cursedbelt 2.6.1 → 2.8.0

package/dist/server/sync/planner.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The pure loop planner — vault's `planNextSync`, unchanged in spirit: back off after
+ * a failure, else honor a debounced dirty flag, else the steady interval. Pure so
+ * the timer is a thin wrapper and this is fake-clock testable.
+ */
+export interface SyncLoopConfig {
+    /** Steady poll cadence when reachable and idle. */
+    intervalMs: number;
+    /** How long after a local write to wait before syncing, so a burst coalesces. */
+    debounceMs: number;
+    /** First backoff step after a failure. */
+    backoffBaseMs: number;
+    /** Backoff ceiling — an unreachable peer (the nightly window) settles here. */
+    backoffMaxMs: number;
+}
+export declare const DEFAULT_LOOP: SyncLoopConfig;
+export interface SyncLoopState {
+    /** When the last sync attempt STARTED (0 if never). */
+    lastAttempt: number;
+    /** Consecutive failed attempts — drives exponential backoff. */
+    consecutiveFailures: number;
+    /** When the oldest un-synced local write happened, or null if clean. */
+    dirtySince: number | null;
+}
+export declare function planNextSync(state: SyncLoopState, now: number, cfg?: SyncLoopConfig): {
+    runNow: boolean;
+    waitMs: number;
+};
+/** A peer that is asleep (the nightly EC2 window) or an internet-less Mac is NORMAL,
+ *  not an error. It still feeds the backoff. */
+export declare function isUnreachable(err: unknown): boolean;
+//# sourceMappingURL=planner.d.ts.map

package/dist/server/sync/planner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planner.d.ts","sourceRoot":"","sources":["../../../src/server/sync/planner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,cAAc;IAC9B,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,YAAY,EAAE,cAK1B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAgB,YAAY,CAC3B,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,cAA6B,GAChC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAerC;AAED;gDACgD;AAChD,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAKnD"}

package/dist/server/sync/planner.js

@@ -0,0 +1,31 @@
+/**
+ * The pure loop planner — vault's `planNextSync`, unchanged in spirit: back off after
+ * a failure, else honor a debounced dirty flag, else the steady interval. Pure so
+ * the timer is a thin wrapper and this is fake-clock testable.
+ */
+export const DEFAULT_LOOP = {
+    intervalMs: 5 * 60_000,
+    debounceMs: 3_000,
+    backoffBaseMs: 30_000,
+    backoffMaxMs: 30 * 60_000,
+};
+export function planNextSync(state, now, cfg = DEFAULT_LOOP) {
+    if (state.consecutiveFailures > 0) {
+        const step = Math.min(cfg.backoffMaxMs, cfg.backoffBaseMs * 2 ** (state.consecutiveFailures - 1));
+        const due = state.lastAttempt + step;
+        return now >= due ? { runNow: true, waitMs: 0 } : { runNow: false, waitMs: due - now };
+    }
+    if (state.dirtySince !== null) {
+        const due = state.dirtySince + cfg.debounceMs;
+        return now >= due ? { runNow: true, waitMs: 0 } : { runNow: false, waitMs: due - now };
+    }
+    const due = state.lastAttempt + cfg.intervalMs;
+    return now >= due ? { runNow: true, waitMs: 0 } : { runNow: false, waitMs: due - now };
+}
+/** A peer that is asleep (the nightly EC2 window) or an internet-less Mac is NORMAL,
+ *  not an error. It still feeds the backoff. */
+export function isUnreachable(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return /ECONNREFUSED|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|fetch failed|timed out|The operation was aborted|network/i.test(msg);
+}
+//# sourceMappingURL=planner.js.map

package/dist/server/sync/planner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planner.js","sourceRoot":"","sources":["../../../src/server/sync/planner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,MAAM,CAAC,MAAM,YAAY,GAAmB;IAC3C,UAAU,EAAE,CAAC,GAAG,MAAM;IACtB,UAAU,EAAE,KAAK;IACjB,aAAa,EAAE,MAAM;IACrB,YAAY,EAAE,EAAE,GAAG,MAAM;CACzB,CAAC;AAWF,MAAM,UAAU,YAAY,CAC3B,KAAoB,EACpB,GAAW,EACX,MAAsB,YAAY;IAElC,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CACpB,GAAG,CAAC,YAAY,EAChB,GAAG,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC,CACxD,CAAC;QACF,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QACrC,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QAC9C,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC;IAC/C,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC;AACxF,CAAC;AAED;gDACgD;AAChD,MAAM,UAAU,aAAa,CAAC,GAAY;IACzC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,sGAAsG,CAAC,IAAI,CACjH,GAAG,CACH,CAAC;AACH,CAAC"}

