@percher/shared 0.1.8 → 1.0.0

package/LICENSE

@@ -0,0 +1,132 @@
+# Scope and exceptions
+
+This licence applies to Percher-authored source, tests, scripts, configuration
+and generated artefacts in this package, whether published or unpublished.
+Versions below 1.0.0 retain their original MIT grants; version 1.0.0 and later
+use FSL-1.1-MIT. Earlier MIT permissions are not revoked or withdrawn.
+
+Scaffold payloads from packages/core/templates and AI instruction payloads
+from packages/core/src/templates/ai-files and docs/CLAUDE.md, including their distributed copies
+and generated output, are licensed under 0BSD, as carried with those payloads.
+This exception does not change the licence of a customer's existing project.
+
+Third-party components retain their own licences, including components named
+in THIRD-PARTY-NOTICES.txt and the Apache-2.0 fixture files enumerated in
+packages/core/test/fixtures/supabase-apps/*/SOURCES.md under their own LICENSE.
+FSL does not relicense those components. packages/mark is private and excluded
+from all MIT, 0BSD and FSL grants here.
+
+In case of overlap, third-party component licences take precedence, followed
+by packages/mark/LICENSE, the 0BSD payload exception, this package LICENSE,
+and finally the repository root LICENSE.
+
+# Functional Source License, Version 1.1, MIT Future License
+
+## Abbreviation
+
+FSL-1.1-MIT
+
+## Notice
+
+Copyright 2026 Mattias Malmborg
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the MIT license that is effective on the second anniversary of the date we make
+the Software available. On or after that date, you may use the Software under
+the MIT license, in which case the following will apply:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/brand.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Brand colours for the places that CANNOT read a CSS variable.
+ *
+ * The palette's real home is `apps/dashboard/app/theme.css`, and anything
+ * rendering inside `.pc-theme` must keep using `var(--pc-primary)` and friends
+ * — those adapt per theme, these cannot. This file exists for the contexts
+ * where a custom property never resolves:
+ *
+ *   - HTML email (no CSS variable support in most clients)
+ *   - satori OG images (renders to a bitmap, no cascade)
+ *   - downloadable artifacts: PWA manifests, icon files, the Caddy badge
+ *   - pages served outside the dashboard's React tree (the app password gate)
+ *   - `var(--token, fallback)` fallbacks, for the moment before the sheet loads
+ *
+ * Before this existed those contexts each kept their own literal, and they
+ * drifted: thirteen email templates, the password gate and the customer-facing
+ * manifest generator were all still painting `#2d6a4f` — a green that has never
+ * matched `--pc-primary` in any version of the v2 palette.
+ *
+ * `apps/dashboard/test/lib/brand-tokens.test.ts` parses theme.css and fails if
+ * any value here disagrees with it, so the two cannot drift apart again
+ * silently. If that test fails, theme.css is right and this file is stale.
+ *
+ * Colours only. The mark's geometry lives in `@percher/mark`, a private
+ * workspace package with its own proprietary LICENSE, because this package is
+ * published to npm and the artwork must not be inside anything that carries a
+ * copying grant. Hex values are not the thing being protected, and published
+ * `@percher/core/appstore-artifacts` needs `iconColourHex` to build the user's
+ * own PWA manifest, so the palette stays here and ships.
+ */
+export declare const BRAND: {
+    /** `--pc-primary`, light theme. The green in every email and manifest. */
+    readonly green: "#2e8055";
+    /** `--pc-primary`, dark theme. OG cards and the dark PWA icons are dark-only. */
+    readonly greenDark: "#4faa7d";
+    /** `--pc-accent`, light theme. */
+    readonly pink: "#d4004c";
+    /** `--pc-accent`, dark theme. */
+    readonly pinkDark: "#e26a8d";
+    /** `--pc-accent-bg` / `--pc-accent-text`, light — only needed as fallbacks. */
+    readonly pinkTint: "#fce8ee";
+    /** Ink on a light surface — `--pc-fg`. */
+    readonly ink: "#33291d";
+};
+/**
+ * The owner-pickable icon colours, keyed by the value stored in the apps
+ * table's `icon_colour` column.
+ *
+ * NOTE the `terracotta` key. The colour it names became pink when the accent
+ * moved; the key did not, because it is persisted data and renaming it is a
+ * migration, not a rename. Read it as "the secondary accent" — the label shown
+ * in the picker is defined separately, and does say Pink.
+ */
+export declare const ICON_COLOURS: {
+    readonly green: "#2e8055";
+    readonly terracotta: "#d4004c";
+    readonly blue: "#4a6fa4";
+    readonly purple: "#6e4dba";
+    readonly olive: "#b8923a";
+};
+export type IconColourKey = keyof typeof ICON_COLOURS;
+/** Resolve a stored `icon_colour` to a hex, falling back to the brand green. */
+export declare function iconColourHex(token: string | null | undefined): string;
+//# sourceMappingURL=brand.d.ts.map

