cursedbelt 2.6.1 → 2.7.0

package/dist/server/sync/timer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timer.js","sourceRoot":"","sources":["../../../src/server/sync/timer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACN,aAAa,EACb,YAAY,EACZ,YAAY,GAGZ,MAAM,WAAW,CAAC;AAInB,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,UAAU,GAAG,KAAK,CAAC;AA+BzB,SAAS,gBAAgB,CAAC,QAAgB;IACzC,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAmB;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAkC,CAAC,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElD,MAAM,KAAK,GAAkB,EAAE,WAAW,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC1F,IAAI,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAQ,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,MAAM,KAAK,IAAI;YAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAiC,EAAE,KAAK,EAAE,EAAE,CAAC;IAC/C,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,IAAyC,EAAQ,EAAE;QACxE,IAAI,OAAO,IAAI,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO;QACjE,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,IAAI;aACP,YAAY,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;YACrB,IAAI,OAAO,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,IAAI,gBAAgB;gBAAE,OAAO;YAC/E,gBAAgB,GAAG,WAAW,CAAC;YAC/B,GAAG,CAAC,oDAAoD,CAAC,CAAC;YAC1D,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACb,OAAO,GAAG,KAAK,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAS,EAAE;QACvB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,QAAQ;YAAE,OAAO,CAAC,0DAA0D;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,GAAG,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAE7E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC;SACvC,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,OAAO;QACR,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,gBAAgB,GAAG,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC;YAC9E,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,IAAI,gBAAgB;gBAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QAED,QAAQ,GAAG,KAAK,CAAC;QACjB,KAAK,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC;QAC3B,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI;aACF,IAAI,CAAC,IAAI,CAAC;aACV,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACX,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YACxB,UAAU,GAAG,aAAa,CAAC;YAC3B,mBAAmB,GAAG,KAAK,CAAC;YAC5B,MAAM,EAAE,MAAM,CAAC;gBACd,aAAa,EAAE,GAAG,EAAE;gBACpB,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;gBAC1C,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;gBAC7B,mBAAmB,EAAE,CAAC;gBACtB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;gBACrD,GAAG,CACF,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE;oBACjC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CACvD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBACjB,GAAG,CACF,8BAA8B,CAAC,CAAC,SAAS,oDAAoD,CAC7F,CAAC;YACH,CAAC;QACF,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC;gBACd,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO;gBACzD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;aAC9C,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAC1B,GAAG,CAAC,kFAAkF,CAAC,CAAC;oBACxF,mBAAmB,GAAG,IAAI,CAAC;gBAC5B,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9E,CAAC;QACF,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACb,QAAQ,GAAG,KAAK,CAAC;YACjB,IAAI,QAAQ;gBAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;;gBACrB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrB,OAAO;QACN,IAAI,EAAE,GAAG,EAAE;YACV,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,MAAM,KAAK,IAAI;gBAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,GAAG,EAAE;YACb,IAAI,OAAO;gBAAE,OAAO;YACpB,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACf,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YACxD,QAAQ,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/server/sync/tokens.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Scoped device tokens — notes' mint/verify/revoke generalized (vault runs a single
+ * static env secret; the token TABLE is the better half: revocable per device, scoped
+ * per capability, sha256 at rest so a database read never yields a usable credential).
+ *
+ * The plaintext token is returned exactly once, at mint. Verification compares sha256
+ * digests via `timingSafeEqual` — length-independent, no oracle.
