@ganju/utils 0.0.6 → 0.0.9

package/dist/attachment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachment.d.ts","sourceRoot":"","sources":["../src/attachment.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,uBAAuB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC5B,UAAU,kBAAkB,EAC5B,YAAY,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,EACxD,OAAM,QAAQ,GAAG,QAAmB,KACnC,OAAO,CAAC,uBAAuB,CAiDjC,CAAC"}
+{"version":3,"file":"attachment.d.ts","sourceRoot":"","sources":["../src/attachment.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC5B,UAAU,kBAAkB,EAC5B,YAAY,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,EACxD,OAAM,QAAQ,GAAG,QAAmB,KACnC,OAAO,CAAC,uBAAuB,CAiDjC,CAAC"}

package/dist/chunking.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chunking.d.ts","sourceRoot":"","sources":["../src/chunking.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AASpE,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,aAAY,SAAS,SAAS,EAA+B,KAC5D,MAAM,EA4BR,CAAC;AAEF,eAAO,MAAM,SAAS,GACpB,MAAM,MAAM,EACZ,UAAU;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KACxD,MAAM,EAeR,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,OAAO;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,KAAG,MASW,CAAC;AAEhB,MAAM,WAAW,aAAc,SAAQ,yBAAyB;IAC9D,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;CAChC;AAED,eAAO,MAAM,aAAa,GACxB,QAAQ,MAAM,EACd,WAAW,iBAAiB,EAAE,GAAG,IAAI,EACrC,iBAAiB,MAAM,GAAG,IAAI,EAC9B,UAAU;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KACxD,aAAa,EA4Bf,CAAC"}
+{"version":3,"file":"chunking.d.ts","sourceRoot":"","sources":["../src/chunking.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AASpE,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,aAAY,SAAS,SAAS,EAA+B,KAC5D,MAAM,EA8BR,CAAC;AAEF,eAAO,MAAM,SAAS,GACpB,MAAM,MAAM,EACZ,UAAU;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KACxD,MAAM,EAeR,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,OAAO;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,KAAG,MASW,CAAC;AAEhB,MAAM,WAAW,aAAc,SAAQ,yBAAyB;IAC9D,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;CAChC;AAED,eAAO,MAAM,aAAa,GACxB,QAAQ,MAAM,EACd,WAAW,iBAAiB,EAAE,GAAG,IAAI,EACrC,iBAAiB,MAAM,GAAG,IAAI,EAC9B,UAAU;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KACxD,aAAa,EAgCf,CAAC"}

package/dist/chunking.js

@@ -29,7 +29,9 @@ const splitRecursive = (text, target, separators = constants_1.constants.CHUNK_S
         }
         if (current)
             chunks.push(current);
-        return chunks.flatMap(chunk => chunk.length > target ? (0, exports.splitRecursive)(chunk, target, separators) : [chunk]);
+        return chunks.flatMap(chunk => chunk.length > target
+            ? (0, exports.splitRecursive)(chunk, target, separators)
+            : [chunk]);
     }
     const chunks = [];
     for (let i = 0; i < text.length; i += target) {
@@ -69,7 +71,9 @@ const prepareChunks = (header, documents, fallbackContent, options) => {
     if (documents && documents.length > 0) {
         const out = [];
         documents.forEach((doc, docIndex) => {
-            const body = (doc.pageContent || '').replace(/[\x00-\x08\x0B\x0C\x0E-\x1F]/g, '').trim();
+            const body = (doc.pageContent || '')
+                .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F]/g, '')
+                .trim();
             if (!body)
                 return;
             const text = docIndex === 0 && header ? `${header}\n\n${body}` : body;
@@ -87,7 +91,9 @@ const prepareChunks = (header, documents, fallbackContent, options) => {
         });
         return out;
     }
-    const body = (fallbackContent || '').replace(/[\x00-\x08\x0B\x0C\x0E-\x1F]/g, '').trim();
+    const body = (fallbackContent || '')
+        .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F]/g, '')
+        .trim();
     const fullText = [header, body].filter(Boolean).join('\n\n');
     return (0, exports.chunkText)(fullText, options).map(content => ({
         content,

package/dist/coerce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coerce.d.ts","sourceRoot":"","sources":["../src/coerce.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,KAAG,MAAM,EAQpD,CAAC"}
+{"version":3,"file":"coerce.d.ts","sourceRoot":"","sources":["../src/coerce.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,KAAG,MAAM,EAWpD,CAAC"}

