+ *
+ * It was written in `apps/collections` on 2026-09-18 and it was right there, but it could only
+ * ever see one app — and the response it was written about, the master-lock wall, is served by
+ * THIS package to every app that mounts the guard. One copy here is what makes the two halves
+ * of `webAnalytics.ts`'s decision checkable in the same place: the wall refuses the beacon, and
+ * a public shell carries it.
+ *
+ * ## 🔴 Conservative on purpose
+ *
+ * Every ambiguity resolves to PERMITTED. A source expression this file cannot parse, a
+ * `'strict-dynamic'` that changes what host lists even mean, a CSP with no script directive at
+ * all — all of them pass. A deployed smoke decides whether an app's `scripts/deploy.ts` rolls
+ * back; a false red there discards good work over a CSP grammar corner, so the only thing that
+ * fails here is a script with NO source expression that could admit it.
+ */
+/** An absolute script URL found in the HTML, with the origin already resolved. */
+export interface InjectedScript {
+    /** Exactly as it appeared in the markup, for the failure message. */
+    src: string;
+    /** `https://static.cloudflareinsights.com`, resolved against the page's own URL. */
+    origin: string;
+}
+/**
+ * Every `<script src=…>` in `html` whose origin is NOT `pageUrl`'s.
+ *
+ * Inline scripts are ignored: they are the page's own (most shells here ship one, a pre-paint
+ * colour-scheme script) and a CSP that refuses them is a different finding from this one.
+ * `data:` and `blob:` are ignored for the same reason — neither is a host anything could have
+ * injected.
+ */
+export declare function foreignScriptSources(html: string, pageUrl: string): InjectedScript[];
+/**
+ * Which of `scripts` the `content-security-policy` header would refuse.
+ *
+ * `null`/absent/empty header means no policy, which refuses nothing. The directive consulted
+ * is `script-src-elem`, then `script-src`, then `default-src` — the browser's own fallback
+ * order for a `<script src>` element.
+ */
+export declare function scriptsRefusedByCsp(csp: string | null | undefined, scripts: InjectedScript[], pageUrl: string): InjectedScript[];

