@percher/shared 0.1.8 → 1.0.0

package/dist/legal-changes.js

@@ -0,0 +1,135 @@
+import { LEGAL_DOCUMENT_VERSIONS } from "./legal.js";
+/**
+ * Newest last. Empty because version 1.0 is the first publication under
+ * Kaizensu AB: there is no earlier version to have changed from, so the chain
+ * starts here rather than being backfilled with a notice nobody was owed.
+ */
+export const LEGAL_CHANGES = [];
+/**
+ * Header carrying the change ids the signup form actually rendered.
+ *
+ * Same channel as the terms-acceptance header, for the same reason: the signup
+ * flow returns no session when email verification is required, so a follow-up
+ * authenticated POST would be refused and the evidence lost. Comma-separated,
+ * and never trusted on its own — the server intersects it with what it can
+ * independently see was disclosable.
+ */
+export const SIGNUP_DISCLOSURE_HEADER = "x-percher-disclosed-changes";
+/** The notice period the documents promise, in milliseconds. */
+export const MATERIAL_CHANGE_NOTICE_MS = 30 * 24 * 60 * 60 * 1000;
+/** `id` shape: the date half is parsed, so this is a gate and not decoration. */
+export const LEGAL_CHANGE_ID_PATTERN = /^\d{4}-\d{2}-\d{2}-[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** Versions are `1.0` or `1.0.1`; an editorial change may only move the last component. */
+export const LEGAL_VERSION_PATTERN = /^\d+\.\d+(?:\.\d+)?$/;
+/**
+ * The canonical JSON of an entry, for the hash that freezes it after the first
+ * send. Keys are emitted in a fixed order rather than insertion order so that
+ * reformatting the source cannot invalidate a change already announced.
+ */
+export function canonicalLegalChangeJson(change) {
+    return JSON.stringify({
+        announceAt: change.announceAt,
+        documents: change.documents.map((document) => ({
+            from: document.from,
+            key: document.key,
+            to: document.to,
+        })),
+        effectiveAt: change.effectiveAt,
+        enforcement: change.enforcement,
+        id: change.id,
+        materiality: change.materiality,
+        modifiesService: change.modifiesService === true,
+        reason: change.reason,
+        summary: { en: change.summary.en, sv: change.summary.sv },
+    });
+}
+/** Entries whose notice may go out now: material, announced, newest last. */
+export function openMaterialChanges(now, changes = LEGAL_CHANGES) {
+    return changes.filter((change) => change.materiality === "material" && Date.parse(change.announceAt) <= now);
+}
+/**
+ * The latest declared version of a document, or its current published version
+ * when no change has ever named it.
+ */
+export function declaredVersion(key, changes = LEGAL_CHANGES) {
+    for (let index = changes.length - 1; index >= 0; index -= 1) {
+        const document = changes[index]?.documents.find((entry) => entry.key === key);
+        if (document)
+            return document.to;
+    }
+    return LEGAL_DOCUMENT_VERSIONS[key];
+}
+/**
+ * Order two `1.0` / `1.0.1` strings. Unparseable input sorts as older, so a
+ * version we cannot read never suppresses a notice.
+ */
+export function compareVersions(left, right) {
+    // Components are compared as digit strings, never parsed to numbers. The
+    // pattern accepts a component of any length, and Number.parseInt collapses
+    // anything past the safe-integer range onto the same value: two different
+    // versions would then read as equal, and pendingAcknowledgement would clear a
+    // banner for a change nobody had acknowledged. Leading zeros are stripped
+    // first, so `01` and `1` stay the same version.
+    const parse = (value) => {
+        if (!LEGAL_VERSION_PATTERN.test(value))
+            return null;
+        const parts = value.split(".");
+        const normalize = (part) => (part ?? "0").replace(/^0+(?=\d)/, "");
+        return [normalize(parts[0]), normalize(parts[1]), normalize(parts[2])];
+    };
+    // Longer digit string wins; equal length falls back to lexicographic order,
+    // which is numeric order once both are the same width.
+    const order = (a, b) => {
+        if (a.length !== b.length)
+            return a.length > b.length ? 1 : -1;
+        if (a === b)
+            return 0;
+        return a > b ? 1 : -1;
+    };
+    const a = parse(left);
+    const b = parse(right);
+    if (!a)
+        return b ? -1 : 0;
+    if (!b)
+        return 1;
+    for (let index = 0; index < 3; index += 1) {
+        const difference = order(a[index] ?? "0", b[index] ?? "0");
+        if (difference !== 0)
+            return difference;
+    }
+    return 0;
+}
+/**
+ * The change a user has not yet acknowledged, if any.
+ *
+ * Read by the dashboard banner and by the operator dry-run. Deliberately NOT
+ * read by the API's auth middleware: a stale accepted version is never an
+ * authorization failure. Extending the 403 to a version comparison would break
+ * every customer's deploy pipeline and every agent integration on a chosen
+ * date, with the remedy being a browser click a CI runner cannot perform — and
+ * it would be stricter than the Terms promise, which make continued use the
+ * acceptance. A test in the API asserts that absence.
+ */
+export function pendingAcknowledgement(acceptedTermsVersion, now, changes = LEGAL_CHANGES) {
+    if (!acceptedTermsVersion)
+        return null;
+    for (let index = changes.length - 1; index >= 0; index -= 1) {
+        const change = changes[index];
+        if (change?.materiality !== "material")
+            continue;
+        if (Date.parse(change.effectiveAt) > now)
+            continue;
+        const terms = change.documents.find((entry) => entry.key === "terms");
+        if (!terms)
+            continue;
+        // Accepting a LATER version acknowledges this one. Exact equality looked
+        // right and was not: a material change to 1.1 followed by an editorial
+        // correction to 1.1.1 leaves someone who accepted 1.1.1 staring at a
+        // banner for a change they have demonstrably already agreed to, with no
+        // way to clear it, because the click re-stamps the newest version and the
+        // comparison keeps failing.
+        return compareVersions(acceptedTermsVersion, terms.to) >= 0 ? null : change;
+    }
+    return null;
+}
+//# sourceMappingURL=legal-changes.js.map

