@hachej/boring-core 0.1.84 → 0.1.85

package/dist/{PostgresModelBudgetStore-CViAvfFy.d.ts → PostgresModelBudgetStore-vDTn1QkE.d.ts}

@@ -1,5 +1,5 @@
 import postgres from 'postgres';
-import { C as CoreConfig } from './types-DKCtYltp.js';
+import { C as CoreConfig } from './types-BIjRgbMV.js';
 import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
 
 type CoreMigrationSql = postgres.Sql;

package/dist/app/front/index.js

@@ -9,12 +9,12 @@ import {
   useSignIn,
   useSignUp,
   useWorkspaceRouteStatus
-} from "../../chunk-6G6Z52VQ.js";
+} from "../../chunk-JLBUXSC5.js";
 import "../../chunk-HYNKZSTF.js";
 import {
   isRuntimeEmailVerificationEnabled
 } from "../../chunk-I4PGL4ZD.js";
-import "../../chunk-VWE46RW4.js";
+import "../../chunk-RTLBMHOB.js";
 import "../../chunk-MLKGABMK.js";
 
 // src/app/front/CoreWorkspaceAgentFront.tsx

package/dist/app/front/publicLaunchPages.css

@@ -0,0 +1,288 @@
+/*
+ * Styling for `PublicLaunchPages` — the tab strip + preview pane apps use to
+ * showcase artifact/calendly/HTML demo pages on the public (no-auth) launch
+ * screen. Brand-agnostic and token-driven so every consumer inherits it
+ * without re-copying the sheet. Imported via the package's `styles.css`
+ * entry.
+ */
+
+.public-pages-pane {
+  display: flex;
+  height: 100%;
+  min-height: 0;
+  flex-direction: column;
+  gap: 8px;
+  padding: 10px;
+  color: var(--foreground);
+}
+
+.public-pages-pane-header {
+  margin-bottom: 8px;
+}
+
+.public-pages-pane-header p {
+  margin: 0 0 6px;
+  color: var(--muted-foreground);
+  font-size: 10px;
+  font-weight: 800;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+}
+
+.public-pages-pane-header h2 {
+  margin: 0;
+  font-size: 18px;
+  letter-spacing: -0.03em;
+}
+
+.public-pages-pane-header span,
+.public-pages-pane-note span {
+  display: block;
+  margin-top: 6px;
+  color: var(--muted-foreground);
+  font-size: 12px;
+  line-height: 1.45;
+}
+
+.public-pages-pane button {
+  display: flex;
+  width: 100%;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 4px;
+  border: 1px solid transparent;
+  border-radius: 10px;
+  background: transparent;
+  color: var(--foreground);
+  cursor: pointer;
+  padding: 9px 11px;
+  text-align: left;
+  transition: background 0.15s ease, border-color 0.15s ease;
+}
+
+.public-pages-pane button strong {
+  font-size: 13px;
+  font-weight: 600;
+  letter-spacing: -0.01em;
+}
+
+.public-pages-pane button:hover {
+  border-color: var(--border);
+  background: var(--muted);
+}
+
+.public-pages-pane button span {
+  color: var(--muted-foreground);
+  font: 600 11.5px/1.3 ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+}
+
+.public-pages-pane-note {
+  margin-top: auto;
+  border: 1px solid var(--border);
+  border-radius: 16px;
+  background: color-mix(in oklch, var(--card) 80%, var(--background));
+  padding: 12px;
+}
+
+.public-html-preview {
+  display: block;
+  width: 100%;
+  height: 100%;
+  min-height: 0;
+  border: 0;
+  background: var(--background);
+}
+
+.public-workspace-tab {
+  min-height: 100%;
+  overflow: auto;
+  padding: 24px;
+  background:
+    radial-gradient(circle at 70% 0%, color-mix(in oklch, var(--primary) 12%, transparent), transparent 34rem),
+    var(--background);
+}
+
+.artifact-header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 20px;
+  margin: 0 auto 22px;
+  max-width: 980px;
+}
+
+.artifact-header p {
+  margin: 0 0 8px;
+  color: var(--muted-foreground);
+  font-size: 11px;
+  font-weight: 800;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+}
+
+.artifact-header h1 {
+  margin: 0;
+  font-size: clamp(32px, 5vw, 56px);
+  line-height: 0.95;
+  letter-spacing: -0.055em;
+}
+
+.artifact-header span {
+  display: block;
+  margin-top: 12px;
+  max-width: 560px;
+  color: var(--muted-foreground);
+  font-size: 15px;
+  line-height: 1.6;
+}
+
+.artifact-header button {
+  border: 1px solid var(--foreground);
+  border-radius: 999px;
+  background: var(--foreground);
+  color: var(--background);
+  cursor: pointer;
+  padding: 11px 16px;
+  font-size: 13px;
+  font-weight: 700;
+}
+
+.artifact-card {
+  margin: 0 auto;
+  max-width: 980px;
+  border: 1px solid var(--border);
+  border-radius: 28px;
+  background: color-mix(in oklch, var(--card) 88%, transparent);
+  box-shadow: 0 24px 80px color-mix(in oklch, var(--foreground) 10%, transparent);
+  padding: clamp(24px, 5vw, 48px);
+}
+
+.artifact-kicker {
+  margin: 0 0 16px;
+  color: var(--muted-foreground);
+  font-size: 12px;
+  font-weight: 800;
+  letter-spacing: 0.16em;
+  text-transform: uppercase;
+}
+
+.artifact-card h2 {
+  margin: 0;
+  max-width: 760px;
+  font-size: clamp(36px, 7vw, 76px);
+  line-height: 0.92;
+  letter-spacing: -0.07em;
+}
+
+.artifact-card p {
+  max-width: 680px;
+  color: var(--muted-foreground);
+  font-size: 17px;
+  line-height: 1.65;
+}
+
+.artifact-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 12px;
+  margin: 28px 0;
+}
+
+.artifact-actions a {
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  padding: 11px 15px;
+  color: var(--foreground);
+  font-size: 13px;
+  font-weight: 700;
+  text-decoration: none;
+}
+
+.artifact-feature-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 12px;
+  margin-top: 30px;
+}
+
+.artifact-feature-grid div {
+  border: 1px solid var(--border);
+  border-radius: 18px;
+  background: var(--background);
+  padding: 16px;
+}
+
+.artifact-feature-grid strong,
+.artifact-feature-grid span {
+  display: block;
+}
+
+.artifact-feature-grid span {
+  margin-top: 8px;
+  color: var(--muted-foreground);
+  font-size: 13px;
+  line-height: 1.45;
+}
+
+.chat-artifact {
+  display: grid;
+  grid-template-columns: minmax(0, 0.85fr) minmax(320px, 1.15fr);
+  gap: 24px;
+  align-items: stretch;
+}
+
+.chat-artifact h2 {
+  font-size: clamp(34px, 5vw, 58px);
+}
+
+.calendly-frame-wrap {
+  min-height: 620px;
+  overflow: hidden;
+  border: 1px solid var(--border);
+  border-radius: 22px;
+  background: var(--background);
+}
+
+.calendly-frame {
+  width: 100%;
+  height: 720px;
+  border: 0;
+}
+
+.calendly-frame-full {
+  display: block;
+  height: 100%;
+  min-height: 760px;
+  background: var(--background);
+}
+
+.calendly-placeholder {
+  display: flex;
+  height: 100%;
+  min-height: 520px;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 10px;
+  padding: 28px;
+  text-align: center;
+}
+
+.calendly-placeholder span {
+  max-width: 360px;
+  color: var(--muted-foreground);
+  font-size: 14px;
+  line-height: 1.5;
+}
+
+@media (max-width: 860px) {
+  .artifact-header,
+  .chat-artifact,
+  .artifact-feature-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .artifact-header {
+    flex-direction: column;
+  }
+}

