cursedbelt 2.6.0 → 2.7.0

package/dist/server/sync/engine.js

@@ -0,0 +1,185 @@
+import { StopBatch, } from "./types";
+const BATCH = 500;
+/** Kit-owned dedupe + ledger insert around the app's per-op merge logic. Everything
+ *  for one op happens in one transaction: state change AND ledger insert, so a crash
+ *  can never apply without recording (double-apply) or record without applying
+ *  (silent drop). */
+export function createSyncApplier(log, applyOne) {
+    return (ops, ctx) => {
+        let applied = 0;
+        let seen = 0;
+        let conflicts = 0;
+        let cursor = ops.length > 0 ? ops[0].seq - 1 : 0;
+        let error = null;
+        for (const op of ops) {
+            if (log.has(op.origin, op.originSeq)) {
+                seen++;
+                cursor = op.seq;
+                continue;
+            }
+            try {
+                const outcome = log.transaction(() => {
+                    const result = applyOne(op, ctx);
+                    log.recordRemote(op);
+                    return result;
+                });
+                if (outcome === "applied")
+                    applied++;
+                else if (outcome === "conflict") {
+                    applied++;
+                    conflicts++;
+                }
+                cursor = op.seq;
+            }
+            catch (err) {
+                if (err instanceof StopBatch) {
+                    error = err.message;
+                    break;
+                }
+                throw err;
+            }
+        }
+        return { applied, seen, conflicts, cursor, error };
+    };
+}
+const DEFAULT_MAX_PUSH_BYTES = 1_000_000;
+/** Split ops into request-sized chunks by serialized payload weight. */
+export function chunkByBytes(ops, maxBytes) {
+    const chunks = [];
+    let current = [];
+    let weight = 0;
+    for (const op of ops) {
+        const size = JSON.stringify(op).length + 1;
+        if (current.length > 0 && weight + size > maxBytes) {
+            chunks.push(current);
+            current = [];
+            weight = 0;
+        }
+        current.push(op);
+        weight += size;
+    }
+    if (current.length > 0)
+        chunks.push(current);
+    return chunks;
+}
+export async function pushToRemote(opts, remote) {
+    const info = await remote.info();
+    const remoteId = info.instanceId;
+    const remoteKinds = new Set(info.opKinds);
+    // One predicate for both compatibility layers, so the "stop before it, leave the
+    // cursor there" path is shared and a caller cannot accidentally give the finer
+    // check the weaker (drop-it) semantics.
+    const refusedBecause = (op) => {
+        if (!remoteKinds.has(op.kind))
+            return op.kind;
+        return opts.peerRefusal?.(op, info) ?? null;
+    };
+    const { log } = opts;
+    const peerHas = log.cursor(remoteId, "pull");
+    let cursor = log.cursor(remoteId, "push");
+    let pushed = 0;
+    let held = 0;
+    // Conflicts the RECEIVER detected while applying our push — push-before-pull means
+    // exactly one side detects any given concurrency, and when that side is the
+    // receiver the count would otherwise vanish from the dialer's summary.
+    let conflicts = 0;
+    let blockedBy;
+    for (;;) {
+        const page = log.listAfter(cursor, remoteId, BATCH);
+        if (page.ops.length === 0) {
+            // Nothing sendable in the window — advance past the peer's own reflected ops.
+            if (page.cursor > cursor) {
+                cursor = page.cursor;
+                log.setCursor(remoteId, "push", cursor);
+            }
+            break;
+        }
+        const blockedAt = page.ops.findIndex((op) => refusedBecause(op) !== null);
+        const sendableRaw = blockedAt === -1 ? page.ops : page.ops.slice(0, blockedAt);
+        if (blockedAt !== -1) {
+            const op = page.ops[blockedAt];
+            blockedBy = refusedBecause(op) ?? op.kind;
+        }
+        const outbound = [];
+        for (const op of sendableRaw) {
+            const filtered = opts.policy ? opts.policy(op) : op;
+            if (filtered === null)
+                held++;
+            else
+                outbound.push(filtered);
+        }
+        if (outbound.length > 0) {
+            // Chunked by bytes so a large backlog cannot trip the proxy's body cap;
+            // the cursor advances per DELIVERED chunk, so an interrupted push resumes
+            // at the failure with nothing lost or re-sent.