package/dist/coerce.js

@@ -6,7 +6,10 @@ const toStringArray = (input) => {
         return input.map(s => String(s).trim()).filter(Boolean);
     }
     if (typeof input === 'string' && input.trim()) {
-        return input.split(',').map(s => s.trim()).filter(Boolean);
+        return input
+            .split(',')
+            .map(s => s.trim())
+            .filter(Boolean);
     }
     return [];
 };

package/dist/constants.d.ts

@@ -55,6 +55,8 @@ interface PlanLimits {
     canUseCustomLlm: boolean;
     canUseCustomCode: boolean;
     maxHttpEndpointsPerArtifact: number | null;
+    includedToolCalls: number;
+    toolCallHardCap: number | null;
     includedMessages: number;
     includedEmbeddedBytes: number;
 }
@@ -85,6 +87,9 @@ export declare const constants: {
     PRICING_INCLUDED_EMBEDDED_GB: number;
     PRICING_MESSAGE_PER_1K_USD: number;
     PRICING_EMBEDDED_PER_GB_USD: number;
+    PRICING_INCLUDED_TOOL_CALLS: number;
+    PRICING_TOOL_CALL_PER_M_USD: number;
+    PRICING_TOOL_CALL_HARD_CAP: number;
     PRICING_CUSTOM_DOMAIN_USD: number;
     PLAN_FEATURE_ORGANIZATION: "organization";
     PLAN_FEATURE_PROJECT: "project";
@@ -98,10 +103,17 @@ export declare const constants: {
     PLAN_FEATURE_RAW_STORAGE: "rawStorage";
     PLAN_FEATURE_EMBEDDED_STORAGE: "embeddedStorage";
     PLAN_FEATURE_MESSAGE: "message";
+    PLAN_FEATURE_TOOL_CALL: "toolCall";
     PLAN_LIMIT_ERROR_CODE: string;
-    STRIPE_METER_MESSAGES: string;
-    STRIPE_METER_SHARED_MESSAGES: string;
-    STRIPE_METER_EMBEDDED: string;
+    BILLING_METER_MESSAGES: string;
+    BILLING_METER_SHARED_MESSAGES: string;
+    BILLING_METER_EMBEDDED: string;
+    BILLING_METER_TOOL_CALLS: string;
+    BILLING_METER_UNITS_KEY: string;
+    POLAR_API_BASE: string;
+    POLAR_SANDBOX_API_BASE: string;
+    POLAR_SERVER_SANDBOX: "sandbox";
+    POLAR_SERVER_PRODUCTION: "production";
     CONSENT_DOCUMENT_TERMS: "terms";
     CONSENT_DOCUMENT_PRIVACY: "privacy";
     CONSENT_DOCUMENTS: ("terms" | "privacy")[];
@@ -120,6 +132,15 @@ export declare const constants: {
     CRON_HOURLY: string;
     CRON_ERROR_ALERTS: string;
     ALERT_STATE_KEY_ERROR_LOG: string;
+    ALERT_STATE_KEY_TOOL_CALLS: string;
+    ALERT_TOOL_CALL_SURGE: number;
+    ALERT_TOOL_CALL_CAP_FRACTION: number;
+    ALERT_TOOL_CALL_COOLDOWN_HOURS: number;
+    ALERT_TOOL_CALL_MAX_ROWS: number;
+    CONTAINMENT_TOKEN_VERSION: string;
+    CONTAINMENT_PURPOSE_DISABLE_CUSTOM_CODE: string;
+    CONTAINMENT_TOKEN_TTL_MS: number;
+    CONTAINMENT_PATH: string;
     ALERT_MIN_STATUS: number;
     ALERT_MAX_ROWS: number;
     ALERT_MAX_GROUPS: number;
@@ -341,6 +362,9 @@ export declare const constants: {
         model: string;
         label: string;
     }[];
+    LLM_CATALOG_CUSTOM_KEY: string;
+    LLM_BASE_URL_REQUIRED_MESSAGE: string;
+    LLM_BASE_URL_INVALID_MESSAGE: string;
     LLM_SYSTEM_DEFAULT: string;
     MAX_TOOL_LOOPS: number;
     CHANNEL_HISTORY_LIMIT: number;