package/dist/app/front/styles.css

@@ -9,6 +9,23 @@
    its plain rules sit after Tailwind's utilities in the cascade. */
 @import "./chatFirst/chatFirstPublicShell.css";
 
+/* Styling for PublicLaunchPages (artifact/calendly/HTML demo tabs on the
+   public launch screen). Imported last for the same cascade-ordering reason
+   as chatFirstPublicShell.css above. */
+@import "./publicLaunchPages.css";
+
+/* Full-bleed app shell: the React root fills the viewport with no scroll
+   chrome of its own (panes manage their own overflow). Every app-shell
+   consumer needs this, so it ships from the package instead of being
+   copy-pasted per app. */
+html,
+body,
+#root {
+  height: 100%;
+  margin: 0;
+  overflow: hidden;
+}
+
 /* Credit notice CTA renders inside the agent subtree. Keep this selector after
    Tailwind + agent globals so it beats both the Button variant colors and
    [data-boring-agent] button color reset. */

package/dist/app/server/index.d.ts

@@ -2,11 +2,11 @@ import { RuntimeProvisioningContribution, RegisterAgentRoutesOptions } from '@ha
 import { DirPluginEntry, CreateWorkspaceAgentServerOptions, WorkspaceAgentServerPluginContext } from '@hachej/boring-workspace/app/server';
 import { WorkspaceServerPlugin, WorkspaceBridgeOperationDefinition, WorkspaceBridgeHandler, WorkspaceBridgeRuntimeEnvOptions, WorkspaceBridgeCallRequest, WorkspaceBridgeCallResponse } from '@hachej/boring-workspace/server';
 import { FastifyRequest, FastifyReply, FastifyInstance } from 'fastify';
-import { C as CoreConfig } from '../../types-DKCtYltp.js';
+import { C as CoreConfig } from '../../types-BIjRgbMV.js';
 import { T as TelemetrySink } from '../../telemetry-DR18MeI0.js';
-import { B as BetterAuthInstance, L as LoadConfigOptions } from '../../loadConfig-DEG0Tu5n.js';
-import { D as Database, U as UserStore, W as WorkspaceStore, C as CoreRequestScopeResolver } from '../../types-uK6CFlxr.js';
-export { a as CoreRequestScope } from '../../types-uK6CFlxr.js';
+import { B as BetterAuthInstance, L as LoadConfigOptions } from '../../loadConfig-Bw6jtipE.js';
+import { D as Database, U as UserStore, W as WorkspaceStore, C as CoreRequestScopeResolver } from '../../types-C5xuRqmA.js';
+export { a as CoreRequestScope } from '../../types-C5xuRqmA.js';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import 'better-auth';
 import 'drizzle-orm/postgres-js';

package/dist/app/server/index.js

@@ -10,13 +10,13 @@ import {
   registerRoutes,
   registerSettingsRoutes,
   registerWorkspaceRoutes
-} from "../../chunk-MWOZRTRG.js";
+} from "../../chunk-ONZ6UPYK.js";
 import {
   PostgresUserStore,
   PostgresWorkspaceStore,
   createDatabase,
   telemetryEvents
-} from "../../chunk-C4YTZAZC.js";
+} from "../../chunk-WRFEUAG7.js";
 import {
   noopTelemetry,
   safeCapture
@@ -25,7 +25,7 @@ import "../../chunk-I4PGL4ZD.js";
 import {
   ERROR_CODES,
   HttpError
-} from "../../chunk-VWE46RW4.js";
+} from "../../chunk-RTLBMHOB.js";
 import "../../chunk-MLKGABMK.js";
 