package/dist/server/sync/status.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The status surface — vault's `SyncStatus` generalized verbatim, because its shape
+ * is the product of a real defect: `enabled: false` alone was read as "not syncing"
+ * on a receiving half that was in step the whole time. `role` is what tells the
+ * receiving half apart from a scratch instance, and anything reasoning about "is
+ * this instance syncing" must read `role`, not `enabled`.
+ */
+export interface SyncStatus {
+    /** Does THIS instance dial out at all? */
+    enabled: boolean;
+    /** dialer — runs the loop · receiver — answers the sync surface for a dialer ·
+     *  none — neither (a dev shell on its own scratch database). */
+    role: "dialer" | "receiver" | "none";
+    /** The peer's ORIGIN — never the bearer token. Null when unlinked. */
+    peer: string | null;
+    lastAttemptAt: number | null;
+    lastSuccessAt: number | null;
+    lastOutcome: "ok" | "unreachable" | "paused" | "error" | null;
+    /** Set while the push is version-skew paused (`blockedBy`) — names the op kind the
+     *  peer cannot take yet, i.e. "the peer needs deploying", the true statement. */
+    pausedOn: string | null;
+    consecutiveFailures: number;
+    /** Local writes the peer has not acknowledged yet — 0 means "fully in step". */
+    pending: number;
+    /** RECEIVER: when a dialing peer last authenticated against the sync surface. */
+    lastPeerContactAt: number | null;
+    /** RECEIVER: when someone last pressed "Sync now" here (the dialer polls it). */
+    syncRequestedAt: number | null;
+}
+export declare const OFFLINE_STATUS: SyncStatus;
+export interface SyncStatusReporter {
+    read(): SyncStatus;
+    /** The timer's / receiver hooks' writer half — nothing else should call it. */
+    update(patch: Partial<SyncStatus>): void;
+}
+/**
+ * Somewhere to keep the ONE field that is a fact about the DATA rather than about
+ * this process.
+ *
+ * 🔴 Why only `lastPeerContactAt`. Every other field describes the live process and
+ * SHOULD reset with it: a dialer that has not attempted anything since boot has
+ * genuinely not attempted anything, and a restored `consecutiveFailures: 3` would be
+ * a claim about failures that did not happen. But "a peer authenticated here" is
+ * something that happened to the database, and forgetting it produced the owner's
+ * 2026-08-16 report — prod saying *"Awaiting first sync"* over a vault he had used
+ * for weeks. The badge's own words are "your Mac has not dialled since this server
+ * last restarted", which is true and which nobody reads as anything but "this has
+ * never synced". A receiver restarts on every deploy, and the dialer runs every 5
+ * minutes only while the Mac is awake — so the window in which a perfectly converged
+ * pair reads as never-synced is wide. It was wider still when the receiver was the
+ * `prod-ec2` box (decommissioned since), which also slept 12am–10am CT: most of a
+ * morning, every morning. In-memory was the wrong home for it.
+ */
+export interface SyncStatusStore {
+    /** The stored contact stamp, or null if a peer has genuinely never called. */
+    loadPeerContactAt(): number | null;
+    /** Persist a newer stamp. Called at most once per {@link PEER_CONTACT_WRITE_MS}. */
+    savePeerContactAt(at: number): void;
+}
+/** A dialer makes several requests per run; one durable write per this window is
+ *  enough to answer "when did a peer last call" to the nearest half-minute. */
+export declare const PEER_CONTACT_WRITE_MS = 30000;
+export declare function createSyncStatusReporter(initial?: Partial<SyncStatus>, store?: SyncStatusStore): SyncStatusReporter;
+//# sourceMappingURL=status.d.ts.map

package/dist/server/sync/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/server/sync/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,UAAU;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB;oEACgE;IAChE,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IACrC,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,IAAI,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;IAC9D;qFACiF;IACjF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iFAAiF;IACjF,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,eAAO,MAAM,cAAc,EAAE,UAY5B,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAClC,IAAI,IAAI,UAAU,CAAC;IACnB,+EAA+E;IAC/E,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,eAAe;IAC/B,8EAA8E;IAC9E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;+EAC+E;AAC/E,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAE5C,wBAAgB,wBAAwB,CACvC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAC7B,KAAK,CAAC,EAAE,eAAe,GACrB,kBAAkB,CAwBpB"}

