cursedbelt 2.7.0 → 3.0.0

package/dist/server/stream/cdcBridge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cdcBridge.js","sourceRoot":"","sources":["../../../src/server/stream/cdcBridge.ts"],"names":[],"mappings":"AAsBA;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAuB/B;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAe,EAAE;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC;IAC/C,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACd,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACnE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACzC,CAAC;IAEJ,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CACT,MAAM,EACN,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACnG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEvC;;;;;;WAMG;QACH,IAAI,MAA6C,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE;YAC/C,MAAM,IAAI,GAAmB;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,EAAE,EAAE,MAAM,CAAC,EAAE;aACd,CAAC;YACF,KAAK,MAAM,UAAU,IAAI,WAAW;gBAClC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,MAAM,EAAE,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC,CAAC;AAWF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAiB,EAAE,OAAuB,EAAQ,EAAE;IACvF,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAClB,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;YACjE,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/server/stream/index.d.ts

@@ -1,4 +0,0 @@
-export * from './cdcBridge';
-export * from './searchBridge';
-export * from './serverPush';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/stream/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/stream/index.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}

package/dist/server/stream/index.js

@@ -1,6 +0,0 @@
-// The server push tier (03 §3.2/§6.2): a transport-free fan-out hub, the SSE
-// bridge that carries it to browsers, and the CDC/job taps that feed it.
-export * from './cdcBridge';
-export * from './searchBridge';
-export * from './serverPush';
-//# sourceMappingURL=index.js.map

package/dist/server/stream/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/stream/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yEAAyE;AACzE,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}

package/dist/server/stream/searchBridge.d.ts

@@ -1,29 +0,0 @@
-import { type MutationRecordLike, type SearchProvider } from 'cwip/search-provider';
-import type { StorageProvider } from 'cwip/storage';
-import type { Unsubscribe } from './serverPush';
-/**
- * The corpus the knowledge spine is indexed under.
- *
- * ONE name, used by the tap that writes it, the job that rebuilds it and the
- * service that queries it. It is the bare domain name rather than
- * `corpusFor('knowledge','k_items')` because the spine is a single logical
- * corpus that happens to live in one table, and because `reindex-corpus` takes
- * this string from a user-facing op body — `knowledge` is what a person types.
- */
-export declare const KNOWLEDGE_CORPUS = "knowledge";
-export interface SearchBridgeOptions {
-    storage: StorageProvider;
-    search: SearchProvider;
-    /**
-     * Reported for every record the index could not follow. Default: swallowed.
-     * A host that cares wires this to its telemetry — a silently drifting index
-     * is the failure mode that gets discovered by a user, months later.
-     */
-    onError?: (error: unknown, record: MutationRecordLike) => void;
-}
-/**
- * Tap the knowledge domain's CDC stream into a `SearchProvider`. Returns one
- * handle that detaches it.
- */
-export declare const bridgeCdcToSearch: (options: SearchBridgeOptions) => Unsubscribe;
-//# sourceMappingURL=searchBridge.d.ts.map

package/dist/server/stream/searchBridge.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"searchBridge.d.ts","sourceRoot":"","sources":["../../../src/server/stream/searchBridge.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAmB,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAK5C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,EAAE,cAAc,CAAC;IACvB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAChE;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,mBAAmB,KAAG,WAkChE,CAAC"}

package/dist/server/stream/searchBridge.js

@@ -1,50 +0,0 @@
-import { getRecord, scopedExec } from 'cwip/repositories';
-import { indexOnMutation } from 'cwip/search-provider';
-/**
- * The corpus the knowledge spine is indexed under.
- *
- * ONE name, used by the tap that writes it, the job that rebuilds it and the
- * service that queries it. It is the bare domain name rather than
- * `corpusFor('knowledge','k_items')` because the spine is a single logical
- * corpus that happens to live in one table, and because `reindex-corpus` takes
- * this string from a user-facing op body — `knowledge` is what a person types.
- */
-export const KNOWLEDGE_CORPUS = 'knowledge';
-/** The knowledge table whose rows become documents. */
-const KNOWLEDGE_TABLE = 'k_items';
-/**
- * Tap the knowledge domain's CDC stream into a `SearchProvider`. Returns one
- * handle that detaches it.
- */
-export const bridgeCdcToSearch = (options) => {
-    const { storage, search } = options;
-    const domain = storage.domain('knowledge');
-    return indexOnMutation(domain, search, async (record) => {
-        if (record.table !== KNOWLEDGE_TABLE)
-            return null;
-        // Re-read through the repository rather than trusting a row shape off the
-        // stream: the mutation record carries an id, not content, precisely so a
-        // consumer cannot index a value that a later statement in the same
-        // transaction changed.
-        // The CDC record's OWN tenant is the scope — a bridge that read with the
-        // ambient tenant would index one tenant's row under another's connection
-        // the first time two tenants write in the same process.
-        const scope = { tenantId: record.tenantId, userId: '' };
-        const row = await scopedExec(domain, scope, getRecord(scope, record.rowId));
-        if (!row)
-            return null;
-        return {
-            corpus: KNOWLEDGE_CORPUS,
-            id: row.id,
-            tenantId: row.tenantId,
-            title: row.title,
-            body: row.bodyMd ?? '',
-        };
-    }, {
-        onError: options.onError,
-        // Deletes arrive as `(domain, table)` and must tombstone the SAME corpus
-        // the inserts were written under.
-        corpus: () => KNOWLEDGE_CORPUS,
-    });
-};
-//# sourceMappingURL=searchBridge.js.map