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AA6JA,QAAA,MAAM,yBAAyB,EAAiB,UAAU,CAAC;AAC3D,QAAA,MAAM,+BAA+B,EAAuB,gBAAgB,CAAC;AAC7E,QAAA,MAAM,8BAA8B,EAAsB,eAAe,CAAC;AAC1E,QAAA,MAAM,wBAAwB,EAAgB,SAAS,CAAC;AAuCxD,QAAA,MAAM,sBAAsB,EAAiB,UAAU,CAAC;AACxD,QAAA,MAAM,4BAA4B,EAAuB,gBAAgB,CAAC;AAC1E,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAClD,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAmYlD,QAAA,MAAM,sBAAsB,EAAkB,WAAW,CAAC;AAC1D,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAGjD,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAkTjD,MAAM,MAAM,mBAAmB,GAC3B;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAk9BpE,UAAU,UAAU;IAElB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAMjC,sBAAsB,EAAE,MAAM,CAAC;IAM/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IAKnB,eAAe,EAAE,OAAO,CAAC;IAOzB,gBAAgB,EAAE,OAAO,CAAC;IAK1B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAqKD,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA94DhB,OAAO,yBAAyB,GAChC,OAAO,+BAA+B,GACtC,OAAO,8BAA8B,GACrC,OAAO,wBAAwB;eAC5B,MAAM;;;;;;;;;;;;;;;;;;eAsCT,OAAO,sBAAsB,GAC7B,OAAO,4BAA4B,GACnC,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB;eACxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6YT,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,sBAAsB;eAC1B,MAAM;eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6NwB,MAAM,GAAG,MAAM;cAAQ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmyDnE,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AA6JA,QAAA,MAAM,yBAAyB,EAAiB,UAAU,CAAC;AAC3D,QAAA,MAAM,+BAA+B,EAAuB,gBAAgB,CAAC;AAC7E,QAAA,MAAM,8BAA8B,EAAsB,eAAe,CAAC;AAC1E,QAAA,MAAM,wBAAwB,EAAgB,SAAS,CAAC;AAuCxD,QAAA,MAAM,sBAAsB,EAAiB,UAAU,CAAC;AACxD,QAAA,MAAM,4BAA4B,EAAuB,gBAAgB,CAAC;AAC1E,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAClD,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAmYlD,QAAA,MAAM,sBAAsB,EAAkB,WAAW,CAAC;AAC1D,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAGjD,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAqUjD,MAAM,MAAM,mBAAmB,GAC3B;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AA2+BpE,UAAU,UAAU;IAElB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAMjC,sBAAsB,EAAE,MAAM,CAAC;IAM/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IAKnB,eAAe,EAAE,OAAO,CAAC;IAOzB,gBAAgB,EAAE,OAAO,CAAC;IAK1B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAQ3C,iBAAiB,EAAE,MAAM,CAAC;IAM1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAG/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAiPD,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAphEhB,OAAO,yBAAyB,GAChC,OAAO,+BAA+B,GACtC,OAAO,8BAA8B,GACrC,OAAO,wBAAwB;eAC5B,MAAM;;;;;;;;;;;;;;;;;;eAsCT,OAAO,sBAAsB,GAC7B,OAAO,4BAA4B,GACnC,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB;eACxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6YT,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,sBAAsB;eAC1B,MAAM;eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgPwB,MAAM,GAAG,MAAM;cAAQ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA46DnE,CAAC"}

