cursedbelt 2.7.0 → 3.0.0

package/dist/server/private-media/unlock.d.ts

@@ -1,53 +0,0 @@
-import { type KeyMode } from './crypto';
-export type UnlockGrant = {
-    userId: string;
-    setKey: Buffer;
-    mode: KeyMode;
-};
-/**
- * What a supplied password MEANS at the unlock/reveal/private-upload surfaces:
- *   • derive (default) — the password derives the set key (deniable sets; the
- *     historical behavior).
- *   • gate — the password is an ACCESS CHECK against the app's own accounts
- *     (verifyPassword, e.g. the login store's argon2id verify) and the set key
- *     stays the recoverable server-derived one. Password changes never orphan
- *     content, and a password is REQUIRED to unlock (no silent session unlock).
- */
-export type UnlockPasswordPolicy = {
-    mode: 'derive';
-} | {
-    mode: 'gate';
-    verifyPassword: (who: {
-        userId: string;
-        userSalt: string;
-    }, password: string) => Promise<boolean>;
-};
-export interface UnlockService {
-    /** Mint an unlock token. Pass `password` for a deniable set; omit for the standard server-key
-     * set (the caller must already have authenticated the user). */
-    unlock(args: {
-        userId: string;
-        userSalt: string;
-        password?: string;
-    }): Promise<{
-        token: string;
-        mode: KeyMode;
-    }>;
-    /** Verify a token and recover the sealed set key, or null if invalid/expired/tampered. */
-    verify(token: string): Promise<UnlockGrant | null>;
-    /** Derive a set key without minting a token (for the reveal endpoint's per-item trials). */
-    deriveSetKey(args: {
-        userId: string;
-        userSalt: string;
-        password?: string;
-    }): Buffer;
-}
-export declare function createUnlockService(opts: {
-    /** Derives the recoverable (standard) set key. */
-    serverSecret: string;
-    /** Signs the unlock JWT AND (domain-separated) seals the set key inside it. */
-    unlockSecret: string;
-    /** Token lifetime — long enough to survive a paused-and-resumed private video. Default 6h. */
-    ttlSeconds?: number;
-}): UnlockService;
-//# sourceMappingURL=unlock.d.ts.map

package/dist/server/private-media/unlock.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/server/private-media/unlock.ts"],"names":[],"mappings":"AAOA,OAAO,EAA4C,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAclF,MAAM,MAAM,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IACE,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,CACd,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EACzC,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B;oEACgE;IAChE,MAAM,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC7E,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,OAAO,CAAC;KACf,CAAC,CAAC;IACH,0FAA0F;IAC1F,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACnD,4FAA4F;IAC5F,YAAY,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;CACrF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,aAAa,CAiDhB"}

package/dist/server/private-media/unlock.js

@@ -1,56 +0,0 @@
-import { decryptSecret, deriveKey, encryptSecret } from 'cwip/node';
-// 🔴 `../auth/jwt`, NOT `../auth` — same reason as `storage/streamToken.ts`, and this is the
-// SECOND edge of the pair: `cursedbelt/server/storage` reaches private-media, so the barrel
-// import here put `otplib` (via `auth/index` → `totp.ts`) back into the storage graph after
-// streamToken.ts had been fixed. Found by bundling the graph and reading the externals, not by
-// grep — a two-hop edge is invisible to the obvious search.
-import { signToken, verifyPurposeToken } from '../auth/jwt';
-import { derivePasswordSetKey, deriveServerSetKey } from './crypto';
-// ── Unlock service ──────────────────────────────────────────────────────────────
-// Turns a private-mode unlock into a short-lived token that CARRIES the set key so later
-// requests (the HLS content-key route, reveal) can unwrap without re-deriving. Two modes:
-//   • deniable  — password given → setKey = scrypt(password, userSalt); the server holds no
-//     copy, so the token is the ONLY way back to that set key until it expires.
-//   • standard  — no password → setKey = scrypt(serverSecret, userId); recoverable, session-gated.
-// The set key is SEALED inside the token (AES-GCM under a server seal key), so the client can't
-// read it out; only this server can. The JWT is signed via cursedbelt's one jose integration
-// under the existing 'pm-unlock' purpose, so it can't be replayed as an access token.
-const PURPOSE = 'pm-unlock';
-export function createUnlockService(opts) {
-    const ttl = opts.ttlSeconds ?? 6 * 60 * 60;
-    const sealKey = deriveKey(opts.unlockSecret, 'pm-unlock-seal');
-    const deriveSetKey = ({ userId, userSalt, password, }) => password
-        ? derivePasswordSetKey(password, userSalt)
-        : deriveServerSetKey(opts.serverSecret, userId);
-    return {
-        deriveSetKey,
-        async unlock(args) {
-            const mode = args.password ? 'deniable' : 'standard';
-            const setKey = deriveSetKey(args);
-            const token = await signToken({
-                userId: args.userId,
-                sessionId: 'pm',
-                roles: [],
-                purpose: PURPOSE,
-                sk: encryptSecret(setKey.toString('base64'), sealKey),
-                m: mode,
-            }, opts.unlockSecret, ttl);
-            return { token, mode };
-        },
-        async verify(token) {
-            try {
-                const p = await verifyPurposeToken(token, opts.unlockSecret, PURPOSE);
-                const sealed = p.sk;
-                const mode = p.m;
-                if (typeof sealed !== 'string' || (mode !== 'standard' && mode !== 'deniable'))
-                    return null;
-                const setKey = Buffer.from(decryptSecret(sealed, sealKey), 'base64');
-                return { userId: p.userId, setKey, mode };
-            }
-            catch {
-                return null;
-            }
-        },
-    };
-}
-//# sourceMappingURL=unlock.js.map