package/dist/brand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand.d.ts","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,eAAO,MAAM,KAAK;IAChB,0EAA0E;aAC1E,KAAK,EAAE,SAAS;IAChB,iFAAiF;aACjF,SAAS,EAAE,SAAS;IACpB,kCAAkC;aAClC,IAAI,EAAE,SAAS;IACf,iCAAiC;aACjC,QAAQ,EAAE,SAAS;IACnB,+EAA+E;aAC/E,QAAQ,EAAE,SAAS;IACnB,0CAA0C;aAC1C,GAAG,EAAE,SAAS;CACN,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY;aACvB,KAAK;aACL,UAAU;aACV,IAAI,EAAE,SAAS;aACf,MAAM,EAAE,SAAS;aACjB,KAAK,EAAE,SAAS;CACR,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,YAAY,CAAC;AAEtD,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGtE"}

package/dist/brand.js

@@ -0,0 +1,67 @@
+/**
+ * Brand colours for the places that CANNOT read a CSS variable.
+ *
+ * The palette's real home is `apps/dashboard/app/theme.css`, and anything
+ * rendering inside `.pc-theme` must keep using `var(--pc-primary)` and friends
+ * — those adapt per theme, these cannot. This file exists for the contexts
+ * where a custom property never resolves:
+ *
+ *   - HTML email (no CSS variable support in most clients)
+ *   - satori OG images (renders to a bitmap, no cascade)
+ *   - downloadable artifacts: PWA manifests, icon files, the Caddy badge
+ *   - pages served outside the dashboard's React tree (the app password gate)
+ *   - `var(--token, fallback)` fallbacks, for the moment before the sheet loads
+ *
+ * Before this existed those contexts each kept their own literal, and they
+ * drifted: thirteen email templates, the password gate and the customer-facing
+ * manifest generator were all still painting `#2d6a4f` — a green that has never
+ * matched `--pc-primary` in any version of the v2 palette.
+ *
+ * `apps/dashboard/test/lib/brand-tokens.test.ts` parses theme.css and fails if
+ * any value here disagrees with it, so the two cannot drift apart again
+ * silently. If that test fails, theme.css is right and this file is stale.
+ *
+ * Colours only. The mark's geometry lives in `@percher/mark`, a private
+ * workspace package with its own proprietary LICENSE, because this package is
+ * published to npm and the artwork must not be inside anything that carries a
+ * copying grant. Hex values are not the thing being protected, and published
+ * `@percher/core/appstore-artifacts` needs `iconColourHex` to build the user's
+ * own PWA manifest, so the palette stays here and ships.
+ */
+export const BRAND = {
+    /** `--pc-primary`, light theme. The green in every email and manifest. */
+    green: "#2e8055",
+    /** `--pc-primary`, dark theme. OG cards and the dark PWA icons are dark-only. */
+    greenDark: "#4faa7d",
+    /** `--pc-accent`, light theme. */
+    pink: "#d4004c",
+    /** `--pc-accent`, dark theme. */
+    pinkDark: "#e26a8d",
+    /** `--pc-accent-bg` / `--pc-accent-text`, light — only needed as fallbacks. */
+    pinkTint: "#fce8ee",
+    /** Ink on a light surface — `--pc-fg`. */
+    ink: "#33291d",
+};
+/**
+ * The owner-pickable icon colours, keyed by the value stored in the apps
+ * table's `icon_colour` column.
+ *
+ * NOTE the `terracotta` key. The colour it names became pink when the accent
+ * moved; the key did not, because it is persisted data and renaming it is a
+ * migration, not a rename. Read it as "the secondary accent" — the label shown
+ * in the picker is defined separately, and does say Pink.
+ */
+export const ICON_COLOURS = {
+    green: BRAND.green,
+    terracotta: BRAND.pink,
+    blue: "#4a6fa4",
+    purple: "#6e4dba",
+    olive: "#b8923a",
+};
+/** Resolve a stored `icon_colour` to a hex, falling back to the brand green. */
+export function iconColourHex(token) {
+    if (!token)
+        return BRAND.green;
+    return ICON_COLOURS[token] ?? BRAND.green;
+}
+//# sourceMappingURL=brand.js.map