package/dist/server/stream/searchBridge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"searchBridge.js","sourceRoot":"","sources":["../../../src/server/stream/searchBridge.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAgD,MAAM,sBAAsB,CAAC;AAIrG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAE5C,uDAAuD;AACvD,MAAM,eAAe,GAAG,SAAS,CAAC;AAalC;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA4B,EAAe,EAAE;IAC7E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAyB,CAAC,CAAC;IAEzD,OAAO,eAAe,CACpB,MAAM,EACN,MAAM,EACN,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAClD,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,uBAAuB;QACvB,yEAAyE;QACzE,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;SACvB,CAAC;IACJ,CAAC,EACD;QACE,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB;KAC/B,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/server/stream/serverPush.d.ts

@@ -1,146 +0,0 @@
-/**
- * The server push tier (03 §3.2, §6.2) — what makes `/api/core/stream` and
- * `/api/instance/:id/stream` live channels instead of single-frame stubs.
- *
- * The client half of the model (03 §6.2) is a dirty ledger: an instance keeps
- * `Map<portId, {dirty, lastRev}>` and pulls the retained value when a pane
- * mounts. That model only works if *something* tells the client a row changed
- * while no pane was listening. This is that something.
- *
- * Three properties the naive "write to the socket in the mutation handler"
- * version gets wrong:
- *
- *   TENANT-SCOPED   A subscriber is bound to the tenant of the request that
- *                   opened it. A CDC record for another tenant is never written
- *                   to that socket — a stream is a data surface, so it obeys the
- *                   same law as a query (J3-2).
- *
- *   BACKPRESSURED   A dead or slow client must not grow an unbounded buffer in
- *                   the server. Each subscriber has a bounded queue; crossing it
- *                   drops the connection with a typed `overflow` frame rather
- *                   than letting one wedged browser tab consume the heap.
- *
- *   NON-BLOCKING    Publishing never awaits a socket write. The hub hands the
- *                   record to each subscriber's queue and returns, so a CDC emit
- *                   (which may be inside a repository op) can never be extended
- *                   by network latency — that is WAL-checkpoint starvation
- *                   wearing a different hat (01 §1.2).
- *
- * The hub is deliberately transport-free: it fans out plain records. `sseBody`
- * turns a subscription into an SSE stream, and the SaaS profile can put the same
- * records on a WebSocket hub without touching a producer.
- */
-/** Detach a subscriber. Idempotent. */
-export type Unsubscribe = () => void;
-/** One server→client push record. */
-export interface ServerPushEvent {
-    /** SSE `event:` name — `cdc`, `job`, `lifecycle`, `state`, … */
-    event: string;
-    /** JSON-serializable payload. */
-    data: unknown;
-    /**
-     * Instance scope. Omitted ⇒ app-wide: delivered to every subscriber,
-     * including per-instance ones (a lock or a redeploy concerns all of them).
-     */
-    instanceId?: string;
-    /**
-     * Tenant scope. Omitted ⇒ untenanted infrastructure event (heartbeat, bundle
-     * change) delivered to everyone. Present ⇒ delivered ONLY to subscribers of
-     * that tenant.
-     */
-    tenantId?: string;
-}
-/** What a subscriber is willing to receive. */
-export interface PushFilter {
-    /**
-     * Receive app-wide events plus these instances'. Omitted or empty ⇒ app-wide
-     * only.
-     *
-     * **A SET rather than a single id, and that is the D28 fix.** A browser allows
-     * six concurrent connections per origin over HTTP/1.1 and an SSE connection is
-     * long-lived, so one stream per instance consumes the whole budget at
-     * `instances × open tabs` — measured: four instances across two tabs exhausts
-     * it, and because ordinary `fetch`es queue behind the streams the symptom is a
-     * HANG rather than an error. One subscriber that follows N instances is what