package/dist/server/sync/status.js

@@ -0,0 +1,50 @@
+/**
+ * The status surface — vault's `SyncStatus` generalized verbatim, because its shape
+ * is the product of a real defect: `enabled: false` alone was read as "not syncing"
+ * on a receiving half that was in step the whole time. `role` is what tells the
+ * receiving half apart from a scratch instance, and anything reasoning about "is
+ * this instance syncing" must read `role`, not `enabled`.
+ */
+export const OFFLINE_STATUS = {
+    enabled: false,
+    role: "none",
+    peer: null,
+    lastAttemptAt: null,
+    lastSuccessAt: null,
+    lastOutcome: null,
+    pausedOn: null,
+    consecutiveFailures: 0,
+    pending: 0,
+    lastPeerContactAt: null,
+    syncRequestedAt: null,
+};
+/** A dialer makes several requests per run; one durable write per this window is
+ *  enough to answer "when did a peer last call" to the nearest half-minute. */
+export const PEER_CONTACT_WRITE_MS = 30_000;
+export function createSyncStatusReporter(initial, store) {
+    const restored = store?.loadPeerContactAt() ?? null;
+    let current = {
+        ...OFFLINE_STATUS,
+        ...(restored === null ? {} : { lastPeerContactAt: restored }),
+        ...initial,
+    };
+    let lastWrittenAt = restored ?? 0;
+    return {
+        read: () => ({ ...current }),
+        update: (patch) => {
+            current = { ...current, ...patch };
+            const at = patch.lastPeerContactAt;
+            if (store && typeof at === "number" && at - lastWrittenAt >= PEER_CONTACT_WRITE_MS) {
+                lastWrittenAt = at;
+                // A status write must never be able to fail the sync request it rode in on.
+                try {
+                    store.savePeerContactAt(at);
+                }
+                catch {
+                    /* the in-memory value still answers; the next contact retries the write */
+                }
+            }
+        },
+    };
+}
+//# sourceMappingURL=status.js.map

package/dist/server/sync/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/server/sync/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAyBH,MAAM,CAAC,MAAM,cAAc,GAAe;IACzC,OAAO,EAAE,KAAK;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,IAAI;IACV,aAAa,EAAE,IAAI;IACnB,aAAa,EAAE,IAAI;IACnB,WAAW,EAAE,IAAI;IACjB,QAAQ,EAAE,IAAI;IACd,mBAAmB,EAAE,CAAC;IACtB,OAAO,EAAE,CAAC;IACV,iBAAiB,EAAE,IAAI;IACvB,eAAe,EAAE,IAAI;CACrB,CAAC;AAiCF;+EAC+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,MAAM,UAAU,wBAAwB,CACvC,OAA6B,EAC7B,KAAuB;IAEvB,MAAM,QAAQ,GAAG,KAAK,EAAE,iBAAiB,EAAE,IAAI,IAAI,CAAC;IACpD,IAAI,OAAO,GAAe;QACzB,GAAG,cAAc;QACjB,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;QAC7D,GAAG,OAAO;KACV,CAAC;IACF,IAAI,aAAa,GAAG,QAAQ,IAAI,CAAC,CAAC;IAClC,OAAO;QACN,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;QAC5B,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC;YACnC,IAAI,KAAK,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,GAAG,aAAa,IAAI,qBAAqB,EAAE,CAAC;gBACpF,aAAa,GAAG,EAAE,CAAC;gBACnB,4EAA4E;gBAC5E,IAAI,CAAC;oBACJ,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACR,2EAA2E;gBAC5E,CAAC;YACF,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/server/sync/timer.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The in-process dialer loop — vault's `syncTimer` generalized. Runs on the dialing
+ * half only; a failure NEVER takes the host daemon down (an unsynced instance still
+ * serves and still accepts writes — that is the point of two independently-writable
+ * instances). The timer is `unref`'d so it never holds the process open.
+ *
+ * The peer is re-resolved on EVERY tick, so linking (or revoking) a peer takes
+ * effect without a restart. The "Sync now" fast lane polls the receiver's request
+ * stamp every ~20s while healthy, so a button press on the far side means seconds,
+ * not "sometime in the next interval".
+ */
+import { type SyncLoopConfig } from "./planner";
+import type { SyncStatusReporter } from "./status";
+import type { SyncSummary } from "./types";
+export declare const REQUEST_POLL_MS = 20000;
+export interface SyncTimerDeps {
+    /** Re-read every tick: null = not linked (quiet no-op, re-checked next tick). */
+    resolvePeer: () => {
+        basePath: string;
+        token: string;
+    } | null;
+    /** Run one full reconciliation against the resolved peer. */
+    sync: (peer: {
+        basePath: string;
+        token: string;
+    }) => Promise<SyncSummary>;
+    /** The local op-log head — a head beyond the last synced one marks dirty. */
+    head: () => number;
+    /** Ask the peer whether its "Sync now" was pressed; null on any failure. */
+    checkRequest?: (peer: {
+        basePath: string;
+        token: string;
+    }) => Promise<number | null>;
+    status?: SyncStatusReporter;
+    loop?: SyncLoopConfig;
+    requestPollMs?: number;
+    now?: () => number;
+    setTimer?: (fn: () => void, ms: number) => unknown;
+    clearTimer?: (handle: unknown) => void;
+    log?: (msg: string) => void;
+    warn?: (msg: string) => void;
+    /** Display origin for the status line; defaults to URL origin parsing. */
+    peerLabel?: (basePath: string) => string | null;
+}
+export interface SyncTimerHandle {
+    stop(): void;
+    /** Run the next tick immediately (the "Sync now" button on the dialing half). */
+    syncNow(): void;
+    /** Mark local writes pending (call after any local op) — debounces a burst. */
+    markDirty(): void;
+}
+export declare function startSyncTimer(deps: SyncTimerDeps): SyncTimerHandle;
+//# sourceMappingURL=timer.d.ts.map