+            for (const chunk of chunkByBytes(outbound, opts.maxPushBytes ?? DEFAULT_MAX_PUSH_BYTES)) {
+                const report = await remote.push({ ops: chunk, peerHas });
+                pushed += report.applied;
+                conflicts += report.conflicts;
+                if (report.error !== null) {
+                    // The remote stopped inside the chunk (its own ordering guard). Advance
+                    // to what it durably took and stop; the next run retries from there.
+                    const processed = report.applied + report.seen;
+                    if (processed > 0) {
+                        cursor = chunk[processed - 1].seq;
+                        log.setCursor(remoteId, "push", cursor);
+                    }
+                    return { remoteId, pushed, held, conflicts, blockedBy: report.error };
+                }
+                cursor = chunk[chunk.length - 1].seq;
+                log.setCursor(remoteId, "push", cursor);
+            }
+        }
+        if (sendableRaw.length === 0)
+            break; // the very next op is blocked — nothing to advance past
+        cursor = sendableRaw[sendableRaw.length - 1].seq;
+        log.setCursor(remoteId, "push", cursor);
+        if (blockedBy)
+            break;
+        if (page.cursor >= page.head && blockedAt === -1) {
+            // Window served through head with nothing blocked — take the page cursor so
+            // trailing excluded ops don't re-page forever.
+            cursor = page.cursor;
+            log.setCursor(remoteId, "push", cursor);
+            break;
+        }
+    }
+    return { remoteId, pushed, held, conflicts, blockedBy };
+}
+export async function pullFromRemote(opts, remote, applyBatch) {
+    const info = await remote.info();
+    const remoteId = info.instanceId;
+    const { log } = opts;
+    const self = log.instanceId();
+    const peerReceivedUpTo = log.cursor(remoteId, "push");
+    let cursor = log.cursor(remoteId, "pull");
+    let pulled = 0;
+    let conflicts = 0;
+    for (;;) {
+        const page = await remote.pull(cursor, self);
+        if (page.ops.length === 0 && page.cursor <= cursor)
+            break;
+        const report = applyBatch(page.ops, { peerId: remoteId, peerReceivedUpTo });
+        pulled += report.applied;
+        conflicts += report.conflicts;
+        if (report.error !== null) {
+            if (report.cursor > cursor) {
+                cursor = report.cursor;
+                log.setCursor(remoteId, "pull", cursor);
+            }
+            break;
+        }
+        cursor = page.ops.length === 0 ? page.cursor : Math.max(report.cursor, page.cursor);
+        log.setCursor(remoteId, "pull", cursor);
+        if (page.cursor >= page.head)
+            break;
+    }
+    return { remoteId, pulled, conflicts };
+}
+/** One full reconciliation: push, then pull. */
+export async function runSync(opts, remote, applyBatch) {
+    const push = await pushToRemote(opts, remote);
+    const pull = await pullFromRemote(opts, remote, applyBatch);
+    return { ...push, ...pull, conflicts: push.conflicts + pull.conflicts, remoteId: push.remoteId };
+}
+//# sourceMappingURL=engine.js.map

package/dist/server/sync/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/server/sync/engine.ts"],"names":[],"mappings":"AAgBA,OAAO,EAMN,SAAS,GAGT,MAAM,SAAS,CAAC;AAEjB,MAAM,KAAK,GAAG,GAAG,CAAC;AAElB;;;qBAGqB;AACrB,MAAM,UAAU,iBAAiB,CAAC,GAAU,EAAE,QAAkB;IAC/D,OAAO,CAAC,GAAa,EAAE,GAAiB,EAAe,EAAE;QACxD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAY,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACtB,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,IAAI,EAAE,CAAC;gBACP,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC;gBAChB,SAAS;YACV,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE;oBACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;oBACjC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;oBACrB,OAAO,MAAM,CAAC;gBACf,CAAC,CAAC,CAAC;gBACH,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,EAAE,CAAC;qBAChC,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBACjC,OAAO,EAAE,CAAC;oBACV,SAAS,EAAE,CAAC;gBACb,CAAC;gBACD,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC;YACjB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;oBAC9B,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC;oBACpB,MAAM;gBACP,CAAC;gBACD,MAAM,GAAG,CAAC;YACX,CAAC;QACF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC,CAAC;AACH,CAAC;AAuCD,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEzC,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,GAAa,EAAE,QAAgB;IAC3D,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,IAAI,GAAG,QAAQ,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,MAAM,IAAI,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,IAAmB,EACnB,MAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;IACjC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,iFAAiF;IACjF,+EAA+E;IAC/E,wCAAwC;IACxC,MAAM,cAAc,GAAG,CAAC,EAAU,EAAiB,EAAE;QACpD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC;QAC9C