package/dist/server/private-media/unlock.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"unlock.js","sourceRoot":"","sources":["../../../src/server/private-media/unlock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACpE,6FAA6F;AAC7F,4FAA4F;AAC5F,4FAA4F;AAC5F,+FAA+F;AAC/F,4DAA4D;AAC5D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAgB,MAAM,UAAU,CAAC;AAElF,mFAAmF;AACnF,yFAAyF;AACzF,0FAA0F;AAC1F,4FAA4F;AAC5F,gFAAgF;AAChF,mGAAmG;AACnG,gGAAgG;AAChG,6FAA6F;AAC7F,sFAAsF;AAEtF,MAAM,OAAO,GAAG,WAAW,CAAC;AAoC5B,MAAM,UAAU,mBAAmB,CAAC,IAOnC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAE/D,MAAM,YAAY,GAAG,CAAC,EACpB,MAAM,EACN,QAAQ,EACR,QAAQ,GAKT,EAAU,EAAE,CACX,QAAQ;QACN,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1C,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAEpD,OAAO;QACL,YAAY;QACZ,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,IAAI,GAAY,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;YAC9D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,SAAS,CAC3B;gBACE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,EAAE;gBACT,OAAO,EAAE,OAAO;gBAChB,EAAE,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;gBACrD,CAAC,EAAE,IAAI;aACR,EACD,IAAI,CAAC,YAAY,EACjB,GAAG,CACJ,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAI,CAAsB,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAI,CAAqB,CAAC,CAAC,CAAC;gBACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACrE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/resume/index.d.ts

@@ -1,3 +0,0 @@
-export { createSqliteResumeStore, MAX_LOCATION_LENGTH, type ResumeRecord, type ResumeStore, type ResumeStoreOptions, } from './store';
-export { mountResumeRoutes, type ResumeRoutesOptions } from './routes';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/resume/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/resume/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,UAAU,CAAC"}

package/dist/server/resume/index.js

@@ -1,3 +0,0 @@
-export { createSqliteResumeStore, MAX_LOCATION_LENGTH, } from './store';
-export { mountResumeRoutes } from './routes';
-//# sourceMappingURL=index.js.map

package/dist/server/resume/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/resume/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GAIpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,iBAAiB,EAA4B,MAAM,UAAU,CAAC"}