-     * makes an app's connection count constant in its instance count.
-     */
-    instanceIds?: readonly string[];
-    /**
-     * The authenticated tenant of the connection. A tenant-scoped event for any
-     * other tenant is never delivered. Omitted ⇒ the connection is unauthenticated
-     * and receives untenanted events only.
-     */
-    tenantId?: string;
-}
-export interface ServerPushHub {
-    /** Fan out one record. Never throws, never blocks on a socket. */
-    publish(event: ServerPushEvent): void;
-    /** Attach a listener. The returned handle is safe to call more than once. */
-    subscribe(filter: PushFilter, listener: (event: ServerPushEvent) => void): Unsubscribe;
-    /** Live subscriber count — the reconnect probe asserts against this. */
-    readonly subscriberCount: number;
-    /** Drop every subscriber (server shutdown). Listeners get a final `close` event. */
-    close(): void;
-}
-export declare const createServerPushHub: () => ServerPushHub;
-export interface SseOptions {
-    /**
-     * Comment-frame interval. Without it an idle stream dies silently behind a
-     * proxy with an idle timeout, and the client never learns it should reconnect.
-     * Default 15s.
-     */
-    heartbeatMs?: number;
-    /**
-     * The `retry:` hint written once at open. This is the browser EventSource
-     * FLOOR, not the schedule — the client uses its own jittered backoff
-     * (03 §6.5), because a fixed hint across N tabs is precisely the synchronized
-     * stampede J5-2 rules out.
-     */
-    retryMs?: number;
-    /**
-     * Queued-but-unwritten frames tolerated before the connection is dropped.
-     * Default 256 — enough for a burst of CDC records, far short of a heap
-     * problem. A client that cannot keep up is better off reconnecting and
-     * re-pulling through its dirty ledger.
-     */
-    maxQueued?: number;
-    /** Frames written before the first heartbeat — the open handshake. */
-    initial?: readonly ServerPushEvent[];
-    /** Cancels the stream (the request's abort signal). */
-    signal?: AbortSignal;
-    /** Timer injection for deterministic tests. */
-    setIntervalFn?: (fn: () => void, ms: number) => unknown;
-    clearIntervalFn?: (handle: unknown) => void;
-}
-/** SSE frame headers. Exported so the mixins and the probes share one copy. */
-export declare const SSE_HEADERS: Readonly<Record<string, string>>;
-/**
- * Serialize one record as an SSE frame.
- *
- * **An instance-scoped record carries its instance id on its own field line**
- * (`instance: gallery`), because one connection now serves N instances (D28) and
- * a client that cannot tell which instance a frame belongs to cannot route it to
- * that instance's ledger. An app-wide record omits the line entirely, which is
- * what "delivered to everyone" looks like on the wire.
- *
- * A custom FIELD rather than a wrapper around `data` is deliberate, and it is
- * the reason this change has no blast radius on payloads: SSE ignores field
- * names it does not know (WHATWG §9.2.6), so `data` stays a pure domain payload,
- * every existing consumer of `CdcPushPayload` is untouched, and a browser
- * `EventSource` — which this framework does not use, but a customer's own script
- * might — still reads the stream correctly and simply does not see the tag.
- * `id:` was the other candidate and is refused: it is Last-Event-ID resumption,
- * and overloading it would silently break the day we implement replay.
- */
-export declare const encodeSseFrame: (event: ServerPushEvent) => string;
-/**
- * Bridge a hub subscription onto a `ReadableStream` of SSE bytes.
- *
- * The stream ends when the client disconnects (`signal`), when the hub closes,
- * or when the subscriber overflows. All three paths run the same teardown, so a
- * dropped tab cannot leave a subscription — or an interval — behind.
- */
-export declare const sseBody: (hub: ServerPushHub, filter: PushFilter, options?: SseOptions) => ReadableStream<Uint8Array>;
-/** A ready-to-return SSE `Response`. */
-export declare const sseResponse: (hub: ServerPushHub, filter: PushFilter, options?: SseOptions) => Response;
-//# sourceMappingURL=serverPush.d.ts.map