package/dist/server/analytics/injectedScripts.js

@@ -0,0 +1,138 @@
+/**
+ * Does a page's own CSP refuse a script that arrived in that page's own HTML?
+ *
+ * ## The invariant, which names no vendor
+ *
+ * > No script that reaches the browser inside a response's HTML may be refused by the CSP on
+ * > that same response.
+ *
+ * Every part of the arrangement may move and this stays right. Turn an edge injection off and
+ * the foreign scripts disappear — green. Decide a third-party script is wanted and allow its
+ * host — green. Harden a page with `script-src 'self'` while something is still injecting into
+ * it — RED, and it names the origin, which is the console line the owner would otherwise find
+ * himself during an incident.
+ *
+ * ## 🔴 Why it lives in this package
+ *
+ * It was written in `apps/collections` on 2026-09-18 and it was right there, but it could only
+ * ever see one app — and the response it was written about, the master-lock wall, is served by
+ * THIS package to every app that mounts the guard. One copy here is what makes the two halves
+ * of `webAnalytics.ts`'s decision checkable in the same place: the wall refuses the beacon, and
+ * a public shell carries it.
+ *
+ * ## 🔴 Conservative on purpose
+ *
+ * Every ambiguity resolves to PERMITTED. A source expression this file cannot parse, a
+ * `'strict-dynamic'` that changes what host lists even mean, a CSP with no script directive at
+ * all — all of them pass. A deployed smoke decides whether an app's `scripts/deploy.ts` rolls
+ * back; a false red there discards good work over a CSP grammar corner, so the only thing that
+ * fails here is a script with NO source expression that could admit it.
+ */
+/**
+ * Every `<script src=…>` in `html` whose origin is NOT `pageUrl`'s.
+ *
+ * Inline scripts are ignored: they are the page's own (most shells here ship one, a pre-paint
+ * colour-scheme script) and a CSP that refuses them is a different finding from this one.
+ * `data:` and `blob:` are ignored for the same reason — neither is a host anything could have
+ * injected.
+ */
+export function foreignScriptSources(html, pageUrl) {
+    const page = new URL(pageUrl);
+    const found = [];
+    const seen = new Set();
+    const tag = /<script\b[^>]*?\bsrc\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/gi;
+    for (const match of html.matchAll(tag)) {
+        const raw = (match[1] ?? match[2] ?? match[3] ?? "").trim();
+        if (!raw)
+            continue;
+        let origin;
+        try {
+            const url = new URL(raw, page);
+            if (url.protocol !== "http:" && url.protocol !== "https:")
+                continue;
+            origin = url.origin;
+        }
+        catch {
+            continue; // not a URL this check can reason about — see the conservative note
+        }
+        if (origin === page.origin)
+            continue;
+        if (seen.has(origin + raw))
+            continue;
+        seen.add(origin + raw);
+        found.push({ src: raw, origin });
+    }
+    return found;
+}
+/**
+ * Which of `scripts` the `content-security-policy` header would refuse.
+ *
+ * `null`/absent/empty header means no policy, which refuses nothing. The directive consulted
+ * is `script-src-elem`, then `script-src`, then `default-src` — the browser's own fallback
+ * order for a `<script src>` element.
+ */
+export function scriptsRefusedByCsp(csp, scripts, pageUrl) {
+    if (!csp?.trim() || scripts.length === 0)
+        return [];
+    const directives = new Map();
+    for (const part of csp.split(";")) {
+        const tokens = part.trim().split(/\s+/).filter(Boolean);
+        const name = tokens.shift()?.toLowerCase();
+        if (name && !directives.has(name))
+            directives.set(name, tokens);
+    }
+    const sources = directives.get("script-src-elem") ??
+        directives.get("script-src") ??
+        directives.get("default-src");
+    if (!sources)
+        return [];
+    // `'strict-dynamic'` makes host allowlists inert in ways that depend on how the script was
+    // reached. Not decidable from the markup alone, so it is permitted — see the header.
+    if (sources.some((s) => s.toLowerCase() === "'strict-dynamic'"))
+        return [];
+    const self = new URL(pageUrl).origin;
+    return scripts.filter((script) => !sources.some((source) => sourceAdmits(source, script.origin, self)));
+}
+/** Does one CSP source expression admit `origin`? Unparseable ⇒ yes, deliberately. */
+function sourceAdmits(source, origin, self) {
+    const value = source.trim();
+    if (!value)
+        return false;
+    if (value === "*")
+        return true;
+    if (value.startsWith("'")) {
+        const keyword = value.toLowerCase();
+        if (keyword === "'self'")
+            return origin === self;
+        // `'none'`, `'unsafe-inline'`, `'nonce-…'`, `'sha256-…'`, `'report-sample'`: none of
+        // them admits a host, and `'none'` in particular must not.
+        return false;
+    }
+    let target;
+    try {
+        target = new URL(origin);
+    }
+    catch {
+        return true;
+    }
+    // A bare scheme source — `https:`, `data:`.
+    if (/^[a-z][a-z0-9+.-]*:$/i.test(value))
+        return value.toLowerCase() === target.protocol;
+    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+    let rest = value;
+    if (withScheme) {
+        if (withScheme[0].toLowerCase() !== `${target.protocol}//`)
+            return false;
+        rest = value.slice(withScheme[0].length);
+    }
+    // Port and path narrow a source; ignoring them can only ever ADMIT more, which is the
+    // direction this file errs in.
+    const host = rest.split("/")[0]?.split(":")[0]?.toLowerCase() ?? "";
+    if (!host)
+        return true;
+    if (host === "*")
+        return true;
+    if (host.startsWith("*."))
+        return target.hostname.toLowerCase().endsWith(host.slice(1));
+    return target.hostname.toLowerCase() === host;
+}

