@hachej/boring-core 0.1.48 → 0.1.50

package/dist/server/index.d.ts

@@ -1,17 +1,17 @@
-import { L as LoadConfigOptions } from '../authHook-DtzhSmqS.js';
-export { A as AuthHookOptions, B as BetterAuthInstance, C as CreateAuthOptions, a as authHook, b as buildRuntimeConfigPayload, c as createAuth, l as loadConfig, v as validateConfig, d as validatePasswordStrength } from '../authHook-DtzhSmqS.js';
+import { L as LoadConfigOptions } from '../authHook-BbgCBHjP.js';
+export { A as AuthHookOptions, B as BetterAuthInstance, C as CreateAuthOptions, a as authHook, b as buildRuntimeConfigPayload, c as createAuth, l as loadConfig, v as validateConfig, d as validatePasswordStrength } from '../authHook-BbgCBHjP.js';
 import { z } from 'zod';
-import { C as CoreConfig, M as MemberRole, d as WorkspaceRuntimeResourceSelector, e as WorkspaceRuntimeResource, f as WorkspaceRuntimeResourceInput } from '../types-CWtJ4kgd.js';
+import { C as CoreConfig, M as MemberRole, W as WorkspaceRuntimeResourceSelector, a as WorkspaceRuntimeResource, b as WorkspaceRuntimeResourceInput } from '../types-Bb7I-83I.js';
 import * as fastify from 'fastify';
 import { FastifyInstance, FastifyPluginAsync, preHandlerHookHandler, FastifyRequest, FastifyReply } from 'fastify';
 import * as http from 'http';
 import { IncomingMessage } from 'node:http';
-import { C as CreateCoreAppOptions, D as Database, U as UserStore, W as WorkspaceStore, a as WorkspaceProvisioner } from '../connection-C5SiqoNc.js';
-export { A as AuthProvider, b as CapabilitiesContributor, P as ProvisionContext, d as ProvisionResult, c as createDatabase } from '../connection-C5SiqoNc.js';
+import { C as CreateCoreAppOptions, D as Database, U as UserStore, W as WorkspaceStore, a as WorkspaceProvisioner } from '../connection-B1iC6B-w.js';
+export { A as AuthProvider, b as CapabilitiesContributor, P as ProvisionContext, c as ProvisionResult, d as createDatabase } from '../connection-B1iC6B-w.js';
 import postgres from 'postgres';
-import { P as PostgresMeteringStore, C as CreditLedgerEntry } from '../PostgresMeteringStore-DhOVVtau.js';
-export { F as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, R as RecordUsageInput, a as RecordUsageResult, b as ReservationFinalStatus, c as ReserveInput, d as ReserveResult, r as runMigrations } from '../PostgresMeteringStore-DhOVVtau.js';
-import { TelemetrySink } from '../shared/index.js';
+import { P as PostgresMeteringStore, C as CreditLedgerEntry } from '../PostgresMeteringStore-qjKGmVFr.js';
+export { F as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, R as RecordUsageInput, a as RecordUsageResult, b as ReservationFinalStatus, c as ReserveInput, d as ReserveResult, r as runMigrations } from '../PostgresMeteringStore-qjKGmVFr.js';
+import { T as TelemetrySink } from '../telemetry-DR18MeI0.js';
 import { AgentMeteringSink } from '@hachej/boring-agent/server';
 import 'better-auth';
 import 'drizzle-orm/postgres-js';
@@ -166,23 +166,6 @@ declare const coreConfigSchema: z.ZodObject<{
         inviteTtlDays?: number | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
-    appId: string;
-    appName: string;
-    appLogo: string | null;
-    port: number;
-    host: string;
-    staticDir: string | null;
-    databaseUrl: string | null;
-    stores: "postgres" | "local";
-    cors: {
-        origins: string[];
-        credentials: true;
-    };
-    bodyLimit: number;
-    logLevel: "error" | "fatal" | "warn" | "info" | "debug" | "trace";
-    encryption: {