package/dist/constants.js

@@ -496,8 +496,8 @@ const DEFAULT_LLM_SYSTEM_PROMPT = 'You are a helpful assistant. Answer the user
 const LLM_CATALOG = [
     {
         provider: LLM_PROVIDER_GOOGLE,
-        model: 'gemini-3-flash-preview',
-        label: 'Gemini 3 Flash'
+        model: 'gemini-3.8-flash',
+        label: 'Gemini 3.8 Flash'
     },
     {
         provider: LLM_PROVIDER_GOOGLE,
@@ -506,13 +506,13 @@ const LLM_CATALOG = [
     },
     {
         provider: LLM_PROVIDER_OPENAI,
-        model: 'gpt-4o-mini',
-        label: 'GPT-4o mini'
+        model: 'gpt-5.4-mini',
+        label: 'GPT-5.4 mini'
     },
     {
         provider: LLM_PROVIDER_OPENAI,
-        model: 'gpt-4o',
-        label: 'GPT-4o'
+        model: 'gpt-5.5',
+        label: 'GPT-5.5'
     },
     {
         provider: LLM_PROVIDER_ANTHROPIC,
@@ -521,15 +521,30 @@ const LLM_CATALOG = [
     },
     {
         provider: LLM_PROVIDER_ANTHROPIC,
-        model: 'claude-sonnet-4-6',
-        label: 'Claude Sonnet 4.6'
+        model: 'claude-sonnet-5',
+        label: 'Claude Sonnet 5'
     },
     {
         provider: LLM_PROVIDER_ANTHROPIC,
-        model: 'claude-opus-4.7',
-        label: 'Claude Sonnet 4.7'
+        model: 'claude-opus-5',
+        label: 'Claude Opus 5'
     }
 ];
+// The picker's escape hatch. Anything that speaks the OpenAI chat-completions
+// protocol — a gateway, an aggregator, a self-hosted server — is reachable
+// without a catalog row: the customer supplies the model id and the base URL,
+// and the request goes out through the OpenAI adapter. Not a provider value, so
+// it can never reach the database; the dashboard translates it into
+// LLM_PROVIDER_OPENAI_COMPATIBLE on submit.
+const LLM_CATALOG_CUSTOM_KEY = 'custom';
+// Validation messages for an organization LLM's base URL. Constants rather than
+// inline strings because localizeZodIssue keys its translations on the exact
+// English text, so the two files have to name the same value. Both also carry a
+// word matchStatus recognises ("required", "must be"): the update path re-checks
+// the merged row and throws the message as a plain Error, and anything
+// unrecognised there becomes an opaque 500 instead of a 400.
+const LLM_BASE_URL_REQUIRED_MESSAGE = 'A base URL is required for an OpenAI-compatible model';
+const LLM_BASE_URL_INVALID_MESSAGE = 'Base URL must be a public https:// address';
 const LLM_SYSTEM_DEFAULT = 'SYSTEM_DEFAULT';
 const MAX_TOOL_LOOPS = 8;
 // How many recent messages a channel turn replays as context.
@@ -1540,7 +1555,8 @@ const PLAN_FREE = 'FREE';
 const PLAN_PRO = 'PRO';
 const PLAN_ENTERPRISE = 'ENTERPRISE';
 const PLANS = [PLAN_FREE, PLAN_PRO, PLAN_ENTERPRISE];
-// Mirror Stripe's subscription statuses so the webhook can store them verbatim.
+// The provider's subscription statuses, mirrored so the webhook can store them
+// verbatim.
 const SUBSCRIPTION_STATUS_ACTIVE = 'active';
 const SUBSCRIPTION_STATUS_TRIALING = 'trialing';
 const SUBSCRIPTION_STATUS_PAST_DUE = 'past_due';
@@ -1617,6 +1633,30 @@ const PRICING_SHARED_KEY_HARD_CAP = 100_000;
 // so $2 is now roughly break-even. Raising CHUNK_TARGET_CHARS would tip it
 // positive without touching this number.
 const PRICING_EMBEDDED_PER_GB_USD = 2;
+// Custom-tool invocations included per month, and the rate beyond them.
+//
+// "Tool call" here means one dispatch into a user's own script on Workers for
+// Platforms — NOT a call to a shipped integration or a proxied server. Those
+// cost us one screened fetch from a Worker we already pay for, which is why they
+// stay bundled; this one runs the customer's code on our infrastructure, and is
+// the first cost axis a user can turn against us rather than merely consume.
+//
+// Cloudflare bills the whole chain (dispatcher → user script → outbound worker)
+// as ONE request and counts CPU across all three, so a call costs ~$2.30 per
+// million at the per-script CPU ceiling. $5/M is ~2x that, and 1,000,000 is far
+// past any real month: the heaviest worked customer in the cost model makes
+// 800,000, and a single artifact pinned at its rate limit for a full month
+// manages ~2.6 million.
+const PRICING_INCLUDED_TOOL_CALLS = 1_000_000;
+const PRICING_TOOL_CALL_PER_M_USD = 5;
+// Abuse backstop on custom-tool invocations — the compute analogue of
+// PRICING_SHARED_KEY_HARD_CAP, and needed for the same reason: past a point,
+// usage stops looking like a customer and starts looking like a runaway loop or
+// a stolen credential. 20x the included allowance is ~$46 of compute against
+// ~$95 billed, and takes eight artifacts held at their rate limit for a month to
+// reach. Enterprise is null — the cost model's own enterprise example makes 20
+// million calls a month, so a fixed ceiling there would fight a real customer.
+const PRICING_TOOL_CALL_HARD_CAP = 20_000_000;
 const PRICING_CUSTOM_DOMAIN_USD = 15;
