@percher/shared 1.0.2 → 1.2.0

package/dist/switches.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Every environment switch the platform reads, declared once.
+ *
+ * A switch is a variable that selects a code path (two paths, an enum of
+ * modes, or "armed when present"), as opposed to configuration such as a URL
+ * or a size. The readers spell their comparisons differently (`=== "1"` in
+ * most places, `=== "true"` in five, `!== "0"` for a default-on switch), and
+ * an operator who set `=1` on a `"true"` switch got the OFF path with no
+ * warning. This registry records each switch's EXISTING accepted spellings.
+ * `switchState` names the four states a raw value can be in, and
+ * `assertValidSwitches` refuses a boot on an invalid one. Readers resolve a
+ * switch through `switchEnabled` / `switchValue`, which return exactly what
+ * the literal comparisons they replaced returned;
+ * `test/switch-readers-parity.test.ts` holds those comparisons and the
+ * switches still read the old way.
+ *
+ * Widening a reader to accept both spellings is deliberately not done here:
+ * a value that is off today because of its spelling would turn on silently
+ * at the next deploy. Fix the value, deliberately, one switch at a time.
+ */
+export type SwitchReader = "api" | "worker" | "dashboard" | "mcp" | "cli";
+export type SwitchState = "enabled" | "disabled" | "unset" | "invalid";
+interface SwitchBase {
+    name: string;
+    readers: readonly SwitchReader[];
+    /** One line: what the ON path does. */
+    purpose: string;
+}
+export interface BooleanSwitch extends SwitchBase {
+    kind: "boolean";
+    /** Raw spellings the readers treat as ON today. */
+    enabled: readonly string[];
+    /** Raw spellings that mean an explicit OFF (never reported as invalid). */
+    disabled: readonly string[];
+    /** What an unset variable resolves to. */
+    default: "enabled" | "disabled";
+}
+export interface EnumSwitch extends SwitchBase {
+    kind: "enum";
+    values: readonly string[];
+    /** The value an unset variable resolves to. */
+    default: string;
+    /** The reader trims and lowercases before comparing, so `" ENFORCE "` works. */
+    normalize?: true;
+}
+export interface PresenceSwitch extends SwitchBase {
+    kind: "presence";
+}
+export type SwitchSpec = BooleanSwitch | EnumSwitch | PresenceSwitch;
+/** The registry. Order: builders, isolation, admission, product, ops, levers. */
+export declare const SWITCHES: readonly SwitchSpec[];
+export declare const SWITCH_BY_NAME: ReadonlyMap<string, SwitchSpec>;
+/** The state a raw value puts a switch in, by that switch's own spellings. */
+export declare function switchState(spec: SwitchSpec, raw: string | undefined): SwitchState;
+type Env = Record<string, string | undefined>;
+/**
+ * The path a boolean switch selects: ON for an enabled spelling, OFF for a
+ * disabled one, and the switch's default when unset or invalid. That is what
+ * every `=== "1"` / `!== "0"` reader returned, so moving a reader here changes
+ * no verdict.
+ */
+export declare function switchEnabled(name: string, env: Env): boolean;
+/** The mode an enum switch selects: its (normalized) value, or the default when unset or invalid. */
+export declare function switchValue(name: string, env: Env): string;
+export interface SwitchReport {
+    name: string;
+    raw: string;
+    state: SwitchState;
+    /** What the value should have been spelled as. */
+    accepted: readonly string[];
+    /** What an unset variable resolves to. */
+    fallback: string;
+}
+/**
+ * The switches whose raw value is set but not a spelling any reader accepts.
+ * The input to the boot refusal; it never throws.
+ */
+export declare function reportSwitches(env: Record<string, string | undefined>, reader?: SwitchReader): SwitchReport[];
+/**
+ * Refuse to boot on a set-but-invalid switch: the reader would silently take
+ * its default path, which is how a `"true"` switch set to `1` stayed off.
+ * A disabled spelling and an unset variable never refuse. The error names
+ * every invalid switch with its raw value and accepted spellings. Call it
+ * before any other boot guard and before any listener starts.
