cursedbelt 2.8.0 → 3.0.1

package/dist/server/sync/http.d.ts

@@ -1,107 +0,0 @@
-/**
- * The HTTP transport: the receiver sub-app the internet-facing instance mounts, and
- * the fetch-backed {@link RemoteApi} the dialer binds to.
- *
- * Mount the receiver OUTSIDE any browser-session gate (a machine peer has no session;
- * notes' 401 trap: a token route registered after the session gate answers 401 with a
- * valid token) but behind the token gate built here. An unconfigured receiver simply
- * does not exist — the orch-companion idiom: no token verifier, no routes, nothing to
- * probe.
- */
-import { Hono } from "hono";
-import type { OpLog } from "./opLog";
-import type { ApplyOne, ApplyReport, RemoteApi } from "./types";
-/**
- * Trim a page to the byte budget, keeping it a PREFIX so `cursor` stays the seq
- * of the last op actually returned. Anything else silently drops ops: the caller
- * advances past rows it never received and no later pull will offer them again.
- */
-export declare function capPageBytes<T extends {
-    seq: number;
-}>(ops: T[], maxBytes: number): {
-    ops: T[];
-    truncated: boolean;
-};
-export interface ReceiverHooks {
-    /** Every authenticated hit — the only evidence a non-dialing half has that it is
-     *  in step (vault's `lastPeerContactAt` lesson). */
-    onPeerContact?: (peerId: string) => void;
-    /** The "Sync now was pressed HERE" stamp the dialer polls. */
-    readRequest?: () => number | null;
-}
-export interface ReceiverOptions {
-    log: OpLog;
-    opKinds: readonly string[];
-    /** Verify a presented bearer token for the sync scope. Return false to refuse.
-     *  Bind this to a TokenStore (`(t) => tokens.verify(t, "sync") !== null`) or a
-     *  constant-time static compare — the kit does not care which. */
-    verifyToken: (presented: string) => boolean;
-    /** The app's merge logic, when it is stateless across a batch (vault, station).
-     *  Give this OR {@link beginBatch}, never both. */
-    applyOne?: ApplyOne;
-    /**
-     * The app's merge logic when the batch needs state of its own — called once per
-     * `POST /push`, so what it closes over belongs to that batch alone.
-     *
-     * 🔴 A single shared `ApplyOne` closing over a mutable accumulator is the bug this
-     * exists to make unrepresentable: two pushes in flight would pour into one counter,
-     * and the second response would carry the first's leftovers. notes needs it — its
-     * applier collects the attachment blobs a purge orphaned and the items whose search
-     * index must be rebuilt, neither of which can happen inside the op's transaction.
-     */
-    beginBatch?: () => ApplyOne;
-    /**
-     * Post-commit work, awaited BEFORE the response goes out — an index rebuild, a blob
-     * delete that is a network call. Anything that must not run inside the applier's
-     * transaction but must be done by the time the caller sees a 200, or the caller will
-     * advance its cursor past work that never happened.
-     */
-    afterBatch?: (report: ApplyReport) => void | Promise<void>;
-    hooks?: ReceiverHooks;
-}
-/** Build the receiver: GET /info, GET /pull, POST /push, GET /requested. */
-export declare function createSyncReceiver(options: ReceiverOptions): Hono;
-/**
- * The fetch-backed remote the dialer binds to. `basePath` is where the peer
- * mounted its receiver (e.g. `https://station.cursedalchemy.com/api/sync`).
- *
- * 🔴 **Redirects are REFUSED, never followed** (2026-08-21). `fetch` follows by
- * default, and that turned a moved hostname into eight days of silence: the
- * console's subdomain cutover made `station.cursedalchemy.com` a **301** to
- * `station.cursedalchemy.com`, the dialer followed it, Cloudflare Access answered
- * the un-credentialed redirect with its **login page — HTTP 200, text/html**,
- * and `r.json()` threw `Failed to parse JSON`. The dialer logs that as
- * `[sync] failed (ignored)` and retries forever, so:
- *
- *   · every mirrored report on prod froze at the moment of the cutover, while
- *     each one still rendered a confident `capturedAt` age;
- *   · nothing was red anywhere — not a gate, not a smoke, not `/healthz`;
- *   · the error named JSON, which is three layers away from the cause.
- *
- * A 3xx here can only ever mean the peer address is wrong, so it is reported as
- * exactly that, with the destination in the message. Following a redirect
- * silently is how a sync survives its own misconfiguration.
- *
- * The same reasoning covers a 2xx that is not JSON: an Access login page, an
- * nginx error page or a captive portal all arrive as `200 text/html`, and
- * "Failed to parse JSON" is the least useful sentence available about any of
- * them. {@link readJson} names the status, the content type and a snippet.
- */
-export declare function createHttpRemote(options: {
-    basePath: string;
-    token: string;
-    selfId: string;
-    fetchImpl?: typeof fetch;
-    timeoutMs?: number;
-    /**
-     * Extra headers for THIS peer's host — the Cloudflare Access service token,
-     * where the receiver sits behind an Access application. Host-scoped BY THE
-     * CALLER — never a blanket wrapper: a credential sent where it is not needed is a
-     * credential leaked. The retired generation had a `satellite-kit/cloudflare-access`
-     * helper that did the host-scoping; no caller in this app passes this today
-     * (`syncClient.ts` handles Access by refusing to follow its 302 instead), so a
-     * future one owns the scoping itself.
-     */
-    extraHeaders?: Record<string, string>;
-}): RemoteApi;
-//# sourceMappingURL=http.d.ts.map