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;IAC7C,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,mFAAmF;IACnF,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,SAA6B,CAAC;IAClC,SAAS,CAAC;QACT,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,8EAA8E;YAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBAC1B,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;YACD,MAAM;QACP,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;QAC1E,MAAM,WAAW,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/E,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAW,CAAC;YACzC,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,IAAI,QAAQ,KAAK,IAAI;gBAAE,IAAI,EAAE,CAAC;;gBACzB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,wEAAwE;YACxE,0EAA0E;YAC1E,+CAA+C;YAC/C,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC,EAAE,CAAC;gBACzF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1D,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC;gBACzB,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;gBAC9B,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC3B,wEAAwE;oBACxE,qEAAqE;oBACrE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;oBAC/C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;wBACnB,MAAM,GAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAY,CAAC,GAAG,CAAC;wBAC9C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;oBACzC,CAAC;oBACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBACvE,CAAC;gBACD,MAAM,GAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAY,CAAC,GAAG,CAAC;gBACjD,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;QACF,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,wDAAwD;QAC7F,MAAM,GAAI,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAY,CAAC,GAAG,CAAC;QAC7D,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,SAAS;YAAE,MAAM;QACrB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YAClD,4EAA4E;YAC5E,+CAA+C;YAC/C,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM;QACP,CAAC;IACF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,IAAmB,EACnB,MAAiB,EACjB,UAA6D;IAE7D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAC9B,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,SAAS,CAAC;QACT,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM;YAAE,MAAM;QAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC;QACzB,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;QAC9B,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBAC5B,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBACvB,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;YACD,MAAM;QACP,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpF,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM;IACrC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAmB,EACnB,MAAiB,EACjB,UAA6D;IAE7D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5D,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AAClG,CAAC"}

package/dist/server/sync/http.d.ts

@@ -0,0 +1,107 @@
+/**
+ * The HTTP transport: the receiver sub-app the internet-facing instance mounts, and
+ * the fetch-backed {@link RemoteApi} the dialer binds to.
+ *
+ * Mount the receiver OUTSIDE any browser-session gate (a machine peer has no session;
+ * notes' 401 trap: a token route registered after the session gate answers 401 with a
+ * valid token) but behind the token gate built here. An unconfigured receiver simply
+ * does not exist — the orch-companion idiom: no token verifier, no routes, nothing to
+ * probe.
+ */
+import { Hono } from "hono";
+import type { OpLog } from "./opLog";
+import type { ApplyOne, ApplyReport, RemoteApi } from "./types";
+/**
+ * Trim a page to the byte budget, keeping it a PREFIX so `cursor` stays the seq
+ * of the last op actually returned. Anything else silently drops ops: the caller
+ * advances past rows it never received and no later pull will offer them again.
+ */
+export declare function capPageBytes<T extends {
+    seq: number;
+}>(ops: T[], maxBytes: number): {
+    ops: T[];
+    truncated: boolean;
+};
+export interface ReceiverHooks {
+    /** Every authenticated hit — the only evidence a non-dialing half has that it is
+     *  in step (vault's `lastPeerContactAt` lesson). */
+    onPeerContact?: (peerId: string) => void;
+    /** The "Sync now was pressed HERE" stamp the dialer polls. */
+    readRequest?: () => number | null;
+}
+export interface ReceiverOptions {
+    log: OpLog;
+    opKinds: readonly string[];
+    /** Verify a presented bearer token for the sync scope. Return false to refuse.
+     *  Bind this to a TokenStore (`(t) => tokens.verify(t, "sync") !== null`) or a
+     *  constant-time static compare — the kit does not care which. */
+    verifyToken: (presented: string) => boolean;
+    /** The app's merge logic, when it is stateless across a batch (vault, station).
+     *  Give this OR {@link beginBatch}, never both. */
+    applyOne?: ApplyOne;
+    /**
+     * The app's merge logic when the batch needs state of its own — called once per
+     * `POST /push`, so what it closes over belongs to that batch alone.