package/dist/server/resume/routes.d.ts

@@ -1,42 +0,0 @@
-/**
- * The three routes behind `useResume`:
- *
- *   GET    {base}?key=default  → { location, updatedAt } | { location: null }
- *   PUT    {base}?key=default  → { ok: true }             body { location }
- *   DELETE {base}?key=default  → { ok: true }
- *
- * ── Caching, decided here rather than left to a proxy ───────────────────────
- * Every response is `no-store, private`. The body is one person's last screen —
- * it is per-user, it changes on every navigation, and a shared cache holding it
- * would hand one reader another reader's place. This is the ONE endpoint the
- * deep-link work adds; the deep links themselves are same-document hash URLs and
- * change nothing about how the app shell is cached.
- *
- * Authorization is the app's, passed in: every satellite already knows how to
- * turn a cookie into a user id, and a resume row is exactly as sensitive as the
- * screen it names.
- */
-import type { Context, Hono } from 'hono';
-import { type ResumeStore } from './store';
-export interface ResumeRoutesOptions {
-    store: ResumeStore;
-    /** Resolve the caller to a user id, or null to refuse. */
-    authorize(c: Context): string | null | Promise<string | null>;
-    /** Default `/api/resume`. */
-    basePath?: string;
-}
-/**
- * What a `?key=` may look like. 🔴 EXPORTED because a client that builds a key
- * out of app data (`useTableViewMode`'s `table-view.<id>`) has no other way to
- * know what this route will accept — and the failure is SILENT: the client
- * swallows every error into "nothing stored", so a rejected key looks exactly
- * like a preference that was never saved. `useTableViewMode.spec.tsx` asserts
- * the keys that hook produces against this regex, so changing either end turns
- * a test red instead of quietly un-remembering everybody's view.
- *
- * Note there is no `:` in the class, which is the separator a key builder
- * reaches for first.
- */
-export declare const RESUME_KEY_PATTERN: RegExp;
-export declare function mountResumeRoutes(app: Hono, options: ResumeRoutesOptions): void;
-//# sourceMappingURL=routes.d.ts.map

package/dist/server/resume/routes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/server/resume/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,WAAW,CAAC;IACnB,0DAA0D;IAC1D,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9D,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,QAA2B,CAAC;AAO3D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAyC/E"}

package/dist/server/resume/routes.js

@@ -1,51 +0,0 @@
-import { MAX_LOCATION_LENGTH } from './store';
-const NO_STORE = { 'cache-control': 'no-store, private' };
-/**
- * What a `?key=` may look like. 🔴 EXPORTED because a client that builds a key
- * out of app data (`useTableViewMode`'s `table-view.<id>`) has no other way to
- * know what this route will accept — and the failure is SILENT: the client
- * swallows every error into "nothing stored", so a rejected key looks exactly
- * like a preference that was never saved. `useTableViewMode.spec.tsx` asserts
- * the keys that hook produces against this regex, so changing either end turns
- * a test red instead of quietly un-remembering everybody's view.
- *
- * Note there is no `:` in the class, which is the separator a key builder
- * reaches for first.
- */
-export const RESUME_KEY_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
-const keyOf = (c) => {
-    const raw = c.req.query('key') ?? 'default';
-    return RESUME_KEY_PATTERN.test(raw) ? raw : null;
-};
-export function mountResumeRoutes(app, options) {
-    const { store, authorize } = options;
-    const base = options.basePath ?? '/api/resume';
-    const withUser = (handler) => async (c) => {
-        const userId = await authorize(c);
-        if (!userId)
-            return c.json({ error: 'unauthorized' }, 401, NO_STORE);
-        const key = keyOf(c);
-        if (!key)
-            return c.json({ error: 'invalid key' }, 400, NO_STORE);
-        return handler(c, userId, key);
-    };
-    app.get(base, withUser((c, userId, key) => {
-        const record = store.read(userId, key);
-        return c.json(record ?? { location: null, updatedAt: null }, 200, NO_STORE);
-    }));
-    app.put(base, withUser(async (c, userId, key) => {
-        const body = (await c.req.json().catch(() => null));
-        const location = typeof body?.location === 'string' ? body.location.trim() : '';
-        if (!location)
-            return c.json({ error: 'location required' }, 400, NO_STORE);
-        if (location.length > MAX_LOCATION_LENGTH)
-            return c.json({ error: 'location too long' }, 413, NO_STORE);
-        store.write(userId, location, key);
-        return c.json({ ok: true }, 200, NO_STORE);
-    }));
-    app.delete(base, withUser((c, userId, key) => {
-        store.clear(userId, key);
-        return c.json({ ok: true }, 200, NO_STORE);
-    }));
-}
-//# sourceMappingURL=routes.js.map

package/dist/server/resume/routes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/server/resume/routes.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,mBAAmB,EAAoB,MAAM,SAAS,CAAC;AAUhE,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,mBAAmB,EAAW,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAE3D,MAAM,KAAK,GAAG,CAAC,CAAU,EAAiB,EAAE;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;IAC5C,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,GAAS,EAAE,OAA4B;IACvE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC;IAE/C,MAAM,QAAQ,GAAG,CAAC,OAAkF,EAAE,EAAE,CACtG,KAAK,EAAE,CAAU,EAAqB,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC;IAEJ,GAAG,CAAC,GAAG,CACL,IAAI,EACJ,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,IAAI,EACJ,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAkC,CAAC;QACrF,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/D,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,IAAI,EACJ,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;QAC1B,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/server/resume/store.d.ts