package/dist/server/sync/timer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timer.d.ts","sourceRoot":"","sources":["../../../src/server/sync/timer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAIN,KAAK,cAAc,EAEnB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,eAAO,MAAM,eAAe,QAAS,CAAC;AAGtC,MAAM,WAAW,aAAa;IAC7B,iFAAiF;IACjF,WAAW,EAAE,MAAM;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,6DAA6D;IAC7D,IAAI,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1E,6EAA6E;IAC7E,IAAI,EAAE,MAAM,MAAM,CAAC;IACnB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrF,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,IAAI,IAAI,CAAC;IACb,iFAAiF;IACjF,OAAO,IAAI,IAAI,CAAC;IAChB,+EAA+E;IAC/E,SAAS,IAAI,IAAI,CAAC;CAClB;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,CAiJnE"}

package/dist/server/sync/timer.js

@@ -0,0 +1,171 @@
+/**
+ * The in-process dialer loop — vault's `syncTimer` generalized. Runs on the dialing
+ * half only; a failure NEVER takes the host daemon down (an unsynced instance still
+ * serves and still accepts writes — that is the point of two independently-writable
+ * instances). The timer is `unref`'d so it never holds the process open.
+ *
+ * The peer is re-resolved on EVERY tick, so linking (or revoking) a peer takes
+ * effect without a restart. The "Sync now" fast lane polls the receiver's request
+ * stamp every ~20s while healthy, so a button press on the far side means seconds,
+ * not "sometime in the next interval".
+ */
+import { isUnreachable, DEFAULT_LOOP, planNextSync, } from "./planner";
+export const REQUEST_POLL_MS = 20_000;
+const KICKOFF_MS = 5_000;
+function defaultPeerLabel(basePath) {
+    try {
+        return new URL(basePath).origin;
+    }
+    catch {
+        return null;
+    }
+}
+export function startSyncTimer(deps) {
+    const now = deps.now ?? Date.now;
+    const setTimer = deps.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+    const clearTimer = deps.clearTimer ?? ((h) => clearTimeout(h));
+    const loop = deps.loop ?? DEFAULT_LOOP;
+    const log = deps.log ?? ((m) => console.log(m));
+    const warn = deps.warn ?? ((m) => console.error(m));
+    const status = deps.status;
+    const peerLabel = deps.peerLabel ?? defaultPeerLabel;
+    const requestPollMs = deps.requestPollMs ?? REQUEST_POLL_MS;
+    status?.update({ enabled: true, role: "dialer" });
+    const state = { lastAttempt: 0, consecutiveFailures: 0, dirtySince: null };
+    let syncedHead = deps.head();
+    let stopped = false;
+    let handle = null;
+    let reportedUnreachable = false;
+    let forceRun = false;
+    let handledRequestAt = 0;
+    let probing = false;
+    let inFlight = false;
+    const schedule = (ms) => {
+        if (stopped)
+            return;
+        if (handle !== null)
+            clearTimer(handle);
+        handle = setTimer(tick, ms);
+        handle?.unref?.();
+    };
+    const sleepFor = (waitMs) => {
+        const healthy = state.consecutiveFailures === 0 && requestPollMs > 0;
+        return Math.max(1, healthy ? Math.min(waitMs, requestPollMs) : waitMs);
+    };
+    const probeRequest = (peer) => {
+        if (probing || requestPollMs === 0 || !deps.checkRequest)
+            return;
+        probing = true;
+        void deps
+            .checkRequest(peer)
+            .then((requestedAt) => {
+            if (stopped || requestedAt === null || requestedAt <= handledRequestAt)
+                return;
+            handledRequestAt = requestedAt;
+            log("[sync] sync requested from the peer — running now.");
+            forceRun = true;
+            schedule(1);
+        })