package/dist/server/sync/http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/server/sync/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAgB,QAAQ,EAAE,WAAW,EAAY,SAAS,EAAU,MAAM,SAAS,CAAC;AA2BhG;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACrD,GAAG,EAAE,CAAC,EAAE,EACR,QAAQ,EAAE,MAAM,GACd;IAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAOlC;AASD,MAAM,WAAW,aAAa;IAC7B;wDACoD;IACpD,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC/B,GAAG,EAAE,KAAK,CAAC;IACX,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;sEAEkE;IAClE,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C;uDACmD;IACnD,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAmFjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,GAAG,SAAS,CAqFZ"}

package/dist/server/sync/http.js

@@ -1,244 +0,0 @@
-/**
- * The HTTP transport: the receiver sub-app the internet-facing instance mounts, and
- * the fetch-backed {@link RemoteApi} the dialer binds to.
- *
- * Mount the receiver OUTSIDE any browser-session gate (a machine peer has no session;
- * notes' 401 trap: a token route registered after the session gate answers 401 with a
- * valid token) but behind the token gate built here. An unconfigured receiver simply
- * does not exist — the orch-companion idiom: no token verifier, no routes, nothing to
- * probe.
- */
-import { Hono } from "hono";
-import { createSyncApplier } from "./engine";
-const noStore = { "cache-control": "no-store" };
-const SYNC_PAGE = 500;
-/**
- * Byte budget for ONE pull page — the mirror of `maxPushBytes` on the push side,
- * and it was missing.
- *
- * 🔴 Measured against live prod on 2026-08-01: `GET /pull?after=0` against
- * station's 709-op log served **37 MB at 309 ops** and then OOM-killed the unit
- * (`memoryMax=300M` on a t3.micro). `SYNC_PAGE = 500` is a COUNT cap, and these
- * ops are not small — a 130 KB overview snapshot, a 68 KB fleet CSV — so 500 of
- * them is tens of megabytes serialized into one response buffer.
- *
- * What makes it worse than a slow request is that it does not converge: the unit
- * dies, systemd restarts it, the dialer retries the identical oversized pull, and
- * the pair never advances. Push already learned this exact lesson (a 413 wedges
- * because the batch never shrinks); the receiving half kept only the count cap
- * because a fully-caught-up peer never asks for enough rows to notice.
- *
- * A single op larger than the budget is still served alone — refusing it would
- * wedge the log permanently on that op, which is worse than one big response.
- */
-const SYNC_PAGE_BYTES = 4_000_000;
-/**
- * Trim a page to the byte budget, keeping it a PREFIX so `cursor` stays the seq
- * of the last op actually returned. Anything else silently drops ops: the caller
- * advances past rows it never received and no later pull will offer them again.
- */
-export function capPageBytes(ops, maxBytes) {
-    let weight = 0;
-    for (let i = 0; i < ops.length; i++) {
-        weight += JSON.stringify(ops[i]).length + 1;
-        if (weight > maxBytes && i > 0)
-            return { ops: ops.slice(0, i), truncated: true };
-    }
-    return { ops, truncated: false };
-}
-/** Coerce and clamp the caller's peer id — a cursor key and a label, never trusted
- *  further than that. */
-function peerIdOf(header, query) {
-    const raw = query ?? header ?? "";
-    return /^[0-9A-Za-z_-]{1,64}$/.test(raw) ? raw : "peer";
-}
-/** Build the receiver: GET /info, GET /pull, POST /push, GET /requested. */
-export function createSyncReceiver(options) {
-    const { log, verifyToken } = options;
-    if ((options.applyOne === undefined) === (options.beginBatch === undefined)) {
-        // Loud at construction, because both mistakes are silent at runtime: neither
-        // given means every op vanishes as "ignored"; both given means one of the two
-        // is quietly never called.
-        throw new Error("[vault sync] receiver: give exactly one of `applyOne` or `beginBatch`");
-    }
-    const beginBatch = options.beginBatch ?? (() => options.applyOne);
-    const api = new Hono();
-    api.use("*", async (c, next) => {
-        const header = c.req.header("authorization") ?? "";
-        const presented = header.startsWith("Bearer ") ? header.slice(7) : "";
-        if (presented.length === 0 || !verifyToken(presented)) {
-            return c.json({ error: "unauthorized" }, 401, noStore);
-        }
-        await next();
-    });
-    // AFTER the gate — an unauthenticated caller must never look like peer contact.
-    api.use("*", async (c, next) => {
-        options.hooks?.onPeerContact?.(peerIdOf(c.req.header("x-sync-peer"), c.req.query("peer")));
-        await next();
-    });
-    api.get("/info", (c) => {
-        const body = {
-            instanceId: log.instanceId(),
-            head: log.head(),
-            opKinds: [...options.opKinds],
-        };
-        return c.json(body, 200, noStore);
-    });
-    api.get("/requested", (c) => c.json({ requestedAt: options.hooks?.readRequest?.() ?? null }, 200, noStore));
-    api.get("/pull", (c) => {
-        const afterRaw = c.req.query("after");
-        const after = afterRaw !== undefined && /^\d+$/.test(afterRaw) ? Number(afterRaw) : 0;
-        const excludeRaw = c.req.query("exclude") ?? "";
-        const exclude = /^[0-9A-Za-z_-]{1,64}$/.test(excludeRaw) ? excludeRaw : "";
-        const page = log.listAfter(after, exclude, SYNC_PAGE);
-        // Count cap first (cheap, bounds the serialize below), then the byte cap.
-        const capped = capPageBytes(page.ops, SYNC_PAGE_BYTES);
-        // The cursor must name the last op ACTUALLY served, or the peer skips the
-        // remainder forever. `head` is untouched — it is how the caller knows to
-        // come back for another page.
-        const cursor = capped.truncated
-            ? (capped.ops.at(-1)?.seq ?? after)
-            : page.cursor;
-        log.setCursor(peerIdOf(c.req.header("x-sync-peer"), c.req.query("peer")), "served", cursor);
-        return c.json({ ops: capped.ops, cursor, head: page.head }, 200, noStore);
-    });
-    api.post("/push", async (c) => {
-        let body;
-        try {
-            body = await c.req.json();
-        }
-        catch {
-            return c.json({ error: "bad_request" }, 400, noStore);