+ */
+import type { Database } from "bun:sqlite";
+export interface DeviceToken {
+    name: string;
+    scope: string;
+    createdAt: number;
+    revokedAt: number | null;
+}
+export interface TokenStore {
+    /** Mint a token for `name`+`scope`; returns the plaintext ONCE. Re-minting a name
+     *  revokes the previous token of that name (one live credential per device name). */
+    mint(name: string, scope: string): string;
+    /** Null when unknown, revoked, or out of scope. */
+    verify(presented: string, scope: string): DeviceToken | null;
+    revoke(name: string): boolean;
+    list(): DeviceToken[];
+}
+export declare function createTokenStore(db: Database): TokenStore;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/server/sync/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/server/sync/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B;yFACqF;IACrF,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,mDAAmD;IACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IAC7D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,IAAI,IAAI,WAAW,EAAE,CAAC;CACtB;AAID,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,UAAU,CA+DzD"}

package/dist/server/sync/tokens.js

@@ -0,0 +1,52 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+const sha256 = (value) => createHash("sha256").update(value).digest();
+export function createTokenStore(db) {
+    db.exec(`
+		CREATE TABLE IF NOT EXISTS sync_tokens (
+			name TEXT PRIMARY KEY,
+			scope TEXT NOT NULL,
+			token_sha256 BLOB NOT NULL,
+			created_at INTEGER NOT NULL,
+			revoked_at INTEGER
+		);
+	`);
+    const upsert = db.prepare("INSERT INTO sync_tokens (name, scope, token_sha256, created_at, revoked_at) VALUES (?, ?, ?, ?, NULL) ON CONFLICT(name) DO UPDATE SET scope = excluded.scope, token_sha256 = excluded.token_sha256, created_at = excluded.created_at, revoked_at = NULL");
+    const allLive = db.prepare("SELECT name, scope, token_sha256, created_at, revoked_at FROM sync_tokens WHERE revoked_at IS NULL");
+    const all = db.prepare("SELECT name, scope, token_sha256, created_at, revoked_at FROM sync_tokens ORDER BY created_at DESC");
+    const revokeStmt = db.prepare("UPDATE sync_tokens SET revoked_at = ? WHERE name = ? AND revoked_at IS NULL");
+    const toToken = (r) => ({
+        name: r.name,
+        scope: r.scope,
+        createdAt: r.created_at,
+        revokedAt: r.revoked_at,
+    });
+    return {
+        mint(name, scope) {
+            const token = randomBytes(32).toString("base64url");
+            upsert.run(name, scope, sha256(token), Date.now());
+            return token;
+        },
+        verify(presented, scope) {
+            if (!presented)
+                return null;
+            const got = sha256(presented);
+            // Scan live rows and compare digests constant-time each. The fleet holds a
+            // handful of devices; a table scan is simpler than an index that would make
+            // the lookup timing depend on the presented value.
+            for (const raw of allLive.all()) {
+                const want = Buffer.from(raw.token_sha256);
+                if (want.length === got.length && timingSafeEqual(want, got)) {
+                    if (raw.scope !== scope)
+                        return null;
+                    return toToken(raw);
+                }
+            }
+            return null;
+        },
+        revoke(name) {
+            return revokeStmt.run(Date.now(), name).changes > 0;
+        },
+        list: () => all.all().map(toToken),
+    };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/server/sync/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/server/sync/tokens.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAmBvE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AAEtF,MAAM,UAAU,gBAAgB,CAAC,EAAY;IAC5C,EAAE,CAAC,IAAI,CAAC;;;;;;;;EAQP,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACxB,yPAAyP,CACzP,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CACzB,oGAAoG,CACpG,CAAC;IACF,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACrB,oGAAoG,CACpG,CAAC;IACF,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC5B,6EAA6E,CAC7E,CAAC;IASF,MAAM,OAAO,GAAG,CAAC,CAAM,EAAe,EAAE,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KACvB,CAAC,CAAC;IAEH,OAAO;QACN,IAAI,CAAC,IAAI,EAAE,KAAK;YACf,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,KAAK;YACtB,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,2EAA2E;YAC3E,4EAA4E;YAC5E,mDAAmD;YACnD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,EAAW,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC9D,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;wBAAE,OAAO,IAAI,CAAC;oBACrC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,CAAC,IAAI;YACV,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAE,GAAG,CAAC,GAAG,EAAY,CAAC,GAAG,CAAC,OAAO,CAAC;KAC7C,CAAC;AACH,CAAC"}

package/dist/server/sync/types.d.ts

@@ -0,0 +1,102 @@
+/**
+ * The wire and store types every consumer of this sync engine shares. The op
+ * envelope is the notes shape — `(origin, originSeq)` gives exactly-once application
+ * with no coordination — and the report is vault's cursor discipline (the reader may
+ * advance exactly to `cursor`, never further) merged with notes' `seen` (a duplicate
+ * is not an error, it is proof the dedupe ledger works).
