@percher/shared 0.1.6 → 0.1.8

package/dist/index.d.ts

@@ -1,7 +1,10 @@
 export { APP_NAME_RE } from "./app-name.js";
-export { MAX_INLINE_PUBLISH_BYTES, MAX_TARBALL_BYTES } from "./limits.js";
+export { INTERNAL_SIG_HEADER, INTERNAL_SIG_MAX_SKEW_MS, INTERNAL_SIG_VERSION, INTERNAL_TS_HEADER, type InternalSigParts, internalSigPayload, } from "./internal-sig.js";
+export { MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MIN_UPLOAD_CHUNK_BYTES, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
 export { MAX_LOG_SEARCH_LENGTH } from "./logs.js";
+export { DEFAULT_DOMAIN_SUFFIX, DEFAULT_MCP_HTTP_PORT, DEFAULT_POCKETBASE_IMAGE, } from "./platform.js";
 export { canonicalInjectedKey, isPercherInjected, PERCHER_INJECTED_ENV_KEYS, } from "./platform-env.js";
 export { DEFAULT_NODE_VERSION_LABEL, DEFAULT_NODE_VERSION_MAJOR } from "./runtime.js";
 export { TIMEOUTS, type TimeoutKey } from "./timeouts.js";
+export { WAITLIST_THROTTLE_WINDOW_MS } from "./waitlist.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,7 +1,10 @@
 export { APP_NAME_RE } from "./app-name.js";
-export { MAX_INLINE_PUBLISH_BYTES, MAX_TARBALL_BYTES } from "./limits.js";
+export { INTERNAL_SIG_HEADER, INTERNAL_SIG_MAX_SKEW_MS, INTERNAL_SIG_VERSION, INTERNAL_TS_HEADER, internalSigPayload, } from "./internal-sig.js";
+export { MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MIN_UPLOAD_CHUNK_BYTES, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
 export { MAX_LOG_SEARCH_LENGTH } from "./logs.js";
+export { DEFAULT_DOMAIN_SUFFIX, DEFAULT_MCP_HTTP_PORT, DEFAULT_POCKETBASE_IMAGE, } from "./platform.js";
 export { canonicalInjectedKey, isPercherInjected, PERCHER_INJECTED_ENV_KEYS, } from "./platform-env.js";
 export { DEFAULT_NODE_VERSION_LABEL, DEFAULT_NODE_VERSION_MAJOR } from "./runtime.js";
 export { TIMEOUTS } from "./timeouts.js";
+export { WAITLIST_THROTTLE_WINDOW_MS } from "./waitlist.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAmB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAElB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAmB,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}

package/dist/internal-sig.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Wire contract for X-Internal-Secret HMAC request signing.
+ *
+ * The legacy scheme sends the shared internal secret verbatim in a header, so a
+ * single captured/logged request grants every `/internal/*` endpoint forever.
+ * Signing binds a credential to one (method, path, body, timestamp): a captured
+ * request can't be replayed against a different endpoint or outside the skew
+ * window, and the raw secret never has to ride on the wire once enforce is on.
+ *
+ * This module is the single source of truth for the canonical string both sides
+ * HMAC, so the API verifier and every signer (the dashboard today; the external
+ * CLABBE runner per docs/integrations/CLABBE_SECURITY_INGEST.md) can't drift. It
+ * is dependency-free on purpose — no crypto here — so it bundles cleanly into the
+ * dashboard (Node) as well as the API (Bun). Each side wraps it with its own
+ * `node:crypto` HMAC.
+ */
+/** Hex HMAC-SHA256 of {@link internalSigPayload}, keyed with the shared secret. */
+export declare const INTERNAL_SIG_HEADER = "X-Internal-Signature";
+/** Unix-epoch milliseconds (as a decimal string) the signature was minted at. */
+export declare const INTERNAL_TS_HEADER = "X-Internal-Timestamp";
+/** Reject a signed request whose timestamp is more than this far from now. */
+export declare const INTERNAL_SIG_MAX_SKEW_MS = 300000;
+/** Canonical-form version. Bumps if the payload shape changes; a verifier can
+ *  refuse a version it doesn't understand rather than mis-compare. */
+export declare const INTERNAL_SIG_VERSION = "v1";
+export interface InternalSigParts {
+    /** HTTP method, case-insensitive — normalized to upper-case in the payload. */
+    method: string;
+    /** Request path WITHOUT query string, exactly as it appears on the wire
+     *  (already-percent-encoded; sign what you send). */
+    path: string;
+    /** The value placed in {@link INTERNAL_TS_HEADER}. Stringified verbatim so the
+     *  verifier signs the exact header bytes — no Number round-trip. */
+    timestamp: number | string;
+    /** Lower-case hex SHA-256 of the raw request body ("" body → sha256 of ""). */
+    bodyHash: string;
+}
+/** The exact string both the signer and verifier feed to HMAC-SHA256. */
+export declare function internalSigPayload(parts: InternalSigParts): string;
+//# sourceMappingURL=internal-sig.d.ts.map