-        }
-        if (body === null || typeof body !== "object")
-            return c.json({ error: "bad_request" }, 400, noStore);
-        const { ops, peerHas } = body;
-        if (!Array.isArray(ops))
-            return c.json({ error: "bad_request" }, 400, noStore);
-        const peerId = peerIdOf(c.req.header("x-sync-peer"), c.req.query("peer"));
-        // The client's DURABLE pull cursor for us is the crash-safe concurrency bound;
-        // fall back to our served cursor if an older caller omits it (vault's rule).
-        const bound = typeof peerHas === "number" && Number.isInteger(peerHas) && peerHas >= 0
-            ? peerHas
-            : log.cursor(peerId, "served");
-        const ctx = { peerId, peerReceivedUpTo: bound };
-        const report = createSyncApplier(log, beginBatch())(ops, ctx);
-        // Awaited, not fire-and-forget: the caller advances its push cursor on this
-        // response, so work still outstanding when it lands is work nobody will redo.
-        await options.afterBatch?.(report);
-        return c.json(report, report.error === null ? 200 : 409, noStore);
-    });
-    return api;
-}
-/**
- * The fetch-backed remote the dialer binds to. `basePath` is where the peer
- * mounted its receiver (e.g. `https://station.cursedalchemy.com/api/sync`).
- *
- * 🔴 **Redirects are REFUSED, never followed** (2026-08-21). `fetch` follows by
- * default, and that turned a moved hostname into eight days of silence: the
- * console's subdomain cutover made `station.cursedalchemy.com` a **301** to
- * `station.cursedalchemy.com`, the dialer followed it, Cloudflare Access answered
- * the un-credentialed redirect with its **login page — HTTP 200, text/html**,
- * and `r.json()` threw `Failed to parse JSON`. The dialer logs that as
- * `[sync] failed (ignored)` and retries forever, so:
- *
- *   · every mirrored report on prod froze at the moment of the cutover, while
- *     each one still rendered a confident `capturedAt` age;
- *   · nothing was red anywhere — not a gate, not a smoke, not `/healthz`;
- *   · the error named JSON, which is three layers away from the cause.
- *
- * A 3xx here can only ever mean the peer address is wrong, so it is reported as
- * exactly that, with the destination in the message. Following a redirect
- * silently is how a sync survives its own misconfiguration.
- *
- * The same reasoning covers a 2xx that is not JSON: an Access login page, an
- * nginx error page or a captive portal all arrive as `200 text/html`, and
- * "Failed to parse JSON" is the least useful sentence available about any of
- * them. {@link readJson} names the status, the content type and a snippet.
- */
-export function createHttpRemote(options) {
-    const base = options.basePath.replace(/\/$/, "");
-    const doFetch = options.fetchImpl ?? fetch;
-    const timeout = options.timeoutMs ?? 60_000;
-    const peer = encodeURIComponent(options.selfId);
-    const request = async (path, init) => {
-        const response = await doFetch(`${base}${path}`, {
-            ...init,
-            // 🔴 See the header note: a followed redirect is how this sync spent
-            // eight days reporting a JSON parse error about an Access login page.
-            redirect: "manual",
-            headers: {
-                authorization: `Bearer ${options.token}`,
-                "x-sync-peer": options.selfId,
-                ...(options.extraHeaders ?? {}),
-                ...(init?.headers ?? {}),
-            },
-            signal: AbortSignal.timeout(timeout),
-        });
-        if (response.status >= 300 && response.status < 400) {
-            throw new Error(`${path}: ${response.status} — the peer address redirects to ` +
-                `${response.headers.get("location") ?? "an unnamed destination"}. ` +
-                `The sync URL points at a host that has moved; point it at the real one.`);
-        }
-        if (response.status === 401) {
-            throw new Error(`${path}: 401 — the sync token was refused.`);
-        }
-        return response;
-    };
-    /**
-     * Read a JSON body, or say what actually arrived.
-     *
-     * A 200 carrying `text/html` is a login page or an error page, and it is the
-     * shape every "the address is wrong" failure takes once a redirect has been
-     * followed. Naming the content type and the first line turns an unactionable
-     * `Failed to parse JSON` into the cause.
-     */
-    const readJson = async (r, path) => {
-        const text = await r.text();
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            const type = r.headers.get("content-type") ?? "no content-type";
-            throw new Error(`${path}: ${r.status} answered ${type}, not JSON — ` +
-                `${text.trim().slice(0, 120).replace(/\s+/g, " ") || "(empty body)"}`);
-        }
-    };
-    return {
-        async info() {
-            const r = await request("/info");
-            if (!r.ok)
-                throw new Error(`sync/info: ${r.status}`);
-            return await readJson(r, "sync/info");
-        },
-        async pull(after, excludeOrigin) {
-            const r = await request(`/pull?after=${after}&exclude=${encodeURIComponent(excludeOrigin)}&peer=${peer}`);
-            if (!r.ok)
-                throw new Error(`sync/pull: ${r.status}`);
-            return await readJson(r, "sync/pull");
-        },
-        async push(payload) {
-            const r = await request(`/push?peer=${peer}`, {
-                method: "POST",
-                headers: { "content-type": "application/json" },
-                body: JSON.stringify(payload),
-            });
-            if (!r.ok && r.status !== 409)
-                throw new Error(`sync/push: ${r.status}`);
-            return await readJson(r, "sync/push");
-        },
-        async requestedAt() {
-            try {
-                const r = await request("/requested");
-                if (!r.ok)
-                    return null;
-                const body = await readJson(r, "sync/requested");
-                return typeof body.requestedAt === "number" ? body.requestedAt : null;
-            }
-            catch {
-                return null;
-            }
-        },
-    };
-}
-//# sourceMappingURL=http.js.map