package/dist/brand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand.js","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,0EAA0E;IAC1E,KAAK,EAAE,SAAS;IAChB,iFAAiF;IACjF,SAAS,EAAE,SAAS;IACpB,kCAAkC;IAClC,IAAI,EAAE,SAAS;IACf,iCAAiC;IACjC,QAAQ,EAAE,SAAS;IACnB,+EAA+E;IAC/E,QAAQ,EAAE,SAAS;IACnB,0CAA0C;IAC1C,GAAG,EAAE,SAAS;CACN,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,UAAU,EAAE,KAAK,CAAC,IAAI;IACtB,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,SAAS;CACR,CAAC;AAIX,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IAC/B,OAAO,YAAY,CAAC,KAAsB,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC;AAC7D,CAAC"}

package/dist/client-ip-attestation.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Wire contract for a signed, single-use client-IP attestation on the
+ * dashboard -> API hop.
+ *
+ * The API decides a request's rate-limit / audit IP from `X-Real-IP`, trusted
+ * only behind Caddy's `X-Percher-Edge` marker. That marker is a REUSABLE bearer:
+ * whoever holds it can assert any IP, on any request, forever. It is the right
+ * shape for Caddy (one hop, config-injected, nothing else to work with), and the
+ * wrong shape for a service forwarding an end user's IP — an observer of one
+ * cleartext control-network request could lift it and re-assert it with an IP of
+ * their choosing, forging attribution and smearing rate limits.
+ *
+ * So a service that HOLDS the internal secret proves the IP instead of bearing a
+ * token for it: an HMAC over (version, ip, timestamp). Three properties follow,
+ * and all three are the point:
+ *
+ *  - it is bound to ONE ip — a captured attestation re-asserts that same
+ *    address and nothing else, so it cannot be aimed at a victim;
+ *  - it is bound to a timestamp — replay dies with the skew window, rather
+ *    than lasting until the internal secret is rotated;
+ *  - it never puts a long-lived credential on the wire at all.
+ *
+ * A service that holds NO secret (the hosted-MCP transport, deliberately) cannot
+ * sign, and keeps forwarding Caddy's marker; that hop is bounded by the
+ * per-bearer and per-IP limits instead. This module is the single source of the
+ * canonical string so the signer and the verifier cannot drift, and it is
+ * dependency-free (no crypto) so it bundles into the dashboard (Node) as well as
+ * the API (Bun) — the same shape as ./internal-sig.
+ */
+/** The asserted client IP. Meaningless without the proof header below. */
+export declare const CLIENT_IP_HEADER = "X-Percher-Client-IP";
+/** `<unix-ms>.<hex hmac-sha256>` over {@link clientIpAttestationPayload}. */
+export declare const CLIENT_IP_PROOF_HEADER = "X-Percher-Client-IP-Proof";
+/** Canonical-form version, so a verifier can refuse a shape it can't compare. */
+export declare const CLIENT_IP_ATTESTATION_VERSION = "v1";
+/**
+ * Replay window. Deliberately much tighter than the 5 minutes `/internal/*`
+ * signing allows: the signer and verifier are two containers on one host with
+ * no meaningful clock skew, and the only thing a replay buys is re-asserting an
+ * IP that genuinely just made a request — so there is no reason to leave the
+ * door open for minutes.
+ */
+export declare const CLIENT_IP_ATTESTATION_MAX_SKEW_MS = 60000;
+/** Longest asserted IP accepted. An IPv6 address with a zone fits in 45. */
+export declare const CLIENT_IP_MAX_LENGTH = 45;
+export interface ClientIpAttestationParts {
+    /** The end user's address, exactly as it will be sent. */
+    ip: string;
+    /** The value placed in the proof header, stringified verbatim so the
+     *  verifier signs the exact bytes — no Number round-trip. */
+    timestamp: number | string;
+}
+/** The exact string both the signer and the verifier feed to HMAC-SHA256. */
+export declare function clientIpAttestationPayload(parts: ClientIpAttestationParts): string;
+/** Assemble the proof header value. */
+export declare function formatClientIpProof(timestamp: number | string, signature: string): string;
+/**
+ * Split a proof header back into its parts, or null when it is not the
+ * `<digits>.<hex>` shape. Returning null (rather than throwing) keeps a
+ * malformed header indistinguishable from an absent one at the call site: both
+ * mean "not attested", which is the safe reading.
+ */
+export declare function parseClientIpProof(raw: string | null | undefined): {
+    timestamp: string;
+    signature: string;
+} | null;
+//# sourceMappingURL=client-ip-attestation.d.ts.map