package/dist/legal-changes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-changes.js","sourceRoot":"","sources":["../src/legal-changes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AA2ElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B,EAAE,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAEtE,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElE,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,8CAA8C,CAAC;AAEtF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAmB;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,EAAE,EAAE,QAAQ,CAAC,EAAE;SAChB,CAAC,CAAC;QACH,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe,KAAK,IAAI;QAChD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE;KAC1D,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,OAAO,GAA2B,aAAa;IAE/C,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CACtF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAqB,EACrB,OAAO,GAA2B,aAAa;IAE/C,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC9E,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAmC,EAAE;QAC/D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,IAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;IACF,4EAA4E;IAC5E,uDAAuD;IACvD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE;QAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3D,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,oBAA+C,EAC/C,GAAW,EACX,OAAO,GAA2B,aAAa;IAE/C,IAAI,CAAC,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,EAAE,WAAW,KAAK,UAAU;YAAE,SAAS;QACjD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,GAAG;YAAE,SAAS;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,0EAA0E;QAC1E,4BAA4B;QAC5B,OAAO,eAAe,CAAC,oBAAoB,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/legal.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Published legal-document versions, shared by the dashboard and the API.
+ *
+ * Keep these in lock-step with the `**Version:**` headers of the canonical
+ * files under legal/ — `scripts/check-legal-versions.mjs` fails review when
+ * they drift. The numbering restarts at 1.0 because Kaizensu AB now owns and
+ * operates the platform, so these are the company's first published versions;
+ * the earlier 2.x sequence belongs to the sole-trader era and does not carry
+ * over. The acceptance version is selected by trusted server code, never by a
+ * browser header. Changing a value records document evidence; nothing compares
+ * or orders these strings, so it neither publishes new terms nor forces
+ * re-acceptance.
+ */
+export declare const LEGAL_DOCUMENT_VERSIONS: {
+    readonly terms: "1.0";
+    readonly aup: "1.0";
+    readonly privacy: "1.0";
+    readonly cookies: "1.0";
+    readonly dpa: "1.0";
+    readonly subprocessors: "1.0";
+    readonly dataPortability: "1.0";
+};
+/**
+ * What each published document said at the version above.
+ *
+ * sha256 over the English then the Swedish file, newline-normalised and
+ * NUL-separated, so a checkout's line-ending setting cannot move the value.
+ *
+ * Without this the version header was the only anchor, and it is one a person
+ * has to remember to move. Editing the body of a document and leaving the
+ * header alone passed every check: the sync step copied the new bytes to the
+ * served copy, no version moved, so no change had to be declared and nobody
+ * was notified. That is the whole mechanism defeated by an omission rather
+ * than a decision. Now the bytes themselves are the anchor: change a document
+ * and the check fails until the change is declared.
+ *
+ * `bun scripts/check-legal-versions.mjs --print-hashes` prints the current
+ * values; never paste one in without the version move and the change entry it
+ * belongs to.
+ */
+export declare const LEGAL_DOCUMENT_HASHES: {
+    readonly terms: "d412c9e85d7fefa5e3595b47aaea67a5d9f495955e458b2d0b4f43c9215317ce";
+    readonly aup: "138ce3bdd9d244a4f31c98955b3c9d59920f32c056608f1135dc8393769a761f";
+    readonly privacy: "186910f4f4825d3ac3bbc3340e7bf4babccea33f8b4166a10c892a7012cff175";
+    readonly cookies: "9c8250a4ea2fbf701d04cfb145d466ff8ba410e6da92433950f119952ba16bf0";
+    readonly dpa: "4c97fd36c886a113477f3eb2c2c0a9b5e03820ec624439906c938bbd40f7a0fb";
+    readonly subprocessors: "e7380f2d604814e1f06f44d8c4afcb34143c1c7994dfecdcec4cf1bbc8810363";
+    readonly dataPortability: "27a7d3ec0175af8f3f1c67db1a65bf01f74d5139b44d9134caef5dd8a924d775";
+};
+/** Version of the canonical English Terms presented during account acceptance. */
+export declare const CURRENT_TERMS_VERSION: "1.0";
+/** The "Last updated" date shared by the current revision of the documents. */
+export declare const LEGAL_DOCUMENT_LAST_UPDATED = "10 September 2026";
+export interface TermsAcceptanceEvidence {
+    version?: string;
+    language?: "en" | "sv";
+}
+//# sourceMappingURL=legal.d.ts.map