+ */
+export declare function assertValidSwitches(env: Record<string, string | undefined>, reader: SwitchReader): void;
+export {};
+//# sourceMappingURL=switches.d.ts.map

package/dist/switches.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"switches.d.ts","sourceRoot":"","sources":["../src/switches.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,WAAW,GAAG,KAAK,GAAG,KAAK,CAAC;AAE1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAEvE,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,IAAI,EAAE,SAAS,CAAC;IAChB,mDAAmD;IACnD,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,0CAA0C;IAC1C,OAAO,EAAE,SAAS,GAAG,UAAU,CAAC;CACjC;AAED,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,UAAU,GAAG,cAAc,CAAC;AA2BrE,iFAAiF;AACjF,eAAO,MAAM,QAAQ,EAAE,SAAS,UAAU,EAwPzC,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAE1D,CAAC;AAEF,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAclF;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAW9C;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAM7D;AAED,qGAAqG;AACrG,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAK1D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,kDAAkD;IAClD,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,MAAM,CAAC,EAAE,YAAY,GACpB,YAAY,EAAE,CAiBhB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,MAAM,EAAE,YAAY,GACnB,IAAI,CAaN"}

package/dist/switches.js

@@ -0,0 +1,232 @@
+/**
+ * Every environment switch the platform reads, declared once.
+ *
+ * A switch is a variable that selects a code path (two paths, an enum of
+ * modes, or "armed when present"), as opposed to configuration such as a URL
+ * or a size. The readers spell their comparisons differently (`=== "1"` in
+ * most places, `=== "true"` in five, `!== "0"` for a default-on switch), and
+ * an operator who set `=1` on a `"true"` switch got the OFF path with no
+ * warning. This registry records each switch's EXISTING accepted spellings.
+ * `switchState` names the four states a raw value can be in, and
+ * `assertValidSwitches` refuses a boot on an invalid one. Readers resolve a
+ * switch through `switchEnabled` / `switchValue`, which return exactly what
+ * the literal comparisons they replaced returned;
+ * `test/switch-readers-parity.test.ts` holds those comparisons and the
+ * switches still read the old way.
+ *
+ * Widening a reader to accept both spellings is deliberately not done here:
+ * a value that is off today because of its spelling would turn on silently
+ * at the next deploy. Fix the value, deliberately, one switch at a time.
+ */
+const ONE = ["1"];
+const TRUE = ["true"];
+const OFF_SPELLINGS = ["0", "false"];
+// A default-on reader is written `!== "0"` (or `!== "false"`), which puts
+// EVERY other spelling on the ON side; its disabled list is exactly that one
+// literal, never both conventional spellings, or the registry would report as
+// OFF a value the reader turns ON.
+const bool = (name, readers, purpose, enabled, def = "disabled", disabled = OFF_SPELLINGS) => ({
+    kind: "boolean",
+    name,
+    readers,
+    purpose,
+    enabled,
+    disabled,
+    default: def,
+});
+/** The registry. Order: builders, isolation, admission, product, ops, levers. */
+export const SWITCHES = [
+    // Build dispatch
+    bool("PERCHER_NODE_USE_DOCKERFILE", ["api"], 'Node/Bun apps build through the Percher Dockerfile instead of Nixpacks (default; "0" is the emergency lever)', ONE, "enabled", ["0"]),
+    bool("PERCHER_PYTHON_USE_DOCKERFILE", ["api"], 'Python apps build through the Percher Dockerfile instead of Nixpacks (default; "0" is the emergency lever)', ONE, "enabled", ["0"]),
+    bool("PERCHER_OPS_BUILD_TRIAGE", ["api"], "append the internal cold-build triage block to build logs", ONE),
+    bool("PERCHER_CAPPED_BUILDER_ACTIVE", ["worker"], "builds run on the capped buildx builder; set by the worker itself once that builder is ready, not by the operator", ONE),
+    // Tenant isolation and networks
+    bool("PERCHER_PER_APP_NETWORKS", ["api", "worker"], "per-app internal networks, pbproxy and per-app egress (production refuses to boot without it)", TRUE),
+    bool("PERCHER_CADDY_RATELIMIT_ENABLED", ["api"], "emit Caddy rate_limit handlers for apps that declare [web].rate_limit", ONE),
+    bool("PERCHER_UNKNOWN_HOST_404", ["api"], "answer app-suffix hosts that no route serves with a 404 instead of Caddy's empty 200", ONE),