package/dist/server/sync/http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/server/sync/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAW,CAAC;AACzD,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,eAAe,GAAG,SAAS,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC3B,GAAQ,EACR,QAAgB;IAEhB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,GAAG,QAAQ,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED;yBACyB;AACzB,SAAS,QAAQ,CAAC,MAA0B,EAAE,KAAyB;IACtE,MAAM,GAAG,GAAG,KAAK,IAAI,MAAM,IAAI,EAAE,CAAC;IAClC,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AACzD,CAAC;AAyCD,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IAC1D,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC;QAC7E,6EAA6E;QAC7E,8EAA8E;QAC9E,2BAA2B;QAC3B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAoB,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IACH,gFAAgF;IAChF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAa;YACtB,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;YAChB,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;SAC7B,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAC7E,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACtD,0EAA0E;QAC1E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACvD,0EAA0E;QAC1E,yEAAyE;QACzE,8BAA8B;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS;YAC9B,CAAC,CAAC,CAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAwB,EAAE,GAAG,IAAI,KAAK,CAAC;YAC3D,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACf,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAA4C,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,KAAK,GACV,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;YACvE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,GAAG,GAAiB,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAgB,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,GAAe,EAAE,GAAG,CAAC,CAAC;QACvF,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAgBhC;IACA,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,IAAkB,EAAqB,EAAE;QAC7E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YAChD,GAAG,IAAI;YACP,qEAAqE;YACrE,sEAAsE;YACtE,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;gBACxC,aAAa,EAAE,OAAO,CAAC,MAAM;gBAC7B,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;gBAC/B,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;aACxB;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,KAAK,QAAQ,CAAC,MAAM,mCAAmC;gBAC7D,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,wBAAwB,IAAI;gBACnE,yEAAyE,CAC1E,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC;IAEF;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,KAAK,EAAK,CAAW,EAAE,IAAY,EAAc,EAAE;QACnE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,iBAAiB,CAAC;YAChE,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,aAAa,IAAI,eAAe;gBACnD,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CACtE,CAAC;QACH,CAAC;IACF,CAAC,CAAC;IACF,OAAO;QACN,KAAK,CAAC,IAAI;YACT,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,OAAO,MAAM,QAAQ,CAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa;YAC9B,MAAM,CAAC,GAAG,MAAM,OAAO,CACtB,eAAe,KAAK,YAAY,kBAAkB,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,CAChF,CAAC;YACF,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,OAAO,MAAM,QAAQ,CAAkD,CAAC,EAAE,WAAW,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO;YACjB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,OAAO,MAAM,QAAQ,CAAc,CAAC,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,CAAC,WAAW;YAChB,IAAI,CAAC;gBACJ,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;gBACtC,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC;gBACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA4B,CAAC,EAAE,gBAAgB,CAAC,CAAC;gBAC5E,OAAO,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/server/sync/index.d.ts