package/dist/legal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal.d.ts","sourceRoot":"","sources":["../src/legal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;aAClC,KAAK,EAAE,KAAK;aACZ,GAAG,EAAE,KAAK;aACV,OAAO,EAAE,KAAK;aACd,OAAO,EAAE,KAAK;aACd,GAAG,EAAE,KAAK;aACV,aAAa,EAAE,KAAK;aACpB,eAAe,EAAE,KAAK;CACd,CAAC;AAEX;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB;aAChC,KAAK,EAAE,kEAAkE;aACzE,GAAG,EAAE,kEAAkE;aACvE,OAAO,EAAE,kEAAkE;aAC3E,OAAO,EAAE,kEAAkE;aAC3E,GAAG,EAAE,kEAAkE;aACvE,aAAa,EAAE,kEAAkE;aACjF,eAAe,EAAE,kEAAkE;CAC3E,CAAC;AAEX,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,OAAgC,CAAC;AAEnE,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B,sBAAsB,CAAC;AAE/D,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB"}

package/dist/legal.js

@@ -0,0 +1,54 @@
+/**
+ * Published legal-document versions, shared by the dashboard and the API.
+ *
+ * Keep these in lock-step with the `**Version:**` headers of the canonical
+ * files under legal/ — `scripts/check-legal-versions.mjs` fails review when
+ * they drift. The numbering restarts at 1.0 because Kaizensu AB now owns and
+ * operates the platform, so these are the company's first published versions;
+ * the earlier 2.x sequence belongs to the sole-trader era and does not carry
+ * over. The acceptance version is selected by trusted server code, never by a
+ * browser header. Changing a value records document evidence; nothing compares
+ * or orders these strings, so it neither publishes new terms nor forces
+ * re-acceptance.
+ */
+export const LEGAL_DOCUMENT_VERSIONS = {
+    terms: "1.0",
+    aup: "1.0",
+    privacy: "1.0",
+    cookies: "1.0",
+    dpa: "1.0",
+    subprocessors: "1.0",
+    dataPortability: "1.0",
+};
+/**
+ * What each published document said at the version above.
+ *
+ * sha256 over the English then the Swedish file, newline-normalised and
+ * NUL-separated, so a checkout's line-ending setting cannot move the value.
+ *
+ * Without this the version header was the only anchor, and it is one a person
+ * has to remember to move. Editing the body of a document and leaving the
+ * header alone passed every check: the sync step copied the new bytes to the
+ * served copy, no version moved, so no change had to be declared and nobody
+ * was notified. That is the whole mechanism defeated by an omission rather
+ * than a decision. Now the bytes themselves are the anchor: change a document
+ * and the check fails until the change is declared.
+ *
+ * `bun scripts/check-legal-versions.mjs --print-hashes` prints the current
+ * values; never paste one in without the version move and the change entry it
+ * belongs to.
+ */
+export const LEGAL_DOCUMENT_HASHES = {
+    terms: "d412c9e85d7fefa5e3595b47aaea67a5d9f495955e458b2d0b4f43c9215317ce",
+    aup: "138ce3bdd9d244a4f31c98955b3c9d59920f32c056608f1135dc8393769a761f",
+    privacy: "186910f4f4825d3ac3bbc3340e7bf4babccea33f8b4166a10c892a7012cff175",
+    cookies: "9c8250a4ea2fbf701d04cfb145d466ff8ba410e6da92433950f119952ba16bf0",
+    dpa: "4c97fd36c886a113477f3eb2c2c0a9b5e03820ec624439906c938bbd40f7a0fb",
+    subprocessors: "e7380f2d604814e1f06f44d8c4afcb34143c1c7994dfecdcec4cf1bbc8810363",
+    dataPortability: "27a7d3ec0175af8f3f1c67db1a65bf01f74d5139b44d9134caef5dd8a924d775",
+};
+/** Version of the canonical English Terms presented during account acceptance. */
+export const CURRENT_TERMS_VERSION = LEGAL_DOCUMENT_VERSIONS.terms;
+/** The "Last updated" date shared by the current revision of the documents. */
+export const LEGAL_DOCUMENT_LAST_UPDATED = "10 September 2026";
+//# sourceMappingURL=legal.js.map