+    bool("PERCHER_PB_AUTH_RATELIMIT_ENABLED", ["api"], "limit login, OTP and account-mail requests per client IP on public PocketBase hosts", ONE),
+    bool("PERCHER_EGRESS_PROBE", ["api"], "run the in-container egress probe in diagnostics", ONE),
+    bool("PERCHER_WILDCARD_TLS", ["api"], "one wildcard DNS-01 certificate instead of per-host certificates", ONE),
+    // Admission and disk
+    bool("PERCHER_MEASURED_ADMISSION", ["api"], "measured admission, overcommit and box eviction instead of reservation accounting", ONE),
+    {
+        kind: "enum",
+        name: "PERCHER_DISK_GATE",
+        readers: ["api"],
+        purpose: "refuse uploads when disk state is unknown (required) or allow them (off)",
+        values: ["required", "off"],
+        default: "required",
+    },
+    bool("DISK_PRESSURE_AUTO_SUSPEND", ["api"], "auto-suspend PocketBase apps after the disk-pressure grace timeline", TRUE),
+    bool("PERCHER_APPDATA_HARD_CAP_ENFORCE", ["api"], "suspend an app immediately when its appdata exceeds the hard cap", TRUE),
+    // Accounts and product surface
+    bool("PERCHER_REQUIRE_EMAIL_VERIFICATION", ["api"], "block API use until the account's email is verified", ONE),
+    bool("PERCHER_ANON_DEPLOYS", ["api"], "open the anonymous deploy lane", ONE),
+    bool("PERCHER_SUPPORT_ENABLED", ["api"], "mount the support routes and jobs", ONE),
+    bool("PERCHER_SUPPORT_DIGEST_SEND_EMPTY", ["api"], "send the daily support digest even when it is empty", ONE),
+    bool("PERCHER_HOSTED_MCP_ENABLED", ["api"], "mount the OAuth authorization server and register mcp.percher.app", ONE),
+    bool("PERCHER_LEGAL_NOTICES_ENABLED", ["api"], "send material legal-change notices instead of reporting only", ONE),
+    bool("PERCHER_DEPLOY_SCREENSHOTS", ["api", "worker"], "capture a post-deploy screenshot with headless Chromium", ONE),
+    bool("PERCHER_RUNTIME_ERROR_CAPTURE", ["api"], "capture runtime errors over CDP instead of the log-trick screenshot", ONE),
+    {
+        kind: "enum",
+        name: "PERCHER_MANAGED_INFERENCE_MODE",
+        readers: ["api"],
+        purpose: "managed inference enabled (subject to credentials and approval) or disabled",
+        values: ["disabled", "enabled"],
+        default: "disabled",
+    },
+    // Deploy pipeline
+    bool("PERCHER_CANARY_AUTO_ROLLBACK", ["api"], "roll back on a canary failure instead of logging", TRUE, "enabled", ["false"]),
+    bool("PERCHER_CANARY_EDGE_KEEPS_LIVE", ["api"], "keep a deploy live when the canary failure was Percher's own edge", ONE, "enabled", ["0"]),
+    bool("PERCHER_DRAIN_AT_SETTLEMENT", ["api"], "drain the predecessor at canary settlement instead of on a timer", ONE, "enabled", ["0"]),
+    // Security scanning
+    bool("SECURITY_BLOCK_DEPLOY", ["api"], "block the swap on red scan findings instead of advising", TRUE),
+    bool("SECURITY_AUTO_HOLD", ["api"], "runtime re-scan places red apps on security hold automatically", TRUE),
+    {
+        kind: "enum",
+        name: "PERCHER_INTERNAL_SIG_MODE",
+        readers: ["api"],
+        purpose: "HMAC signing of /internal/* calls: off, log or enforce",
+        values: ["off", "log", "enforce"],
+        default: "off",
+    },
+    bool("METRICS_PUBLIC", ["api"], "serve /metrics without the internal secret", TRUE),
+    // Dashboard
+    {
+        kind: "enum",
+        name: "PERCHER_CONTROL_CSP",
+        readers: ["dashboard"],
+        purpose: "content-security policy off, report-only or enforced",
+        values: ["off", "report", "enforce"],
+        default: "report",
+        normalize: true,
+    },
+    bool("NEXT_PUBLIC_PERCHER_E2E", ["dashboard"], "compile the e2e login-as route into the bundle (build time)", ONE),
+    {
+        kind: "presence",
+        name: "PERCHER_E2E_SECRET",
+        readers: ["dashboard"],
+        purpose: "the e2e login-as route works when set",
+    },
+    bool("PERCHER_ALLOW_NO_CAPTCHA", ["dashboard"], "allow production without Turnstile", ONE),
+    bool("PERCHER_ALLOW_UNVERIFIED_SIGNUP", ["dashboard"], "allow production without Resend", ONE),
+    bool("PERCHER_DASHBOARD_SECRET_BUILD", ["dashboard"], "allow an ephemeral BetterAuth key during `next build` only, never at runtime", ONE),
+    // Boot-guard opt-outs and topology
+    bool("PERCHER_ALLOW_NO_ALERTING", ["api"], "boot without an alert channel", ONE),
+    {
+        kind: "presence",