 // src/app/server/createCoreWorkspaceAgentServer.ts
@@ -939,11 +939,12 @@ async function createCoreWorkspaceAgentServer(options = {}) {
     admitRuntimeOperation: options.admitEffect ? async (workspaceId) => {
       try {
         await options.admitEffect({ workspaceId, requestId: "workspace-bridge-runtime" });
-      } catch {
+      } catch (error) {
+        const code = typeof error === "object" && error !== null && "code" in error && error.code === ERROR_CODES.D1_ADMISSION_IDENTITY_MISMATCH ? ERROR_CODES.D1_ADMISSION_IDENTITY_MISMATCH : ERROR_CODES.D1_ADMISSION_RECORD_FAILED;
         throw new HttpError({
           status: 500,
-          code: ERROR_CODES.D1_ADMISSION_RECORD_FAILED,
-          message: ERROR_CODES.D1_ADMISSION_RECORD_FAILED
+          code,
+          message: code
         });
       }
     } : void 0

package/dist/{chunk-6G6Z52VQ.js → chunk-JLBUXSC5.js}

@@ -9,7 +9,7 @@ import {
   ConfigFetchError,
   ERROR_CODES,
   HttpError
-} from "./chunk-VWE46RW4.js";
+} from "./chunk-RTLBMHOB.js";
 
 // src/front/AppErrorBoundary.tsx
 import { Component } from "react";

package/dist/{chunk-MWOZRTRG.js → chunk-ONZ6UPYK.js}

@@ -13,7 +13,7 @@ import {
   workspaceRuntimes,
   workspaceSettings,
   workspaces
-} from "./chunk-C4YTZAZC.js";
+} from "./chunk-WRFEUAG7.js";
 import {
   noopTelemetry,
   safeCapture
@@ -25,7 +25,7 @@ import {
   ConfigValidationError,
   ERROR_CODES,
   HttpError
-} from "./chunk-VWE46RW4.js";
+} from "./chunk-RTLBMHOB.js";
 
 // src/server/config/schema.ts
 import { z } from "zod";
@@ -259,10 +259,31 @@ function parseTrustedProxyPolicy(env) {
     }
     return void 0;
   }
-  return {
-    cidrs: (cidrs ?? "").split(",").map((value) => value.trim()),
+  return Object.freeze({
+    cidrs: Object.freeze(
+      (cidrs ?? "").split(",").map((value) => value.trim())
+    ),
     hops: hops !== void 0 && /^[1-8]$/.test(hops) ? Number(hops) : Number.NaN
-  };
+  });
+}
+function readCoreSecurityConfigProjection(env) {
+  const betterAuthUrl = env.BETTER_AUTH_URL ?? `http://localhost:${env.PORT ?? "3000"}`;
+  const corsOriginsRaw = env.CORS_ORIGINS ?? "";
+  const corsOrigins = Object.freeze(
+    corsOriginsRaw ? corsOriginsRaw.split(",").map((origin) => origin.trim()).filter(Boolean) : ["http://localhost:3000", "http://localhost:5173"]
+  );
+  const cspUpgradeInsecureRequests = env.CSP_UPGRADE_INSECURE_REQUESTS !== void 0 ? env.CSP_UPGRADE_INSECURE_REQUESTS === "true" : betterAuthUrl.startsWith("https://");
+  const sessionCookieSecure = env.SESSION_COOKIE_SECURE !== void 0 ? env.SESSION_COOKIE_SECURE === "true" : betterAuthUrl.startsWith("https://");
+  return Object.freeze({
+    host: env.HOST ?? "0.0.0.0",
+    port: parseInt(env.PORT ?? "3000", 10),
+    betterAuthUrl,
+    corsOrigins,
+    cspEnabled: env.CSP_ENABLED !== "false",
+    cspUpgradeInsecureRequests,
+    sessionCookieSecure,
+    trustedProxy: parseTrustedProxyPolicy(env)
+  });
 }
 async function loadConfig(options) {
   const env = options?.env ?? process.env;
@@ -310,13 +331,6 @@ async function loadConfig(options) {
       `[config:insecure-defaults] Using placeholder values for: ${insecureDefaults.join(", ")}. Do NOT use in production.`
     );
   }
-  const authUrl = env.BETTER_AUTH_URL ?? `http://localhost:${env.PORT ?? "3000"}`;
-  const corsOriginsRaw = env.CORS_ORIGINS ?? "";
-  const corsOrigins = corsOriginsRaw ? corsOriginsRaw.split(",").map((s) => s.trim()).filter(Boolean) : ["http://localhost:3000", "http://localhost:5173"];
-  const cspEnabled = env.CSP_ENABLED !== "false";
-  const cspUpgradeInsecureRequests = env.CSP_UPGRADE_INSECURE_REQUESTS !== void 0 ? env.CSP_UPGRADE_INSECURE_REQUESTS === "true" : authUrl.startsWith("https://");
-  const sessionCookieSecureOverride = env.SESSION_COOKIE_SECURE;
-  const sessionCookieSecure = sessionCookieSecureOverride !== void 0 ? sessionCookieSecureOverride === "true" : authUrl.startsWith("https://");
   const githubOauth = toml.features?.github_oauth ?? env.GITHUB_OAUTH === "true";
   const github = env.GITHUB_CLIENT_ID && env.GITHUB_CLIENT_SECRET ? {
     clientId: env.GITHUB_CLIENT_ID,
@@ -330,35 +344,37 @@ async function loadConfig(options) {
   const mailFrom = env.MAIL_FROM;
   const mailTransportUrl = env.MAIL_TRANSPORT_URL;
   const mail = mailFrom && mailTransportUrl ? { from: mailFrom, transportUrl: mailTransportUrl } : void 0;
+  const rateLimit2 = parseRateLimitOverrides(env.RATE_LIMIT_OVERRIDES_JSON);
+  const securityConfig = readCoreSecurityConfigProjection(env);
   const raw = {
     appId,
     appName,
     appLogo,
-    port: parseInt(env.PORT ?? "3000", 10),
-    host: env.HOST ?? "0.0.0.0",
+    port: securityConfig.port,
+    host: securityConfig.host,
     staticDir: env.STATIC_DIR ?? null,
     databaseUrl,
     stores,
     cors: {
-      origins: corsOrigins,
+      origins: securityConfig.corsOrigins,
       credentials: true
     },
     bodyLimit: parseInt(env.BODY_LIMIT_BYTES ?? String(SIXTEEN_MB), 10),
     logLevel: env.LOG_LEVEL ?? "info",
-    rateLimit: parseRateLimitOverrides(env.RATE_LIMIT_OVERRIDES_JSON),
+    rateLimit: rateLimit2,
     security: {
       csp: {
-        enabled: cspEnabled,
-        upgradeInsecureRequests: cspUpgradeInsecureRequests
+        enabled: securityConfig.cspEnabled,
+        upgradeInsecureRequests: securityConfig.cspUpgradeInsecureRequests
       },
-      trustedProxy: parseTrustedProxyPolicy(env)
+      trustedProxy: securityConfig.trustedProxy
     },
     encryption: {
       workspaceSettingsKey: encryptionKey
     },
     auth: {
       secret: authSecret,
-      url: authUrl,
+      url: securityConfig.betterAuthUrl,
       github,
       google,
       mail,
@@ -366,7 +382,7 @@ async function loadConfig(options) {
         env.SESSION_TTL_SECONDS ?? String(THIRTY_DAYS_SECONDS),
         10
       ),
-      sessionCookieSecure
+      sessionCookieSecure: securityConfig.sessionCookieSecure
     },
     features: {
       githubOauth: githubOauth && github !== void 0,
@@ -3308,6 +3324,7 @@ function resourceToHandle(resource) {
 
