@percher/shared 0.1.3 → 0.1.4

package/dist/pow.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Proof-of-work for the headless anonymous-deploy gate (FUTURE23 Spår A
+ * hardening). A solution is any string such that
+ * `sha256(`${nonce}:${solution}`)` has at least `difficulty` leading zero
+ * bits. Lives in @percher/shared so the API verifies with the EXACT algorithm
+ * the CLI/MCP client solves — a drift between the two would silently reject
+ * every legitimate publish or accept unsolved ones.
+ *
+ * A browser CAPTCHA can't gate this endpoint: the caller is a headless agent
+ * or CLI. PoW is the headless equivalent — the client spends CPU instead of a
+ * human solving a puzzle, so a botnet pays a real cost per app regardless of
+ * how many IPs it controls.
+ */
+export declare const POW_ALGORITHM = "sha256-leading-zero-bits";
+/** Count leading zero bits in a hex digest. */
+export declare function leadingZeroBits(hexDigest: string): number;
+/** True if `solution` meets `difficulty` for `nonce`. difficulty<=0 is a no-op. */
+export declare function verifyPow(nonce: string, solution: string, difficulty: number): boolean;
+/**
+ * Brute-force a solution. Returns the first hit, or null if `maxIterations` is
+ * exhausted (guards against a pathological difficulty hanging the client).
+ */
+export declare function solvePow(nonce: string, difficulty: number, maxIterations?: number): string | null;
+//# sourceMappingURL=pow.d.ts.map

package/dist/pow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pow.d.ts","sourceRoot":"","sources":["../src/pow.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,6BAA6B,CAAC;AAMxD,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAazD;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAItF;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,aAAa,SAAa,GACzB,MAAM,GAAG,IAAI,CAOf"}

package/dist/pow.js

@@ -0,0 +1,56 @@
+import { createHash } from "node:crypto";
+/**
+ * Proof-of-work for the headless anonymous-deploy gate (FUTURE23 Spår A
+ * hardening). A solution is any string such that
+ * `sha256(`${nonce}:${solution}`)` has at least `difficulty` leading zero
+ * bits. Lives in @percher/shared so the API verifies with the EXACT algorithm
+ * the CLI/MCP client solves — a drift between the two would silently reject
+ * every legitimate publish or accept unsolved ones.
+ *
+ * A browser CAPTCHA can't gate this endpoint: the caller is a headless agent
+ * or CLI. PoW is the headless equivalent — the client spends CPU instead of a
+ * human solving a puzzle, so a botnet pays a real cost per app regardless of
+ * how many IPs it controls.
+ */
+export const POW_ALGORITHM = "sha256-leading-zero-bits";
+function digest(nonce, solution) {
+    return createHash("sha256").update(`${nonce}:${solution}`).digest("hex");
+}
+/** Count leading zero bits in a hex digest. */
+export function leadingZeroBits(hexDigest) {
+    let bits = 0;
+    for (const ch of hexDigest) {
+        const nibble = Number.parseInt(ch, 16);
+        if (nibble === 0) {
+            bits += 4;
+            continue;
+        }
+        // clz32(n) - 28 = leading zeros of a 4-bit value (1..15).
+        bits += Math.clz32(nibble) - 28;
+        break;
+    }
+    return bits;
+}
+/** True if `solution` meets `difficulty` for `nonce`. difficulty<=0 is a no-op. */
+export function verifyPow(nonce, solution, difficulty) {
+    if (difficulty <= 0)
+        return true;
+    if (!solution)
+        return false;
+    return leadingZeroBits(digest(nonce, solution)) >= difficulty;
+}
+/**
+ * Brute-force a solution. Returns the first hit, or null if `maxIterations` is
+ * exhausted (guards against a pathological difficulty hanging the client).
+ */
+export function solvePow(nonce, difficulty, maxIterations = 50_000_000) {
+    if (difficulty <= 0)
+        return "0";
+    for (let i = 0; i < maxIterations; i++) {
+        const solution = i.toString(36);
+        if (leadingZeroBits(digest(nonce, solution)) >= difficulty)
+            return solution;
+    }
+    return null;
+}
+//# sourceMappingURL=pow.js.map

package/dist/pow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pow.js","sourceRoot":"","sources":["../src/pow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAExD,SAAS,MAAM,CAAC,KAAa,EAAE,QAAgB;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,0DAA0D;QAC1D,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM;IACR,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAkB;IAC3E,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,UAAU,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAa,EACb,UAAkB,EAClB,aAAa,GAAG,UAAU;IAE1B,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,UAAU;YAAE,OAAO,QAAQ,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@percher/shared",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Shared constants and contracts (timeouts, etc.) used across the Percher CLI, API, MCP, and worker. Internal — values change in lockstep across packages.",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,6 +25,11 @@
       "types": "./dist/platform-env.d.ts",
       "import": "./dist/platform-env.js",
       "default": "./dist/platform-env.js"
+    },
+    "./pow": {
+      "types": "./dist/pow.d.ts",
+      "import": "./dist/pow.js",
+      "default": "./dist/pow.js"
     }
   },
   "files": [