package/dist/legal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal.js","sourceRoot":"","sources":["../src/legal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,KAAK,EAAE,KAAK;IACZ,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,KAAK;IACd,GAAG,EAAE,KAAK;IACV,aAAa,EAAE,KAAK;IACpB,eAAe,EAAE,KAAK;CACd,CAAC;AAEX;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,kEAAkE;IACzE,GAAG,EAAE,kEAAkE;IACvE,OAAO,EAAE,kEAAkE;IAC3E,OAAO,EAAE,kEAAkE;IAC3E,GAAG,EAAE,kEAAkE;IACvE,aAAa,EAAE,kEAAkE;IACjF,eAAe,EAAE,kEAAkE;CAC3E,CAAC;AAEX,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,KAAK,CAAC;AAEnE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC"}

package/dist/limits.d.ts

@@ -6,6 +6,14 @@
  * extractor, which guards against zip bombs.
  */
 export declare const MAX_TARBALL_BYTES: number;
+/**
+ * Max accepted tarball for an ANONYMOUS deploy (25 MiB). The anonymous lane
+ * is a demo sandbox with no account behind it: the whole lane is capped at a
+ * handful of live apps, each one costs disk that nobody has agreed to pay for,
+ * and no legitimate demo needs 500 MB. Enforced on the streaming save, so a
+ * chunked or forged Content-Length cannot walk past it.
+ */
+export declare const MAX_ANON_TARBALL_BYTES: number;
 /**
  * Max accepted inline-source publish size in bytes (25 MB) — the sum of
  * the decoded `content` bytes an assistant passes to `percher_publish` /

package/dist/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAoB,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD;;;;;;GAMG;AAEH;;8BAE8B;AAC9B,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;;iEAKiE;AACjE,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;qDAIqD;AACrD,eAAO,MAAM,qBAAqB,QAAqB,CAAC;AAExD;;4BAE4B;AAC5B,eAAO,MAAM,8BAA8B,QAAsB,CAAC;AAElE;yEACyE;AACzE,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB,MAAM,CAAC"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAoB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD;;;;;;GAMG;AAEH;;8BAE8B;AAC9B,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;;iEAKiE;AACjE,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;qDAIqD;AACrD,eAAO,MAAM,qBAAqB,QAAqB,CAAC;AAExD;;4BAE4B;AAC5B,eAAO,MAAM,8BAA8B,QAAsB,CAAC;AAElE;yEACyE;AACzE,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB,MAAM,CAAC"}

package/dist/limits.js

@@ -6,6 +6,14 @@
  * extractor, which guards against zip bombs.
  */
 export const MAX_TARBALL_BYTES = 500 * 1024 * 1024;
+/**
+ * Max accepted tarball for an ANONYMOUS deploy (25 MiB). The anonymous lane
+ * is a demo sandbox with no account behind it: the whole lane is capped at a
+ * handful of live apps, each one costs disk that nobody has agreed to pay for,
+ * and no legitimate demo needs 500 MB. Enforced on the streaming save, so a
+ * chunked or forged Content-Length cannot walk past it.
+ */
+export const MAX_ANON_TARBALL_BYTES = 25 * 1024 * 1024;
 /**
  * Max accepted inline-source publish size in bytes (25 MB) — the sum of
  * the decoded `content` bytes an assistant passes to `percher_publish` /