 const PLAN_LIMITS = {
     FREE: {
@@ -1642,6 +1682,15 @@ const PLAN_LIMITS = {
         canUseCustomLlm: false,
         canUseCustomCode: false,
         maxHttpEndpointsPerArtifact: 3,
+        // Free can't deploy custom code, so the only way to have a running script on
+        // this plan is to have DOWNGRADED with one already published — a paid org
+        // keeps its versions and their bundles. Those tools go on serving, because
+        // killing a customer's live integrations the moment a card fails is a worse
+        // failure than serving a bounded number of calls while they fix it. This is
+        // that bound: real breathing room, ~$0.02 of compute, and no overage path
+        // off Free to turn it into a bill.
+        includedToolCalls: 0,
+        toolCallHardCap: 10_000,
         includedMessages: 100,
         includedEmbeddedBytes: 5 * MB
     },
@@ -1663,6 +1712,8 @@ const PLAN_LIMITS = {
         canUseCustomLlm: true,
         canUseCustomCode: true,
         maxHttpEndpointsPerArtifact: null,
+        includedToolCalls: PRICING_INCLUDED_TOOL_CALLS,
+        toolCallHardCap: PRICING_TOOL_CALL_HARD_CAP,
         includedMessages: PRICING_INCLUDED_MESSAGES,
         includedEmbeddedBytes: PRICING_INCLUDED_EMBEDDED_GB * GB
     },
@@ -1680,6 +1731,12 @@ const PLAN_LIMITS = {
         canUseCustomLlm: true,
         canUseCustomCode: true,
         maxHttpEndpointsPerArtifact: null,
+        includedToolCalls: PRICING_INCLUDED_TOOL_CALLS,
+        // No backstop: an Enterprise contract is negotiated against real volume, and
+        // the reference deal in the cost model runs 20 million calls a month — the
+        // exact number a Pro-shaped ceiling would refuse. Raise the ceiling by
+        // contract; don't make one plan's abuse limit another plan's product limit.
+        toolCallHardCap: null,
         includedMessages: PRICING_INCLUDED_MESSAGES,
         includedEmbeddedBytes: PRICING_INCLUDED_EMBEDDED_GB * GB
     }
@@ -1698,19 +1755,42 @@ const PLAN_FEATURE_HTTP_ENDPOINT = 'httpEndpoint';
 const PLAN_FEATURE_RAW_STORAGE = 'rawStorage';
 const PLAN_FEATURE_EMBEDDED_STORAGE = 'embeddedStorage';
 const PLAN_FEATURE_MESSAGE = 'message';
+const PLAN_FEATURE_TOOL_CALL = 'toolCall';
 // Stable code returned on a quota block so clients can branch on it (402).
 const PLAN_LIMIT_ERROR_CODE = 'PLAN_LIMIT_EXCEEDED';
-// Stripe Billing Meter event names. The metering cron reports per-period
-// OVERAGE (usage above the plan's included allowance) to these meters; the
-// meters' prices on the subscription turn that into charges. Embedded storage
-// is reported in whole MB, messages as a raw count.
+// Billing meter event names. The metering cron reports per-period OVERAGE
+// (usage above the plan's included allowance) to these meters; the meters'
+// prices on the subscribed product turn that into charges. Embedded storage is
+// reported in whole MB, messages as a raw count.
+//
+// Each name must match the filter on its meter exactly. A mismatch is not an
+// error at either end — the event is accepted, matches no meter, and the usage
+// is silently unbilled.
 //
 // Messages report to two separate meters because the two kinds of turn bill at
 // different rates — a turn on the org's own key is a platform fee, a turn on our
 // model is inference we bought. One meter can't price both.
-const STRIPE_METER_MESSAGES = 'ganju_channel_messages';
-const STRIPE_METER_SHARED_MESSAGES = 'ganju_shared_messages';
-const STRIPE_METER_EMBEDDED = 'ganju_embedded_storage';
+const BILLING_METER_MESSAGES = 'ganju_channel_messages';
+const BILLING_METER_SHARED_MESSAGES = 'ganju_shared_messages';
+const BILLING_METER_EMBEDDED = 'ganju_embedded_storage';
+// Custom-tool invocations, reported as a raw count of the calls above the
+// included allowance and priced per call at $5/1,000,000. Metered prices are
+// per single unit, so a partial block is billed as the fraction it is — a
+// customer 2.5 million past the allowance owes $12.50, which is what every page
+// of ours quotes.
+const BILLING_METER_TOOL_CALLS = 'ganju_custom_tool_calls';
+// The metadata property every meter aggregates (`sum` over it). Ingested events
+// carry the increment under this key, so it has to agree with the aggregation
+// configured on all four meters — which is why it lives beside their names
+// rather than at the call site.
+const BILLING_METER_UNITS_KEY = 'units';
+// Polar API hosts. Sandbox is a separate host rather than a mode flag, so the
+// account, products, meters and webhook secret there are all distinct from
+// production's — which is what `POLAR_SERVER` selects between.
+const POLAR_API_BASE = 'https://api.polar.sh';
+const POLAR_SANDBOX_API_BASE = 'https://sandbox-api.polar.sh';
+const POLAR_SERVER_SANDBOX = 'sandbox';
+const POLAR_SERVER_PRODUCTION = 'production';