+     *
+     * 🔴 A single shared `ApplyOne` closing over a mutable accumulator is the bug this
+     * exists to make unrepresentable: two pushes in flight would pour into one counter,
+     * and the second response would carry the first's leftovers. notes needs it — its
+     * applier collects the attachment blobs a purge orphaned and the items whose search
+     * index must be rebuilt, neither of which can happen inside the op's transaction.
+     */
+    beginBatch?: () => ApplyOne;
+    /**
+     * Post-commit work, awaited BEFORE the response goes out — an index rebuild, a blob
+     * delete that is a network call. Anything that must not run inside the applier's
+     * transaction but must be done by the time the caller sees a 200, or the caller will
+     * advance its cursor past work that never happened.
+     */
+    afterBatch?: (report: ApplyReport) => void | Promise<void>;
+    hooks?: ReceiverHooks;
+}
+/** Build the receiver: GET /info, GET /pull, POST /push, GET /requested. */
+export declare function createSyncReceiver(options: ReceiverOptions): Hono;
+/**
+ * The fetch-backed remote the dialer binds to. `basePath` is where the peer
+ * mounted its receiver (e.g. `https://station.cursedalchemy.com/api/sync`).
+ *
+ * 🔴 **Redirects are REFUSED, never followed** (2026-08-21). `fetch` follows by
+ * default, and that turned a moved hostname into eight days of silence: the
+ * console's subdomain cutover made `station.cursedalchemy.com` a **301** to
+ * `station.cursedalchemy.com`, the dialer followed it, Cloudflare Access answered
+ * the un-credentialed redirect with its **login page — HTTP 200, text/html**,
+ * and `r.json()` threw `Failed to parse JSON`. The dialer logs that as
+ * `[sync] failed (ignored)` and retries forever, so:
+ *
+ *   · every mirrored report on prod froze at the moment of the cutover, while
+ *     each one still rendered a confident `capturedAt` age;
+ *   · nothing was red anywhere — not a gate, not a smoke, not `/healthz`;
+ *   · the error named JSON, which is three layers away from the cause.
+ *
+ * A 3xx here can only ever mean the peer address is wrong, so it is reported as
+ * exactly that, with the destination in the message. Following a redirect
+ * silently is how a sync survives its own misconfiguration.
+ *
+ * The same reasoning covers a 2xx that is not JSON: an Access login page, an
+ * nginx error page or a captive portal all arrive as `200 text/html`, and
+ * "Failed to parse JSON" is the least useful sentence available about any of
+ * them. {@link readJson} names the status, the content type and a snippet.
+ */
+export declare function createHttpRemote(options: {
+    basePath: string;
+    token: string;
+    selfId: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    /**
+     * Extra headers for THIS peer's host — the Cloudflare Access service token,
+     * where the receiver sits behind an Access application. Host-scoped BY THE
+     * CALLER — never a blanket wrapper: a credential sent where it is not needed is a
+     * credential leaked. The retired generation had a `satellite-kit/cloudflare-access`
+     * helper that did the host-scoping; no caller in this app passes this today
+     * (`syncClient.ts` handles Access by refusing to follow its 302 instead), so a
+     * future one owns the scoping itself.
+     */
+    extraHeaders?: Record<string, string>;
+}): RemoteApi;
+//# sourceMappingURL=http.d.ts.map

package/dist/server/sync/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/server/sync/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAgB,QAAQ,EAAE,WAAW,EAAY,SAAS,EAAU,MAAM,SAAS,CAAC;AA2BhG;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACrD,GAAG,EAAE,CAAC,EAAE,EACR,QAAQ,EAAE,MAAM,GACd;IAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAOlC;AASD,MAAM,WAAW,aAAa;IAC7B;wDACoD;IACpD,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC/B,GAAG,EAAE,KAAK,CAAC;IACX,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;sEAEkE;IAClE,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C;uDACmD;IACnD,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAmFjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,GAAG,SAAS,CAqFZ"}

package/dist/server/sync/http.js

@@ -0,0 +1,244 @@
+/**
+ * The HTTP transport: the receiver sub-app the internet-facing instance mounts, and
+ * the fetch-backed {@link RemoteApi} the dialer binds to.