package/dist/limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzD;;;;;;GAMG;AAEH;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;;iEAKiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;qDAIqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD;;4BAE4B;AAC5B,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElE;yEACyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC"}
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzD;;;;;;GAMG;AAEH;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;;iEAKiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;qDAIqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD;;4BAE4B;AAC5B,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElE;yEACyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC"}

package/dist/oauth-client-name.d.ts

@@ -0,0 +1,22 @@
+/** Maximum number of Unicode code points shown from an open-DCR client name. */
+export declare const MAX_OAUTH_CLIENT_NAME_DISPLAY_CODE_POINTS = 80;
+/**
+ * Normalise an attacker-controlled OAuth Dynamic Client Registration name for
+ * display. The stored registration metadata remains verbatim; every UI/email
+ * surface calls this at its trust boundary.
+ *
+ * Unicode `Cf` includes bidi overrides/isolates, Arabic Letter Mark, soft
+ * hyphen, zero-width space, deprecated directional controls and tag
+ * characters. Those can reorder or invisibly split surrounding trusted copy.
+ * Replace them with a space rather than deleting them, so fragments cannot be
+ * joined into a new visible word. ZWNJ and ZWJ are the narrow exceptions:
+ * they are required for legitimate Persian/Indic text and emoji sequences and
+ * do not reorder the rest of the line. C0/C1 controls and lone surrogates are
+ * treated the same way.
+ *
+ * This deliberately does not apply NFKC or an ASCII allowlist. The label is
+ * explicitly unverified, and international product names should survive
+ * unchanged when they contain no display-control characters.
+ */
+export declare function normaliseOAuthClientName(raw: string | null | undefined): string | null;
+//# sourceMappingURL=oauth-client-name.d.ts.map

package/dist/oauth-client-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-name.d.ts","sourceRoot":"","sources":["../src/oauth-client-name.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,eAAO,MAAM,yCAAyC,KAAK,CAAC;AAK5D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAetF"}

package/dist/oauth-client-name.js

@@ -0,0 +1,37 @@
+/** Maximum number of Unicode code points shown from an open-DCR client name. */
+export const MAX_OAUTH_CLIENT_NAME_DISPLAY_CODE_POINTS = 80;
+const ZERO_WIDTH_NON_JOINER = "\u200c";
+const ZERO_WIDTH_JOINER = "\u200d";
+/**
+ * Normalise an attacker-controlled OAuth Dynamic Client Registration name for
+ * display. The stored registration metadata remains verbatim; every UI/email
+ * surface calls this at its trust boundary.
+ *
+ * Unicode `Cf` includes bidi overrides/isolates, Arabic Letter Mark, soft
+ * hyphen, zero-width space, deprecated directional controls and tag
+ * characters. Those can reorder or invisibly split surrounding trusted copy.
+ * Replace them with a space rather than deleting them, so fragments cannot be
+ * joined into a new visible word. ZWNJ and ZWJ are the narrow exceptions:
+ * they are required for legitimate Persian/Indic text and emoji sequences and
+ * do not reorder the rest of the line. C0/C1 controls and lone surrogates are
+ * treated the same way.
+ *
+ * This deliberately does not apply NFKC or an ASCII allowlist. The label is
+ * explicitly unverified, and international product names should survive
+ * unchanged when they contain no display-control characters.
+ */
+export function normaliseOAuthClientName(raw) {
+    if (!raw)
+        return null;
+    const cleaned = raw
+        .replace(/[\p{Cc}\p{Cf}\p{Cs}]/gu, (character) => character === ZERO_WIDTH_NON_JOINER || character === ZERO_WIDTH_JOINER ? character : " ")
+        .replace(/\s+/gu, " ")
+        .trim();
+    if (cleaned.length === 0)
+        return null;
+    const codePoints = [...cleaned];
+    return codePoints.length > MAX_OAUTH_CLIENT_NAME_DISPLAY_CODE_POINTS
+        ? `${codePoints.slice(0, MAX_OAUTH_CLIENT_NAME_DISPLAY_CODE_POINTS).join("")}...`
+        : cleaned;
+}
+//# sourceMappingURL=oauth-client-name.js.map

package/dist/oauth-client-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-name.js","sourceRoot":"","sources":["../src/oauth-client-name.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,MAAM,CAAC,MAAM,yCAAyC,GAAG,EAAE,CAAC;AAE5D,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AACvC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAA8B;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,OAAO,GAAG,GAAG;SAChB,OAAO,CAAC,wBAAwB,EAAE,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,KAAK,qBAAqB,IAAI,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CACzF;SACA,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,IAAI,EAAE,CAAC;IACV,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAChC,OAAO,UAAU,CAAC,MAAM,GAAG,yCAAyC;QAClE,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,yCAAyC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK;QACjF,CAAC,CAAC,OAAO,CAAC;AACd,CAAC"}