+ *
+ * ── 🔴 "sync-kit" is a PAST NAME. The engine is `cursedbelt/sync` ────────────
+ * The retired generation published this as `@satellites/sync-kit`. It came across
+ * whole into `apps/vault/src/kit/sync/` when that app graduated, and came here —
+ * `cursedbelt/sync` — on 2026-09-15, before `apps/station` could graduate and fork
+ * it a second time. That is the move this header used to call an open question in
+ * `tasks/`; it is done, and the app-local copies are what is temporary now.
+ *
+ * `@satellites/sync-kit` is NOT installable and never was — it was never published
+ * to npm — and its design plan (`plans/01-sync-kit-adoption-design.md`) belonged to
+ * the retired monorepo and did not come across. Comments in consuming apps still say
+ * "the sync-kit adoption": that is the NAME OF AN EVENT, the 2026-08 change that
+ * moved vault from its own `oplog` table onto this engine's `sync_ops`, and it is
+ * worth keeping because the dual-compat code only makes sense in its light.
+ */
+/** One durable mutation in the shared op log. `payload` is app-defined per `kind`. */
+export interface SyncOp {
+    /** This instance's monotonic sequence for the op (assigned by the local log). */
+    seq: number;
+    /** The instance id that BORN the op (stable per instance, never per device). */
+    origin: string;
+    /** The origin's own monotonic counter — `(origin, originSeq)` is the identity. */
+    originSeq: number;
+    /** Wall-clock ms when the op was born. LWW inputs, display, nothing structural. */
+    ts: number;
+    /** App-defined kind, e.g. `doc.set`. The version-negotiation unit. */
+    kind: string;
+    payload: unknown;
+}
+/** What applying one batch did. `cursor` is the last seq FULLY applied — a stopped
+ *  batch leaves it just before the failure so the next run resumes there. */
+export interface ApplyReport {
+    /** Ops that changed local state. */
+    applied: number;
+    /** Ops already held (dedupe hit) — counted, never re-applied. */
+    seen: number;
+    /** Concurrent edits reconciled (however the app's applier chose to). */
+    conflicts: number;
+    cursor: number;
+    /** Non-null when the batch stopped early (version skew, deferred ordering…). */
+    error: string | null;
+}
+/** The peer info handshake. `opKinds` is the compatibility advertisement — a dialer
+ *  stops BEFORE the first op a peer cannot take (notes' version-skew lesson: sending
+ *  it wedges the push with an error that reads like corruption). */
+export interface PeerInfo {
+    instanceId: string;
+    head: number;
+    opKinds: string[];
+}
+/** The transport seam. Pure interface so tests drive the engine against a REAL second
+ *  store mounted in a Hono app — no HTTP mocks (the notes/vault discipline). */
+export interface RemoteApi {
+    info(): Promise<PeerInfo>;
+    pull(after: number, excludeOrigin: string): Promise<{
+        ops: SyncOp[];
+        cursor: number;
+        head: number;
+    }>;
+    push(payload: {
+        ops: SyncOp[];
+        peerHas: number;
+    }): Promise<ApplyReport>;
+    /** The receiver's "someone pressed Sync now here" stamp; null when unsupported. */
+    requestedAt?(): Promise<number | null>;
+}
+/** Context the applier gets per batch — vault's concurrency bound. */
+export interface ApplyContext {
+    /** The peer's stable instance id. */
+    peerId: string;
+    /** Max LOCAL-born seq the peer already holds of OURS — an entity whose newest
+     *  local op is beyond this AND diverges is a true concurrent edit. */
+    peerReceivedUpTo: number;
+}
+/** The app's merge logic for ONE op that passed the dedupe ledger. Return value:
+ *  - `"applied"`   — state changed
+ *  - `"ignored"`   — stale/no-op (still recorded in the ledger, cursor advances)
+ *  - `"conflict"`  — applied with a materialized conflict artifact
+ *  Throw {@link StopBatch} to stop BEFORE this op (cursor stays short of it). */
+export type ApplyOne = (op: SyncOp, ctx: ApplyContext) => "applied" | "ignored" | "conflict";
+/** Stop the current batch before the offending op — deferred ordering, a payload this
+ *  build cannot hold yet, anything where "retry after the world changes" is right. */