package/dist/server/stream/serverPush.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serverPush.d.ts","sourceRoot":"","sources":["../../../src/server/stream/serverPush.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,uCAAuC;AACvC,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAErC,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+CAA+C;AAC/C,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IACtC,6EAA6E;IAC7E,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,WAAW,CAAC;IACvF,wEAAwE;IACxE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oFAAoF;IACpF,KAAK,IAAI,IAAI,CAAC;CACf;AAkBD,eAAO,MAAM,mBAAmB,QAAO,aA+CtC,CAAC;AAIF,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,OAAO,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACrC,uDAAuD;IACvD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACxD,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CAC7C;AAED,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMvD,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,eAAe,KAAG,MACoF,CAAC;AAE7I;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,GAAI,KAAK,aAAa,EAAE,QAAQ,UAAU,EAAE,UAAS,UAAe,KAAG,cAAc,CAAC,UAAU,CAiGnH,CAAC;AAEF,wCAAwC;AACxC,eAAO,MAAM,WAAW,GAAI,KAAK,aAAa,EAAE,QAAQ,UAAU,EAAE,UAAS,UAAe,KAAG,QACjB,CAAC"}

package/dist/server/stream/serverPush.js

@@ -1,225 +0,0 @@
-/**
- * The server push tier (03 §3.2, §6.2) — what makes `/api/core/stream` and
- * `/api/instance/:id/stream` live channels instead of single-frame stubs.
- *
- * The client half of the model (03 §6.2) is a dirty ledger: an instance keeps
- * `Map<portId, {dirty, lastRev}>` and pulls the retained value when a pane
- * mounts. That model only works if *something* tells the client a row changed
- * while no pane was listening. This is that something.
- *
- * Three properties the naive "write to the socket in the mutation handler"
- * version gets wrong:
- *
- *   TENANT-SCOPED   A subscriber is bound to the tenant of the request that
- *                   opened it. A CDC record for another tenant is never written
- *                   to that socket — a stream is a data surface, so it obeys the
- *                   same law as a query (J3-2).
- *
- *   BACKPRESSURED   A dead or slow client must not grow an unbounded buffer in
- *                   the server. Each subscriber has a bounded queue; crossing it
- *                   drops the connection with a typed `overflow` frame rather
- *                   than letting one wedged browser tab consume the heap.
- *
- *   NON-BLOCKING    Publishing never awaits a socket write. The hub hands the
- *                   record to each subscriber's queue and returns, so a CDC emit
- *                   (which may be inside a repository op) can never be extended
- *                   by network latency — that is WAL-checkpoint starvation
- *                   wearing a different hat (01 §1.2).
- *
- * The hub is deliberately transport-free: it fans out plain records. `sseBody`
- * turns a subscription into an SSE stream, and the SaaS profile can put the same
- * records on a WebSocket hub without touching a producer.
- */
-const matches = (event, subscriber) => {
-    // Tenant law first: a scoped event never crosses tenants, whatever the
-    // instance filter says.
-    if (event.tenantId !== undefined && event.tenantId !== subscriber.filter.tenantId)
-        return false;
-    // App-wide events reach everyone; instance-scoped ones only their instances.
-    if (event.instanceId !== undefined && !subscriber.instanceIds.has(event.instanceId))
-        return false;
-    return true;
-};
-export const createServerPushHub = () => {
-    const subscribers = new Set();
-    let closed = false;
-    return {
-        publish(event) {
-            if (closed)
-                return;
-            // Snapshot: a listener that unsubscribes itself mid-fanout (the normal
-            // overflow path) must not mutate the set being iterated.
-            for (const subscriber of [...subscribers]) {
-                if (!matches(event, subscriber))
-                    continue;
-                try {
-                    subscriber.listener(event);
-                }
-                catch {
-                    // A broken transport is that subscriber's problem, never the
-                    // producer's: drop it and keep fanning out.
-                    subscribers.delete(subscriber);
-                }
-            }
-        },
-        subscribe(filter, listener) {
-            if (closed)
-                return () => undefined;
-            const subscriber = { filter, instanceIds: new Set(filter.instanceIds ?? []), listener };
-            subscribers.add(subscriber);
-            return () => {
-                subscribers.delete(subscriber);
-            };
-        },
-        get subscriberCount() {
-            return subscribers.size;
-        },
-        close() {
-            if (closed)
-                return;
-            closed = true;
-            for (const subscriber of [...subscribers]) {
-                try {
-                    subscriber.listener({ event: 'close', data: { reason: 'server-shutdown' } });
-                }
-                catch {
-                    // Shutdown is best-effort — a transport that already died is fine.
-                }
-            }
-            subscribers.clear();
-        },
-    };
-};
-/** SSE frame headers. Exported so the mixins and the probes share one copy. */
-export const SSE_HEADERS = Object.freeze({
-    'Content-Type': 'text/event-stream',
-    'Cache-Control': 'no-cache',
-    Connection: 'keep-alive',
-    // Keeps nginx from holding the stream in a proxy buffer.
-    'X-Accel-Buffering': 'no',