package/dist/oauth-scopes.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Hosted-MCP OAuth scope copy — the permission text a user reads on the
+ * consent screen, and again in the email telling them a client was connected.
+ *
+ * It lives here because those two surfaces must not drift: the email has to
+ * describe the access in the words the user actually consented to, and they
+ * are rendered by different processes (Next.js dashboard, API mailer). Two
+ * copies of security-relevant permission text is exactly the kind of drift
+ * that ends with an email under-describing what a grant can do.
+ *
+ * An unknown scope falls through to its raw token — nothing is ever silently
+ * hidden from the reader.
+ */
+export declare const OAUTH_SCOPE_LABELS: Readonly<Record<string, string>>;
+/** Map a raw scope token to its human label, or the token itself if unknown. */
+export declare function describeOAuthScope(scope: string): string;
+/** Split a space-delimited OAuth scope string into individual tokens. */
+export declare function parseOAuthScopes(scope: string): string[];
+//# sourceMappingURL=oauth-scopes.d.ts.map

package/dist/oauth-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-scopes.d.ts","sourceRoot":"","sources":["../src/oauth-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK/D,CAAC;AAEF,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAKxD"}

package/dist/oauth-scopes.js

@@ -0,0 +1,31 @@
+/**
+ * Hosted-MCP OAuth scope copy — the permission text a user reads on the
+ * consent screen, and again in the email telling them a client was connected.
+ *
+ * It lives here because those two surfaces must not drift: the email has to
+ * describe the access in the words the user actually consented to, and they
+ * are rendered by different processes (Next.js dashboard, API mailer). Two
+ * copies of security-relevant permission text is exactly the kind of drift
+ * that ends with an email under-describing what a grant can do.
+ *
+ * An unknown scope falls through to its raw token — nothing is ever silently
+ * hidden from the reader.
+ */
+export const OAUTH_SCOPE_LABELS = {
+    "mcp:apps": "View and operate your apps (deploy, env, domains, logs)",
+    "mcp:apps.read": "View your apps and their status",
+    "mcp:account": "View your account",
+    mcp: "Use the hosted Percher MCP tools",
+};
+/** Map a raw scope token to its human label, or the token itself if unknown. */
+export function describeOAuthScope(scope) {
+    return OAUTH_SCOPE_LABELS[scope] ?? scope;
+}
+/** Split a space-delimited OAuth scope string into individual tokens. */
+export function parseOAuthScopes(scope) {
+    return scope
+        .split(/\s+/)
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+//# sourceMappingURL=oauth-scopes.js.map

package/dist/oauth-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-scopes.js","sourceRoot":"","sources":["../src/oauth-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAqC;IAClE,UAAU,EAAE,yDAAyD;IACrE,eAAe,EAAE,iCAAiC;IAClD,aAAa,EAAE,mBAAmB;IAClC,GAAG,EAAE,kCAAkC;CACxC,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AAC5C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC"}

package/dist/platform-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-env.d.ts","sourceRoot":"","sources":["../src/platform-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAqBxD,CAAC;AAcH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAItD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGxD"}
+{"version":3,"file":"platform-env.d.ts","sourceRoot":"","sources":["../src/platform-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CA2BxD,CAAC;AAcH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAItD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGxD"}

package/dist/platform-env.js

@@ -32,6 +32,12 @@ export const PERCHER_INJECTED_ENV_KEYS = new Set([
     // App identity
     "PERCHER_APP_NAME",
     "PERCHER_APP_URL",
+    // App id + the identity-assertion verification key, injected into gated
+    // (private/password) apps so they can verify `X-Percher-Assertion` (see
+    // packages/api/src/site-identity-assertion.ts). Platform-owned like the
+    // rest — a user must never set them.
+    "PERCHER_APP_ID",
+    "PERCHER_IDENTITY_SECRET",
     // Egress proxy (Percher injects these so app code can reach the
     // public internet through the forward proxy — see docs/CLAUDE.md
     // "Outbound HTTPS")