+export declare class StopBatch extends Error {
+    constructor(reason: string);
+}
+export interface SyncSummary {
+    remoteId: string;
+    pushed: number;
+    pulled: number;
+    conflicts: number;
+    /** Ops the export policy held back (counted, never sent). */
+    held: number;
+    /** Set when the remote runs an older schema and cannot take what comes next. */
+    blockedBy?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/server/sync/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/sync/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,sFAAsF;AACtF,MAAM,WAAW,MAAM;IACtB,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,EAAE,EAAE,MAAM,CAAC;IACX,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CACjB;AAED;6EAC6E;AAC7E,MAAM,WAAW,WAAW;IAC3B,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;oEAEoE;AACpE,MAAM,WAAW,QAAQ;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;gFACgF;AAChF,MAAM,WAAW,SAAS;IACzB,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1B,IAAI,CACH,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACxE,mFAAmF;IACnF,WAAW,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACvC;AAED,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC5B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf;0EACsE;IACtE,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED;;;;iFAIiF;AACjF,MAAM,MAAM,QAAQ,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,KAAK,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAE7F;sFACsF;AACtF,qBAAa,SAAU,SAAQ,KAAK;gBACvB,MAAM,EAAE,MAAM;CAI1B;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/server/sync/types.js

@@ -0,0 +1,30 @@
+/**
+ * The wire and store types every consumer of this sync engine shares. The op
+ * envelope is the notes shape — `(origin, originSeq)` gives exactly-once application
+ * with no coordination — and the report is vault's cursor discipline (the reader may
+ * advance exactly to `cursor`, never further) merged with notes' `seen` (a duplicate
+ * is not an error, it is proof the dedupe ledger works).
+ *
+ * ── 🔴 "sync-kit" is a PAST NAME. The engine is `cursedbelt/sync` ────────────
+ * The retired generation published this as `@satellites/sync-kit`. It came across
+ * whole into `apps/vault/src/kit/sync/` when that app graduated, and came here —
+ * `cursedbelt/sync` — on 2026-09-15, before `apps/station` could graduate and fork
+ * it a second time. That is the move this header used to call an open question in
+ * `tasks/`; it is done, and the app-local copies are what is temporary now.
+ *
+ * `@satellites/sync-kit` is NOT installable and never was — it was never published
+ * to npm — and its design plan (`plans/01-sync-kit-adoption-design.md`) belonged to
+ * the retired monorepo and did not come across. Comments in consuming apps still say
+ * "the sync-kit adoption": that is the NAME OF AN EVENT, the 2026-08 change that
+ * moved vault from its own `oplog` table onto this engine's `sync_ops`, and it is
+ * worth keeping because the dual-compat code only makes sense in its light.
+ */
+/** Stop the current batch before the offending op — deferred ordering, a payload this
+ *  build cannot hold yet, anything where "retry after the world changes" is right. */
+export class StopBatch extends Error {
+    constructor(reason) {
+        super(reason);
+        this.name = "StopBatch";
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/server/sync/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/server/sync/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAqEH;sFACsF;AACtF,MAAM,OAAO,SAAU,SAAQ,KAAK;IACnC,YAAY,MAAc;QACzB,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IACzB,CAAC;CACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt",
-	"version": "2.6.1",
+	"version": "2.7.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "Shared Bun + React framework",
@@ -460,12 +460,12 @@
 			"import": "./dist/server/storage/index.js"
 		},
 		"./server/item-crypto": {
-		"types": "./dist/server/auth/vault.d.ts",
-		"bun": "./src/server/auth/vault.ts",
-		"source": "./src/server/auth/vault.ts",
-		"import": "./dist/server/auth/vault.js"
-	},
-	"./server/storage/types": {