+            .finally(() => {
+            probing = false;
+        });
+    };
+    const tick = () => {
+        if (stopped)
+            return;
+        if (inFlight)
+            return; // two concurrent runs share cursors and would double-push
+        const head = deps.head();
+        if (head > syncedHead && state.dirtySince === null)
+            state.dirtySince = now();
+        const peer = deps.resolvePeer();
+        status?.update({
+            peer: peer === null ? null : peerLabel(peer.basePath),
+            pending: Math.max(0, head - syncedHead),
+        });
+        if (peer === null) {
+            schedule(loop.intervalMs);
+            return;
+        }
+        const plan = planNextSync(state, now(), loop);
+        if (!plan.runNow && !forceRun) {
+            const linkedAndHealthy = state.consecutiveFailures === 0 && requestPollMs > 0;
+            schedule(sleepFor(plan.waitMs));
+            if (linkedAndHealthy)
+                probeRequest(peer);
+            return;
+        }
+        forceRun = false;
+        state.lastAttempt = now();
+        status?.update({ lastAttemptAt: state.lastAttempt });
+        const headAtAttempt = head;
+        inFlight = true;
+        deps
+            .sync(peer)
+            .then((s) => {
+            state.consecutiveFailures = 0;
+            state.dirtySince = null;
+            syncedHead = headAtAttempt;
+            reportedUnreachable = false;
+            status?.update({
+                lastSuccessAt: now(),
+                lastOutcome: s.blockedBy ? "paused" : "ok",
+                pausedOn: s.blockedBy ?? null,
+                consecutiveFailures: 0,
+                pending: Math.max(0, deps.head() - syncedHead),
+            });
+            if (s.pushed > 0 || s.pulled > 0 || s.conflicts > 0) {
+                log(`[sync] ↑${s.pushed} ↓${s.pulled}` +
+                    (s.conflicts > 0 ? ` (${s.conflicts} conflicts)` : ""));
+            }
+            if (s.blockedBy) {
+                log(`[sync] push paused before "${s.blockedBy}" — the peer cannot take it yet (deploy pending?).`);
+            }
+        })
+            .catch((err) => {
+            state.consecutiveFailures += 1;
+            status?.update({
+                lastOutcome: isUnreachable(err) ? "unreachable" : "error",
+                consecutiveFailures: state.consecutiveFailures,
+            });
+            if (isUnreachable(err)) {
+                if (!reportedUnreachable) {
+                    log(`[sync] peer unreachable — will retry. This is normal (nightly window / offline).`);
+                    reportedUnreachable = true;
+                }
+            }
+            else {
+                warn(`[sync] failed (ignored): ${err instanceof Error ? err.message : err}`);
+            }
+        })
+            .finally(() => {
+            inFlight = false;
+            if (forceRun)
+                schedule(1);
+            else
+                schedule(sleepFor(Math.max(1_000, planNextSync(state, now(), loop).waitMs)));
+        });
+    };
+    schedule(KICKOFF_MS);
+    return {
+        stop: () => {
+            stopped = true;
+            if (handle !== null)
+                clearTimer(handle);
+        },
+        syncNow: () => {
+            if (stopped)
+                return;
+            forceRun = true;
+            schedule(1);
+        },
+        markDirty: () => {
+            if (stopped)
+                return;
+            if (state.dirtySince === null)
+                state.dirtySince = now();
+            schedule(1);
+        },
+    };
+}
+//# sourceMappingURL=timer.js.map