-});
-/**
- * Serialize one record as an SSE frame.
- *
- * **An instance-scoped record carries its instance id on its own field line**
- * (`instance: gallery`), because one connection now serves N instances (D28) and
- * a client that cannot tell which instance a frame belongs to cannot route it to
- * that instance's ledger. An app-wide record omits the line entirely, which is
- * what "delivered to everyone" looks like on the wire.
- *
- * A custom FIELD rather than a wrapper around `data` is deliberate, and it is
- * the reason this change has no blast radius on payloads: SSE ignores field
- * names it does not know (WHATWG §9.2.6), so `data` stays a pure domain payload,
- * every existing consumer of `CdcPushPayload` is untouched, and a browser
- * `EventSource` — which this framework does not use, but a customer's own script
- * might — still reads the stream correctly and simply does not see the tag.
- * `id:` was the other candidate and is refused: it is Last-Event-ID resumption,
- * and overloading it would silently break the day we implement replay.
- */
-export const encodeSseFrame = (event) => `event: ${event.event}\n${event.instanceId === undefined ? '' : `instance: ${event.instanceId}\n`}data: ${JSON.stringify(event.data)}\n\n`;
-/**
- * Bridge a hub subscription onto a `ReadableStream` of SSE bytes.
- *
- * The stream ends when the client disconnects (`signal`), when the hub closes,
- * or when the subscriber overflows. All three paths run the same teardown, so a
- * dropped tab cannot leave a subscription — or an interval — behind.
- */
-export const sseBody = (hub, filter, options = {}) => {
-    const heartbeatMs = options.heartbeatMs ?? 15_000;
-    const retryMs = options.retryMs ?? 500;
-    const maxQueued = options.maxQueued ?? 256;
-    const setIntervalFn = options.setIntervalFn ?? ((fn, ms) => setInterval(fn, ms));
-    const clearIntervalFn = options.clearIntervalFn ?? ((handle) => clearInterval(handle));
-    const encoder = new TextEncoder();
-    let unsubscribe = () => undefined;
-    let heartbeat = null;
-    let done = false;
-    return new ReadableStream({
-        start(controller) {
-            const teardown = () => {
-                if (done)
-                    return;
-                done = true;
-                unsubscribe();
-                if (heartbeat !== null)
-                    clearIntervalFn(heartbeat);
-                heartbeat = null;
-                try {
-                    controller.close();
-                }
-                catch {
-                    // Already closed by the runtime when the socket died — expected.
-                }
-            };
-            const write = (chunk) => {
-                if (done)
-                    return false;
-                try {
-                    controller.enqueue(encoder.encode(chunk));
-                    return true;
-                }
-                catch {
-                    teardown();
-                    return false;
-                }
-            };
-            write(`retry: ${retryMs}\n\n`);
-            for (const event of options.initial ?? [])
-                write(encodeSseFrame(event));
-            /**
-             * `desiredSize` is the consumer's remaining appetite under the default
-             * one-chunk strategy, so it goes NEGATIVE by exactly the number of frames
-             * enqueued but not yet read — i.e. it *is* the backlog. `null` means the
-             * stream is already gone. Either way a client that stopped reading gets
-             * dropped rather than buffered into the server's heap.
-             */
-            const backlogged = () => {
-                const desired = controller.desiredSize;
-                return desired === null || desired < -maxQueued;
-            };
-            const dropSlowConsumer = () => {
-                write(encodeSseFrame({ event: 'overflow', data: { reason: 'slow-consumer', maxQueued } }));
-                teardown();
-            };
-            unsubscribe = hub.subscribe(filter, (event) => {
-                if (event.event === 'close') {
-                    write(encodeSseFrame(event));
-                    teardown();
-                    return;
-                }
-                if (backlogged()) {
-                    dropSlowConsumer();
-                    return;
-                }
-                write(encodeSseFrame(event));
-            });
-            heartbeat = setIntervalFn(() => {
-                // A comment frame: keeps proxies and the browser from calling the
-                // connection idle without waking any client-side handler. It is also the
-                // liveness check for a connection that receives no events at all — an
-                // idle socket whose peer stopped reading is found here, not never.
-                if (backlogged()) {
-                    dropSlowConsumer();
-                    return;
-                }
-                write(': keep-alive\n\n');
-            }, heartbeatMs);
-            if (options.signal) {
-                if (options.signal.aborted)
-                    teardown();
-                else
-                    options.signal.addEventListener('abort', teardown, { once: true });
-            }
-        },
-        cancel() {
-            done = true;
-            unsubscribe();
-            if (heartbeat !== null)
-                clearIntervalFn(heartbeat);
-            heartbeat = null;
-        },
-    });
-};
-/** A ready-to-return SSE `Response`. */
-export const sseResponse = (hub, filter, options = {}) => new Response(sseBody(hub, filter, options), { headers: { ...SSE_HEADERS } });
-//# sourceMappingURL=serverPush.js.map