@@ -1,42 +0,0 @@
-/**
- * `cursedbelt/sync` — the op-log replication engine, shared rather than forked.
- *
- * ## Why it is here and not in the app
- *
- * The retired tree had FOUR consumers of this engine: `apps/vault` (8 files),
- * `apps/station` (6), `apps/notes` (4) and `packages/feedback-kit` (5). `vault`
- * graduated first and carried all 3,245 lines in whole, as
- * `apps/vault/src/kit/sync/`, because a Phase A that also publishes a library is a
- * Phase A that does not land. This is the other half of that trade, and it had a
- * DEADLINE rather than a backlog slot: the moment `apps/station` graduates with the
- * copy still in `vault`, the generation owns two divergent forks of a replication
- * engine — the exact shape the owner ruled against on 2026-09-13, *"if we don't
- * adapt to this at the right time then it will be hard to remember to keep updating
- * multiple copies as the apps move and grow."*
- *
- * ## 🔴 A LEAF export, and it must stay one
- *
- * `cursedbelt/sync` resolves straight to this directory. It is deliberately NOT
- * reachable through the `cursedbelt/server` barrel, which drags `kysely` and
- * `otplib` behind it — an app that wants an op-log should not install two
- * databases to get one. The only runtime dependency beneath this subpath is
- * `hono` (for the receiver routes in `http.ts` and `commands.ts`); everything else
- * is `bun:sqlite`, `node:crypto` and `node:fs`.
- *
- * It lives under `src/server/` because that is where this package's two typecheck
- * projects put Bun's ambient types: the root `tsconfig.json` runs `types: []` to
- * keep the browser/React surface pristine and EXCLUDES `src/server`, so
- * `bun:sqlite` and `node:crypto` only resolve on this side of the split. The
- * directory decides the types; the `exports` key decides the spelling.
- */
-export { StopBatch, type ApplyContext, type ApplyOne, type ApplyReport, type PeerInfo, type RemoteApi, type SyncOp, type SyncSummary, } from "./types";
-export { createOpLog, type OpLog } from "./opLog";
-export { createTokenStore, type DeviceToken, type TokenStore } from "./tokens";
-export { createSyncApplier, pushToRemote, pullFromRemote, runSync, type EngineOptions, type ExportPolicy, type PeerRefusal, } from "./engine";
-export { capPageBytes, createHttpRemote, createSyncReceiver, type ReceiverHooks, type ReceiverOptions, } from "./http";
-export { DEFAULT_LOOP, isUnreachable, planNextSync, type SyncLoopConfig, type SyncLoopState, } from "./planner";
-export { OFFLINE_STATUS, PEER_CONTACT_WRITE_MS, createSyncStatusReporter, type SyncStatus, type SyncStatusReporter, type SyncStatusStore, } from "./status";
-export { REQUEST_POLL_MS, startSyncTimer, type SyncTimerDeps, type SyncTimerHandle } from "./timer";
-export { createSyncAlarm, type AlarmOutcome, type SyncAlarm, type SyncAlarmOptions } from "./alarm";
-export { DEFAULT_HOLD_MS, createCommandQueue, createCommandReceiver, createCommandRemote, startCommandWorker, type CommandQueue, type CommandRemote, type CommandRoutesOptions, type CommandStatus, type CommandWorkerDeps, type CommandWorkerHandle, type SyncCommand, } from "./commands";
-//# sourceMappingURL=index.d.ts.map

package/dist/server/sync/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACN,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,WAAW,GAChB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC/E,OAAO,EACN,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,OAAO,EACP,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,GACpB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACN,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,aAAa,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACN,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,WAAW,GAChB,MAAM,YAAY,CAAC"}