+			"types": "./dist/server/auth/vault.d.ts",
+			"bun": "./src/server/auth/vault.ts",
+			"source": "./src/server/auth/vault.ts",
+			"import": "./dist/server/auth/vault.js"
+		},
+		"./server/storage/types": {
 			"types": "./dist/server/storage/types.d.ts",
 			"bun": "./src/server/storage/types.ts",
 			"source": "./src/server/storage/types.ts",
@@ -502,17 +502,23 @@
 			"import": "./dist/server/index.js"
 		},
 		"./server/login-throttle": {
-		"types": "./dist/server/auth/loginThrottle.d.ts",
-		"bun": "./src/server/auth/loginThrottle.ts",
-		"source": "./src/server/auth/loginThrottle.ts",
-		"import": "./dist/server/auth/loginThrottle.js"
-	},
-	"./server/guard/revocations": {
+			"types": "./dist/server/auth/loginThrottle.d.ts",
+			"bun": "./src/server/auth/loginThrottle.ts",
+			"source": "./src/server/auth/loginThrottle.ts",
+			"import": "./dist/server/auth/loginThrottle.js"
+		},
+		"./server/guard/revocations": {
 			"types": "./dist/server/guard/revocationStore.d.ts",
 			"bun": "./src/server/guard/revocationStore.ts",
 			"source": "./src/server/guard/revocationStore.ts",
 			"import": "./dist/server/guard/revocationStore.js"
 		},
+		"./sync": {
+			"types": "./dist/server/sync/index.d.ts",
+			"bun": "./src/server/sync/index.ts",
+			"source": "./src/server/sync/index.ts",
+			"import": "./dist/server/sync/index.js"
+		},
 		"./server/sqlite": {
 			"types": "./dist/server/sqlite/index.d.ts",
 			"bun": "./src/server/sqlite/index.ts",

package/src/server/sync/alarm.spec.ts

@@ -0,0 +1,149 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createSyncAlarm } from "./alarm";
+
+/**
+ * 🔴 `tmpdir()`, not vault's `scratchDir()` — the seam moved when this engine did.
+ *
+ * In `apps/vault` this suite imported `scripts/testScratch`, an opt-in helper that
+ * hands out a directory under `$FORGE_STATE` and sweeps it. cursedbelt solves the
+ * same problem one level lower: `forceTestEnv.ts` is a bunfig PRELOAD that
+ * redirects `$TMPDIR` itself for every test process in the repo (rationale and the
+ * 4,950× measurement behind it are in `scripts/testTmpRoot.ts`). So a plain
+ * `mkdtempSync(join(tmpdir(), …))` here already lands in the small, swept root —
+ * and reaching back for the app's helper would be a cross-repo import that only
+ * resolves while the copy in vault still exists.
+ */
+const dirs: string[] = [];
+const scratchDir = (prefix: string): string => {
+	const dir = mkdtempSync(join(tmpdir(), `cb-${prefix}-`));
+	dirs.push(dir);
+	return dir;
+};
+afterAll(() => {
+	for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+function makeAlarm(overrides: { threshold?: number; reRaiseMs?: number } = {}) {
+	const dir = scratchDir("sync-alarm");
+	const raised: string[] = [];
+	let clock = 1_000_000;
+	const alarm = createSyncAlarm({
+		statePath: join(dir, "alarm.json"),
+		threshold: overrides.threshold ?? 3,
+		reRaiseMs: overrides.reRaiseMs ?? 60_000,
+		notify: (_title, body) => raised.push(body),
+		now: () => clock,
+		appName: "station",
+	});
+	return { alarm, raised, tick: (ms: number) => (clock += ms) };
+}
+
+describe("sync alarm", () => {
+	test("raises after the threshold of paused rounds, not before", () => {
+		const { alarm, raised } = makeAlarm();
+		alarm.record("paused", "doc.set");
+		alarm.record("paused", "doc.set");
+		expect(raised).toHaveLength(0);
+		alarm.record("paused", "doc.set");
+		expect(raised).toHaveLength(1);
+		expect(raised[0]).toContain("doc.set");
+	});
+
+	test("re-raises only after the re-raise window", () => {
+		const { alarm, raised, tick } = makeAlarm();
+		for (let i = 0; i < 5; i++) alarm.record("paused", "k");
+		expect(raised).toHaveLength(1);
+		tick(59_000);
+		alarm.record("paused", "k");
+		expect(raised).toHaveLength(1);
+		tick(2_000);
+		alarm.record("paused", "k");
+		expect(raised).toHaveLength(2);
+	});
+
+	test("ok resets the counter; unreachable neither counts nor resets", () => {
+		const { alarm, raised } = makeAlarm();
+		alarm.record("paused", "k");
+		alarm.record("paused", "k");
+		// The nightly window: unreachable rounds must not walk the counter to the
+		// threshold, and must not clear a genuine pause streak either.