package/dist/server/stream/serverPush.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"serverPush.js","sourceRoot":"","sources":["../../../src/server/stream/serverPush.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAiEH,MAAM,OAAO,GAAG,CAAC,KAAsB,EAAE,UAAsB,EAAW,EAAE;IAC1E,uEAAuE;IACvE,wBAAwB;IACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChG,6EAA6E;IAC7E,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAkB,EAAE;IACrD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAc,CAAC;IAC1C,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,OAAO;QACL,OAAO,CAAC,KAAK;YACX,IAAI,MAAM;gBAAE,OAAO;YACnB,uEAAuE;YACvE,yDAAyD;YACzD,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;oBAAE,SAAS;gBAC1C,IAAI,CAAC;oBACH,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,6DAA6D;oBAC7D,4CAA4C;oBAC5C,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,CAAC,MAAM,EAAE,QAAQ;YACxB,IAAI,MAAM;gBAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;YACnC,MAAM,UAAU,GAAe,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;YACpG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC5B,OAAO,GAAG,EAAE;gBACV,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,eAAe;YACjB,OAAO,WAAW,CAAC,IAAI,CAAC;QAC1B,CAAC;QAED,KAAK;YACH,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,UAAU,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;gBACrE,CAAC;YACH,CAAC;YACD,WAAW,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAkCF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAqC,MAAM,CAAC,MAAM,CAAC;IACzE,cAAc,EAAE,mBAAmB;IACnC,eAAe,EAAE,UAAU;IAC3B,UAAU,EAAE,YAAY;IACxB,yDAAyD;IACzD,mBAAmB,EAAE,IAAI;CAC1B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAsB,EAAU,EAAE,CAC/D,UAAU,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,UAAU,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;AAE7I;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAkB,EAAE,MAAkB,EAAE,UAAsB,EAAE,EAA8B,EAAE;IACtH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAwC,CAAC,CAAC,CAAC;IACzH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAElC,IAAI,WAAW,GAAgB,GAAG,EAAE,CAAC,SAAS,CAAC;IAC/C,IAAI,SAAS,GAAY,IAAI,CAAC;IAE9B,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,UAAU;YACd,MAAM,QAAQ,GAAG,GAAS,EAAE;gBAC1B,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,WAAW,EAAE,CAAC;gBACd,IAAI,SAAS,KAAK,IAAI;oBAAE,eAAe,CAAC,SAAS,CAAC,CAAC;gBACnD,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC;oBACH,UAAU,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;gBACnE,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,CAAC,KAAa,EAAW,EAAE;gBACvC,IAAI,IAAI;oBAAE,OAAO,KAAK,CAAC;gBACvB,IAAI,CAAC;oBACH,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC1C,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,EAAE,CAAC;oBACX,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC,CAAC;YAEF,KAAK,CAAC,UAAU,OAAO,MAAM,CAAC,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE;gBAAE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;YAExE;;;;;;eAMG;YACH,MAAM,UAAU,GAAG,GAAY,EAAE;gBAC/B,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC;gBACvC,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC;YAClD,CAAC,CAAC;YAEF,MAAM,gBAAgB,GAAG,GAAS,EAAE;gBAClC,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC3F,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC;YAEF,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5C,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;oBAC5B,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC7B,QAAQ,EAAE,CAAC;oBACX,OAAO;gBACT,CAAC;gBACD,IAAI,UAAU,EAAE,EAAE,CAAC;oBACjB,gBAAgB,EAAE,CAAC;oBACnB,OAAO;gBACT,CAAC;gBACD,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YAEH,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE;gBAC7B,kEAAkE;gBAClE,yEAAyE;gBACzE,sEAAsE;gBACtE,mEAAmE;gBACnE,IAAI,UAAU,EAAE,EAAE,CAAC;oBACjB,gBAAgB,EAAE,CAAC;oBACnB,OAAO;gBACT,CAAC;gBACD,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC5B,CAAC,EAAE,WAAW,CAAC,CAAC;YAEhB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;oBAAE,QAAQ,EAAE,CAAC;;oBAClC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,MAAM;YACJ,IAAI,GAAG,IAAI,CAAC;YACZ,WAAW,EAAE,CAAC;YACd,IAAI,SAAS,KAAK,IAAI;gBAAE,eAAe,CAAC,SAAS,CAAC,CAAC;YACnD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,wCAAwC;AACxC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAE,MAAkB,EAAE,UAAsB,EAAE,EAAY,EAAE,CACxG,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE,CAAC,CAAC"}

