[Alex-Dolid]

Summary

This branch is the whole of @alexify/syncom as it stands, from the migration of the globalstorage files to a
replicated, schema-validated, queryable storage engine with signed operations. main holds only the initial
commit, so this PR is effectively the package.

The version is 0.0.1 — a development placeholder. Nothing is published to npm, and there is no release until the
package does what it is meant to; the first release version is chosen then (CHANGELOG.md keeps everything under
[Unreleased]). Zero runtime dependencies, CommonJS, no build step.

What is in it

Replication

• Every write is an operation in a persisted, hash-linkable log; peers exchange ops over an injected link (wrpc over
  WebSocket or WebRTC), resume from the last event id, and bootstrap from a streamed snapshot when they cannot.
• A coordinator-free mesh: every node dials and hosts; hubs dial each other; ops relay hop by hop, de-duplicated by
  version vectors kept per origin and scope.
• Push recovery on the link's next sign of life, an outbox bound, per-peer push limits, a failed page treated as a
  break in the stream (retry from the saved cursor, then stuck).

Data model — what converges

• Last-writer-wins registers per field, per-origin counters (inc), observed-remove sets (add/remove),
  tombstones a newer write revives; a field is one kind only.
• purge(id) — the right to be forgotten: wins at any stamp, scrubs the payload from every log it reaches.

Storage

• Injected backends (node:fs, OPFS, IndexedDB via @alexify/syncom/idb, memory), exclusive open, a bounded cache,
  an in-memory record catalog (list()/hasRecord() without I/O), encryption at rest, an optional chain
  (chain: false for hubs), repair(id) from the log.

Schema and queries

• Injected validators (metaschema, any Standard Schema, ajv), schema versions on every op, reading older records
  through a lens, migrate().
• Mango cursors with indexes, unique keys, top-k, watch(), and full-text search ($text) — fuzzy, TF-IDF
  ranked trigram search through the @alexify/syncom/search subpath (0.9 KB).

Trust

• Every op is signed with the node's Ed25519 key, and the node id is that key: any peer verifies an op through
  any relay. sync.signatures: 'verify' | 'require' | false.
• The host checks ids, op shape, clock skew and scopes before anything reads an op; snapshots and feeds serve only
  the granted scopes.

Operability

• Hooks inside writes, reads and peer batches; contained events; injected OpenTelemetry (spans, metrics, log events
  as a surface); a SyncomError with a code for every operational failure; stats(), peers(), hosted().

Docs and benchmarks

• A VitePress site: guides for storage, sync (incl. signatures), schema, queries (incl. full-text search), hooks,
  backends, scaling, WebRTC, telemetry, architecture, why, a 40-feature comparison with 18 libraries, and benchmarks
  against nine of them. Every number comes from a script in the repository.

Breaking, relative to globalstorage

The full list is under Changed (breaking) in CHANGELOG.md. The ones that change how code is written:

• open() is exclusive by default (LOCKED); smart contracts live in @alexify/syncom/contracts.
• Record ids are checked ([A-Za-z0-9_@-][A-Za-z0-9._@-]{0,127}); an entity definition takes only known keys.
• set() is a whole-record write; a field is a register, a counter or a set, never two.
• The node id is the Ed25519 public key; a UUID in an existing node.json is rekeyed once (identity.rekeyed).
• Node.js ≥ 22.

Not in this PR

• A signed hello challenge (proof that a peer holds the key it greets with).
• List and text CRDTs; git-like branching; master/backup/cache server roles.
• Framework coupling (Impress, Metarhia) — out of scope by design: transport, backend, validator and telemetry are
  injected.

Testing

• pnpm lint, pnpm format:check, pnpm test:coverage (720 tests: 719 pass, 1 skipped; 99.6 % lines, 96.4 %
  branches), pnpm test:types, pnpm size (browser entry 40.7 KB min+gzip of a 41 KB budget; the search subpath
  0.9 KB), pnpm run docs:build — all green.
• Cross-platform behaviour runs on both halves (Node, and the browser halves under Node with an OPFS mock and
  webcrypto); the wrpc and metaschema integration tests ran; one test is skipped by design (it needs
  --expose-gc).
• Convergence: a seeded fuzz over a four-node mesh (set, update, inc, add, remove, delete), partitions, a late
  joiner bootstrapping from a compacted host, and a three-node mesh under signatures: 'require' where every logged
  op verifies against its origin.
• Not checked by hand: a real browser (two tabs, WebRTC between them).

Performance note

Signing is the main cost in memory. In the cross-library benchmarks (re-measured on this branch) an in-memory
insert went from ~37,500/s to ~15,600/s, and replicating a store in memory from ~108,000 to ~9,000 records/s — the
replica verifies every op at ~0.1 ms each. On disk inserts are unchanged (~1,500/s; the file writes dominate),
replication went from ~7,000 to ~4,000/s. sync.signatures: false removes both costs. Verifying on Node's
thread pool instead of the main thread is the obvious next step and is not in this PR.

Reviewing

Commit by commit: each one is a single change with every gate green. CLAUDE.md lists the load-bearing rules the
code follows (the three write paths, the op model, the trust boundary, signatures, the catalog seam).

🤖 Generated with Claude Code