 export {
   coreConfigSchema,
+  readCoreSecurityConfigProjection,
   loadConfig,
   validateConfig,
   buildRuntimeConfigPayload,

package/dist/{chunk-VWE46RW4.js → chunk-RTLBMHOB.js}

@@ -30,6 +30,7 @@ var ERROR_CODES = {
   DB_UNAVAILABLE: "db_unavailable",
   INTERNAL_ERROR: "internal_error",
   D1_HOST_SCOPE_VIOLATION: "D1_HOST_SCOPE_VIOLATION",
+  D1_ADMISSION_IDENTITY_MISMATCH: "D1_ADMISSION_IDENTITY_MISMATCH",
   D1_ADMISSION_RECORD_FAILED: "D1_ADMISSION_RECORD_FAILED",
   D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN: "D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN",
   // Credits + purchases

package/dist/{chunk-C4YTZAZC.js → chunk-WRFEUAG7.js}

@@ -1,7 +1,7 @@
 import {
   ERROR_CODES,
   HttpError
-} from "./chunk-VWE46RW4.js";
+} from "./chunk-RTLBMHOB.js";
 import {
   __export
 } from "./chunk-MLKGABMK.js";
@@ -566,6 +566,7 @@ __export(schema_exports, {
   creditGrants: () => creditGrants,
   creditPurchases: () => creditPurchases,
   d1BindingAdmissions: () => d1BindingAdmissions,
+  d1DestructivePublicationEvents: () => d1DestructivePublicationEvents,
   idempotencyKeys: () => idempotencyKeys,
   modelBudgetReservations: () => modelBudgetReservations,
   sessions: () => sessions,
@@ -1068,13 +1069,43 @@ var d1BindingAdmissions = pgTable2(
     sequence: bigint("sequence", { mode: "bigint" }).generatedAlwaysAsIdentity(),
     hostId: text2("host_id").notNull(),
     bindingId: text2("binding_id").notNull(),
-    activeRevision: text2("active_revision").notNull(),
+    firstRevisionId: text2("active_revision").notNull(),
+    // Nullable only for immutable rows created before migration 0020; runtime admission rejects those rows as mismatches.
+    executionIdentityDigest: text2("execution_identity_digest"),
+    firstDesiredStateDigest: text2("first_desired_state_digest"),
     admittedAt: timestamp2("admitted_at", { withTimezone: true }).defaultNow().notNull()
   },
   (table) => [
     primaryKey({ name: "d1_binding_admissions_pk", columns: [table.hostId, table.bindingId] }),
     uniqueIndex("d1_binding_admissions_sequence_unique").on(table.sequence),
-    check("d1_binding_admissions_revision_check", sql3`${table.activeRevision} ~ '^r[0-9]{10}$'`)
+    check("d1_binding_admissions_revision_check", sql3`${table.firstRevisionId} ~ '^r[0-9]{10}$'`),
+    check("d1_binding_admissions_execution_digest_check", sql3`${table.executionIdentityDigest} ~ '^sha256:[a-f0-9]{64}$'`),
+    check("d1_binding_admissions_desired_digest_check", sql3`${table.firstDesiredStateDigest} ~ '^sha256:[a-f0-9]{64}$'`)
+  ]
+);
+var d1DestructivePublicationEvents = pgTable2(
+  "d1_destructive_publication_events",
+  {
+    sequence: bigint("sequence", { mode: "bigint" }).generatedAlwaysAsIdentity().primaryKey(),
+    operationId: text2("operation_id").notNull(),
+    state: text2("state").notNull(),
+    hostId: text2("host_id").notNull(),
+    expectedRevision: text2("expected_revision").notNull(),
+    expectedDigest: text2("expected_digest").notNull(),
+    targetRevision: text2("target_revision").notNull(),
+    targetDigest: text2("target_digest").notNull(),
+    removalBindingIds: text2("removal_binding_ids").array().notNull(),
+    recordedAt: timestamp2("recorded_at", { withTimezone: true }).defaultNow().notNull()
+  },
+  (table) => [
+    uniqueIndex("d1_destructive_publication_prepared_unique").on(table.operationId).where(sql3`${table.state} = 'prepared'`),
+    uniqueIndex("d1_destructive_publication_terminal_unique").on(table.operationId).where(sql3`${table.state} IN ('committed', 'aborted')`),
+    check("d1_destructive_publication_state_check", sql3`${table.state} IN ('prepared', 'committed', 'aborted')`),
+    check("d1_destructive_publication_expected_revision_check", sql3`${table.expectedRevision} ~ '^r[0-9]{10}$'`),
+    check("d1_destructive_publication_target_revision_check", sql3`${table.targetRevision} ~ '^r[0-9]{10}$'`),
+    check("d1_destructive_publication_expected_digest_check", sql3`${table.expectedDigest} ~ '^sha256:[a-f0-9]{64}$'`),
+    check("d1_destructive_publication_target_digest_check", sql3`${table.targetDigest} ~ '^sha256:[a-f0-9]{64}$'`),
+    check("d1_destructive_publication_removals_check", sql3`cardinality(${table.removalBindingIds}) > 0`)
   ]
 );
 