+ *
+ * Mount the receiver OUTSIDE any browser-session gate (a machine peer has no session;
+ * notes' 401 trap: a token route registered after the session gate answers 401 with a
+ * valid token) but behind the token gate built here. An unconfigured receiver simply
+ * does not exist — the orch-companion idiom: no token verifier, no routes, nothing to
+ * probe.
+ */
+import { Hono } from "hono";
+import { createSyncApplier } from "./engine";
+const noStore = { "cache-control": "no-store" };
+const SYNC_PAGE = 500;
+/**
+ * Byte budget for ONE pull page — the mirror of `maxPushBytes` on the push side,
+ * and it was missing.
+ *
+ * 🔴 Measured against live prod on 2026-08-01: `GET /pull?after=0` against
+ * station's 709-op log served **37 MB at 309 ops** and then OOM-killed the unit
+ * (`memoryMax=300M` on a t3.micro). `SYNC_PAGE = 500` is a COUNT cap, and these
+ * ops are not small — a 130 KB overview snapshot, a 68 KB fleet CSV — so 500 of
+ * them is tens of megabytes serialized into one response buffer.
+ *
+ * What makes it worse than a slow request is that it does not converge: the unit
+ * dies, systemd restarts it, the dialer retries the identical oversized pull, and
+ * the pair never advances. Push already learned this exact lesson (a 413 wedges
+ * because the batch never shrinks); the receiving half kept only the count cap
+ * because a fully-caught-up peer never asks for enough rows to notice.
+ *
+ * A single op larger than the budget is still served alone — refusing it would
+ * wedge the log permanently on that op, which is worse than one big response.
+ */
+const SYNC_PAGE_BYTES = 4_000_000;
+/**
+ * Trim a page to the byte budget, keeping it a PREFIX so `cursor` stays the seq
+ * of the last op actually returned. Anything else silently drops ops: the caller
+ * advances past rows it never received and no later pull will offer them again.
+ */
+export function capPageBytes(ops, maxBytes) {
+    let weight = 0;
+    for (let i = 0; i < ops.length; i++) {
+        weight += JSON.stringify(ops[i]).length + 1;
+        if (weight > maxBytes && i > 0)
+            return { ops: ops.slice(0, i), truncated: true };
+    }
+    return { ops, truncated: false };
+}
+/** Coerce and clamp the caller's peer id — a cursor key and a label, never trusted
+ *  further than that. */
+function peerIdOf(header, query) {
+    const raw = query ?? header ?? "";
+    return /^[0-9A-Za-z_-]{1,64}$/.test(raw) ? raw : "peer";
+}
+/** Build the receiver: GET /info, GET /pull, POST /push, GET /requested. */
+export function createSyncReceiver(options) {
+    const { log, verifyToken } = options;
+    if ((options.applyOne === undefined) === (options.beginBatch === undefined)) {
+        // Loud at construction, because both mistakes are silent at runtime: neither
+        // given means every op vanishes as "ignored"; both given means one of the two
+        // is quietly never called.
+        throw new Error("[vault sync] receiver: give exactly one of `applyOne` or `beginBatch`");
+    }
+    const beginBatch = options.beginBatch ?? (() => options.applyOne);
+    const api = new Hono();
+    api.use("*", async (c, next) => {
+        const header = c.req.header("authorization") ?? "";
+        const presented = header.startsWith("Bearer ") ? header.slice(7) : "";
+        if (presented.length === 0 || !verifyToken(presented)) {
+            return c.json({ error: "unauthorized" }, 401, noStore);
+        }
+        await next();
+    });
+    // AFTER the gate — an unauthenticated caller must never look like peer contact.
+    api.use("*", async (c, next) => {
+        options.hooks?.onPeerContact?.(peerIdOf(c.req.header("x-sync-peer"), c.req.query("peer")));
+        await next();
+    });
+    api.get("/info", (c) => {
+        const body = {
+            instanceId: log.instanceId(),
+            head: log.head(),
+            opKinds: [...options.opKinds],
+        };
+        return c.json(body, 200, noStore);
+    });
+    api.get("/requested", (c) => c.json({ requestedAt: options.hooks?.readRequest?.() ?? null }, 200, noStore));
+    api.get("/pull", (c) => {
+        const afterRaw = c.req.query("after");
+        const after = afterRaw !== undefined && /^\d+$/.test(afterRaw) ? Number(afterRaw) : 0;
+        const excludeRaw = c.req.query("exclude") ?? "";
+        const exclude = /^[0-9A-Za-z_-]{1,64}$/.test(excludeRaw) ? excludeRaw : "";
+        const page = log.listAfter(after, exclude, SYNC_PAGE);
+        // Count cap first (cheap, bounds the serialize below), then the byte cap.