 // Legal documents a user accepts, and the version they're on. Bump the version
 // when the document changes materially — existing users are then re-prompted,
 // and the old acceptance stays on record. Keep in sync with the "Last updated"
@@ -1718,7 +1798,7 @@ const STRIPE_METER_EMBEDDED = 'ganju_embedded_storage';
 const CONSENT_DOCUMENT_TERMS = 'terms';
 const CONSENT_DOCUMENT_PRIVACY = 'privacy';
 const CONSENT_DOCUMENTS = [CONSENT_DOCUMENT_TERMS, CONSENT_DOCUMENT_PRIVACY];
-const CONSENT_CURRENT_VERSION = '2026-08-01';
+const CONSENT_CURRENT_VERSION = '2026-09-10';
 const CONSENT_SOURCE_SIGNUP = 'signup';
 const CONSENT_SOURCE_REACCEPT = 'reaccept';
 const CONSENT_SOURCES = [CONSENT_SOURCE_SIGNUP, CONSENT_SOURCE_REACCEPT];
@@ -1753,6 +1833,39 @@ const RETENTION_EXPIRED_SESSION_DAYS = 30;
 const CRON_HOURLY = '0 * * * *';
 const CRON_ERROR_ALERTS = '*/15 * * * *';
 const ALERT_STATE_KEY_ERROR_LOG = 'error_log';
+// Custom-tool usage alerting, keyed per organization as `tool_calls:<id>`. The
+// monthly hard cap bounds what abuse can spend; these thresholds are what say
+// something is happening NOW, while there is still a month left to spend.
+const ALERT_STATE_KEY_TOOL_CALLS = 'tool_calls';
+// Calls in a single hour. The per-tool rate limit allows 3,600/hour, and a month
+// of the included million sustained is ~1,370/hour — so five figures in one hour
+// is either many artifacts at full tilt or something that should be looked at.
+const ALERT_TOOL_CALL_SURGE = 10_000;
+// The share of the abuse backstop at which the wall is close enough to warn
+// about. Half a month's ceiling reached is worth an email even if the rate is
+// unremarkable, because the alternative is a customer meeting it silently.
+const ALERT_TOOL_CALL_CAP_FRACTION = 0.5;
+// How long to stay quiet about one organization after alerting on it. Without
+// this a busy month is an hourly email, and an hourly email is a muted one.
+const ALERT_TOOL_CALL_COOLDOWN_HOURS = 6;
+// Organizations itemised in one digest.
+const ALERT_TOOL_CALL_MAX_ROWS = 25;
+// The "stop these tools" link the usage digest carries.
+//
+// It exists because the alert travels and the response did not: every other
+// containment step needs a shell holding the production database URL, so an
+// abuse notice arriving away from a desk was one nobody could act on for hours.
+//
+// Narrow on purpose. It disables the organization's custom-code installs — the
+// tools stop registering at boot, the code, versions and settings all survive,
+// and any owner can switch them back on. It cannot delete a script, touch a
+// credential, or reach anything else.
+const CONTAINMENT_TOKEN_VERSION = '1';
+const CONTAINMENT_PURPOSE_DISABLE_CUSTOM_CODE = 'disable-custom-code';
+// Long enough to still work when the mail is read a few hours late, short enough
+// that a forwarded thread or an archived inbox is not a way in.
+const CONTAINMENT_TOKEN_TTL_MS = 12 * 60 * 60 * 1000;
+const CONTAINMENT_PATH = '/containment';
 // Only alert on genuine server failures. 4xx rows are expected client errors
 // (validation, not-found, quota) and would drown the signal.
 const ALERT_MIN_STATUS = 500;
@@ -1793,6 +1906,9 @@ exports.constants = {
     PRICING_INCLUDED_EMBEDDED_GB,
     PRICING_MESSAGE_PER_1K_USD,
     PRICING_EMBEDDED_PER_GB_USD,
+    PRICING_INCLUDED_TOOL_CALLS,
+    PRICING_TOOL_CALL_PER_M_USD,
+    PRICING_TOOL_CALL_HARD_CAP,
     PRICING_CUSTOM_DOMAIN_USD,
     PLAN_FEATURE_ORGANIZATION,
     PLAN_FEATURE_PROJECT,
@@ -1806,10 +1922,17 @@ exports.constants = {
     PLAN_FEATURE_RAW_STORAGE,
     PLAN_FEATURE_EMBEDDED_STORAGE,
     PLAN_FEATURE_MESSAGE,
+    PLAN_FEATURE_TOOL_CALL,
     PLAN_LIMIT_ERROR_CODE,
-    STRIPE_METER_MESSAGES,
-    STRIPE_METER_SHARED_MESSAGES,
-    STRIPE_METER_EMBEDDED,
+    BILLING_METER_MESSAGES,
+    BILLING_METER_SHARED_MESSAGES,
+    BILLING_METER_EMBEDDED,
+    BILLING_METER_TOOL_CALLS,
+    BILLING_METER_UNITS_KEY,
+    POLAR_API_BASE,
+    POLAR_SANDBOX_API_BASE,
+    POLAR_SERVER_SANDBOX,
+    POLAR_SERVER_PRODUCTION,
     CONSENT_DOCUMENT_TERMS,
     CONSENT_DOCUMENT_PRIVACY,
     CONSENT_DOCUMENTS,
@@ -1823,6 +1946,15 @@ exports.constants = {
     CRON_HOURLY,
     CRON_ERROR_ALERTS,
     ALERT_STATE_KEY_ERROR_LOG,
+    ALERT_STATE_KEY_TOOL_CALLS,
+    ALERT_TOOL_CALL_SURGE,
+    ALERT_TOOL_CALL_CAP_FRACTION,
+    ALERT_TOOL_CALL_COOLDOWN_HOURS,
+    ALERT_TOOL_CALL_MAX_ROWS,
+    CONTAINMENT_TOKEN_VERSION,
+    CONTAINMENT_PURPOSE_DISABLE_CUSTOM_CODE,
+    CONTAINMENT_TOKEN_TTL_MS,
+    CONTAINMENT_PATH,
     ALERT_MIN_STATUS,
     ALERT_MAX_ROWS,
     ALERT_MAX_GROUPS,
@@ -2034,6 +2166,9 @@ exports.constants = {
     DEFAULT_LLM_MODEL,
     DEFAULT_LLM_SYSTEM_PROMPT,
     LLM_CATALOG,
+    LLM_CATALOG_CUSTOM_KEY,
+    LLM_BASE_URL_REQUIRED_MESSAGE,
+    LLM_BASE_URL_INVALID_MESSAGE,
     LLM_SYSTEM_DEFAULT,
     MAX_TOOL_LOOPS,
     CHANNEL_HISTORY_LIMIT,