package/dist/server/sync/timer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timer.js","sourceRoot":"","sources":["../../../src/server/sync/timer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACN,aAAa,EACb,YAAY,EACZ,YAAY,GAGZ,MAAM,WAAW,CAAC;AAInB,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,UAAU,GAAG,KAAK,CAAC;AA+BzB,SAAS,gBAAgB,CAAC,QAAgB;IACzC,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAmB;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAkC,CAAC,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElD,MAAM,KAAK,GAAkB,EAAE,WAAW,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC1F,IAAI,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAQ,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,MAAM,KAAK,IAAI;YAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAiC,EAAE,KAAK,EAAE,EAAE,CAAC;IAC/C,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,IAAyC,EAAQ,EAAE;QACxE,IAAI,OAAO,IAAI,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO;QACjE,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,IAAI;aACP,YAAY,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;YACrB,IAAI,OAAO,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,IAAI,gBAAgB;gBAAE,OAAO;YAC/E,gBAAgB,GAAG,WAAW,CAAC;YAC/B,GAAG,CAAC,oDAAoD,CAAC,CAAC;YAC1D,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACb,OAAO,GAAG,KAAK,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAS,EAAE;QACvB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,QAAQ;YAAE,OAAO,CAAC,0DAA0D;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,GAAG,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAE7E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC;SACvC,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,OAAO;QACR,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,gBAAgB,GAAG,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC;YAC9E,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,IAAI,gBAAgB;gBAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QAED,QAAQ,GAAG,KAAK,CAAC;QACjB,KAAK,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC;QAC3B,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI;aACF,IAAI,CAAC,IAAI,CAAC;aACV,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACX,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YACxB,UAAU,GAAG,aAAa,CAAC;YAC3B,mBAAmB,GAAG,KAAK,CAAC;YAC5B,MAAM,EAAE,MAAM,CAAC;gBACd,aAAa,EAAE,GAAG,EAAE;gBACpB,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;gBAC1C,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;gBAC7B,mBAAmB,EAAE,CAAC;gBACtB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;gBACrD,GAAG,CACF,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE;oBACjC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CACvD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBACjB,GAAG,CACF,8BAA8B,CAAC,CAAC,SAAS,oDAAoD,CAC7F,CAAC;YACH,CAAC;QACF,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC;gBACd,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO;gBACzD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;aAC9C,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAC1B,GAAG,CAAC,kFAAkF,CAAC,CAAC;oBACxF,mBAAmB,GAAG,IAAI,CAAC;gBAC5B,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9E,CAAC;QACF,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACb,QAAQ,GAAG,KAAK,CAAC;YACjB,IAAI,QAAQ;gBAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;;gBACrB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrB,OAAO;QACN,IAAI,EAAE,GAAG,EAAE;YACV,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,MAAM,KAAK,IAAI;gBAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,GAAG,EAAE;YACb,IAAI,OAAO;gBAAE,OAAO;YACpB,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACf,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YACxD,QAAQ,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/server/sync/tokens.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Scoped device tokens — notes' mint/verify/revoke generalized (vault runs a single
+ * static env secret; the token TABLE is the better half: revocable per device, scoped
+ * per capability, sha256 at rest so a database read never yields a usable credential).
+ *
+ * The plaintext token is returned exactly once, at mint. Verification compares sha256
+ * digests via `timingSafeEqual` — length-independent, no oracle.
+ */
+import type { Database } from "bun:sqlite";
+export interface DeviceToken {
+    name: string;
+    scope: string;
+    createdAt: number;
+    revokedAt: number | null;
+}
+export interface TokenStore {
+    /** Mint a token for `name`+`scope`; returns the plaintext ONCE. Re-minting a name
+     *  revokes the previous token of that name (one live credential per device name). */
+    mint(name: string, scope: string): string;
+    /** Null when unknown, revoked, or out of scope. */
+    verify(presented: string, scope: string): DeviceToken | null;
+    revoke(name: string): boolean;
+    list(): DeviceToken[];
+}
+export declare function createTokenStore(db: Database): TokenStore;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/server/sync/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/server/sync/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B;yFACqF;IACrF,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,mDAAmD;IACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IAC7D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,IAAI,IAAI,WAAW,EAAE,CAAC;CACtB;AAID,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,UAAU,CA+DzD"}