+        const capped = capPageBytes(page.ops, SYNC_PAGE_BYTES);
+        // The cursor must name the last op ACTUALLY served, or the peer skips the
+        // remainder forever. `head` is untouched — it is how the caller knows to
+        // come back for another page.
+        const cursor = capped.truncated
+            ? (capped.ops.at(-1)?.seq ?? after)
+            : page.cursor;
+        log.setCursor(peerIdOf(c.req.header("x-sync-peer"), c.req.query("peer")), "served", cursor);
+        return c.json({ ops: capped.ops, cursor, head: page.head }, 200, noStore);
+    });
+    api.post("/push", async (c) => {
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "bad_request" }, 400, noStore);
+        }
+        if (body === null || typeof body !== "object")
+            return c.json({ error: "bad_request" }, 400, noStore);
+        const { ops, peerHas } = body;
+        if (!Array.isArray(ops))
+            return c.json({ error: "bad_request" }, 400, noStore);
+        const peerId = peerIdOf(c.req.header("x-sync-peer"), c.req.query("peer"));
+        // The client's DURABLE pull cursor for us is the crash-safe concurrency bound;
+        // fall back to our served cursor if an older caller omits it (vault's rule).
+        const bound = typeof peerHas === "number" && Number.isInteger(peerHas) && peerHas >= 0
+            ? peerHas
+            : log.cursor(peerId, "served");
+        const ctx = { peerId, peerReceivedUpTo: bound };
+        const report = createSyncApplier(log, beginBatch())(ops, ctx);
+        // Awaited, not fire-and-forget: the caller advances its push cursor on this
+        // response, so work still outstanding when it lands is work nobody will redo.
+        await options.afterBatch?.(report);
+        return c.json(report, report.error === null ? 200 : 409, noStore);
+    });
+    return api;
+}
+/**
+ * The fetch-backed remote the dialer binds to. `basePath` is where the peer
+ * mounted its receiver (e.g. `https://station.cursedalchemy.com/api/sync`).
+ *
+ * 🔴 **Redirects are REFUSED, never followed** (2026-08-21). `fetch` follows by
+ * default, and that turned a moved hostname into eight days of silence: the
+ * console's subdomain cutover made `station.cursedalchemy.com` a **301** to
+ * `station.cursedalchemy.com`, the dialer followed it, Cloudflare Access answered
+ * the un-credentialed redirect with its **login page — HTTP 200, text/html**,
+ * and `r.json()` threw `Failed to parse JSON`. The dialer logs that as
+ * `[sync] failed (ignored)` and retries forever, so:
+ *
+ *   · every mirrored report on prod froze at the moment of the cutover, while
+ *     each one still rendered a confident `capturedAt` age;
+ *   · nothing was red anywhere — not a gate, not a smoke, not `/healthz`;
+ *   · the error named JSON, which is three layers away from the cause.
+ *
+ * A 3xx here can only ever mean the peer address is wrong, so it is reported as
+ * exactly that, with the destination in the message. Following a redirect
+ * silently is how a sync survives its own misconfiguration.
+ *
+ * The same reasoning covers a 2xx that is not JSON: an Access login page, an
+ * nginx error page or a captive portal all arrive as `200 text/html`, and
+ * "Failed to parse JSON" is the least useful sentence available about any of
+ * them. {@link readJson} names the status, the content type and a snippet.
+ */
+export function createHttpRemote(options) {
+    const base = options.basePath.replace(/\/$/, "");
+    const doFetch = options.fetchImpl ?? fetch;
+    const timeout = options.timeoutMs ?? 60_000;
+    const peer = encodeURIComponent(options.selfId);
+    const request = async (path, init) => {
+        const response = await doFetch(`${base}${path}`, {
+            ...init,
+            // 🔴 See the header note: a followed redirect is how this sync spent
+            // eight days reporting a JSON parse error about an Access login page.