-        workspaceSettingsKey: string;
-    };
     auth: {
         secret: string;
         url: string;
@@ -201,6 +184,23 @@ declare const coreConfigSchema: z.ZodObject<{
             transportUrl: string;
         } | undefined;
     };
+    appId: string;
+    appName: string;
+    appLogo: string | null;
+    port: number;
+    host: string;
+    staticDir: string | null;
+    databaseUrl: string | null;
+    stores: "postgres" | "local";
+    cors: {
+        origins: string[];
+        credentials: true;
+    };
+    bodyLimit: number;
+    logLevel: "error" | "fatal" | "warn" | "info" | "debug" | "trace";
+    encryption: {
+        workspaceSettingsKey: string;
+    };
     features: {
         githubOauth: boolean;
         googleOauth: boolean;
@@ -219,23 +219,6 @@ declare const coreConfigSchema: z.ZodObject<{
         };
     } | undefined;
 }, {
-    appId: string;
-    appName: string;
-    appLogo: string | null;
-    port: number;
-    host: string;
-    staticDir: string | null;
-    databaseUrl: string | null;
-    stores: "postgres" | "local";
-    cors: {
-        origins: string[];
-        credentials: true;
-    };
-    bodyLimit: number;
-    logLevel: "error" | "fatal" | "warn" | "info" | "debug" | "trace";
-    encryption: {
-        workspaceSettingsKey: string;
-    };
     auth: {
         secret: string;
         url: string;
@@ -254,6 +237,23 @@ declare const coreConfigSchema: z.ZodObject<{
             transportUrl: string;
         } | undefined;
     };
+    appId: string;
+    appName: string;
+    appLogo: string | null;
+    port: number;
+    host: string;
+    staticDir: string | null;
+    databaseUrl: string | null;
+    stores: "postgres" | "local";
+    cors: {
+        origins: string[];
+        credentials: true;
+    };
+    bodyLimit: number;
+    logLevel: "error" | "fatal" | "warn" | "info" | "debug" | "trace";
+    encryption: {
+        workspaceSettingsKey: string;
+    };
     features: {
         githubOauth: boolean;
         googleOauth: boolean;
@@ -533,16 +533,21 @@ interface CreditsConfig {
     /** Days until the signup grant expires; null = never. */
     signupGrantExpiresAfterDays: number | null;
     /**
-     * Per-run hold, in credit micros. This is the per-run overdraft bound: a run
-     * is admitted against this hold, but the actual charge is posted afterward, so
-     * a single run can overshoot the hold by (actualCost − hold). Set this to
-     * cover your worst-case single run (max tokens on the priciest enabled model)
-     * so the hard stop is effectively exact.
+     * Per-run hold, in credit micros. This is the per-run fallback-charge / usage
+     * budget: the actual charge is posted afterward, so a single run can overshoot
+     * the hold by (actualCost − hold).
      */
     runReservationMicros: number;
     reservationTtlSeconds: number;
-    /** Floor below which a run is refused. */
+    /** Floor kept available after placing the hold when runAdmissionMicros is unset. */
     minBalanceMicros: number;
+    /**
+     * Available balance required before a run can start. Defaults to
+     * runReservationMicros + minBalanceMicros for the conservative no-debt posture.
+     * Apps may set this lower intentionally to let users spend down to a product
+     * threshold, accepting bounded recoverable debt for low-balance runs.
+     */
+    runAdmissionMicros?: number;
     pricing: CreditPricingConfig;
 }
 declare const DEFAULT_CREDITS_CONFIG: CreditsConfig;