package/dist/server/sync/index.js

@@ -1,42 +0,0 @@
-/**
- * `cursedbelt/sync` — the op-log replication engine, shared rather than forked.
- *
- * ## Why it is here and not in the app
- *
- * The retired tree had FOUR consumers of this engine: `apps/vault` (8 files),
- * `apps/station` (6), `apps/notes` (4) and `packages/feedback-kit` (5). `vault`
- * graduated first and carried all 3,245 lines in whole, as
- * `apps/vault/src/kit/sync/`, because a Phase A that also publishes a library is a
- * Phase A that does not land. This is the other half of that trade, and it had a
- * DEADLINE rather than a backlog slot: the moment `apps/station` graduates with the
- * copy still in `vault`, the generation owns two divergent forks of a replication
- * engine — the exact shape the owner ruled against on 2026-09-13, *"if we don't
- * adapt to this at the right time then it will be hard to remember to keep updating
- * multiple copies as the apps move and grow."*
- *
- * ## 🔴 A LEAF export, and it must stay one
- *
- * `cursedbelt/sync` resolves straight to this directory. It is deliberately NOT
- * reachable through the `cursedbelt/server` barrel, which drags `kysely` and
- * `otplib` behind it — an app that wants an op-log should not install two
- * databases to get one. The only runtime dependency beneath this subpath is
- * `hono` (for the receiver routes in `http.ts` and `commands.ts`); everything else
- * is `bun:sqlite`, `node:crypto` and `node:fs`.
- *
- * It lives under `src/server/` because that is where this package's two typecheck
- * projects put Bun's ambient types: the root `tsconfig.json` runs `types: []` to
- * keep the browser/React surface pristine and EXCLUDES `src/server`, so
- * `bun:sqlite` and `node:crypto` only resolve on this side of the split. The
- * directory decides the types; the `exports` key decides the spelling.
- */
-export { StopBatch, } from "./types";
-export { createOpLog } from "./opLog";
-export { createTokenStore } from "./tokens";
-export { createSyncApplier, pushToRemote, pullFromRemote, runSync, } from "./engine";
-export { capPageBytes, createHttpRemote, createSyncReceiver, } from "./http";
-export { DEFAULT_LOOP, isUnreachable, planNextSync, } from "./planner";
-export { OFFLINE_STATUS, PEER_CONTACT_WRITE_MS, createSyncStatusReporter, } from "./status";
-export { REQUEST_POLL_MS, startSyncTimer } from "./timer";
-export { createSyncAlarm } from "./alarm";
-export { DEFAULT_HOLD_MS, createCommandQueue, createCommandReceiver, createCommandRemote, startCommandWorker, } from "./commands";
-//# sourceMappingURL=index.js.map

package/dist/server/sync/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACN,SAAS,GAQT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAc,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAqC,MAAM,UAAU,CAAC;AAC/E,OAAO,EACN,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,OAAO,GAIP,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,GAGlB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACN,YAAY,EACZ,aAAa,EACb,YAAY,GAGZ,MAAM,WAAW,CAAC;AACnB,OAAO,EACN,cAAc,EACd,qBAAqB,EACrB,wBAAwB,GAIxB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,cAAc,EAA4C,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,eAAe,EAA4D,MAAM,SAAS,CAAC;AACpG,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GAQlB,MAAM,YAAY,CAAC"}

package/dist/server/sync/opLog.d.ts

@@ -1,62 +0,0 @@
-/**
- * The durable op log + cursor bookkeeping, over the app's own `bun:sqlite` handle.
- * Fixed table names (`sync_ops`, `sync_cursors`, `sync_meta`) — a consumer of this
- * engine is expected to give sync its own tables rather than remap; the notes/vault
- * retrofit maps their legacy tables behind this interface, not the other way round.
- *
- * Identity: `(origin, origin_seq)` UNIQUE — exactly-once application with no peer
- * coordination (the notes ledger shape). `seq` is this instance's own monotonic
- * stream every peer pages over.
- */
-import type { Database } from "bun:sqlite";
-import type { SyncOp } from "./types";
-export interface OpLog {
-    /** This instance's stable id (minted once, persisted in sync_meta). */
-    instanceId(): string;
-    /** Record a locally-born op; returns it with seq/originSeq assigned. */
-    recordLocal(kind: string, payload: unknown, ts?: number): SyncOp;
-    /** Record a remote op into the ledger (dedupe identity kept). Caller applies state
-     *  FIRST in the same transaction scope; see `createSyncApplier`. */
-    recordRemote(op: SyncOp): void;
-    /** Is this (origin, originSeq) already in the ledger? */
-    has(origin: string, originSeq: number): boolean;
-    /** Page of ops with seq > after, excluding one origin (the peer's own — it already
-     *  has them), oldest first. `cursor` = last row's seq served (or `after`). */
-    listAfter(after: number, excludeOrigin: string, limit: number): {
-        ops: SyncOp[];
-        cursor: number;
-        head: number;
-    };
-    /** Highest local seq (0 when empty). */
-    head(): number;
-    /** Durable per-peer cursors. `direction`: what WE track about the peer. */
-    cursor(peerId: string, direction: "push" | "pull" | "served"): number;
-    setCursor(peerId: string, direction: "push" | "pull" | "served", seq: number): void;
-    /** Compaction for STATE-shaped kinds (a snapshot is not history): delete this
-     *  origin's OWN earlier ops of `kind` matching `payloadWhere` below `keepSeq`.
-     *  Safe under the exactly-once ledger — peers dedupe by (origin, originSeq),
-     *  pull pages tolerate seq gaps, and a deleted op is simply never sent. */
-    compactOwn(kind: string, keepSeq: number, payloadLike: string): number;
-    /** The same compaction, for a state kind that arrived from a PEER.
-     *
-     *  `compactOwn` is scoped to `origin = instanceId`, so a pure RECEIVER of a
-     *  state kind matches zero rows and its log grows without bound — prod
-     *  station reached 5,537 revisions of one `overview` snapshot (963 MB, ~160
-     *  MB/day) because every one of them originated on the Mac. The safety
-     *  argument on `compactOwn` never depended on who minted the op, only on the
-     *  kind being STATE rather than history, so it carries over verbatim.
-     *
-     *  Keyed on `origin_seq`, not local `seq`: a receiver compacts while
-     *  applying, which happens BEFORE the incoming row is inserted, so there is
-     *  no local seq yet to compare against. `(origin, origin_seq)` is the
-     *  ledger's own identity and is monotonic per origin, so it orders the
-     *  origin's stream exactly as well. */
-    compactOrigin(origin: string, kind: string, keepOriginSeq: number, payloadLike: string): number;
-    /** Arbitrary sync-scoped metadata (instance id lives here too). */
-    getMeta(key: string): string | null;
-    setMeta(key: string, value: string): void;
-    /** Run `fn` inside one sqlite transaction (apply + ledger-insert atomicity). */
-    transaction<T>(fn: () => T): T;
-}
-export declare function createOpLog(db: Database): OpLog;
-//# sourceMappingURL=opLog.d.ts.map