package/dist/server/sync/tokens.js

@@ -0,0 +1,52 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+const sha256 = (value) => createHash("sha256").update(value).digest();
+export function createTokenStore(db) {
+    db.exec(`
+		CREATE TABLE IF NOT EXISTS sync_tokens (
+			name TEXT PRIMARY KEY,
+			scope TEXT NOT NULL,
+			token_sha256 BLOB NOT NULL,
+			created_at INTEGER NOT NULL,
+			revoked_at INTEGER
+		);
+	`);
+    const upsert = db.prepare("INSERT INTO sync_tokens (name, scope, token_sha256, created_at, revoked_at) VALUES (?, ?, ?, ?, NULL) ON CONFLICT(name) DO UPDATE SET scope = excluded.scope, token_sha256 = excluded.token_sha256, created_at = excluded.created_at, revoked_at = NULL");
+    const allLive = db.prepare("SELECT name, scope, token_sha256, created_at, revoked_at FROM sync_tokens WHERE revoked_at IS NULL");
+    const all = db.prepare("SELECT name, scope, token_sha256, created_at, revoked_at FROM sync_tokens ORDER BY created_at DESC");
+    const revokeStmt = db.prepare("UPDATE sync_tokens SET revoked_at = ? WHERE name = ? AND revoked_at IS NULL");
+    const toToken = (r) => ({
+        name: r.name,
+        scope: r.scope,
+        createdAt: r.created_at,
+        revokedAt: r.revoked_at,
+    });
+    return {
+        mint(name, scope) {
+            const token = randomBytes(32).toString("base64url");
+            upsert.run(name, scope, sha256(token), Date.now());
+            return token;
+        },
+        verify(presented, scope) {
+            if (!presented)
+                return null;
+            const got = sha256(presented);
+            // Scan live rows and compare digests constant-time each. The fleet holds a
+            // handful of devices; a table scan is simpler than an index that would make
+            // the lookup timing depend on the presented value.
+            for (const raw of allLive.all()) {
+                const want = Buffer.from(raw.token_sha256);
+                if (want.length === got.length && timingSafeEqual(want, got)) {
+                    if (raw.scope !== scope)
+                        return null;
+                    return toToken(raw);
+                }
+            }
+            return null;
+        },
+        revoke(name) {
+            return revokeStmt.run(Date.now(), name).changes > 0;
+        },
+        list: () => all.all().map(toToken),
+    };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/server/sync/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/server/sync/tokens.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAmBvE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AAEtF,MAAM,UAAU,gBAAgB,CAAC,EAAY;IAC5C,EAAE,CAAC,IAAI,CAAC;;;;;;;;EAQP,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACxB,yPAAyP,CACzP,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CACzB,oGAAoG,CACpG,CAAC;IACF,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACrB,oGAAoG,CACpG,CAAC;IACF,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC5B,6EAA6E,CAC7E,CAAC;IASF,MAAM,OAAO,GAAG,CAAC,CAAM,EAAe,EAAE,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KACvB,CAAC,CAAC;IAEH,OAAO;QACN,IAAI,CAAC,IAAI,EAAE,KAAK;YACf,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,KAAK;YACtB,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,2EAA2E;YAC3E,4EAA4E;YAC5E,mDAAmD;YACnD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,EAAW,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC9D,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;wBAAE,OAAO,IAAI,CAAC;oBACrC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,CAAC,IAAI;YACV,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAE,GAAG,CAAC,GAAG,EAAY,CAAC,GAAG,CAAC,OAAO,CAAC;KAC7C,CAAC;AACH,CAAC"}