package/dist/client-ip-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip-attestation.d.ts","sourceRoot":"","sources":["../src/client-ip-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AACtD,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAElE,iFAAiF;AACjF,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,QAAS,CAAC;AAExD,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX;iEAC6D;IAC7D,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CAC5B;AAED,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAElF;AAED,uCAAuC;AACvC,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7B;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASjD"}

package/dist/client-ip-attestation.js

@@ -0,0 +1,74 @@
+/**
+ * Wire contract for a signed, single-use client-IP attestation on the
+ * dashboard -> API hop.
+ *
+ * The API decides a request's rate-limit / audit IP from `X-Real-IP`, trusted
+ * only behind Caddy's `X-Percher-Edge` marker. That marker is a REUSABLE bearer:
+ * whoever holds it can assert any IP, on any request, forever. It is the right
+ * shape for Caddy (one hop, config-injected, nothing else to work with), and the
+ * wrong shape for a service forwarding an end user's IP — an observer of one
+ * cleartext control-network request could lift it and re-assert it with an IP of
+ * their choosing, forging attribution and smearing rate limits.
+ *
+ * So a service that HOLDS the internal secret proves the IP instead of bearing a
+ * token for it: an HMAC over (version, ip, timestamp). Three properties follow,
+ * and all three are the point:
+ *
+ *  - it is bound to ONE ip — a captured attestation re-asserts that same
+ *    address and nothing else, so it cannot be aimed at a victim;
+ *  - it is bound to a timestamp — replay dies with the skew window, rather
+ *    than lasting until the internal secret is rotated;
+ *  - it never puts a long-lived credential on the wire at all.
+ *
+ * A service that holds NO secret (the hosted-MCP transport, deliberately) cannot
+ * sign, and keeps forwarding Caddy's marker; that hop is bounded by the
+ * per-bearer and per-IP limits instead. This module is the single source of the
+ * canonical string so the signer and the verifier cannot drift, and it is
+ * dependency-free (no crypto) so it bundles into the dashboard (Node) as well as
+ * the API (Bun) — the same shape as ./internal-sig.
+ */
+/** The asserted client IP. Meaningless without the proof header below. */
+export const CLIENT_IP_HEADER = "X-Percher-Client-IP";
+/** `<unix-ms>.<hex hmac-sha256>` over {@link clientIpAttestationPayload}. */
+export const CLIENT_IP_PROOF_HEADER = "X-Percher-Client-IP-Proof";
+/** Canonical-form version, so a verifier can refuse a shape it can't compare. */
+export const CLIENT_IP_ATTESTATION_VERSION = "v1";
+/**
+ * Replay window. Deliberately much tighter than the 5 minutes `/internal/*`
+ * signing allows: the signer and verifier are two containers on one host with
+ * no meaningful clock skew, and the only thing a replay buys is re-asserting an
+ * IP that genuinely just made a request — so there is no reason to leave the
+ * door open for minutes.
+ */
+export const CLIENT_IP_ATTESTATION_MAX_SKEW_MS = 60_000;
+/** Longest asserted IP accepted. An IPv6 address with a zone fits in 45. */
+export const CLIENT_IP_MAX_LENGTH = 45;
+/** The exact string both the signer and the verifier feed to HMAC-SHA256. */
+export function clientIpAttestationPayload(parts) {
+    return [CLIENT_IP_ATTESTATION_VERSION, parts.ip, String(parts.timestamp)].join("\n");
+}
+/** Assemble the proof header value. */
+export function formatClientIpProof(timestamp, signature) {
+    return `${timestamp}.${signature}`;
+}
+/**
+ * Split a proof header back into its parts, or null when it is not the
+ * `<digits>.<hex>` shape. Returning null (rather than throwing) keeps a
+ * malformed header indistinguishable from an absent one at the call site: both
+ * mean "not attested", which is the safe reading.
+ */
+export function parseClientIpProof(raw) {
+    if (!raw)
+        return null;
+    const dot = raw.indexOf(".");
+    if (dot <= 0 || dot === raw.length - 1)
+        return null;
+    const timestamp = raw.slice(0, dot);
+    const signature = raw.slice(dot + 1);
+    if (!/^\d{1,15}$/.test(timestamp))
+        return null;
+    if (!/^[0-9a-f]{64}$/i.test(signature))
+        return null;
+    return { timestamp, signature };
+}
+//# sourceMappingURL=client-ip-attestation.js.map