package/dist/internal-sig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-sig.d.ts","sourceRoot":"","sources":["../src/internal-sig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AAEzD,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAEhD;sEACsE;AACtE,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf;yDACqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb;wEACoE;IACpE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAQlE"}

package/dist/internal-sig.js

@@ -0,0 +1,36 @@
+/**
+ * Wire contract for X-Internal-Secret HMAC request signing.
+ *
+ * The legacy scheme sends the shared internal secret verbatim in a header, so a
+ * single captured/logged request grants every `/internal/*` endpoint forever.
+ * Signing binds a credential to one (method, path, body, timestamp): a captured
+ * request can't be replayed against a different endpoint or outside the skew
+ * window, and the raw secret never has to ride on the wire once enforce is on.
+ *
+ * This module is the single source of truth for the canonical string both sides
+ * HMAC, so the API verifier and every signer (the dashboard today; the external
+ * CLABBE runner per docs/integrations/CLABBE_SECURITY_INGEST.md) can't drift. It
+ * is dependency-free on purpose — no crypto here — so it bundles cleanly into the
+ * dashboard (Node) as well as the API (Bun). Each side wraps it with its own
+ * `node:crypto` HMAC.
+ */
+/** Hex HMAC-SHA256 of {@link internalSigPayload}, keyed with the shared secret. */
+export const INTERNAL_SIG_HEADER = "X-Internal-Signature";
+/** Unix-epoch milliseconds (as a decimal string) the signature was minted at. */
+export const INTERNAL_TS_HEADER = "X-Internal-Timestamp";
+/** Reject a signed request whose timestamp is more than this far from now. */
+export const INTERNAL_SIG_MAX_SKEW_MS = 300_000;
+/** Canonical-form version. Bumps if the payload shape changes; a verifier can
+ *  refuse a version it doesn't understand rather than mis-compare. */
+export const INTERNAL_SIG_VERSION = "v1";
+/** The exact string both the signer and verifier feed to HMAC-SHA256. */
+export function internalSigPayload(parts) {
+    return [
+        INTERNAL_SIG_VERSION,
+        parts.method.toUpperCase(),
+        parts.path,
+        String(parts.timestamp),
+        parts.bodyHash,
+    ].join("\n");
+}
+//# sourceMappingURL=internal-sig.js.map

package/dist/internal-sig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-sig.js","sourceRoot":"","sources":["../src/internal-sig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAEzD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD;sEACsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAezC,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,KAAuB;IACxD,OAAO;QACL,oBAAoB;QACpB,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,KAAK,CAAC,IAAI;QACV,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QACvB,KAAK,CAAC,QAAQ;KACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/limits.d.ts

@@ -19,4 +19,37 @@ export declare const MAX_TARBALL_BYTES: number;
  * (`percher_deploy`), not inline.
  */
 export declare const MAX_INLINE_PUBLISH_BYTES: number;
+/**
+ * Chunked inline upload (publish sessions) — the multi-call variant of
+ * inline publish for apps too large to travel in ONE model-generated
+ * tool call (~100 KB practical per-turn ceiling). Bytes move as
+ * hash-verified chunks into a staging session; commit re-enters the
+ * standard inline-publish path.
+ */
+/** Max RAW (decoded) bytes per uploaded chunk. Clients default lower
+ *  (32 KB) and shrink on repeated hash mismatches; the server rejects
+ *  anything over this cap. */
+export declare const MAX_UPLOAD_CHUNK_BYTES: number;
+/** Min RAW bytes per uploaded chunk, EXCEPT the final piece of a file.
+ *  Enforced server-side because tiny chunks are a death spiral for the
+ *  model-text transport (live dogfood 2026-07-08: an agent shrank
+ *  8→4→2 KB after one mismatch and hit the per-message output ceiling
+ *  before finishing): every extra call costs a full model turn AND all
+ *  payloads count against ONE assistant message's max length. */
+export declare const MIN_UPLOAD_CHUNK_BYTES: number;
+/** Idle TTL for an open upload session — refreshed on every accepted
+ *  chunk, so it measures INACTIVITY, not total duration. Live dogfood
+ *  2026-07-08: a fixed 1 h total expired twice mid-upload because the
+ *  chat channel's real cadence includes approval prompts, max-length
+ *  "Continue" pauses, and the human walking away. */
+export declare const UPLOAD_SESSION_TTL_MS: number;
+/** Absolute cap on an upload session's lifetime from creation — bounds
+ *  the rolling idle-refresh so periodically-pinged sessions can't hold
+ *  staged bytes forever. */
+export declare const UPLOAD_SESSION_MAX_LIFETIME_MS: number;
+/** Max simultaneously-open upload sessions per user. A session stages up
+ *  to MAX_INLINE_PUBLISH_BYTES, so this bounds per-user staged bytes. */
+export declare const MAX_OPEN_UPLOAD_SESSIONS_PER_USER = 2;
+/** Max files a single upload-session manifest may declare. */
+export declare const MAX_UPLOAD_SESSION_FILES = 400;
 //# sourceMappingURL=limits.d.ts.map