+		alarm.record("unreachable");
+		alarm.record("paused", "k");
+		expect(raised).toHaveLength(1);
+		alarm.record("ok");
+		alarm.record("paused", "k");
+		alarm.record("paused", "k");
+		expect(raised).toHaveLength(1); // streak restarted from zero
+	});
+
+	test("auth refusals raise with the re-link message", () => {
+		const { alarm, raised } = makeAlarm({ threshold: 1 });
+		alarm.record("auth");
+		expect(raised[0]).toContain("Re-link");
+	});
+
+	test("state survives a process restart (same state file)", () => {
+		const dir = scratchDir("sync-alarm");
+		const statePath = join(dir, "alarm.json");
+		const raised: string[] = [];
+		const make = () =>
+			createSyncAlarm({
+				statePath,
+				threshold: 3,
+				notify: (_t, b) => raised.push(b),
+				now: () => 5_000,
+			});
+		make().record("paused", "k");
+		make().record("paused", "k");
+		make().record("paused", "k");
+		expect(raised).toHaveLength(1);
+	});
+});
+
+/**
+ * 🔴 The outcome that was missing, and the eight days it cost.
+ *
+ * The console's subdomain cutover left the Mac's sync dialer aimed at a host
+ * that had become a 301. It followed the redirect into a Cloudflare Access login
+ * page and threw a JSON parse error every round — neither `paused` (nothing was
+ * version-skewed), nor `auth` (no token was refused), nor `unreachable` (the
+ * peer answered). So the alarm recorded NOTHING while every mirrored report on
+ * prod froze, each still rendering a confident age.
+ */
+describe("a sustained hard ERROR raises, exactly like a sustained pause", () => {
+	test("consecutive errors cross the threshold and the alarm names the real error", () => {
+		const { alarm, raised } = makeAlarm({ threshold: 3 });
+		alarm.record("error", "sync/info: 200 answered text/html, not JSON");
+		alarm.record("error", "sync/info: 200 answered text/html, not JSON");
+		expect(raised).toHaveLength(0);
+		alarm.record("error", "sync/info: 200 answered text/html, not JSON");
+		expect(raised).toHaveLength(1);
+		// The message carries the cause, because "failed (ignored)" being
+		// uninformative is the whole reason this outcome exists.
+		expect(raised[0]).toContain("text/html");
+	});
+
+	test("one good round clears the counter", () => {
+		const { alarm, raised } = makeAlarm({ threshold: 3 });
+		alarm.record("error", "boom");
+		alarm.record("error", "boom");
+		alarm.record("ok");
+		alarm.record("error", "boom");
+		alarm.record("error", "boom");
+		expect(raised).toHaveLength(0);
+	});
+
+	test("an UNREACHABLE peer between errors neither counts nor resets", () => {
+		// The nightly EC2 sleep sits in the middle of a real outage all the time.
+		const { alarm, raised } = makeAlarm({ threshold: 3 });
+		alarm.record("error", "boom");
+		alarm.record("unreachable");
+		alarm.record("error", "boom");
+		alarm.record("unreachable");
+		alarm.record("error", "boom");
+		expect(raised).toHaveLength(1);
+	});
+});

package/src/server/sync/alarm.ts

@@ -0,0 +1,137 @@
+/**
+ * Pause-alarm escalation — notes' `syncAlarm` generalized. A sync that is version-
+ * skew paused or auth-refused for a sustained stretch is a real problem the owner
+ * must hear about (the 2026-07-31 notes incident: prod ran stale code most of a day
+ * and only an owner eyeballing counts caught it). An UNREACHABLE peer neither counts
+ * nor resets — the nightly EC2 sleep must never false-alarm.
+ *
+ * State is a small JSON file so the alarm survives process restarts; the notifier is
+ * a seam (macOS `osascript` by default) so tests and non-Mac hosts inject their own.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+
+/**
+ * 🔴 `error` joined on 2026-08-21, and it is the outcome that was MISSING.
+ *
+ * The console's subdomain cutover left the Mac's `STATION_SYNC_URL` pointing at
+ * a host that had become a 301; the dialer followed it into a Cloudflare Access
+ * login page and threw `Failed to parse JSON` every round. That is neither
+ * `paused` (nothing is version-skewed) nor `auth` (no token was refused) nor
+ * `unreachable` (the peer answered), so it recorded NOTHING — the timer logged
+ * `[sync] failed (ignored)` and the alarm's counter sat at zero while every
+ * mirrored report on prod froze for days, each still rendering a confident age.