package/dist/server/analytics/webAnalytics.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Cloudflare Web Analytics — ONE definition of the beacon, for every app on the fleet.
+ *
+ * ## 🔴 Why this is here and not in each app's `index.html` alone
+ *
+ * Until 2026-09-18 the zone carried **Automatic Setup**: Cloudflare rewrote every HTML
+ * response leaving `cursedalchemy.com` and appended the beacon tag. Nothing in any repo
+ * asked for it, nothing in any repo could see it locally, and it arrived on pages that
+ * deliberately refuse third-party script — including the master-lock wall, where a master
+ * password is typed. The owner read a console during an outage on 2026-09-17 and the FIRST
+ * line was that tag being refused; it broke nothing and cost an agent the first minutes of
+ * the incident.
+ *
+ * His decision, 2026-09-18, in his words: *"do your recommendation with option c but not on
+ * the wall. If we can stop the console error that would be good since we are purposely
+ * blocking on that page and it makes it look like there is a mistake when it shows."* — and,
+ * on why the wall's CSP may not simply be loosened: *"I don't want to trust cloudflare with
+ * master password data that is typed in."*
+ *
+ * So the install method moves from automatic to MANUAL. Same site, same dashboard, same
+ * data; the difference is that the fleet now decides *which pages* carry it. Public shells
+ * do. {@link "../master-lock/guard".MASTER_LOCK_CSP the wall} does not — and under manual
+ * setup it is not injected into at all, so there is no refused script and no console line.
+ *
+ * ## 🔴 `token` is the site TOKEN, not the site TAG
+ *
+ * They are both 32 hex characters and they are not interchangeable. `site_tag`
+ * ({@link WEB_ANALYTICS_SITE_TAG}) is the id the RUM API addresses the site by;
+ * `site_token` ({@link WEB_ANALYTICS_SITE_TOKEN}) is what goes in `data-cf-beacon`. Putting
+ * the tag in the snippet does not error anywhere — the page loads, the beacon loads, and the
+ * data goes nowhere. Measured 2026-09-18 against
+ * `GET /accounts/<acct>/rum/site_info/list`, which returns both fields **and** the ready-made
+ * `snippet`; {@link WEB_ANALYTICS_TAG} is that snippet byte-for-byte, and the token in it is
+ * the same one the edge was injecting.
+ *
+ * Neither value is a secret: the token is served to every visitor inside every page's HTML,
+ * which is the whole mechanism. It is an identifier, not a credential.
+ */
+/** The host the beacon is fetched from — the origin a CSP would have to admit. */
+export declare const WEB_ANALYTICS_BEACON_ORIGIN = "https://static.cloudflareinsights.com";
+/** The beacon itself. Manual setup serves the unversioned path; the edge served a pinned one. */
+export declare const WEB_ANALYTICS_BEACON_SRC = "https://static.cloudflareinsights.com/beacon.min.js";
+/**
+ * The `cursedalchemy.com` site's id in the RUM API. **Not** what goes in the tag — see the
+ * module note. Kept beside the token so the next reader cannot pick the wrong one by accident.
+ */
+export declare const WEB_ANALYTICS_SITE_TAG = "d1bea8562544421fbd2db5f11b74d1cc";
+/** The `cursedalchemy.com` site's `data-cf-beacon` token. This is what the tag carries. */
+export declare const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
+/**
+ * The snippet, exactly as Cloudflare's own `site_info` endpoint spells it.
+ *
+ * 🔴 The single-quoted attributes and the space after `"token":` are Cloudflare's, not a
+ * style choice, and they are kept because this string is COMPARED against what an app's
+ * shell contains. `data-cf-beacon`'s value is JSON containing double quotes, so the attribute
+ * quoting cannot be flipped without escaping; leaving it identical to the vendor's text means
+ * a future reader can diff it against the dashboard in one glance.
+ *
+ * `type='module'` rather than `defer`: that is what the endpoint returns today and what the
+ * edge was injecting, so switching install methods changes nothing about how the page loads.
+ */
+export declare function webAnalyticsTag(token?: string): string;
+/** The fleet's tag, for the one site this generation serves. */
+export declare const WEB_ANALYTICS_TAG: string;
+/** The zone. A page served from anywhere else must not load the beacon — see below. */
+export declare const WEB_ANALYTICS_PUBLIC_HOST = "cursedalchemy.com";
+/**
+ * What a static shell actually pastes: the tag, behind a HOSTNAME GUARD.
+ *
+ * ## 🔴 Why the bare snippet cannot go in an `index.html`
+ *
+ * Measured 2026-09-18, the first time the eight shells carried it. The beacon posts its
+ * pageview to `https://cloudflareinsights.com/cdn-cgi/rum`, and Cloudflare answers that
+ * preflight with `Access-Control-Allow-Origin: http://127.0.0.1` — no port. So on every LOCAL
+ * page load the browser prints:
+ *
+ * > Access to XMLHttpRequest at 'https://cloudflareinsights.com/cdn-cgi/rum' from origin
+ * > 'http://127.0.0.1:57845' has been blocked by CORS policy … Failed to load resource
+ *
+ * Under Automatic Setup this never happened: the injection is done by the EDGE, so it existed
+ * only on the zone and a developer never saw it. Pasting the raw snippet into the source moves
+ * it to every `bun run dev` and every browser test — `apps/music` lost 5 route-render checks and
+ * `apps/desk` lost 24, both asserting the console is empty, and the owner's own local console
+ * would have gained a red line on every page.
+ *
+ * That is the exact cost he asked to be rid of, one environment over. So the guard: the beacon
+ * is appended only when the page is being served from {@link WEB_ANALYTICS_PUBLIC_HOST}, which
+ * is the only place it can report anyway.
+ *
+ * ## Why an inline script rather than a build-time injection
+ *
+ * A Vite plugin would mean ten `vite.config.ts` edits and a frontend build depending on a
+ * server package — and it would not even work: `apps/desk`'s browser suite runs against a
+ * production `dist` served from `127.0.0.1`, so a production-only injection is still a console
+ * error there. The hostname is the honest discriminator, not the build mode.
+ *
+ * 🔴 It needs inline script to be permitted on the page. Every shell that carries it already
+ * ships one; `apps/vault` does not, serves `script-src 'self'`, and is exempt from the beacon
+ * for that reason — see `tools/check-web-analytics.ts`.
+ */
+export declare function webAnalyticsBootstrap(token?: string): string;
+/**
+ * Does `html` carry the beacon for this site?
+ *
+ * Deliberately NOT a substring test against {@link WEB_ANALYTICS_TAG}: a shell is authored by
+ * hand and a formatter is allowed to re-wrap the tag across lines or re-order its attributes.
+ * What must be true is that the beacon's source is there AND that it is carrying the right
+ * token — the two halves that decide whether a pageview is recorded at all.
+ */
+export declare function htmlCarriesWebAnalytics(html: string, token?: string): boolean;