package/dist/server/sync/opLog.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"opLog.d.ts","sourceRoot":"","sources":["../../../src/server/sync/opLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC,MAAM,WAAW,KAAK;IACrB,uEAAuE;IACvE,UAAU,IAAI,MAAM,CAAC;IACrB,wEAAwE;IACxE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjE;wEACoE;IACpE,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,yDAAyD;IACzD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD;kFAC8E;IAC9E,SAAS,CACR,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACX;QAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,wCAAwC;IACxC,IAAI,IAAI,MAAM,CAAC;IACf,2EAA2E;IAC3E,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IACtE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACpF;;;+EAG2E;IAC3E,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IACvE;;;;;;;;;;;;;2CAauC;IACvC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAChG,mEAAmE;IACnE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gFAAgF;IAChF,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;CAC/B;AAID,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,GAAG,KAAK,CA2H/C"}

package/dist/server/sync/opLog.js

@@ -1,97 +0,0 @@
-import { randomUUID } from "node:crypto";
-const INSTANCE_KEY = "sync.instance_id";
-export function createOpLog(db) {
-    db.exec(`
-		CREATE TABLE IF NOT EXISTS sync_ops (
-			seq INTEGER PRIMARY KEY AUTOINCREMENT,
-			origin TEXT NOT NULL,
-			origin_seq INTEGER NOT NULL,
-			ts INTEGER NOT NULL,
-			kind TEXT NOT NULL,
-			payload TEXT NOT NULL,
-			UNIQUE(origin, origin_seq)
-		);
-		CREATE INDEX IF NOT EXISTS idx_sync_ops_origin ON sync_ops(origin, seq);
-		CREATE TABLE IF NOT EXISTS sync_cursors (
-			peer_id TEXT NOT NULL,
-			direction TEXT NOT NULL,
-			seq INTEGER NOT NULL DEFAULT 0,
-			PRIMARY KEY(peer_id, direction)
-		);
-		CREATE TABLE IF NOT EXISTS sync_meta (
-			key TEXT PRIMARY KEY,
-			value TEXT NOT NULL
-		);
-	`);
-    const getMetaStmt = db.prepare("SELECT value FROM sync_meta WHERE key = ?");
-    const setMetaStmt = db.prepare("INSERT INTO sync_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value");
-    const getMeta = (key) => getMetaStmt.get(key)?.value ?? null;
-    const setMeta = (key, value) => {
-        setMetaStmt.run(key, value);
-    };
-    let cachedId = getMeta(INSTANCE_KEY);
-    if (cachedId === null) {
-        // Short + url/label safe; uniqueness across a two-or-three instance fleet is
-        // what matters, not global collision resistance.
-        cachedId = `i-${randomUUID().slice(0, 12)}`;
-        setMeta(INSTANCE_KEY, cachedId);
-    }
-    const instanceId = cachedId;
-    const insertOp = db.prepare("INSERT INTO sync_ops (origin, origin_seq, ts, kind, payload) VALUES (?, ?, ?, ?, ?)");
-    const hasStmt = db.prepare("SELECT 1 FROM sync_ops WHERE origin = ? AND origin_seq = ? LIMIT 1");
-    const headStmt = db.prepare("SELECT COALESCE(MAX(seq), 0) AS head FROM sync_ops");
-    const maxOriginSeqStmt = db.prepare("SELECT COALESCE(MAX(origin_seq), 0) AS m FROM sync_ops WHERE origin = ?");
-    const listStmt = db.prepare("SELECT seq, origin, origin_seq, ts, kind, payload FROM sync_ops WHERE seq > ? AND origin != ? ORDER BY seq ASC LIMIT ?");
-    const compactStmt = db.prepare("DELETE FROM sync_ops WHERE origin = ? AND kind = ? AND seq < ? AND payload LIKE ?");
-    const compactOriginStmt = db.prepare("DELETE FROM sync_ops WHERE origin = ? AND kind = ? AND origin_seq < ? AND payload LIKE ?");
-    const cursorStmt = db.prepare("SELECT seq FROM sync_cursors WHERE peer_id = ? AND direction = ?");
-    const setCursorStmt = db.prepare("INSERT INTO sync_cursors (peer_id, direction, seq) VALUES (?, ?, ?) ON CONFLICT(peer_id, direction) DO UPDATE SET seq = excluded.seq");
-    const rowToOp = (row) => ({
-        seq: row.seq,
-        origin: row.origin,
-        originSeq: row.origin_seq,
-        ts: row.ts,
-        kind: row.kind,
-        payload: JSON.parse(row.payload),
-    });
-    return {
-        instanceId: () => instanceId,
-        recordLocal(kind, payload, ts) {
-            const at = ts ?? Date.now();
-            const originSeq = maxOriginSeqStmt.get(instanceId).m + 1;
-            insertOp.run(instanceId, originSeq, at, kind, JSON.stringify(payload ?? null));
-            const seq = headStmt.get().head;
-            return { seq, origin: instanceId, originSeq, ts: at, kind, payload };
-        },
-        recordRemote(op) {
-            insertOp.run(op.origin, op.originSeq, op.ts, op.kind, JSON.stringify(op.payload ?? null));
-        },
-        has: (origin, originSeq) => hasStmt.get(origin, originSeq) !== null,
-        listAfter(after, excludeOrigin, limit) {
-            const rows = listStmt.all(after, excludeOrigin, limit);
-            const ops = rows.map(rowToOp);
-            const head = headStmt.get().head;
-            // An all-excluded page must still advance the peer past what it skipped, or a
-            // log dominated by the peer's own reflected ops would page forever. Serve the
-            // true high-water mark of the WINDOW scanned: when the page is short, we
-            // reached head; otherwise the last row's seq.
-            const cursor = rows.length === 0 ? Math.max(after, head) : rows[rows.length - 1].seq;
-            return { ops, cursor, head };
-        },
-        head: () => headStmt.get().head,
-        compactOwn(kind, keepSeq, payloadLike) {
-            return compactStmt.run(instanceId, kind, keepSeq, payloadLike).changes;
-        },
-        compactOrigin(origin, kind, keepOriginSeq, payloadLike) {
-            return compactOriginStmt.run(origin, kind, keepOriginSeq, payloadLike).changes;
-        },
-        cursor: (peerId, direction) => cursorStmt.get(peerId, direction)?.seq ?? 0,
-        setCursor(peerId, direction, seq) {
-            setCursorStmt.run(peerId, direction, seq);
-        },
-        getMeta,
-        setMeta,
-        transaction: (fn) => db.transaction(fn)(),
-    };
-}
-//# sourceMappingURL=opLog.js.map