+ *
+ * A sustained hard error is exactly as bad as a sustained pause and is now
+ * counted the same. `unreachable` remains the one outcome that neither counts
+ * nor resets, because the nightly EC2 sleep must never false-alarm.
+ */
+export type AlarmOutcome = "ok" | "paused" | "auth" | "error" | "unreachable";
+
+interface AlarmState {
+	consecutiveBad: number;
+	firstBadAt: number | null;
+	lastRaisedAt: number | null;
+	lastReason: string | null;
+}
+
+const EMPTY: AlarmState = {
+	consecutiveBad: 0,
+	firstBadAt: null,
+	lastRaisedAt: null,
+	lastReason: null,
+};
+
+export interface SyncAlarmOptions {
+	/** Where the counter lives (survives restarts). */
+	statePath: string;
+	/** Rounds of paused/auth before raising (with the round cadence, pick so the
+	 *  threshold lands around ~45 min of sustained pause). */
+	threshold?: number;
+	/** Re-raise cadence while the condition persists. Default 4h. */
+	reRaiseMs?: number;
+	/** Present the alarm. Default: macOS notification via osascript. */
+	notify?: (title: string, body: string) => void;
+	now?: () => number;
+	appName?: string;
+}
+
+export interface SyncAlarm {
+	/** Record one sync round's outcome; raises when the threshold crosses. */
+	record(outcome: AlarmOutcome, reason?: string): void;
+}
+
+function defaultNotify(title: string, body: string): void {
+	try {
+		const esc = (s: string) => s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+		Bun.spawnSync([
+			"osascript",
+			"-e",
+			`display notification "${esc(body)}" with title "${esc(title)}"`,
+		]);
+	} catch {
+		// A notifier must never take the loop down.
+	}
+}
+
+export function createSyncAlarm(options: SyncAlarmOptions): SyncAlarm {
+	const threshold = options.threshold ?? 9;
+	const reRaiseMs = options.reRaiseMs ?? 4 * 60 * 60_000;
+	const notify = options.notify ?? defaultNotify;
+	const now = options.now ?? Date.now;
+	const appName = options.appName ?? "sync";
+
+	const load = (): AlarmState => {
+		try {
+			if (!existsSync(options.statePath)) return { ...EMPTY };
+			return {
+				...EMPTY,
+				...(JSON.parse(readFileSync(options.statePath, "utf8")) as Partial<AlarmState>),
+			};
+		} catch {
+			return { ...EMPTY };
+		}
+	};
+	const save = (state: AlarmState): void => {
+		try {
+			mkdirSync(dirname(options.statePath), { recursive: true });
+			writeFileSync(options.statePath, JSON.stringify(state));
+		} catch {
+			// Losing the counter degrades to a later alarm, never to a crash.
+		}
+	};
+
+	return {
+		record(outcome, reason) {
+			const state = load();
+			if (outcome === "ok") {
+				save({ ...EMPTY });
+				return;
+			}
+			if (outcome === "unreachable") return; // neither counts nor resets
+			state.consecutiveBad += 1;
+			state.lastReason = reason ?? outcome;
+			if (state.firstBadAt === null) state.firstBadAt = now();
+			const due =
+				state.consecutiveBad >= threshold &&
+				(state.lastRaisedAt === null || now() - state.lastRaisedAt >= reRaiseMs);
+			if (due) {
+				state.lastRaisedAt = now();
+				const since = state.firstBadAt
+					? new Date(state.firstBadAt).toLocaleTimeString()
+					: "a while";
+				notify(
+					outcome === "error" ? `${appName}: sync is FAILING` : `${appName}: sync is paused`,
+					outcome === "auth"
+						? `The sync token is being refused (since ${since}). Re-link the peer.`
+						: outcome === "error"
+							? // Names the real error, because this alarm's whole reason for
+								// existing is that "failed (ignored)" was invisible.
+								`Every sync round has failed since ${since}: ${state.lastReason}`
+							: `Push has been paused on "${state.lastReason}" since ${since} — the peer likely needs a deploy.`,
+				);
+			}
+			save(state);
+		},
+	};
+}