package/dist/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAoB,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAmB,CAAC"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAoB,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD;;;;;;GAMG;AAEH;;8BAE8B;AAC9B,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;;iEAKiE;AACjE,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;qDAIqD;AACrD,eAAO,MAAM,qBAAqB,QAAqB,CAAC;AAExD;;4BAE4B;AAC5B,eAAO,MAAM,8BAA8B,QAAsB,CAAC;AAElE;yEACyE;AACzE,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB,MAAM,CAAC"}

package/dist/limits.js

@@ -19,4 +19,37 @@ export const MAX_TARBALL_BYTES = 500 * 1024 * 1024;
  * (`percher_deploy`), not inline.
  */
 export const MAX_INLINE_PUBLISH_BYTES = 25 * 1024 * 1024;
+/**
+ * Chunked inline upload (publish sessions) — the multi-call variant of
+ * inline publish for apps too large to travel in ONE model-generated
+ * tool call (~100 KB practical per-turn ceiling). Bytes move as
+ * hash-verified chunks into a staging session; commit re-enters the
+ * standard inline-publish path.
+ */
+/** Max RAW (decoded) bytes per uploaded chunk. Clients default lower
+ *  (32 KB) and shrink on repeated hash mismatches; the server rejects
+ *  anything over this cap. */
+export const MAX_UPLOAD_CHUNK_BYTES = 64 * 1024;
+/** Min RAW bytes per uploaded chunk, EXCEPT the final piece of a file.
+ *  Enforced server-side because tiny chunks are a death spiral for the
+ *  model-text transport (live dogfood 2026-07-08: an agent shrank
+ *  8→4→2 KB after one mismatch and hit the per-message output ceiling
+ *  before finishing): every extra call costs a full model turn AND all
+ *  payloads count against ONE assistant message's max length. */
+export const MIN_UPLOAD_CHUNK_BYTES = 16 * 1024;
+/** Idle TTL for an open upload session — refreshed on every accepted
+ *  chunk, so it measures INACTIVITY, not total duration. Live dogfood
+ *  2026-07-08: a fixed 1 h total expired twice mid-upload because the
+ *  chat channel's real cadence includes approval prompts, max-length
+ *  "Continue" pauses, and the human walking away. */
+export const UPLOAD_SESSION_TTL_MS = 6 * 60 * 60 * 1000;
+/** Absolute cap on an upload session's lifetime from creation — bounds
+ *  the rolling idle-refresh so periodically-pinged sessions can't hold
+ *  staged bytes forever. */
+export const UPLOAD_SESSION_MAX_LIFETIME_MS = 24 * 60 * 60 * 1000;
+/** Max simultaneously-open upload sessions per user. A session stages up
+ *  to MAX_INLINE_PUBLISH_BYTES, so this bounds per-user staged bytes. */
+export const MAX_OPEN_UPLOAD_SESSIONS_PER_USER = 2;
+/** Max files a single upload-session manifest may declare. */
+export const MAX_UPLOAD_SESSION_FILES = 400;
 //# sourceMappingURL=limits.js.map

package/dist/limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC"}
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzD;;;;;;GAMG;AAEH;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;;iEAKiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;qDAIqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD;;4BAE4B;AAC5B,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElE;yEACyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC"}