package/dist/containmentToken.d.ts

@@ -0,0 +1,25 @@
+export interface ContainmentTokenPayload {
+    v: string;
+    p: string;
+    organizationId: string;
+    iat: number;
+    exp: number;
+}
+/**
+ * Mint a containment link token for one organization.
+ *
+ * The lifetime is deliberately short. This is not a login: it is a thing you act
+ * on while reading the mail that carried it, and an expiry measured in hours
+ * means a forwarded thread or an archived inbox stops being a way in.
+ */
+export declare const mintContainmentToken: (organizationId: string, secret: string, issuedAt?: number, ttlMs?: number) => Promise<string>;
+/**
+ * Verify a containment token and return its payload, or null when it is
+ * malformed, expired, of an unknown format version, minted for another purpose,
+ * or not signed by this deployment's secret.
+ *
+ * Null rather than a reason, so the page can answer every rejection identically:
+ * a link that says *why* it failed tells whoever found it what to change.
+ */
+export declare const verifyContainmentToken: (token: string, secret: string, now?: number) => Promise<ContainmentTokenPayload | null>;
+//# sourceMappingURL=containmentToken.d.ts.map

package/dist/containmentToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containmentToken.d.ts","sourceRoot":"","sources":["../src/containmentToken.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,uBAAuB;IAGtC,CAAC,EAAE,MAAM,CAAC;IAEV,CAAC,EAAE,MAAM,CAAC;IACV,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAaD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,gBAAgB,MAAM,EACtB,QAAQ,MAAM,EACd,WAAU,MAAmB,EAC7B,QAAO,MAA2C,KACjD,OAAO,CAAC,MAAM,CAoBhB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,MAAK,MAAmB,KACvB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAiDxC,CAAC"}