package/dist/client-ip-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip-attestation.js","sourceRoot":"","sources":["../src/client-ip-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AACtD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAElE,iFAAiF;AACjF,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAExD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAUvC,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CAAC,KAA+B;IACxE,OAAO,CAAC,6BAA6B,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,mBAAmB,CAAC,SAA0B,EAAE,SAAiB;IAC/E,OAAO,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA8B;IAE9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC"}

package/dist/index.d.ts

@@ -1,10 +1,17 @@
 export { APP_NAME_RE } from "./app-name.js";
+export { BRAND, ICON_COLOURS, type IconColourKey, iconColourHex } from "./brand.js";
+export { CLIENT_IP_ATTESTATION_MAX_SKEW_MS, CLIENT_IP_ATTESTATION_VERSION, CLIENT_IP_HEADER, CLIENT_IP_MAX_LENGTH, CLIENT_IP_PROOF_HEADER, type ClientIpAttestationParts, clientIpAttestationPayload, formatClientIpProof, parseClientIpProof, } from "./client-ip-attestation.js";
 export { INTERNAL_SIG_HEADER, INTERNAL_SIG_MAX_SKEW_MS, INTERNAL_SIG_VERSION, INTERNAL_TS_HEADER, type InternalSigParts, internalSigPayload, } from "./internal-sig.js";
-export { MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MIN_UPLOAD_CHUNK_BYTES, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
+export { CURRENT_TERMS_VERSION, LEGAL_DOCUMENT_HASHES, LEGAL_DOCUMENT_LAST_UPDATED, LEGAL_DOCUMENT_VERSIONS, type TermsAcceptanceEvidence, } from "./legal.js";
+export { canonicalLegalChangeJson, compareVersions, declaredVersion, LEGAL_CHANGE_ID_PATTERN, LEGAL_CHANGES, LEGAL_VERSION_PATTERN, type LegalChange, type LegalChangeDocument, type LegalChangeEnforcement, type LegalChangeReason, type LegalDocumentKey, MATERIAL_CHANGE_NOTICE_MS, openMaterialChanges, pendingAcknowledgement, SIGNUP_DISCLOSURE_HEADER, } from "./legal-changes.js";
+export { MAX_ANON_TARBALL_BYTES, MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MIN_UPLOAD_CHUNK_BYTES, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
 export { MAX_LOG_SEARCH_LENGTH } from "./logs.js";
-export { DEFAULT_DOMAIN_SUFFIX, DEFAULT_MCP_HTTP_PORT, DEFAULT_POCKETBASE_IMAGE, } from "./platform.js";
+export { MAX_OAUTH_CLIENT_NAME_DISPLAY_CODE_POINTS, normaliseOAuthClientName, } from "./oauth-client-name.js";
+export { describeOAuthScope, OAUTH_SCOPE_LABELS, parseOAuthScopes } from "./oauth-scopes.js";
+export { DEFAULT_DOMAIN_SUFFIX, DEFAULT_MCP_HTTP_PORT, DEFAULT_POCKETBASE_IMAGE, MCP_TOOL_COUNT_HOSTED, MCP_TOOL_COUNT_LOCAL, } from "./platform.js";
 export { canonicalInjectedKey, isPercherInjected, PERCHER_INJECTED_ENV_KEYS, } from "./platform-env.js";
 export { DEFAULT_NODE_VERSION_LABEL, DEFAULT_NODE_VERSION_MAJOR } from "./runtime.js";
-export { TIMEOUTS, type TimeoutKey } from "./timeouts.js";
+export { normalizeSignupInviteCode, SIGNUP_INVITE_CODE_ALPHABET, SIGNUP_INVITE_CODE_LENGTH, SIGNUP_INVITE_CODE_PREFIX, SIGNUP_INVITE_HEADER, } from "./signup-invite.js";