package/dist/server/index.js

@@ -24,20 +24,21 @@ import {
   requireWorkspaceMember,
   validateConfig,
   validatePasswordStrength
-} from "../chunk-6GAQRQKO.js";
+} from "../chunk-ZMS6O4CY.js";
 import {
   InsufficientCreditError,
   PostgresMeteringStore,
   createDatabase,
   runMigrations
-} from "../chunk-FZC3VL5D.js";
+} from "../chunk-BVZ2YT3M.js";
 import {
   noopTelemetry,
   safeCapture
 } from "../chunk-AQBXNPMD.js";
+import "../chunk-I4PGL4ZD.js";
 import {
   ERROR_CODES
-} from "../chunk-LIBHVT7V.js";
+} from "../chunk-QZGYKLXB.js";
 import "../chunk-MLKGABMK.js";
 
 // src/server/security/safeRedirect.ts
@@ -254,6 +255,7 @@ var CreditsService = class {
     if (!nonNegInt(config.signupGrantMicros)) throw new Error("credits: signupGrantMicros must be a non-negative safe integer");
     if (!posInt(config.runReservationMicros)) throw new Error("credits: runReservationMicros must be a positive safe integer");
     if (!nonNegInt(config.minBalanceMicros)) throw new Error("credits: minBalanceMicros must be a non-negative safe integer");
+    if (config.runAdmissionMicros !== void 0 && !nonNegInt(config.runAdmissionMicros)) throw new Error("credits: runAdmissionMicros must be a non-negative safe integer");
     if (!posInt(config.reservationTtlSeconds)) throw new Error("credits: reservationTtlSeconds must be a positive safe integer");
     if (!Number.isSafeInteger(config.runReservationMicros + config.minBalanceMicros)) {
       throw new Error("credits: runReservationMicros + minBalanceMicros exceeds the safe integer range");
@@ -362,9 +364,9 @@ var CreditsService = class {
         source: "pi-chat",
         amountMicros: this.config.runReservationMicros,
         ttlSeconds: this.config.reservationTtlSeconds,
-        // Must keep minBalanceMicros available AFTER placing the hold, so a run
-        // is admitted only when available ≥ hold + floor (matches the config doc).
-        minAvailableMicros: this.config.runReservationMicros + this.config.minBalanceMicros
+        // Conservative default is hold + floor; apps can explicitly lower this
+        // threshold with runAdmissionMicros to allow bounded-debt low-balance runs.
+        minAvailableMicros: this.config.runAdmissionMicros ?? this.config.runReservationMicros + this.config.minBalanceMicros
       });
       if (created) safeCapture(this.telemetry, { name: "run.started", distinctId: input.userId });
       return reservationId;

package/dist/shared/index.d.ts

@@ -1,15 +1,9 @@
-export { g as CapabilitiesResponse, h as ConfigFetchError, i as ConfigValidationError, j as CoreCapabilities, C as CoreConfig, E as ERROR_CODES, k as ErrorCode, H as HttpError, J as JsonValue, M as MemberRole, l as RateLimitEndpointOverride, R as RuntimeConfig, m as SessionPayload, S as SessionState, U as User, W as Workspace, b as WorkspaceInvite, a as WorkspaceMember, c as WorkspaceRuntime } from '../types-CWtJ4kgd.js';
+import { U as User, C as CoreConfig, R as RuntimeConfig } from '../types-Bb7I-83I.js';
+export { g as CapabilitiesResponse, h as ConfigFetchError, i as ConfigValidationError, j as CoreCapabilities, E as ERROR_CODES, k as ErrorCode, H as HttpError, J as JsonValue, M as MemberRole, l as RateLimitEndpointOverride, m as SessionPayload, S as SessionState, c as Workspace, e as WorkspaceInvite, d as WorkspaceMember, f as WorkspaceRuntime } from '../types-Bb7I-83I.js';
+export { a as TelemetryEvent, T as TelemetrySink, n as noopTelemetry, s as safeCapture } from '../telemetry-DR18MeI0.js';
 
-interface TelemetrySink {
-    capture(event: TelemetryEvent): void | Promise<void>;
-    flush?(): void | Promise<void>;
-}
-interface TelemetryEvent {
-    name: string;
-    distinctId?: string;
-    properties?: Record<string, unknown>;
-}
-declare const noopTelemetry: TelemetrySink;
-declare function safeCapture(telemetry: TelemetrySink, event: TelemetryEvent): void;
+declare function isCoreEmailVerificationEnabled(config: Pick<CoreConfig, 'auth'>): boolean;
+declare function isRuntimeEmailVerificationEnabled(config: Pick<RuntimeConfig, 'features'> | null | undefined): boolean;
+declare function canUseProtectedApi(user: Pick<User, 'emailVerified'> | null | undefined, requireEmailVerification: boolean): boolean;
 
-export { type TelemetryEvent, type TelemetrySink, noopTelemetry, safeCapture };
+export { CoreConfig, RuntimeConfig, User, canUseProtectedApi, isCoreEmailVerificationEnabled, isRuntimeEmailVerificationEnabled };

package/dist/shared/index.js

@@ -2,18 +2,26 @@ import {
   noopTelemetry,
   safeCapture
 } from "../chunk-AQBXNPMD.js";
+import {
+  canUseProtectedApi,
+  isCoreEmailVerificationEnabled,
+  isRuntimeEmailVerificationEnabled
+} from "../chunk-I4PGL4ZD.js";
 import {
   ConfigFetchError,
   ConfigValidationError,
   ERROR_CODES,
   HttpError
-} from "../chunk-LIBHVT7V.js";
+} from "../chunk-QZGYKLXB.js";
 import "../chunk-MLKGABMK.js";
 export {
   ConfigFetchError,
   ConfigValidationError,
   ERROR_CODES,
   HttpError,
+  canUseProtectedApi,
+  isCoreEmailVerificationEnabled,
+  isRuntimeEmailVerificationEnabled,
   noopTelemetry,
   safeCapture
 };