package/dist/platform.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Cross-process platform defaults. These are the fallback values used when the
+ * corresponding env var is unset; the authoritative production values live in
+ * infra/docker-compose.yml. Kept here (not in any one package) so the API, the
+ * worker daemon, and the MCP transport agree on a single source of truth
+ * without depending on each other.
+ */
+/** Default PocketBase sidecar image when PERCHER_POCKETBASE_IMAGE is unset. */
+export declare const DEFAULT_POCKETBASE_IMAGE = "percher/pocketbase:0.39.9";
+/** Default app domain suffix when PERCHER_DOMAIN_SUFFIX is unset. */
+export declare const DEFAULT_DOMAIN_SUFFIX = "percher.run";
+/** Default hosted-MCP HTTP port when PERCHER_MCP_HTTP_PORT is unset. */
+export declare const DEFAULT_MCP_HTTP_PORT = 8787;
+//# sourceMappingURL=platform.d.ts.map

package/dist/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,OAAO,CAAC"}

package/dist/platform.js

@@ -0,0 +1,14 @@
+/**
+ * Cross-process platform defaults. These are the fallback values used when the
+ * corresponding env var is unset; the authoritative production values live in
+ * infra/docker-compose.yml. Kept here (not in any one package) so the API, the
+ * worker daemon, and the MCP transport agree on a single source of truth
+ * without depending on each other.
+ */
+/** Default PocketBase sidecar image when PERCHER_POCKETBASE_IMAGE is unset. */
+export const DEFAULT_POCKETBASE_IMAGE = "percher/pocketbase:0.39.9";
+/** Default app domain suffix when PERCHER_DOMAIN_SUFFIX is unset. */
+export const DEFAULT_DOMAIN_SUFFIX = "percher.run";
+/** Default hosted-MCP HTTP port when PERCHER_MCP_HTTP_PORT is unset. */
+export const DEFAULT_MCP_HTTP_PORT = 8787;
+//# sourceMappingURL=platform.js.map

package/dist/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC"}

package/dist/waitlist.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Rolling window for the waitlist's per-IP throttle.
+ *
+ * It is also, exactly, how long that IP address is kept. The waitlist row holds
+ * an email address and the IP the submission came from, and the IP has ONE
+ * purpose: counting a single submitter's inserts inside this window. Once the
+ * window has passed the value can never be read again, so keeping it is storage
+ * without a purpose (GDPR Art. 5.1.b/e) next to an email address that identifies
+ * the person — which is what makes the pair worth separating on a clock.
+ *
+ * Lives in `@percher/shared` because two processes act on it and they must not
+ * drift: the dashboard enforces the throttle and clears expired IPs on each
+ * submission, and the API's retention sweep clears them when submissions stop.
+ * A backstop shorter than the throttle window would delete IPs the throttle
+ * still needs and silently stop rate-limiting.
+ */
+export declare const WAITLIST_THROTTLE_WINDOW_MS: number;
+//# sourceMappingURL=waitlist.d.ts.map

package/dist/waitlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waitlist.d.ts","sourceRoot":"","sources":["../src/waitlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B,QAAiB,CAAC"}

package/dist/waitlist.js

@@ -0,0 +1,18 @@
+/**
+ * Rolling window for the waitlist's per-IP throttle.
+ *
+ * It is also, exactly, how long that IP address is kept. The waitlist row holds
+ * an email address and the IP the submission came from, and the IP has ONE
+ * purpose: counting a single submitter's inserts inside this window. Once the
+ * window has passed the value can never be read again, so keeping it is storage
+ * without a purpose (GDPR Art. 5.1.b/e) next to an email address that identifies
+ * the person — which is what makes the pair worth separating on a clock.
+ *
+ * Lives in `@percher/shared` because two processes act on it and they must not
+ * drift: the dashboard enforces the throttle and clears expired IPs on each
+ * submission, and the API's retention sweep clears them when submissions stop.
+ * A backstop shorter than the throttle window would delete IPs the throttle
+ * still needs and silently stop rate-limiting.
+ */
+export const WAITLIST_THROTTLE_WINDOW_MS = 60 * 60 * 1000;
+//# sourceMappingURL=waitlist.js.map

package/dist/waitlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waitlist.js","sourceRoot":"","sources":["../src/waitlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@percher/shared",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Shared constants and contracts (timeouts, etc.) used across the Percher CLI, API, MCP, and worker. Internal — values change in lockstep across packages.",
   "type": "module",
   "main": "./dist/index.js",