package/dist/containmentToken.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyContainmentToken = exports.mintContainmentToken = void 0;
+const base64_1 = require("./base64");
+const constants_1 = require("./constants");
+const encoder = new TextEncoder();
+const importKey = (secret) => crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']);
+/**
+ * Mint a containment link token for one organization.
+ *
+ * The lifetime is deliberately short. This is not a login: it is a thing you act
+ * on while reading the mail that carried it, and an expiry measured in hours
+ * means a forwarded thread or an archived inbox stops being a way in.
+ */
+const mintContainmentToken = async (organizationId, secret, issuedAt = Date.now(), ttlMs = constants_1.constants.CONTAINMENT_TOKEN_TTL_MS) => {
+    const body = {
+        v: constants_1.constants.CONTAINMENT_TOKEN_VERSION,
+        p: constants_1.constants.CONTAINMENT_PURPOSE_DISABLE_CUSTOM_CODE,
+        organizationId,
+        iat: Math.floor(issuedAt / 1000),
+        // Rounded up so a stated lifetime is a floor rather than up to a second
+        // short of one.
+        exp: Math.ceil((issuedAt + ttlMs) / 1000)
+    };
+    const encodedPayload = (0, base64_1.toBase64Url)((0, base64_1.bytesToBase64)(encoder.encode(JSON.stringify(body))));
+    const key = await importKey(secret);
+    const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(encodedPayload));
+    return `${encodedPayload}.${(0, base64_1.toBase64Url)((0, base64_1.bytesToBase64)(new Uint8Array(signature)))}`;
+};
+exports.mintContainmentToken = mintContainmentToken;
+/**
+ * Verify a containment token and return its payload, or null when it is
+ * malformed, expired, of an unknown format version, minted for another purpose,
+ * or not signed by this deployment's secret.
+ *
+ * Null rather than a reason, so the page can answer every rejection identically:
+ * a link that says *why* it failed tells whoever found it what to change.
+ */
+const verifyContainmentToken = async (token, secret, now = Date.now()) => {
+    const separator = token.lastIndexOf('.');
+    if (separator <= 0)
+        return null;
+    const encodedPayload = token.slice(0, separator);
+    const signature = token.slice(separator + 1);
+    const key = await importKey(secret);
+    let valid;
+    try {
+        const signatureBytes = new Uint8Array((0, base64_1.base64ToBytes)((0, base64_1.fromBase64Url)(signature)));
+        valid = await crypto.subtle.verify('HMAC', key, signatureBytes, encoder.encode(encodedPayload));
+    }
+    catch {
+        return null;
+    }
+    if (!valid)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode((0, base64_1.base64ToBytes)((0, base64_1.fromBase64Url)(encodedPayload))));
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return null;
+    const candidate = parsed;
+    if (candidate.v !== constants_1.constants.CONTAINMENT_TOKEN_VERSION)
+        return null;
+    if (candidate.p !== constants_1.constants.CONTAINMENT_PURPOSE_DISABLE_CUSTOM_CODE) {
+        return null;
+    }
+    if (typeof candidate.organizationId !== 'string' ||
+        !candidate.organizationId) {
+        return null;
+    }
+    if (typeof candidate.exp !== 'number')
+        return null;
+    if (candidate.exp * 1000 <= now)
+        return null;
+    return candidate;
+};
+exports.verifyContainmentToken = verifyContainmentToken;

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAU/B,eAAO,MAAM,0BAA0B,GAAI,GAAG,OAAO,WAMpD,CAAC;AAYF,eAAO,MAAM,aAAa,GAAI,WAAW,MAAM,EAAE,QAAQ,MAAM,WAS9D,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,WAS1D,CAAC;AAEF,eAAO,MAAM,SAAS,GAAU,OAAO,MAAM,oBAW5C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAU,OAAO,MAAM,oBASlD,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,KAAK,MAAM,EAAE,SAAS,MAAM,oBAmB/D,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,YAOnD,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAU/B,eAAO,MAAM,0BAA0B,GAAI,GAAG,OAAO,WAMpD,CAAC;AAYF,eAAO,MAAM,aAAa,GAAI,WAAW,MAAM,EAAE,QAAQ,MAAM,WAS9D,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,WAS1D,CAAC;AAEF,eAAO,MAAM,SAAS,GAAU,OAAO,MAAM,oBAW5C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAU,OAAO,MAAM,oBAalD,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,KAAK,MAAM,EAAE,SAAS,MAAM,oBAmB/D,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,YAOnD,CAAC"}

package/dist/crypto.js

@@ -67,7 +67,10 @@ const sha256Base64Url = async (input) => {
     let binary = '';
     for (let i = 0; i < bytes.length; i++)
         binary += String.fromCharCode(bytes[i]);
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    return btoa(binary)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
 };
 exports.sha256Base64Url = sha256Base64Url;
 const hmacSha256Hex = async (key, message) => {

package/dist/getEnv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getEnv.d.ts","sourceRoot":"","sources":["../src/getEnv.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;CACzC;AAED,eAAO,MAAM,MAAM,GACjB,QAAQ,SAAS,EACjB,KAAK,MAAM,KACV,MAAM,GAAG,SAKX,CAAC"}
+{"version":3,"file":"getEnv.d.ts","sourceRoot":"","sources":["../src/getEnv.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;CACzC;AAED,eAAO,MAAM,MAAM,GAAI,QAAQ,SAAS,EAAE,KAAK,MAAM,KAAG,MAAM,GAAG,SAKhE,CAAC"}