@@ -1,38 +0,0 @@
-/**
- * Where "the last place you were" is kept — one small table, in the app's own
- * database, keyed by the app's own user id.
- *
- * ── Why server-side at all ──────────────────────────────────────────────────
- * `localStorage` would be one line and would answer the wrong question. The
- * owner's report is about coming BACK to an app, and he does that from another
- * device — the 2026-08-13 music sign-in from a second laptop is the same shape.
- * A place remembered only in the browser that saw it is not remembered.
- *
- * ── Why the app's database and not a fleet service ──────────────────────────
- * Same reasoning as `../notifications/migrations.ts`: the SCHEMA is shared, the
- * DATA is local. A resume row is one string per user per app; a central service
- * would put a network hop in front of the first paint of every app in the fleet,
- * and the first thing each would do is cache it.
- *
- * The DDL is idempotent, so calling this twice — or beside a migration runner —
- * converges on one table.
- */
-import type { Database } from 'bun:sqlite';
-/** Longer than any real place, short enough that nobody can park a payload here. */
-export declare const MAX_LOCATION_LENGTH = 2048;
-export interface ResumeRecord {
-    location: string;
-    updatedAt: number;
-}
-export interface ResumeStore {
-    read(userId: string, key?: string): ResumeRecord | null;
-    write(userId: string, location: string, key?: string): void;
-    /** No key clears every remembered place for that user. */
-    clear(userId: string, key?: string): void;
-}
-export interface ResumeStoreOptions {
-    table?: string;
-    now?: () => number;
-}
-export declare function createSqliteResumeStore(db: Database, options?: ResumeStoreOptions): ResumeStore;
-//# sourceMappingURL=store.d.ts.map

package/dist/server/resume/store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/server/resume/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;IACxD,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5D,0DAA0D;IAC1D,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAKD,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAE,kBAAuB,GAAG,WAAW,CAqCnG"}

package/dist/server/resume/store.js

@@ -1,39 +0,0 @@
-/** Longer than any real place, short enough that nobody can park a payload here. */
-export const MAX_LOCATION_LENGTH = 2048;
-const IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const DEFAULT_KEY = 'default';
-export function createSqliteResumeStore(db, options = {}) {
-    const table = options.table ?? 'cb_resume';
-    if (!IDENTIFIER.test(table))
-        throw new Error(`invalid resume table name: ${table}`);
-    const now = options.now ?? Date.now;
-    db.run(`CREATE TABLE IF NOT EXISTS ${table} (
-    user_id TEXT NOT NULL,
-    place_key TEXT NOT NULL,
-    location TEXT NOT NULL,
-    updated_at INTEGER NOT NULL,
-    PRIMARY KEY (user_id, place_key)
-  )`);
-    return {
-        read(userId, key = DEFAULT_KEY) {
-            const row = db
-                .query(`SELECT location, updated_at FROM ${table} WHERE user_id = ? AND place_key = ?`)
-                .get(userId, key);
-            return row ? { location: row.location, updatedAt: row.updated_at } : null;
-        },
-        write(userId, location, key = DEFAULT_KEY) {
-            // Truncated rather than refused: a place that is somehow too long should
-            // cost the reader nothing, and the next navigation overwrites it anyway.
-            const value = location.slice(0, MAX_LOCATION_LENGTH);
-            db.run(`INSERT INTO ${table} (user_id, place_key, location, updated_at) VALUES (?, ?, ?, ?)
-         ON CONFLICT(user_id, place_key) DO UPDATE SET location = excluded.location, updated_at = excluded.updated_at`, [userId, key, value, now()]);
-        },
-        clear(userId, key) {
-            if (key === undefined)
-                db.run(`DELETE FROM ${table} WHERE user_id = ?`, [userId]);
-            else
-                db.run(`DELETE FROM ${table} WHERE user_id = ? AND place_key = ?`, [userId, key]);
-        },
-    };
-}
-//# sourceMappingURL=store.js.map

package/dist/server/resume/store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/server/resume/store.ts"],"names":[],"mappings":"AAqBA,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAmBxC,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,WAAW,GAAG,SAAS,CAAC;AAE9B,MAAM,UAAU,uBAAuB,CAAC,EAAY,EAAE,UAA8B,EAAE;IACpF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEpC,EAAE,CAAC,GAAG,CAAC,8BAA8B,KAAK;;;;;;IAMxC,CAAC,CAAC;IAEJ,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,WAAW;YAC5B,MAAM,GAAG,GAAG,EAAE;iBACX,KAAK,CACJ,oCAAoC,KAAK,sCAAsC,CAChF;iBACA,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACpB,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,CAAC;QACD,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,WAAW;YACvC,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACrD,EAAE,CAAC,GAAG,CACJ,eAAe,KAAK;sHAC0F,EAC9G,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAC5B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,EAAE,GAAG;YACf,IAAI,GAAG,KAAK,SAAS;gBAAE,EAAE,CAAC,GAAG,CAAC,eAAe,KAAK,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;;gBAC7E,EAAE,CAAC,GAAG,CAAC,eAAe,KAAK,sCAAsC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACzF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/retention/archive.d.ts