package/dist/server/analytics/webAnalytics.js

@@ -0,0 +1,130 @@
+/**
+ * Cloudflare Web Analytics — ONE definition of the beacon, for every app on the fleet.
+ *
+ * ## 🔴 Why this is here and not in each app's `index.html` alone
+ *
+ * Until 2026-09-18 the zone carried **Automatic Setup**: Cloudflare rewrote every HTML
+ * response leaving `cursedalchemy.com` and appended the beacon tag. Nothing in any repo
+ * asked for it, nothing in any repo could see it locally, and it arrived on pages that
+ * deliberately refuse third-party script — including the master-lock wall, where a master
+ * password is typed. The owner read a console during an outage on 2026-09-17 and the FIRST
+ * line was that tag being refused; it broke nothing and cost an agent the first minutes of
+ * the incident.
+ *
+ * His decision, 2026-09-18, in his words: *"do your recommendation with option c but not on
+ * the wall. If we can stop the console error that would be good since we are purposely
+ * blocking on that page and it makes it look like there is a mistake when it shows."* — and,
+ * on why the wall's CSP may not simply be loosened: *"I don't want to trust cloudflare with
+ * master password data that is typed in."*
+ *
+ * So the install method moves from automatic to MANUAL. Same site, same dashboard, same
+ * data; the difference is that the fleet now decides *which pages* carry it. Public shells
+ * do. {@link "../master-lock/guard".MASTER_LOCK_CSP the wall} does not — and under manual
+ * setup it is not injected into at all, so there is no refused script and no console line.
+ *
+ * ## 🔴 `token` is the site TOKEN, not the site TAG
+ *
+ * They are both 32 hex characters and they are not interchangeable. `site_tag`
+ * ({@link WEB_ANALYTICS_SITE_TAG}) is the id the RUM API addresses the site by;
+ * `site_token` ({@link WEB_ANALYTICS_SITE_TOKEN}) is what goes in `data-cf-beacon`. Putting
+ * the tag in the snippet does not error anywhere — the page loads, the beacon loads, and the
+ * data goes nowhere. Measured 2026-09-18 against
+ * `GET /accounts/<acct>/rum/site_info/list`, which returns both fields **and** the ready-made
+ * `snippet`; {@link WEB_ANALYTICS_TAG} is that snippet byte-for-byte, and the token in it is
+ * the same one the edge was injecting.
+ *
+ * Neither value is a secret: the token is served to every visitor inside every page's HTML,
+ * which is the whole mechanism. It is an identifier, not a credential.
+ */
+/** The host the beacon is fetched from — the origin a CSP would have to admit. */
+export const WEB_ANALYTICS_BEACON_ORIGIN = "https://static.cloudflareinsights.com";
+/** The beacon itself. Manual setup serves the unversioned path; the edge served a pinned one. */
+export const WEB_ANALYTICS_BEACON_SRC = `${WEB_ANALYTICS_BEACON_ORIGIN}/beacon.min.js`;
+/**
+ * The `cursedalchemy.com` site's id in the RUM API. **Not** what goes in the tag — see the
+ * module note. Kept beside the token so the next reader cannot pick the wrong one by accident.
+ */
+export const WEB_ANALYTICS_SITE_TAG = "d1bea8562544421fbd2db5f11b74d1cc";
+/** The `cursedalchemy.com` site's `data-cf-beacon` token. This is what the tag carries. */
+export const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
+/**
+ * The snippet, exactly as Cloudflare's own `site_info` endpoint spells it.
+ *
+ * 🔴 The single-quoted attributes and the space after `"token":` are Cloudflare's, not a
+ * style choice, and they are kept because this string is COMPARED against what an app's
+ * shell contains. `data-cf-beacon`'s value is JSON containing double quotes, so the attribute
+ * quoting cannot be flipped without escaping; leaving it identical to the vendor's text means
+ * a future reader can diff it against the dashboard in one glance.
+ *
+ * `type='module'` rather than `defer`: that is what the endpoint returns today and what the