package/dist/platform-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-env.js","sourceRoot":"","sources":["../src/platform-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAS;IAC5E,yBAAyB;IACzB,UAAU;IACV,MAAM;IACN,sEAAsE;IACtE,kEAAkE;IAClE,8CAA8C;IAC9C,cAAc;IACd,gBAAgB;IAChB,wBAAwB;IACxB,2BAA2B;IAC3B,eAAe;IACf,kBAAkB;IAClB,iBAAiB;IACjB,gEAAgE;IAChE,iEAAiE;IACjE,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,UAAU;IACV,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAS;IACnE,YAAY;IACZ,aAAa;IACb,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"platform-env.js","sourceRoot":"","sources":["../src/platform-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAS;IAC5E,yBAAyB;IACzB,UAAU;IACV,MAAM;IACN,sEAAsE;IACtE,kEAAkE;IAClE,8CAA8C;IAC9C,cAAc;IACd,gBAAgB;IAChB,wBAAwB;IACxB,2BAA2B;IAC3B,eAAe;IACf,kBAAkB;IAClB,iBAAiB;IACjB,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,qCAAqC;IACrC,gBAAgB;IAChB,yBAAyB;IACzB,gEAAgE;IAChE,iEAAiE;IACjE,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,UAAU;IACV,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAS;IACnE,YAAY;IACZ,aAAa;IACb,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/platform.d.ts

@@ -6,9 +6,26 @@
  * without depending on each other.
  */
 /** Default PocketBase sidecar image when PERCHER_POCKETBASE_IMAGE is unset. */
-export declare const DEFAULT_POCKETBASE_IMAGE = "percher/pocketbase:0.39.9";
+export declare const DEFAULT_POCKETBASE_IMAGE = "percher/pocketbase:0.40.3-hardened.1";
 /** Default app domain suffix when PERCHER_DOMAIN_SUFFIX is unset. */
 export declare const DEFAULT_DOMAIN_SUFFIX = "percher.run";
 /** Default hosted-MCP HTTP port when PERCHER_MCP_HTTP_PORT is unset. */
 export declare const DEFAULT_MCP_HTTP_PORT = 8787;
+/**
+ * Number of tools the LOCAL stdio MCP server registers, and the number the
+ * HOSTED connector exposes (a deny-by-default allowlist — a strict subset in
+ * spirit, though it also carries a few hosted-only names).
+ *
+ * These live here so public copy can state a figure without importing
+ * `@percher/mcp` (the dashboard doesn't depend on it). They are NOT the source
+ * of truth: `packages/mcp/test/tools.test.ts` asserts the real registry and
+ * allowlist match these constants, so bumping the tool set fails the build
+ * until the number is updated in exactly one place.
+ *
+ * The previous arrangement hardcoded the count in six unrelated files; they
+ * drifted to three different values (51/52/53), and one shipped artifact
+ * disagreed with itself on two lines.
+ */
+export declare const MCP_TOOL_COUNT_LOCAL = 53;
+export declare const MCP_TOOL_COUNT_HOSTED = 22;
 //# sourceMappingURL=platform.d.ts.map

package/dist/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,OAAO,CAAC"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,yCAAyC,CAAC;AAE/E,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,qBAAqB,KAAK,CAAC"}

package/dist/platform.js

@@ -6,9 +6,26 @@
  * without depending on each other.
  */
 /** Default PocketBase sidecar image when PERCHER_POCKETBASE_IMAGE is unset. */
-export const DEFAULT_POCKETBASE_IMAGE = "percher/pocketbase:0.39.9";
+export const DEFAULT_POCKETBASE_IMAGE = "percher/pocketbase:0.40.3-hardened.1";
 /** Default app domain suffix when PERCHER_DOMAIN_SUFFIX is unset. */
 export const DEFAULT_DOMAIN_SUFFIX = "percher.run";
 /** Default hosted-MCP HTTP port when PERCHER_MCP_HTTP_PORT is unset. */
 export const DEFAULT_MCP_HTTP_PORT = 8787;
+/**
+ * Number of tools the LOCAL stdio MCP server registers, and the number the
+ * HOSTED connector exposes (a deny-by-default allowlist — a strict subset in
+ * spirit, though it also carries a few hosted-only names).
+ *
+ * These live here so public copy can state a figure without importing
+ * `@percher/mcp` (the dashboard doesn't depend on it). They are NOT the source
+ * of truth: `packages/mcp/test/tools.test.ts` asserts the real registry and
+ * allowlist match these constants, so bumping the tool set fails the build
+ * until the number is updated in exactly one place.
+ *
+ * The previous arrangement hardcoded the count in six unrelated files; they
+ * drifted to three different values (51/52/53), and one shipped artifact
+ * disagreed with itself on two lines.
+ */
+export const MCP_TOOL_COUNT_LOCAL = 53;
+export const MCP_TOOL_COUNT_HOSTED = 22;
 //# sourceMappingURL=platform.js.map

package/dist/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC"}
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,sCAAsC,CAAC;AAE/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC"}

package/dist/signup-invite-hash.d.ts

@@ -0,0 +1,8 @@
+/**
+ * sha256 hex of a normalized invite code — the value stored in
+ * `signup_invites.code_hash`. Server-only, on its own subpath like `./pow`:
+ * the signup form imports the header name and code shape from the package
+ * index, and `node:crypto` must not reach that client bundle.
+ */
+export declare function hashSignupInviteCode(code: string): string;
+//# sourceMappingURL=signup-invite-hash.d.ts.map

package/dist/signup-invite-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup-invite-hash.d.ts","sourceRoot":"","sources":["../src/signup-invite-hash.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/signup-invite-hash.js