+            redirect: "manual",
+            headers: {
+                authorization: `Bearer ${options.token}`,
+                "x-sync-peer": options.selfId,
+                ...(options.extraHeaders ?? {}),
+                ...(init?.headers ?? {}),
+            },
+            signal: AbortSignal.timeout(timeout),
+        });
+        if (response.status >= 300 && response.status < 400) {
+            throw new Error(`${path}: ${response.status} — the peer address redirects to ` +
+                `${response.headers.get("location") ?? "an unnamed destination"}. ` +
+                `The sync URL points at a host that has moved; point it at the real one.`);
+        }
+        if (response.status === 401) {
+            throw new Error(`${path}: 401 — the sync token was refused.`);
+        }
+        return response;
+    };
+    /**
+     * Read a JSON body, or say what actually arrived.
+     *
+     * A 200 carrying `text/html` is a login page or an error page, and it is the
+     * shape every "the address is wrong" failure takes once a redirect has been
+     * followed. Naming the content type and the first line turns an unactionable
+     * `Failed to parse JSON` into the cause.
+     */
+    const readJson = async (r, path) => {
+        const text = await r.text();
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            const type = r.headers.get("content-type") ?? "no content-type";
+            throw new Error(`${path}: ${r.status} answered ${type}, not JSON — ` +
+                `${text.trim().slice(0, 120).replace(/\s+/g, " ") || "(empty body)"}`);
+        }
+    };
+    return {
+        async info() {
+            const r = await request("/info");
+            if (!r.ok)
+                throw new Error(`sync/info: ${r.status}`);
+            return await readJson(r, "sync/info");
+        },
+        async pull(after, excludeOrigin) {
+            const r = await request(`/pull?after=${after}&exclude=${encodeURIComponent(excludeOrigin)}&peer=${peer}`);
+            if (!r.ok)
+                throw new Error(`sync/pull: ${r.status}`);
+            return await readJson(r, "sync/pull");
+        },
+        async push(payload) {
+            const r = await request(`/push?peer=${peer}`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify(payload),
+            });
+            if (!r.ok && r.status !== 409)
+                throw new Error(`sync/push: ${r.status}`);
+            return await readJson(r, "sync/push");
+        },
+        async requestedAt() {
+            try {
+                const r = await request("/requested");
+                if (!r.ok)
+                    return null;
+                const body = await readJson(r, "sync/requested");
+                return typeof body.requestedAt === "number" ? body.requestedAt : null;
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/server/sync/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/server/sync/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAW,CAAC;AACzD,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,eAAe,GAAG,SAAS,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC3B,GAAQ,EACR,QAAgB;IAEhB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,GAAG,QAAQ,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED;yBACyB;AACzB,SAAS,QAAQ,CAAC,MAA0B,EAAE,KAAyB;IACtE,MAAM,GAAG,GAAG,KAAK,IAAI,MAAM,IAAI,EAAE,CAAC;IAClC,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AACzD,CAAC;AAyCD,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IAC1D,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC;QAC7E,6EAA6E;QAC7E,8EAA8E;QAC9E,2BAA2B;QAC3B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAoB,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IACH,gFAAgF;IAChF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAa;YACtB,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;YAChB,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;SAC7B,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAC7E,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACtD,0EAA0E;QAC1E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACvD,0EAA0E;QAC1E,yEAAyE;QACzE,8BAA8B;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS;YAC9B,CAAC,CAAC,CAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAwB,EAAE,GAAG,IAAI,KAAK,CAAC;YAC3D,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACf,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAA4C,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,KAAK,GACV,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;YACvE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,GAAG,GAAiB,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAgB,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,GAAe,EAAE,GAAG,CAAC,CAAC;QACvF,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAgBhC;IACA,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,IAAkB,EAAqB,EAAE;QAC7E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YAChD,GAAG,IAAI;YACP,qEAAqE;YACrE,sEAAsE;YACtE,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;gBACxC,aAAa,EAAE,OAAO,CAAC,MAAM;gBAC7B,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;gBAC/B,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;aACxB;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,KAAK,QAAQ,CAAC,MAAM,mCAAmC;gBAC7D,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,wBAAwB,IAAI;gBACnE,yEAAyE,CAC1E,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC;IAEF;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,KAAK,EAAK,CAAW,EAAE,IAAY,EAAc,EAAE;QACnE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,iBAAiB,CAAC;YAChE,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,aAAa,IAAI,eAAe;gBACnD,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CACtE,CAAC;QACH,CAAC;IACF,CAAC,CAAC;IACF,OAAO;QACN,KAAK,CAAC,IAAI;YACT,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,OAAO,MAAM,QAAQ,CAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa;YAC9B,MAAM,CAAC,GAAG,MAAM,OAAO,CACtB,eAAe,KAAK,YAAY,kBAAkB,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,CAChF,CAAC;YACF,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,OAAO,MAAM,QAAQ,CAAkD,CAAC,EAAE,WAAW,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO;YACjB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,OAAO,MAAM,QAAQ,CAAc,CAAC,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,CAAC,WAAW;YAChB,IAAI,CAAC;gBACJ,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;gBACtC,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC;gBACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA4B,CAAC,EAAE,gBAAgB,CAAC,CAAC;gBAC5E,OAAO,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/server/sync/index.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `cursedbelt/sync` — the op-log replication engine, shared rather than forked.