+export { BUN_MAX_IDLE_TIMEOUT_SECONDS, HTTP_IDLE_TIMEOUT_SECONDS, type HttpIdleTimeoutSurface, TIMEOUTS, type TimeoutKey, } from "./timeouts.js";
 export { WAITLIST_THROTTLE_WINDOW_MS } from "./waitlist.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,QAAQ,EACR,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,10 +1,17 @@
 export { APP_NAME_RE } from "./app-name.js";
+export { BRAND, ICON_COLOURS, iconColourHex } from "./brand.js";
+export { CLIENT_IP_ATTESTATION_MAX_SKEW_MS, CLIENT_IP_ATTESTATION_VERSION, CLIENT_IP_HEADER, CLIENT_IP_MAX_LENGTH, CLIENT_IP_PROOF_HEADER, clientIpAttestationPayload, formatClientIpProof, parseClientIpProof, } from "./client-ip-attestation.js";
 export { INTERNAL_SIG_HEADER, INTERNAL_SIG_MAX_SKEW_MS, INTERNAL_SIG_VERSION, INTERNAL_TS_HEADER, internalSigPayload, } from "./internal-sig.js";
-export { MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MIN_UPLOAD_CHUNK_BYTES, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
+export { CURRENT_TERMS_VERSION, LEGAL_DOCUMENT_HASHES, LEGAL_DOCUMENT_LAST_UPDATED, LEGAL_DOCUMENT_VERSIONS, } from "./legal.js";
+export { canonicalLegalChangeJson, compareVersions, declaredVersion, LEGAL_CHANGE_ID_PATTERN, LEGAL_CHANGES, LEGAL_VERSION_PATTERN, MATERIAL_CHANGE_NOTICE_MS, openMaterialChanges, pendingAcknowledgement, SIGNUP_DISCLOSURE_HEADER, } from "./legal-changes.js";
+export { MAX_ANON_TARBALL_BYTES, MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MIN_UPLOAD_CHUNK_BYTES, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
 export { MAX_LOG_SEARCH_LENGTH } from "./logs.js";
-export { DEFAULT_DOMAIN_SUFFIX, DEFAULT_MCP_HTTP_PORT, DEFAULT_POCKETBASE_IMAGE, } from "./platform.js";
+export { MAX_OAUTH_CLIENT_NAME_DISPLAY_CODE_POINTS, normaliseOAuthClientName, } from "./oauth-client-name.js";
+export { describeOAuthScope, OAUTH_SCOPE_LABELS, parseOAuthScopes } from "./oauth-scopes.js";
+export { DEFAULT_DOMAIN_SUFFIX, DEFAULT_MCP_HTTP_PORT, DEFAULT_POCKETBASE_IMAGE, MCP_TOOL_COUNT_HOSTED, MCP_TOOL_COUNT_LOCAL, } from "./platform.js";
 export { canonicalInjectedKey, isPercherInjected, PERCHER_INJECTED_ENV_KEYS, } from "./platform-env.js";
 export { DEFAULT_NODE_VERSION_LABEL, DEFAULT_NODE_VERSION_MAJOR } from "./runtime.js";
-export { TIMEOUTS } from "./timeouts.js";
+export { normalizeSignupInviteCode, SIGNUP_INVITE_CODE_ALPHABET, SIGNUP_INVITE_CODE_LENGTH, SIGNUP_INVITE_CODE_PREFIX, SIGNUP_INVITE_HEADER, } from "./signup-invite.js";
+export { BUN_MAX_IDLE_TIMEOUT_SECONDS, HTTP_IDLE_TIMEOUT_SECONDS, TIMEOUTS, } from "./timeouts.js";
 export { WAITLIST_THROTTLE_WINDOW_MS } from "./waitlist.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAElB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAmB,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAsB,aAAa,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EAEtB,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAElB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,GAExB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EAMrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EAEzB,QAAQ,GAET,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}