package/dist/telemetry-DR18MeI0.d.ts

@@ -0,0 +1,13 @@
+interface TelemetrySink {
+    capture(event: TelemetryEvent): void | Promise<void>;
+    flush?(): void | Promise<void>;
+}
+interface TelemetryEvent {
+    name: string;
+    distinctId?: string;
+    properties?: Record<string, unknown>;
+}
+declare const noopTelemetry: TelemetrySink;
+declare function safeCapture(telemetry: TelemetrySink, event: TelemetryEvent): void;
+
+export { type TelemetrySink as T, type TelemetryEvent as a, noopTelemetry as n, safeCapture as s };

package/dist/{types-CWtJ4kgd.d.ts → types-Bb7I-83I.d.ts}

@@ -3,6 +3,7 @@ declare const ERROR_CODES: {
     readonly FORBIDDEN: "forbidden";
     readonly WEAK_PASSWORD: "weak_password";
     readonly EMAIL_IN_USE: "email_in_use";
+    readonly EMAIL_NOT_VERIFIED: "email_not_verified";
     readonly NOT_MEMBER: "not_member";
     readonly LAST_OWNER: "last_owner";
     readonly INVITE_NOT_FOUND: "invite_not_found";
@@ -239,6 +240,7 @@ interface RuntimeConfig {
         googleOauth: boolean;
         invitesEnabled: boolean;
         sendWelcomeEmail: boolean;
+        emailVerification: boolean;
     };
 }
 type JsonValue = string | number | boolean | null | JsonValue[] | {
@@ -274,4 +276,4 @@ type CapabilitiesResponse = {
     [contributorName: string]: JsonValue | CoreCapabilities | undefined;
 };
 
-export { type CoreConfig as C, ERROR_CODES as E, HttpError as H, type JsonValue as J, type MemberRole as M, type RuntimeConfig as R, type SessionState as S, type User as U, type Workspace as W, type WorkspaceMember as a, type WorkspaceInvite as b, type WorkspaceRuntime as c, type WorkspaceRuntimeResourceSelector as d, type WorkspaceRuntimeResource as e, type WorkspaceRuntimeResourceInput as f, type CapabilitiesResponse as g, ConfigFetchError as h, ConfigValidationError as i, type CoreCapabilities as j, type ErrorCode as k, type RateLimitEndpointOverride as l, type SessionPayload as m };
+export { type CoreConfig as C, ERROR_CODES as E, HttpError as H, type JsonValue as J, type MemberRole as M, type RuntimeConfig as R, type SessionState as S, type User as U, type WorkspaceRuntimeResourceSelector as W, type WorkspaceRuntimeResource as a, type WorkspaceRuntimeResourceInput as b, type Workspace as c, type WorkspaceMember as d, type WorkspaceInvite as e, type WorkspaceRuntime as f, type CapabilitiesResponse as g, ConfigFetchError as h, ConfigValidationError as i, type CoreCapabilities as j, type ErrorCode as k, type RateLimitEndpointOverride as l, type SessionPayload as m };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-core",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "type": "module",
   "license": "MIT",
   "description": "Foundation package for boring-ui-v2 apps: DB, auth, config, HTTP app factory, and frontend app shell.",
@@ -79,9 +79,9 @@
     "react-router-dom": "^7.14.2",
     "smol-toml": "^1.6.1",
     "zod": "^3.25.76",
-    "@hachej/boring-agent": "0.1.48",
-    "@hachej/boring-ui-kit": "0.1.48",
-    "@hachej/boring-workspace": "0.1.48"
+    "@hachej/boring-agent": "0.1.50",
+    "@hachej/boring-ui-kit": "0.1.50",
+    "@hachej/boring-workspace": "0.1.50"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",
@@ -113,7 +113,8 @@
     }
   },
   "scripts": {
-    "build": "tsup && cp src/front/theme.css dist/front/theme.css && mkdir -p dist/app/front && cp src/app/front/styles.css dist/app/front/styles.css",
+    "build": "tsup && pnpm run build:assert",
+    "build:assert": "node ./scripts/assert-build-artifacts.mjs",
     "dev": "tsup --watch",
     "test": "vitest run --no-file-parallelism",
     "test:watch": "vitest",