package/dist/server/sync/alarm.d.ts

@@ -1,35 +0,0 @@
-/**
- * 🔴 `error` joined on 2026-08-21, and it is the outcome that was MISSING.
- *
- * The console's subdomain cutover left the Mac's `STATION_SYNC_URL` pointing at
- * a host that had become a 301; the dialer followed it into a Cloudflare Access
- * login page and threw `Failed to parse JSON` every round. That is neither
- * `paused` (nothing is version-skewed) nor `auth` (no token was refused) nor
- * `unreachable` (the peer answered), so it recorded NOTHING — the timer logged
- * `[sync] failed (ignored)` and the alarm's counter sat at zero while every
- * mirrored report on prod froze for days, each still rendering a confident age.
- *
- * A sustained hard error is exactly as bad as a sustained pause and is now
- * counted the same. `unreachable` remains the one outcome that neither counts
- * nor resets, because the nightly EC2 sleep must never false-alarm.
- */
-export type AlarmOutcome = "ok" | "paused" | "auth" | "error" | "unreachable";
-export interface SyncAlarmOptions {
-    /** Where the counter lives (survives restarts). */
-    statePath: string;
-    /** Rounds of paused/auth before raising (with the round cadence, pick so the
-     *  threshold lands around ~45 min of sustained pause). */
-    threshold?: number;
-    /** Re-raise cadence while the condition persists. Default 4h. */
-    reRaiseMs?: number;
-    /** Present the alarm. Default: macOS notification via osascript. */
-    notify?: (title: string, body: string) => void;
-    now?: () => number;
-    appName?: string;
-}
-export interface SyncAlarm {
-    /** Record one sync round's outcome; raises when the threshold crosses. */
-    record(outcome: AlarmOutcome, reason?: string): void;
-}
-export declare function createSyncAlarm(options: SyncAlarmOptions): SyncAlarm;
-//# sourceMappingURL=alarm.d.ts.map

package/dist/server/sync/alarm.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"alarm.d.ts","sourceRoot":"","sources":["../../../src/server/sync/alarm.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;AAgB9E,MAAM,WAAW,gBAAgB;IAChC,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB;8DAC0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACzB,0EAA0E;IAC1E,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrD;AAeD,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CA4DpE"}