package/dist/legal-changes.d.ts

@@ -0,0 +1,118 @@
+import { LEGAL_DOCUMENT_VERSIONS } from "./legal.js";
+/**
+ * The declared history of changes to the published legal documents.
+ *
+ * The Terms and the AUP promise every account holder an email at least 30 days
+ * before a material change takes effect, and a free way out during that window.
+ * This array is the machinery behind that promise: the notifier job, the public
+ * updates list and the review-time guard all read it, so a delivered email, a
+ * published page and the document's own `**Version:**` header cannot disagree.
+ *
+ * Materiality is a person's decision recorded in a reviewed commit. Nothing here
+ * is derived from a diff, and there is deliberately no heuristic: the only way
+ * that judgement can fail is by quietly downgrading a change to someone's rights
+ * into a typo fix, and a classifier would fail in exactly that direction.
+ *
+ * An entry is frozen once its notice has been sent. Editing it would make a
+ * delivered email untrue, so the job stores a hash on first send and refuses to
+ * send more notices for that change if the hash stops matching.
+ */
+/** Why we are permitted to make the change. Annex 1(j) of 93/13 wants this stated. */
+export type LegalChangeReason = "legal_compliance" | "security" | "abuse_prevention" | "service_change" | "provider_change" | "clarification";
+/**
+ * How the change binds.
+ *
+ * `notice_only` is the default and the only tier the platform implements:
+ * notice, a free exit, and continued use on or after the effective date is
+ * acceptance of the amended terms. The other two exist so that a change needing
+ * affirmative agreement has somewhere to live rather than being smuggled through
+ * the silence path. `consent_required` in particular covers anything resting on
+ * a GDPR consent basis, where silence is categorically invalid, and anything
+ * touching price or the subject matter of the contract.
+ */
+export type LegalChangeEnforcement = "notice_only" | "acknowledge_required" | "consent_required";
+export type LegalDocumentKey = keyof typeof LEGAL_DOCUMENT_VERSIONS;
+export interface LegalChangeDocument {
+    key: LegalDocumentKey;
+    /** The version this document carried before the change. */
+    from: string;
+    /** The version it carries after. Must equal LEGAL_DOCUMENT_VERSIONS[key] for the latest entry. */
+    to: string;
+}
+export interface LegalChange {
+    /** `YYYY-MM-DD-slug`. The date half is the effective date, so an id reads as a promise. */
+    id: string;
+    /** The human decision. An editorial change never sends an email. */
+    materiality: "material" | "editorial";
+    reason: LegalChangeReason;
+    enforcement: LegalChangeEnforcement;
+    /** ISO instant, UTC. When the notice may start going out. */
+    announceAt: string;
+    /** ISO instant, UTC. When the new documents govern. */
+    effectiveAt: string;
+    /** Every document whose version header moves in this change. */
+    documents: readonly LegalChangeDocument[];
+    /**
+     * Authored plain text, both languages, rendered escaped. A Swedish operator
+     * publishing Swedish documents may not send an English-only notice about them.
+     */
+    summary: {
+        en: string;
+        sv: string;
+    };
+    /** Set when the same change also modifies the Service itself (2019/770 Art. 19). */
+    modifiesService?: boolean;
+}
+/**
+ * Newest last. Empty because version 1.0 is the first publication under
+ * Kaizensu AB: there is no earlier version to have changed from, so the chain
+ * starts here rather than being backfilled with a notice nobody was owed.
+ */
+export declare const LEGAL_CHANGES: readonly LegalChange[];
+/**
+ * Header carrying the change ids the signup form actually rendered.
+ *
+ * Same channel as the terms-acceptance header, for the same reason: the signup
+ * flow returns no session when email verification is required, so a follow-up