package/dist/front/index.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { Component, ReactNode, ErrorInfo } from 'react';
-import { R as RuntimeConfig, a as CapabilitiesResponse, W as WorkspaceMember, U as User, b as Workspace, M as MemberRole, S as SessionState } from '../types-DKCtYltp.js';
+import { R as RuntimeConfig, a as CapabilitiesResponse, W as WorkspaceMember, U as User, b as Workspace, M as MemberRole, S as SessionState } from '../types-BIjRgbMV.js';
 export { b as CompanyAdminLabels, c as CompanyAdminProvider, d as CompanyAdminProviderProps, e as CompanyAdminStatus, f as CoreFront, C as CoreFrontAuthPagesOverride, a as CoreFrontCompanyAdminOptions, g as CoreFrontProps, L as LoadCompanyAdminStatus, R as RenderCompanyAdminContent, u as useCompanyAdminStatus } from '../CoreFront-DB1OfNJU.js';
 import * as _tanstack_react_query from '@tanstack/react-query';
 import * as better_auth_react from 'better-auth/react';

package/dist/front/index.js

@@ -62,13 +62,13 @@ import {
   useWorkspaceMembers,
   useWorkspaceRole,
   useWorkspaceRouteStatus
-} from "../chunk-6G6Z52VQ.js";
+} from "../chunk-JLBUXSC5.js";
 import {
   TopBarSlotProvider,
   useTopBarSlot
 } from "../chunk-HYNKZSTF.js";
 import "../chunk-I4PGL4ZD.js";
-import "../chunk-VWE46RW4.js";
+import "../chunk-RTLBMHOB.js";
 import "../chunk-MLKGABMK.js";
 export {
   AppErrorBoundary,

package/dist/{loadConfig-DEG0Tu5n.d.ts → loadConfig-Bw6jtipE.d.ts}

@@ -1,7 +1,7 @@
 import { FastifyPluginAsync } from 'fastify';
 import { Auth } from 'better-auth';
-import { C as CoreConfig, R as RuntimeConfig } from './types-DKCtYltp.js';
-import { W as WorkspaceStore, D as Database } from './types-uK6CFlxr.js';
+import { C as CoreConfig, R as RuntimeConfig } from './types-BIjRgbMV.js';
+import { W as WorkspaceStore, D as Database } from './types-C5xuRqmA.js';
 import { T as TelemetrySink } from './telemetry-DR18MeI0.js';
 
 declare function validatePasswordStrength(password: string): {
@@ -35,8 +35,24 @@ interface LoadConfigOptions {
     env?: Record<string, string | undefined>;
     allowMissingSecrets?: boolean;
 }
+type CoreTrustedProxyPolicyInput = undefined | 'legacy-unsafe' | Readonly<{
+    cidrs: readonly string[];
+    hops: number;
+}>;
+interface CoreSecurityConfigProjection {
+    readonly host: string;
+    readonly port: number;
+    readonly betterAuthUrl: string;
+    readonly corsOrigins: readonly string[];
+    readonly cspEnabled: boolean;
+    readonly cspUpgradeInsecureRequests: boolean;
+    readonly sessionCookieSecure: boolean;
+    /** Parsed input only; whole-config schema validation still establishes validity. */
+    readonly trustedProxy: CoreTrustedProxyPolicyInput;
+}
+declare function readCoreSecurityConfigProjection(env: Readonly<Record<string, string | undefined>>): CoreSecurityConfigProjection;
 declare function loadConfig(options?: LoadConfigOptions): Promise<CoreConfig>;
 declare function validateConfig(raw: unknown): CoreConfig;
 declare function buildRuntimeConfigPayload(config: CoreConfig): RuntimeConfig;
 