+ * edge was injecting, so switching install methods changes nothing about how the page loads.
+ */
+export function webAnalyticsTag(token = WEB_ANALYTICS_SITE_TOKEN) {
+    return ("<!-- Cloudflare Web Analytics -->" +
+        `<script type='module' src='${WEB_ANALYTICS_BEACON_SRC}' ` +
+        `data-cf-beacon='{"token": "${token}"}'></script>` +
+        "<!-- End Cloudflare Web Analytics -->");
+}
+/** The fleet's tag, for the one site this generation serves. */
+export const WEB_ANALYTICS_TAG = webAnalyticsTag();
+/** The zone. A page served from anywhere else must not load the beacon — see below. */
+export const WEB_ANALYTICS_PUBLIC_HOST = "cursedalchemy.com";
+/**
+ * What a static shell actually pastes: the tag, behind a HOSTNAME GUARD.
+ *
+ * ## 🔴 Why the bare snippet cannot go in an `index.html`
+ *
+ * Measured 2026-09-18, the first time the eight shells carried it. The beacon posts its
+ * pageview to `https://cloudflareinsights.com/cdn-cgi/rum`, and Cloudflare answers that
+ * preflight with `Access-Control-Allow-Origin: http://127.0.0.1` — no port. So on every LOCAL
+ * page load the browser prints:
+ *
+ * > Access to XMLHttpRequest at 'https://cloudflareinsights.com/cdn-cgi/rum' from origin
+ * > 'http://127.0.0.1:57845' has been blocked by CORS policy … Failed to load resource
+ *
+ * Under Automatic Setup this never happened: the injection is done by the EDGE, so it existed
+ * only on the zone and a developer never saw it. Pasting the raw snippet into the source moves
+ * it to every `bun run dev` and every browser test — `apps/music` lost 5 route-render checks and
+ * `apps/desk` lost 24, both asserting the console is empty, and the owner's own local console
+ * would have gained a red line on every page.
+ *
+ * That is the exact cost he asked to be rid of, one environment over. So the guard: the beacon
+ * is appended only when the page is being served from {@link WEB_ANALYTICS_PUBLIC_HOST}, which
+ * is the only place it can report anyway.
+ *
+ * ## Why an inline script rather than a build-time injection
+ *
+ * A Vite plugin would mean ten `vite.config.ts` edits and a frontend build depending on a
+ * server package — and it would not even work: `apps/desk`'s browser suite runs against a
+ * production `dist` served from `127.0.0.1`, so a production-only injection is still a console
+ * error there. The hostname is the honest discriminator, not the build mode.
+ *
+ * 🔴 It needs inline script to be permitted on the page. Every shell that carries it already
+ * ships one; `apps/vault` does not, serves `script-src 'self'`, and is exempt from the beacon
+ * for that reason — see `tools/check-web-analytics.ts`.
+ */
+export function webAnalyticsBootstrap(token = WEB_ANALYTICS_SITE_TOKEN) {
+    return [
+        "<script>",
+        `\tvar host = location.hostname;`,
+        `\tif (host === "${WEB_ANALYTICS_PUBLIC_HOST}" || host.endsWith(".${WEB_ANALYTICS_PUBLIC_HOST}")) {`,
+        `\t\tvar beacon = document.createElement("script");`,
+        `\t\tbeacon.type = "module";`,
+        `\t\tbeacon.src = "${WEB_ANALYTICS_BEACON_SRC}";`,
+        `\t\tbeacon.setAttribute("data-cf-beacon", '{"token": "${token}"}');`,
+        `\t\tdocument.head.appendChild(beacon);`,
+        "\t}",
+        "</script>",
+    ].join("\n");
+}
+/**
+ * Does `html` carry the beacon for this site?
+ *
+ * Deliberately NOT a substring test against {@link WEB_ANALYTICS_TAG}: a shell is authored by
+ * hand and a formatter is allowed to re-wrap the tag across lines or re-order its attributes.
+ * What must be true is that the beacon's source is there AND that it is carrying the right
+ * token — the two halves that decide whether a pageview is recorded at all.
+ */
+export function htmlCarriesWebAnalytics(html, token = WEB_ANALYTICS_SITE_TOKEN) {
+    return html.includes(WEB_ANALYTICS_BEACON_SRC) && html.includes(token);
+}