package/dist/server/sync/opLog.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"opLog.js","sourceRoot":"","sources":["../../../src/server/sync/opLog.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAoDzC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC,MAAM,UAAU,WAAW,CAAC,EAAY;IACvC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;EAqBP,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC7B,wGAAwG,CACxG,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAiB,EAAE,CAC7C,WAAW,CAAC,GAAG,CAAC,GAAG,CAA8B,EAAE,KAAK,IAAI,IAAI,CAAC;IACnE,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QACpD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACvB,6EAA6E;QAC7E,iDAAiD;QACjD,QAAQ,GAAG,KAAK,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC;IAE5B,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAC1B,qFAAqF,CACrF,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC;IAClF,MAAM,gBAAgB,GAAG,EAAE,CAAC,OAAO,CAClC,yEAAyE,CACzE,CAAC;IACF,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAC1B,wHAAwH,CACxH,CAAC;IACF,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC7B,mFAAmF,CACnF,CAAC;IACF,MAAM,iBAAiB,GAAG,EAAE,CAAC,OAAO,CACnC,0FAA0F,CAC1F,CAAC;IACF,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,kEAAkE,CAAC,CAAC;IAClG,MAAM,aAAa,GAAG,EAAE,CAAC,OAAO,CAC/B,sIAAsI,CACtI,CAAC;IAUF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAU,EAAE,CAAC,CAAC;QACxC,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAY;KAC3C,CAAC,CAAC;IAEH,OAAO;QACN,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU;QAC5B,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YAC5B,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAmB,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5E,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAI,QAAQ,CAAC,GAAG,EAAuB,CAAC,IAAI,CAAC;YACtD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtE,CAAC;QACD,YAAY,CAAC,EAAE;YACd,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,GAAG,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,IAAI;QACnE,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK;YACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAY,CAAC;YAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAI,QAAQ,CAAC,GAAG,EAAuB,CAAC,IAAI,CAAC;YACvD,8EAA8E;YAC9E,8EAA8E;YAC9E,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,MAAM,GACX,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAW,CAAC,GAAG,CAAC;YAClF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAE,QAAQ,CAAC,GAAG,EAAuB,CAAC,IAAI;QACrD,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW;YACpC,OAAO,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC;QACxE,CAAC;QACD,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW;YACrD,OAAO,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC;QAChF,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC5B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAA4B,EAAE,GAAG,IAAI,CAAC;QACxE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG;YAC/B,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO;QACP,OAAO;QACP,WAAW,EAAE,CAAI,EAAW,EAAK,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE;KACxD,CAAC;AACH,CAAC"}