+ *
+ * ## Why it is here and not in the app
+ *
+ * The retired tree had FOUR consumers of this engine: `apps/vault` (8 files),
+ * `apps/station` (6), `apps/notes` (4) and `packages/feedback-kit` (5). `vault`
+ * graduated first and carried all 3,245 lines in whole, as
+ * `apps/vault/src/kit/sync/`, because a Phase A that also publishes a library is a
+ * Phase A that does not land. This is the other half of that trade, and it had a
+ * DEADLINE rather than a backlog slot: the moment `apps/station` graduates with the
+ * copy still in `vault`, the generation owns two divergent forks of a replication
+ * engine — the exact shape the owner ruled against on 2026-09-13, *"if we don't
+ * adapt to this at the right time then it will be hard to remember to keep updating
+ * multiple copies as the apps move and grow."*
+ *
+ * ## 🔴 A LEAF export, and it must stay one
+ *
+ * `cursedbelt/sync` resolves straight to this directory. It is deliberately NOT
+ * reachable through the `cursedbelt/server` barrel, which drags `kysely` and
+ * `otplib` behind it — an app that wants an op-log should not install two
+ * databases to get one. The only runtime dependency beneath this subpath is
+ * `hono` (for the receiver routes in `http.ts` and `commands.ts`); everything else
+ * is `bun:sqlite`, `node:crypto` and `node:fs`.
+ *
+ * It lives under `src/server/` because that is where this package's two typecheck
+ * projects put Bun's ambient types: the root `tsconfig.json` runs `types: []` to
+ * keep the browser/React surface pristine and EXCLUDES `src/server`, so
+ * `bun:sqlite` and `node:crypto` only resolve on this side of the split. The
+ * directory decides the types; the `exports` key decides the spelling.
+ */
+export { StopBatch, type ApplyContext, type ApplyOne, type ApplyReport, type PeerInfo, type RemoteApi, type SyncOp, type SyncSummary, } from "./types";
+export { createOpLog, type OpLog } from "./opLog";
+export { createTokenStore, type DeviceToken, type TokenStore } from "./tokens";
+export { createSyncApplier, pushToRemote, pullFromRemote, runSync, type EngineOptions, type ExportPolicy, type PeerRefusal, } from "./engine";
+export { capPageBytes, createHttpRemote, createSyncReceiver, type ReceiverHooks, type ReceiverOptions, } from "./http";
+export { DEFAULT_LOOP, isUnreachable, planNextSync, type SyncLoopConfig, type SyncLoopState, } from "./planner";
+export { OFFLINE_STATUS, PEER_CONTACT_WRITE_MS, createSyncStatusReporter, type SyncStatus, type SyncStatusReporter, type SyncStatusStore, } from "./status";
+export { REQUEST_POLL_MS, startSyncTimer, type SyncTimerDeps, type SyncTimerHandle } from "./timer";
+export { createSyncAlarm, type AlarmOutcome, type SyncAlarm, type SyncAlarmOptions } from "./alarm";
+export { DEFAULT_HOLD_MS, createCommandQueue, createCommandReceiver, createCommandRemote, startCommandWorker, type CommandQueue, type CommandRemote, type CommandRoutesOptions, type CommandStatus, type CommandWorkerDeps, type CommandWorkerHandle, type SyncCommand, } from "./commands";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/sync/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACN,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,WAAW,GAChB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC/E,OAAO,EACN,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,OAAO,EACP,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,GACpB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACN,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,aAAa,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACN,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,WAAW,GAChB,MAAM,YAAY,CAAC"}