package/dist/server/master-lock/guard.d.ts

@@ -46,6 +46,20 @@ export interface MasterLockGuardOptions extends LockPageOptions {
      */
     secure?: (url: URL, req: Request) => boolean;
 }
+/**
+ * The lock page's own CSP. Strict enough to stand in front of `apps/vault`'s wall without
+ * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
+ * script does the POST), and the page cannot be framed.
+ *
+ * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
+ * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
+ * without anything going red. It is also what
+ * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
+ * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
+ * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18:
+ * *"I don't want to trust cloudflare with master password data that is typed in."*
+ */
+export declare const MASTER_LOCK_CSP: string;
 export interface MasterLockGuard {
     /** `Response` when handled, `null` when the app should serve the request. */
     handle(req: Request): Promise<Response | null>;

package/dist/server/master-lock/guard.js

@@ -19,8 +19,16 @@ const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma
  * The lock page's own CSP. Strict enough to stand in front of `apps/vault`'s wall without
  * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
  * script does the POST), and the page cannot be framed.
+ *
+ * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
+ * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
+ * without anything going red. It is also what
+ * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
+ * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
+ * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18:
+ * *"I don't want to trust cloudflare with master password data that is typed in."*
  */
-const LOCK_CSP = "default-src 'none'; style-src 'self'; script-src 'self'; connect-src 'self'; " +
+export const MASTER_LOCK_CSP = "default-src 'none'; style-src 'self'; script-src 'self'; connect-src 'self'; " +
     "img-src data:; form-action 'none'; base-uri 'none'; frame-ancestors 'none'";
 export function createMasterLockGuard(options) {
     const resolve = typeof options.lock === "function" ? options.lock : () => options.lock;
@@ -256,7 +264,7 @@ function lockPage(options, lock) {
         status: 200,
         headers: {
             "content-type": "text/html; charset=utf-8",
-            "content-security-policy": LOCK_CSP,
+            "content-security-policy": MASTER_LOCK_CSP,
             "x-content-type-options": "nosniff",
             [MASTER_LOCK_STATE_HEADER]: "locked",
             ...noStore,
@@ -275,7 +283,7 @@ function accountsPage(options) {
         status: 200,
         headers: {
             "content-type": "text/html; charset=utf-8",
-            "content-security-policy": LOCK_CSP,
+            "content-security-policy": MASTER_LOCK_CSP,
             "x-content-type-options": "nosniff",
             ...noStore,
         },