package/dist/server/sync/alarm.js

@@ -1,92 +0,0 @@
-/**
- * Pause-alarm escalation — notes' `syncAlarm` generalized. A sync that is version-
- * skew paused or auth-refused for a sustained stretch is a real problem the owner
- * must hear about (the 2026-07-31 notes incident: prod ran stale code most of a day
- * and only an owner eyeballing counts caught it). An UNREACHABLE peer neither counts
- * nor resets — the nightly EC2 sleep must never false-alarm.
- *
- * State is a small JSON file so the alarm survives process restarts; the notifier is
- * a seam (macOS `osascript` by default) so tests and non-Mac hosts inject their own.
- */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
-const EMPTY = {
-    consecutiveBad: 0,
-    firstBadAt: null,
-    lastRaisedAt: null,
-    lastReason: null,
-};
-function defaultNotify(title, body) {
-    try {
-        const esc = (s) => s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-        Bun.spawnSync([
-            "osascript",
-            "-e",
-            `display notification "${esc(body)}" with title "${esc(title)}"`,
-        ]);
-    }
-    catch {
-        // A notifier must never take the loop down.
-    }
-}
-export function createSyncAlarm(options) {
-    const threshold = options.threshold ?? 9;
-    const reRaiseMs = options.reRaiseMs ?? 4 * 60 * 60_000;
-    const notify = options.notify ?? defaultNotify;
-    const now = options.now ?? Date.now;
-    const appName = options.appName ?? "sync";
-    const load = () => {
-        try {
-            if (!existsSync(options.statePath))
-                return { ...EMPTY };
-            return {
-                ...EMPTY,
-                ...JSON.parse(readFileSync(options.statePath, "utf8")),
-            };
-        }
-        catch {
-            return { ...EMPTY };
-        }
-    };
-    const save = (state) => {
-        try {
-            mkdirSync(dirname(options.statePath), { recursive: true });
-            writeFileSync(options.statePath, JSON.stringify(state));
-        }
-        catch {
-            // Losing the counter degrades to a later alarm, never to a crash.
-        }
-    };
-    return {
-        record(outcome, reason) {
-            const state = load();
-            if (outcome === "ok") {
-                save({ ...EMPTY });
-                return;
-            }
-            if (outcome === "unreachable")
-                return; // neither counts nor resets
-            state.consecutiveBad += 1;
-            state.lastReason = reason ?? outcome;
-            if (state.firstBadAt === null)
-                state.firstBadAt = now();
-            const due = state.consecutiveBad >= threshold &&
-                (state.lastRaisedAt === null || now() - state.lastRaisedAt >= reRaiseMs);
-            if (due) {
-                state.lastRaisedAt = now();
-                const since = state.firstBadAt
-                    ? new Date(state.firstBadAt).toLocaleTimeString()
-                    : "a while";
-                notify(outcome === "error" ? `${appName}: sync is FAILING` : `${appName}: sync is paused`, outcome === "auth"
-                    ? `The sync token is being refused (since ${since}). Re-link the peer.`
-                    : outcome === "error"
-                        ? // Names the real error, because this alarm's whole reason for
-                            // existing is that "failed (ignored)" was invisible.
-                            `Every sync round has failed since ${since}: ${state.lastReason}`
-                        : `Push has been paused on "${state.lastReason}" since ${since} — the peer likely needs a deploy.`);
-            }
-            save(state);
-        },
-    };
-}
-//# sourceMappingURL=alarm.js.map

package/dist/server/sync/alarm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"alarm.js","sourceRoot":"","sources":["../../../src/server/sync/alarm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0BpC,MAAM,KAAK,GAAe;IACzB,cAAc,EAAE,CAAC;IACjB,UAAU,EAAE,IAAI;IAChB,YAAY,EAAE,IAAI;IAClB,UAAU,EAAE,IAAI;CAChB,CAAC;AAqBF,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IACjD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzE,GAAG,CAAC,SAAS,CAAC;YACb,WAAW;YACX,IAAI;YACJ,yBAAyB,GAAG,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,KAAK,CAAC,GAAG;SAChE,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACR,4CAA4C;IAC7C,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAyB;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;IAE1C,MAAM,IAAI,GAAG,GAAe,EAAE;QAC7B,IAAI,CAAC;YACJ,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;YACxD,OAAO;gBACN,GAAG,KAAK;gBACR,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAyB;aAC/E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QACrB,CAAC;IACF,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAiB,EAAQ,EAAE;QACxC,IAAI,CAAC;YACJ,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACR,kEAAkE;QACnE,CAAC;IACF,CAAC,CAAC;IAEF,OAAO;QACN,MAAM,CAAC,OAAO,EAAE,MAAM;YACrB,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtB,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;gBACnB,OAAO;YACR,CAAC;YACD,IAAI,OAAO,KAAK,aAAa;gBAAE,OAAO,CAAC,4BAA4B;YACnE,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;YAC1B,KAAK,CAAC,UAAU,GAAG,MAAM,IAAI,OAAO,CAAC;YACrC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YACxD,MAAM,GAAG,GACR,KAAK,CAAC,cAAc,IAAI,SAAS;gBACjC,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,SAAS,CAAC,CAAC;YAC1E,IAAI,GAAG,EAAE,CAAC;gBACT,KAAK,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU;oBAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE;oBACjD,CAAC,CAAC,SAAS,CAAC;gBACb,MAAM,CACL,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,kBAAkB,EAClF,OAAO,KAAK,MAAM;oBACjB,CAAC,CAAC,0CAA0C,KAAK,sBAAsB;oBACvE,CAAC,CAAC,OAAO,KAAK,OAAO;wBACpB,CAAC,CAAC,8DAA8D;4BAC/D,qDAAqD;4BACrD,qCAAqC,KAAK,KAAK,KAAK,CAAC,UAAU,EAAE;wBAClE,CAAC,CAAC,4BAA4B,KAAK,CAAC,UAAU,WAAW,KAAK,oCAAoC,CACpG,CAAC;YACH,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,CAAC;QACb,CAAC;KACD,CAAC;AACH,CAAC"}