+ * authenticated POST would be refused and the evidence lost. Comma-separated,
+ * and never trusted on its own — the server intersects it with what it can
+ * independently see was disclosable.
+ */
+export declare const SIGNUP_DISCLOSURE_HEADER = "x-percher-disclosed-changes";
+/** The notice period the documents promise, in milliseconds. */
+export declare const MATERIAL_CHANGE_NOTICE_MS: number;
+/** `id` shape: the date half is parsed, so this is a gate and not decoration. */
+export declare const LEGAL_CHANGE_ID_PATTERN: RegExp;
+/** Versions are `1.0` or `1.0.1`; an editorial change may only move the last component. */
+export declare const LEGAL_VERSION_PATTERN: RegExp;
+/**
+ * The canonical JSON of an entry, for the hash that freezes it after the first
+ * send. Keys are emitted in a fixed order rather than insertion order so that
+ * reformatting the source cannot invalidate a change already announced.
+ */
+export declare function canonicalLegalChangeJson(change: LegalChange): string;
+/** Entries whose notice may go out now: material, announced, newest last. */
+export declare function openMaterialChanges(now: number, changes?: readonly LegalChange[]): LegalChange[];
+/**
+ * The latest declared version of a document, or its current published version
+ * when no change has ever named it.
+ */
+export declare function declaredVersion(key: LegalDocumentKey, changes?: readonly LegalChange[]): string;
+/**
+ * Order two `1.0` / `1.0.1` strings. Unparseable input sorts as older, so a
+ * version we cannot read never suppresses a notice.
+ */
+export declare function compareVersions(left: string, right: string): number;
+/**
+ * The change a user has not yet acknowledged, if any.
+ *
+ * Read by the dashboard banner and by the operator dry-run. Deliberately NOT
+ * read by the API's auth middleware: a stale accepted version is never an
+ * authorization failure. Extending the 403 to a version comparison would break
+ * every customer's deploy pipeline and every agent integration on a chosen
+ * date, with the remedy being a browser click a CI runner cannot perform — and
+ * it would be stricter than the Terms promise, which make continued use the
+ * acceptance. A test in the API asserts that absence.
+ */
+export declare function pendingAcknowledgement(acceptedTermsVersion: string | null | undefined, now: number, changes?: readonly LegalChange[]): LegalChange | null;
+//# sourceMappingURL=legal-changes.d.ts.map

package/dist/legal-changes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-changes.d.ts","sourceRoot":"","sources":["../src/legal-changes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AAEH,sFAAsF;AACtF,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,UAAU,GACV,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,sBAAsB,GAAG,kBAAkB,CAAC;AAEjG,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,uBAAuB,CAAC;AAEpE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,gBAAgB,CAAC;IACtB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,2FAA2F;IAC3F,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,WAAW,EAAE,UAAU,GAAG,WAAW,CAAC;IACtC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,WAAW,EAAE,sBAAsB,CAAC;IACpC,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC1C;;;OAGG;IACH,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAAO,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;AAEtE,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,QAA2B,CAAC;AAElE,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAiD,CAAC;AAEtF,2FAA2F;AAC3F,eAAO,MAAM,qBAAqB,QAAyB,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAgBpE;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,SAAS,WAAW,EAAkB,GAC9C,WAAW,EAAE,CAIf;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,OAAO,GAAE,SAAS,WAAW,EAAkB,GAC9C,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA6BnE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/C,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,SAAS,WAAW,EAAkB,GAC9C,WAAW,GAAG,IAAI,CAiBpB"}