package/dist/server/master-lock/index.d.ts

@@ -21,7 +21,7 @@
  * bundle, no framework version to migrate, and no app-local copy to drift.
  */
 export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage";
-export { type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard } from "./guard";
+export { MASTER_LOCK_CSP, type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard, } from "./guard";
 export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions, lockPageHtml, } from "./lockPage";
 export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, type MasterLockDirectoryOptions, masterLockPrincipalKey, } from "./principals";
 export { FIRST_ACCOUNT_ID, MasterLock, type MasterLockAccount, type MasterLockAddAccountResult, type MasterLockEnrollResult, type MasterLockOptions, type MasterLockRecord, type MasterLockStore, type MasterLockUnlockResult, readRecord, } from "./masterLock";

package/dist/server/master-lock/index.js

@@ -21,7 +21,7 @@
  * bundle, no framework version to migrate, and no app-local copy to drift.
  */
 export { MASTER_LOCK_ACCOUNTS_PAGE_PATHS, MASTER_LOCK_ACCOUNTS_SCRIPT, MASTER_LOCK_ACCOUNTS_STYLE, MASTER_LOCK_MIN_PASSWORD_LENGTH, accountsPageHtml, } from "./accountsPage";
-export { createMasterLockGuard } from "./guard";
+export { MASTER_LOCK_CSP, createMasterLockGuard, } from "./guard";
 export { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml, } from "./lockPage";
 export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, masterLockPrincipalKey, } from "./principals";
 export { FIRST_ACCOUNT_ID, MasterLock, readRecord, } from "./masterLock";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.4.0",
+	"version": "4.6.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -48,6 +48,12 @@
 			"source": "./src/server/context.ts",
 			"import": "./dist/server/context.js"
 		},
+		"./analytics": {
+			"types": "./dist/server/analytics/index.d.ts",
+			"bun": "./src/server/analytics/index.ts",
+			"source": "./src/server/analytics/index.ts",
+			"import": "./dist/server/analytics/index.js"
+		},
 		"./bench": {
 			"types": "./dist/server/bench/index.d.ts",
 			"bun": "./src/server/bench/index.ts",

package/src/server/analytics/index.ts

@@ -0,0 +1,32 @@
+/**
+ * `cursedbelt-server/analytics` — where the fleet's web-analytics beacon is DEFINED, and the
+ * invariant that decides which responses may carry it.
+ *
+ * Two files, and the pairing is the point:
+ *
+ *  · `webAnalytics.ts` is the one copy of the tag. An app's public shell pastes it; nothing
+ *    generates ten of them.
+ *  · `injectedScripts.ts` is the general rule — nothing that arrives in a response's HTML may
+ *    be refused by the CSP on that same response — which is what makes "the wall never carries
+ *    the beacon" a CHECK rather than a sentence. `../master-lock/beaconNeverReachesTheWall.spec.ts`
+ *    is that check.
+ *
+ * Both are pure string work with no imports at all, so this subpath costs a consumer nothing
+ * and drags no peer.
+ */
+export {
+	type InjectedScript,
+	foreignScriptSources,
+	scriptsRefusedByCsp,
+} from "./injectedScripts";
+export {
+	WEB_ANALYTICS_BEACON_ORIGIN,
+	WEB_ANALYTICS_BEACON_SRC,
+	WEB_ANALYTICS_PUBLIC_HOST,
+	WEB_ANALYTICS_SITE_TAG,
+	WEB_ANALYTICS_SITE_TOKEN,
+	WEB_ANALYTICS_TAG,
+	htmlCarriesWebAnalytics,
+	webAnalyticsBootstrap,
+	webAnalyticsTag,
+} from "./webAnalytics";