-export { type AuthHookOptions as A, type BetterAuthInstance as B, type CreateAuthOptions as C, type LoadConfigOptions as L, authHook as a, buildRuntimeConfigPayload as b, createAuth as c, validatePasswordStrength as d, loadConfig as l, validateConfig as v };
+export { type AuthHookOptions as A, type BetterAuthInstance as B, type CoreSecurityConfigProjection as C, type LoadConfigOptions as L, type CoreTrustedProxyPolicyInput as a, type CreateAuthOptions as b, authHook as c, buildRuntimeConfigPayload as d, createAuth as e, validatePasswordStrength as f, loadConfig as l, readCoreSecurityConfigProjection as r, validateConfig as v };

package/dist/server/db/index.d.ts

@@ -1,7 +1,7 @@
-import { U as UserStore, W as WorkspaceStore } from '../../types-uK6CFlxr.js';
-export { D as Database, c as createDatabase } from '../../types-uK6CFlxr.js';
-export { B as BudgetReservationAdmission, a as BudgetReservationAdmissionInput, b as BudgetReservationScope, c as BudgetSpendQuery, d as BudgetSpendSnapshot, F as FinishBudgetReservationInput, e as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, f as ModelBudgetExceededError, P as PostgresBudgetReservationStore, g as PostgresMeteringStore, h as PostgresModelBudgetStore, R as RecordUsageInput, i as RecordUsageResult, j as ReservationFinalStatus, k as ReserveBudgetInput, l as ReserveBudgetResult, m as ReserveInput, n as ReserveResult, o as RunMigrationsOptions, U as UserBudgetExceededError, r as runMigrations } from '../../PostgresModelBudgetStore-CViAvfFy.js';
-import { U as User, b as Workspace, E as ERROR_CODES, M as MemberRole, W as WorkspaceMember, c as WorkspaceInvite, d as WorkspaceRuntime, e as WorkspaceRuntimeResourceSelector, f as WorkspaceRuntimeResource, g as WorkspaceRuntimeResourceInput } from '../../types-DKCtYltp.js';
+import { U as UserStore, W as WorkspaceStore } from '../../types-C5xuRqmA.js';
+export { D as Database, c as createDatabase } from '../../types-C5xuRqmA.js';
+export { B as BudgetReservationAdmission, a as BudgetReservationAdmissionInput, b as BudgetReservationScope, c as BudgetSpendQuery, d as BudgetSpendSnapshot, F as FinishBudgetReservationInput, e as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, f as ModelBudgetExceededError, P as PostgresBudgetReservationStore, g as PostgresMeteringStore, h as PostgresModelBudgetStore, R as RecordUsageInput, i as RecordUsageResult, j as ReservationFinalStatus, k as ReserveBudgetInput, l as ReserveBudgetResult, m as ReserveInput, n as ReserveResult, o as RunMigrationsOptions, U as UserBudgetExceededError, r as runMigrations } from '../../PostgresModelBudgetStore-vDTn1QkE.js';
+import { U as User, b as Workspace, E as ERROR_CODES, M as MemberRole, W as WorkspaceMember, c as WorkspaceInvite, d as WorkspaceRuntime, e as WorkspaceRuntimeResourceSelector, f as WorkspaceRuntimeResource, g as WorkspaceRuntimeResourceInput } from '../../types-BIjRgbMV.js';
 import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
 import 'postgres';
 import 'fastify';

package/dist/server/db/index.js

@@ -11,8 +11,8 @@ import {
   UserBudgetExceededError,
   createDatabase,
   runMigrations
-} from "../../chunk-C4YTZAZC.js";
-import "../../chunk-VWE46RW4.js";
+} from "../../chunk-WRFEUAG7.js";
+import "../../chunk-RTLBMHOB.js";
 import "../../chunk-MLKGABMK.js";
 export {
   InsufficientCreditError,

package/dist/server/index.d.ts

@@ -1,16 +1,16 @@
-import { L as LoadConfigOptions } from '../loadConfig-DEG0Tu5n.js';
-export { A as AuthHookOptions, B as BetterAuthInstance, C as CreateAuthOptions, a as authHook, b as buildRuntimeConfigPayload, c as createAuth, l as loadConfig, v as validateConfig, d as validatePasswordStrength } from '../loadConfig-DEG0Tu5n.js';
+import { L as LoadConfigOptions } from '../loadConfig-Bw6jtipE.js';
+export { A as AuthHookOptions, B as BetterAuthInstance, C as CoreSecurityConfigProjection, a as CoreTrustedProxyPolicyInput, b as CreateAuthOptions, c as authHook, d as buildRuntimeConfigPayload, e as createAuth, l as loadConfig, r as readCoreSecurityConfigProjection, v as validateConfig, f as validatePasswordStrength } from '../loadConfig-Bw6jtipE.js';
 import { z } from 'zod';
-import { C as CoreConfig, M as MemberRole, e as WorkspaceRuntimeResourceSelector, f as WorkspaceRuntimeResource, g as WorkspaceRuntimeResourceInput } from '../types-DKCtYltp.js';
+import { C as CoreConfig, M as MemberRole, e as WorkspaceRuntimeResourceSelector, f as WorkspaceRuntimeResource, g as WorkspaceRuntimeResourceInput } from '../types-BIjRgbMV.js';
 import * as fastify from 'fastify';
 import { preHandlerHookHandler, FastifyInstance, FastifyPluginAsync, FastifyRequest, FastifyReply } from 'fastify';
 import * as http from 'http';
 import { IncomingMessage } from 'node:http';
-import { W as WorkspaceStore, b as CreateCoreAppOptions, D as Database, U as UserStore, d as WorkspaceProvisioner } from '../types-uK6CFlxr.js';
-export { A as AuthProvider, e as CapabilitiesContributor, a as CoreRequestScope, C as CoreRequestScopeResolver, P as ProvisionContext, f as ProvisionResult, c as createDatabase } from '../types-uK6CFlxr.js';
+import { W as WorkspaceStore, b as CreateCoreAppOptions, D as Database, U as UserStore, d as WorkspaceProvisioner } from '../types-C5xuRqmA.js';
+export { A as AuthProvider, e as CapabilitiesContributor, a as CoreRequestScope, C as CoreRequestScopeResolver, P as ProvisionContext, f as ProvisionResult, c as createDatabase } from '../types-C5xuRqmA.js';
 import postgres from 'postgres';
-import { o as RunMigrationsOptions, g as PostgresMeteringStore, C as CreditLedgerEntry } from '../PostgresModelBudgetStore-CViAvfFy.js';
-export { B as BudgetReservationAdmission, a as BudgetReservationAdmissionInput, b as BudgetReservationScope, c as BudgetSpendQuery, d as BudgetSpendSnapshot, F as FinishBudgetReservationInput, e as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, f as ModelBudgetExceededError, P as PostgresBudgetReservationStore, h as PostgresModelBudgetStore, R as RecordUsageInput, i as RecordUsageResult, j as ReservationFinalStatus, k as ReserveBudgetInput, l as ReserveBudgetResult, m as ReserveInput, n as ReserveResult, U as UserBudgetExceededError, r as runMigrations } from '../PostgresModelBudgetStore-CViAvfFy.js';
+import { o as RunMigrationsOptions, g as PostgresMeteringStore, C as CreditLedgerEntry } from '../PostgresModelBudgetStore-vDTn1QkE.js';
+export { B as BudgetReservationAdmission, a as BudgetReservationAdmissionInput, b as BudgetReservationScope, c as BudgetSpendQuery, d as BudgetSpendSnapshot, F as FinishBudgetReservationInput, e as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, f as ModelBudgetExceededError, P as PostgresBudgetReservationStore, h as PostgresModelBudgetStore, R as RecordUsageInput, i as RecordUsageResult, j as ReservationFinalStatus, k as ReserveBudgetInput, l as ReserveBudgetResult, m as ReserveInput, n as ReserveResult, U as UserBudgetExceededError, r as runMigrations } from '../PostgresModelBudgetStore-vDTn1QkE.js';
 import { T as TelemetrySink } from '../telemetry-DR18MeI0.js';
 import { AgentMeteringSink } from '@hachej/boring-agent/server';
 import 'better-auth';