@@ -0,0 +1,11 @@
+import { createHash } from "node:crypto";
+/**
+ * sha256 hex of a normalized invite code — the value stored in
+ * `signup_invites.code_hash`. Server-only, on its own subpath like `./pow`:
+ * the signup form imports the header name and code shape from the package
+ * index, and `node:crypto` must not reach that client bundle.
+ */
+export function hashSignupInviteCode(code) {
+    return createHash("sha256").update(code, "utf8").digest("hex");
+}
+//# sourceMappingURL=signup-invite-hash.js.map

package/dist/signup-invite-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup-invite-hash.js","sourceRoot":"","sources":["../src/signup-invite-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/dist/signup-invite.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Beta signup invites. Two processes act on one code and must not drift: the
+ * API mints and stores the hash, and the dashboard validates what the form
+ * sent. The API consumes the use atomically with account provisioning.
+ *
+ * The plaintext code is shown to the operator exactly once at mint time and
+ * never stored, so the hash is the only thing either side can compare. The
+ * hash itself lives in `./signup-invite-hash` (server-only, needs
+ * `node:crypto`); this module is safe for the signup form's client bundle.
+ */
+/** Request header the signup form uses to carry the code through BetterAuth. */
+export declare const SIGNUP_INVITE_HEADER = "x-percher-invite-code";
+export declare const SIGNUP_INVITE_CODE_PREFIX = "beta-";
+/** Random part is lowercase base36, so a code survives being typed or spoken. */
+export declare const SIGNUP_INVITE_CODE_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+export declare const SIGNUP_INVITE_CODE_LENGTH = 24;
+/**
+ * Canonical form of a code as a user might have typed it: whitespace trimmed,
+ * case folded. Returns null for anything that is not shaped like a code, so
+ * callers never hash (or log) arbitrary input.
+ */
+export declare function normalizeSignupInviteCode(raw: string | null | undefined): string | null;
+//# sourceMappingURL=signup-invite.d.ts.map

package/dist/signup-invite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup-invite.d.ts","sourceRoot":"","sources":["../src/signup-invite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D,eAAO,MAAM,yBAAyB,UAAU,CAAC;AAEjD,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,yCAAyC,CAAC;AAClF,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAI5C;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIvF"}

package/dist/signup-invite.js

@@ -0,0 +1,29 @@
+/**
+ * Beta signup invites. Two processes act on one code and must not drift: the
+ * API mints and stores the hash, and the dashboard validates what the form
+ * sent. The API consumes the use atomically with account provisioning.
+ *
+ * The plaintext code is shown to the operator exactly once at mint time and
+ * never stored, so the hash is the only thing either side can compare. The
+ * hash itself lives in `./signup-invite-hash` (server-only, needs
+ * `node:crypto`); this module is safe for the signup form's client bundle.
+ */
+/** Request header the signup form uses to carry the code through BetterAuth. */
+export const SIGNUP_INVITE_HEADER = "x-percher-invite-code";
+export const SIGNUP_INVITE_CODE_PREFIX = "beta-";
+/** Random part is lowercase base36, so a code survives being typed or spoken. */
+export const SIGNUP_INVITE_CODE_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+export const SIGNUP_INVITE_CODE_LENGTH = 24;
+const CODE_RE = /^beta-[a-z0-9]{24}$/;
+/**
+ * Canonical form of a code as a user might have typed it: whitespace trimmed,
+ * case folded. Returns null for anything that is not shaped like a code, so
+ * callers never hash (or log) arbitrary input.
+ */
+export function normalizeSignupInviteCode(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const code = raw.trim().toLowerCase();
+    return CODE_RE.test(code) ? code : null;
+}
+//# sourceMappingURL=signup-invite.js.map

package/dist/signup-invite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup-invite.js","sourceRoot":"","sources":["../src/signup-invite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAEjD,iFAAiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,sCAAsC,CAAC;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAA8B;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC"}