@@ -1,79 +0,0 @@
-/** One sealed archive file. */
-export interface ArchiveSegment {
-    /** Absolute path on this machine. */
-    path: string;
-    /** Basename — what a collector and the index line name it by. */
-    file: string;
-    rows: number;
-    bytes: number;
-    sha256: string;
-    at: number;
-}
-export interface ArchiveSink {
-    /** Where segments are written. */
-    readonly dir: string;
-    /** True when THIS machine is the archive's final home (no collector is owed). */
-    readonly terminal: boolean;
-    /**
-     * Bytes of sealed segments still waiting for a collector. Always 0 when
-     * `terminal` — a home archive is never "pending", it is the archive.
-     */
-    pendingBytes(): number;
-    /**
-     * Seal one segment, proven on disk. THROWS if it cannot prove it: the caller
-     * treats that as "these rows stay in the table".
-     */
-    write(records: ReadonlyArray<Record<string, unknown>>, at: number): ArchiveSegment;
-}
-/** The default budget of uncollected archive on a staged (deployed-box) home.
- *  Generous next to the tables it governs — notes' whole `ops` log is ~15 MB —
- *  and small next to a 6.7 GB root. Reached only if the collector has stopped. */
-export declare const DEFAULT_PENDING_ARCHIVE_BUDGET_BYTES: number;
-/** `20260825-114233` — sortable, second-resolution, and the same shape the
- *  fleet's dated backup dirs already use, so one eye reads both. */
-export declare function archiveStamp(date: Date): string;
-export interface ArchiveHome {
-    dir: string;
-    terminal: boolean;
-}
-/**
- * Where this app's archive lives on THIS machine, and whether the machine keeps
- * it.
- *
- * `<app-data-home>/cursed-satellites/archive/<app>/`, reached through the same env
- * ladder the retention home uses, so a test, a container and a deployed box each
- * land somewhere writable rather than somewhere assumed.
- */
-export declare function resolveArchiveHome(app: string, env?: Record<string, string | undefined>): ArchiveHome;
-export interface JsonlArchiveOptions {
-    app: string;
-    /** Stable, app-scoped resource id — the segment name's prefix. */
-    resource: string;
-    /** Overrides the resolved home. Tests and callers that already resolved it. */
-    home?: ArchiveHome;
-    env?: Record<string, string | undefined>;
-}
-/**
- * The fleet's archive sink: newline-delimited JSON segments plus an append-only
- * `index.jsonl` naming every segment ever sealed here.
- *
- * The index is what makes the archive answerable without reading gigabytes —
- * "what is in here, how many rows, and does it still hash the same" — and it is
- * appended rather than rewritten so a crash mid-write can cost at most the last
- * line, never the catalogue.
- */
-export declare function createJsonlArchive(options: JsonlArchiveOptions): ArchiveSink;
-/**
- * Re-verify every segment in an archive directory against the sha256 the index
- * recorded — the answer to "is this archive still real?" without a restore.
- *
- * Exists because an archive nobody can check is a belief, and this whole
- * category is a promise that the rows still exist somewhere.
- */
-export declare function verifyArchive(dir: string): {
-    segments: number;
-    rows: number;
-    bytes: number;
-    bad: string[];
-};
-//# sourceMappingURL=archive.d.ts.map

package/dist/server/retention/archive.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../../src/server/retention/archive.ts"],"names":[],"mappings":"AA8DA,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC9B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACX;AAED,MAAM,WAAW,WAAW;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,YAAY,IAAI,MAAM,CAAC;IACvB;;;OAGG;IACH,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,cAAc,CAAC;CACnF;AAED;;kFAEkF;AAClF,eAAO,MAAM,oCAAoC,QAAmB,CAAC;AAIrE;oEACoE;AACpE,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAM/C;AAED,MAAM,WAAW,WAAW;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;CAClB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACnD,WAAW,CAmCb;AAED,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACzC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,WAAW,CA2G5E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,EAAE,CAAC;CACd,CAqCA"}