package/dist/server/index.js

@@ -11,6 +11,7 @@ import {
   createMailTransport,
   createPostSignupHook,
   loadConfig,
+  readCoreSecurityConfigProjection,
   registerInviteRoutes,
   registerMemberRoutes,
   registerRoutes,
@@ -25,7 +26,7 @@ import {
   validateConfig,
   validatePasswordStrength,
   withUserSettingsWriteLock
-} from "../chunk-MWOZRTRG.js";
+} from "../chunk-ONZ6UPYK.js";
 import {
   InsufficientCreditError,
   ModelBudgetExceededError,
@@ -35,7 +36,7 @@ import {
   UserBudgetExceededError,
   createDatabase,
   runMigrations
-} from "../chunk-C4YTZAZC.js";
+} from "../chunk-WRFEUAG7.js";
 import {
   noopTelemetry,
   safeCapture
@@ -43,7 +44,7 @@ import {
 import "../chunk-I4PGL4ZD.js";
 import {
   ERROR_CODES
-} from "../chunk-VWE46RW4.js";
+} from "../chunk-RTLBMHOB.js";
 import "../chunk-MLKGABMK.js";
 
 // src/server/security/safeRedirect.ts
@@ -1626,6 +1627,7 @@ export {
   maxEffectiveRate,
   maxServedRate,
   parseLemonSqueezyOrder,
+  readCoreSecurityConfigProjection,
   registerCreditsRoutes,
   registerInviteRoutes,
   registerMemberRoutes,

package/dist/shared/index.d.ts

@@ -1,5 +1,5 @@
-import { U as User, C as CoreConfig, R as RuntimeConfig } from '../types-DKCtYltp.js';
-export { a as CapabilitiesResponse, h as ConfigFetchError, i as ConfigValidationError, j as CoreCapabilities, E as ERROR_CODES, k as ErrorCode, H as HttpError, J as JsonValue, M as MemberRole, l as RateLimitEndpointOverride, m as SessionPayload, S as SessionState, T as TrustedProxyPolicy, b as Workspace, c as WorkspaceInvite, W as WorkspaceMember, d as WorkspaceRuntime } from '../types-DKCtYltp.js';
+import { U as User, C as CoreConfig, R as RuntimeConfig } from '../types-BIjRgbMV.js';
+export { a as CapabilitiesResponse, h as ConfigFetchError, i as ConfigValidationError, j as CoreCapabilities, E as ERROR_CODES, k as ErrorCode, H as HttpError, J as JsonValue, M as MemberRole, l as RateLimitEndpointOverride, m as SessionPayload, S as SessionState, T as TrustedProxyPolicy, b as Workspace, c as WorkspaceInvite, W as WorkspaceMember, d as WorkspaceRuntime } from '../types-BIjRgbMV.js';
 export { a as TelemetryEvent, T as TelemetrySink, n as noopTelemetry, s as safeCapture } from '../telemetry-DR18MeI0.js';
 
 declare function isCoreEmailVerificationEnabled(config: Pick<CoreConfig, 'auth'>): boolean;

package/dist/shared/index.js

@@ -12,7 +12,7 @@ import {
   ConfigValidationError,
   ERROR_CODES,
   HttpError
-} from "../chunk-VWE46RW4.js";
+} from "../chunk-RTLBMHOB.js";
 import "../chunk-MLKGABMK.js";
 export {
   ConfigFetchError,

package/dist/{types-DKCtYltp.d.ts → types-BIjRgbMV.d.ts}

@@ -24,6 +24,7 @@ declare const ERROR_CODES: {
     readonly DB_UNAVAILABLE: "db_unavailable";
     readonly INTERNAL_ERROR: "internal_error";
     readonly D1_HOST_SCOPE_VIOLATION: "D1_HOST_SCOPE_VIOLATION";
+    readonly D1_ADMISSION_IDENTITY_MISMATCH: "D1_ADMISSION_IDENTITY_MISMATCH";
     readonly D1_ADMISSION_RECORD_FAILED: "D1_ADMISSION_RECORD_FAILED";
     readonly D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN: "D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN";
     readonly PAYMENT_REQUIRED: "payment_required";