package/dist/server/sync/types.d.ts

@@ -0,0 +1,102 @@
+/**
+ * The wire and store types every consumer of this sync engine shares. The op
+ * envelope is the notes shape — `(origin, originSeq)` gives exactly-once application
+ * with no coordination — and the report is vault's cursor discipline (the reader may
+ * advance exactly to `cursor`, never further) merged with notes' `seen` (a duplicate
+ * is not an error, it is proof the dedupe ledger works).
+ *
+ * ── 🔴 "sync-kit" is a PAST NAME. The engine is `cursedbelt/sync` ────────────
+ * The retired generation published this as `@satellites/sync-kit`. It came across
+ * whole into `apps/vault/src/kit/sync/` when that app graduated, and came here —
+ * `cursedbelt/sync` — on 2026-09-15, before `apps/station` could graduate and fork
+ * it a second time. That is the move this header used to call an open question in
+ * `tasks/`; it is done, and the app-local copies are what is temporary now.
+ *
+ * `@satellites/sync-kit` is NOT installable and never was — it was never published
+ * to npm — and its design plan (`plans/01-sync-kit-adoption-design.md`) belonged to
+ * the retired monorepo and did not come across. Comments in consuming apps still say
+ * "the sync-kit adoption": that is the NAME OF AN EVENT, the 2026-08 change that
+ * moved vault from its own `oplog` table onto this engine's `sync_ops`, and it is
+ * worth keeping because the dual-compat code only makes sense in its light.
+ */
+/** One durable mutation in the shared op log. `payload` is app-defined per `kind`. */
+export interface SyncOp {
+    /** This instance's monotonic sequence for the op (assigned by the local log). */
+    seq: number;
+    /** The instance id that BORN the op (stable per instance, never per device). */
+    origin: string;
+    /** The origin's own monotonic counter — `(origin, originSeq)` is the identity. */
+    originSeq: number;
+    /** Wall-clock ms when the op was born. LWW inputs, display, nothing structural. */
+    ts: number;
+    /** App-defined kind, e.g. `doc.set`. The version-negotiation unit. */
+    kind: string;
+    payload: unknown;
+}
+/** What applying one batch did. `cursor` is the last seq FULLY applied — a stopped
+ *  batch leaves it just before the failure so the next run resumes there. */
+export interface ApplyReport {
+    /** Ops that changed local state. */
+    applied: number;
+    /** Ops already held (dedupe hit) — counted, never re-applied. */
+    seen: number;
+    /** Concurrent edits reconciled (however the app's applier chose to). */
+    conflicts: number;
+    cursor: number;
+    /** Non-null when the batch stopped early (version skew, deferred ordering…). */
+    error: string | null;
+}
+/** The peer info handshake. `opKinds` is the compatibility advertisement — a dialer
+ *  stops BEFORE the first op a peer cannot take (notes' version-skew lesson: sending
+ *  it wedges the push with an error that reads like corruption). */
+export interface PeerInfo {
+    instanceId: string;
+    head: number;
+    opKinds: string[];
+}
+/** The transport seam. Pure interface so tests drive the engine against a REAL second
+ *  store mounted in a Hono app — no HTTP mocks (the notes/vault discipline). */
+export interface RemoteApi {
+    info(): Promise<PeerInfo>;
+    pull(after: number, excludeOrigin: string): Promise<{
+        ops: SyncOp[];
+        cursor: number;
+        head: number;
+    }>;
+    push(payload: {
+        ops: SyncOp[];
+        peerHas: number;
+    }): Promise<ApplyReport>;
+    /** The receiver's "someone pressed Sync now here" stamp; null when unsupported. */
+    requestedAt?(): Promise<number | null>;
+}
+/** Context the applier gets per batch — vault's concurrency bound. */
+export interface ApplyContext {
+    /** The peer's stable instance id. */
+    peerId: string;
+    /** Max LOCAL-born seq the peer already holds of OURS — an entity whose newest
+     *  local op is beyond this AND diverges is a true concurrent edit. */
+    peerReceivedUpTo: number;
+}
+/** The app's merge logic for ONE op that passed the dedupe ledger. Return value:
+ *  - `"applied"`   — state changed
+ *  - `"ignored"`   — stale/no-op (still recorded in the ledger, cursor advances)
+ *  - `"conflict"`  — applied with a materialized conflict artifact
+ *  Throw {@link StopBatch} to stop BEFORE this op (cursor stays short of it). */
+export type ApplyOne = (op: SyncOp, ctx: ApplyContext) => "applied" | "ignored" | "conflict";
+/** Stop the current batch before the offending op — deferred ordering, a payload this
+ *  build cannot hold yet, anything where "retry after the world changes" is right. */
+export declare class StopBatch extends Error {
+    constructor(reason: string);
+}
+export interface SyncSummary {
+    remoteId: string;
+    pushed: number;
+    pulled: number;
+    conflicts: number;
+    /** Ops the export policy held back (counted, never sent). */
+    held: number;
+    /** Set when the remote runs an older schema and cannot take what comes next. */
+    blockedBy?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/server/sync/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/sync/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,sFAAsF;AACtF,MAAM,WAAW,MAAM;IACtB,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,EAAE,EAAE,MAAM,CAAC;IACX,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CACjB;AAED;6EAC6E;AAC7E,MAAM,WAAW,WAAW;IAC3B,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;oEAEoE;AACpE,MAAM,WAAW,QAAQ;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;gFACgF;AAChF,MAAM,WAAW,SAAS;IACzB,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1B,IAAI,CACH,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACxE,mFAAmF;IACnF,WAAW,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACvC;AAED,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC5B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf;0EACsE;IACtE,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED;;;;iFAIiF;AACjF,MAAM,MAAM,QAAQ,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,KAAK,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAE7F;sFACsF;AACtF,qBAAa,SAAU,SAAQ,KAAK;gBACvB,MAAM,EAAE,MAAM;CAI1B;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB"}