package/dist/{types-uK6CFlxr.d.ts → types-C5xuRqmA.d.ts}

@@ -1,6 +1,6 @@
 import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
-import { C as CoreConfig, b as Workspace, E as ERROR_CODES, M as MemberRole, W as WorkspaceMember, U as User, c as WorkspaceInvite, d as WorkspaceRuntime, e as WorkspaceRuntimeResourceSelector, f as WorkspaceRuntimeResource, g as WorkspaceRuntimeResourceInput, a as CapabilitiesResponse } from './types-DKCtYltp.js';
+import { C as CoreConfig, b as Workspace, E as ERROR_CODES, M as MemberRole, W as WorkspaceMember, U as User, c as WorkspaceInvite, d as WorkspaceRuntime, e as WorkspaceRuntimeResourceSelector, f as WorkspaceRuntimeResource, g as WorkspaceRuntimeResourceInput, a as CapabilitiesResponse } from './types-BIjRgbMV.js';
 import { FastifyRequest } from 'fastify';
 
 type Database = ReturnType<typeof drizzle>;

package/drizzle/0019_d1_destructive_publication_events.sql

@@ -0,0 +1,36 @@
+CREATE TABLE "d1_destructive_publication_events" (
+	"sequence" bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+	"operation_id" text NOT NULL,
+	"state" text NOT NULL,
+	"host_id" text NOT NULL,
+	"expected_revision" text NOT NULL,
+	"expected_digest" text NOT NULL,
+	"target_revision" text NOT NULL,
+	"target_digest" text NOT NULL,
+	"removal_binding_ids" text[] NOT NULL,
+	"recorded_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "d1_destructive_publication_state_check" CHECK ("state" IN ('prepared', 'committed', 'aborted')),
+	CONSTRAINT "d1_destructive_publication_expected_revision_check" CHECK ("expected_revision" ~ '^r[0-9]{10}$'),
+	CONSTRAINT "d1_destructive_publication_target_revision_check" CHECK ("target_revision" ~ '^r[0-9]{10}$'),
+	CONSTRAINT "d1_destructive_publication_expected_digest_check" CHECK ("expected_digest" ~ '^sha256:[a-f0-9]{64}$'),
+	CONSTRAINT "d1_destructive_publication_target_digest_check" CHECK ("target_digest" ~ '^sha256:[a-f0-9]{64}$'),
+	CONSTRAINT "d1_destructive_publication_removals_check" CHECK (cardinality("removal_binding_ids") > 0)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "d1_destructive_publication_prepared_unique" ON "d1_destructive_publication_events" ("operation_id") WHERE "state" = 'prepared';
+--> statement-breakpoint
+CREATE UNIQUE INDEX "d1_destructive_publication_terminal_unique" ON "d1_destructive_publication_events" ("operation_id") WHERE "state" IN ('committed', 'aborted');
+--> statement-breakpoint
+CREATE OR REPLACE FUNCTION d1_reject_destructive_publication_event_mutation() RETURNS trigger AS $$
+BEGIN
+	RAISE EXCEPTION 'd1 destructive publication events are immutable';
+END;
+$$ LANGUAGE plpgsql;
+--> statement-breakpoint
+CREATE TRIGGER d1_destructive_publication_events_immutable
+BEFORE UPDATE OR DELETE ON "d1_destructive_publication_events"
+FOR EACH ROW EXECUTE FUNCTION d1_reject_destructive_publication_event_mutation();
+--> statement-breakpoint
+CREATE TRIGGER d1_destructive_publication_events_truncate_immutable
+BEFORE TRUNCATE ON "d1_destructive_publication_events"
+FOR EACH STATEMENT EXECUTE FUNCTION d1_reject_destructive_publication_event_mutation();

package/drizzle/0020_d1_admission_execution_identity.sql

@@ -0,0 +1,5 @@
+ALTER TABLE "d1_binding_admissions"
+	ADD COLUMN "execution_identity_digest" text,
+	ADD COLUMN "first_desired_state_digest" text,
+	ADD CONSTRAINT "d1_binding_admissions_execution_digest_check" CHECK ("execution_identity_digest" ~ '^sha256:[a-f0-9]{64}$'),
+	ADD CONSTRAINT "d1_binding_admissions_desired_digest_check" CHECK ("first_desired_state_digest" ~ '^sha256:[a-f0-9]{64}$');

package/drizzle/meta/_journal.json

@@ -134,6 +134,20 @@
       "when": 1783900800000,
       "tag": "0018_d1_binding_admissions",
       "breakpoints": true
+    },
+    {
+      "idx": 19,
+      "version": "7",
+      "when": 1783987200000,
+      "tag": "0019_d1_destructive_publication_events",
+      "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "7",
+      "when": 1784073600000,
+      "tag": "0020_d1_admission_execution_identity",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-core",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "type": "module",
   "license": "MIT",
   "description": "Foundation package for boring-ui-v2 apps: DB, auth, config, HTTP app factory, and frontend app shell.",
@@ -80,9 +80,9 @@
     "react-router-dom": "^7.18.0",
     "smol-toml": "^1.7.0",
     "zod": "^3.25.76",
-    "@hachej/boring-agent": "0.1.84",
-    "@hachej/boring-ui-kit": "0.1.84",
-    "@hachej/boring-workspace": "0.1.84"
+    "@hachej/boring-agent": "0.1.85",
+    "@hachej/boring-ui-kit": "0.1.85",
+    "@hachej/boring-workspace": "0.1.85"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",