+        name: "PERCHER_WORKER_URL",
+        readers: ["api"],
+        purpose: "proxy container operations to the worker daemon (production topology) when set",
+    },
+    {
+        kind: "presence",
+        name: "PLATFORM_SUNSET_DATE",
+        readers: ["api"],
+        purpose: "sunset mode: banners, emails and the deletion schedule, when set",
+    },
+    // Client telemetry opt-outs
+    bool("PERCHER_NO_TELEMETRY", ["cli", "mcp"], "client telemetry off", ["1", "true"]),
+    bool("DO_NOT_TRACK", ["cli", "mcp"], "client telemetry off (the cross-tool convention)", ONE),
+    // Withdrawn provider seam
+    {
+        kind: "enum",
+        name: "CRASH_ANALYZER_PROVIDER",
+        readers: ["api"],
+        purpose: "the fake crash analyzer for tests, or none",
+        values: ["fake", "disabled"],
+        default: "disabled",
+    },
+];
+export const SWITCH_BY_NAME = new Map(SWITCHES.map((s) => [s.name, s]));
+/** The state a raw value puts a switch in, by that switch's own spellings. */
+export function switchState(spec, raw) {
+    if (raw === undefined || raw === "")
+        return "unset";
+    switch (spec.kind) {
+        case "boolean":
+            if (spec.enabled.includes(raw))
+                return "enabled";
+            if (spec.disabled.includes(raw))
+                return "disabled";
+            return "invalid";
+        case "enum": {
+            const value = spec.normalize ? raw.trim().toLowerCase() : raw;
+            return spec.values.includes(value) ? "enabled" : "invalid";
+        }
+        case "presence":
+            return "enabled";
+    }
+}
+function registered(name, kind) {
+    const spec = SWITCH_BY_NAME.get(name);
+    if (spec?.kind !== kind)
+        throw new Error(`${name} is not a registered ${kind} switch`);
+    return spec;
+}
+/**
+ * The path a boolean switch selects: ON for an enabled spelling, OFF for a
+ * disabled one, and the switch's default when unset or invalid. That is what
+ * every `=== "1"` / `!== "0"` reader returned, so moving a reader here changes
+ * no verdict.
+ */
+export function switchEnabled(name, env) {
+    const spec = registered(name, "boolean");
+    const state = switchState(spec, env[name]);
+    if (state === "enabled")
+        return true;
+    if (state === "disabled")
+        return false;
+    return spec.default === "enabled";
+}
+/** The mode an enum switch selects: its (normalized) value, or the default when unset or invalid. */
+export function switchValue(name, env) {
+    const spec = registered(name, "enum");
+    const raw = env[name];
+    if (raw === undefined || switchState(spec, raw) !== "enabled")
+        return spec.default;
+    return spec.normalize ? raw.trim().toLowerCase() : raw;
+}
+/**
+ * The switches whose raw value is set but not a spelling any reader accepts.
+ * The input to the boot refusal; it never throws.
+ */
+export function reportSwitches(env, reader) {
+    const out = [];
+    for (const spec of SWITCHES) {
+        if (reader && !spec.readers.includes(reader))
+            continue;
+        const raw = env[spec.name];
+        const state = switchState(spec, raw);
+        if (state !== "invalid" || raw === undefined)
+            continue;
+        const accepted = spec.kind === "boolean"
+            ? [...spec.enabled, ...spec.disabled]
+            : spec.kind === "enum"
+                ? spec.values
+                : [];
+        const fallback = spec.kind === "presence" ? "unset" : spec.default;
+        out.push({ name: spec.name, raw, state, accepted, fallback });
+    }
+    return out;
+}
+/**
+ * Refuse to boot on a set-but-invalid switch: the reader would silently take
+ * its default path, which is how a `"true"` switch set to `1` stayed off.
+ * A disabled spelling and an unset variable never refuse. The error names
+ * every invalid switch with its raw value and accepted spellings. Call it
+ * before any other boot guard and before any listener starts.
+ */
+export function assertValidSwitches(env, reader) {
+    const invalid = reportSwitches(env, reader);
+    if (invalid.length === 0)
+        return;
+    throw new Error(invalid
+        .map((r) => `[percher-${reader}] refusing to start: ${r.name}=${JSON.stringify(r.raw)} is not a spelling this switch accepts. ` +
+        `Accepted: ${r.accepted.map((a) => JSON.stringify(a)).join(", ")}. ` +
+        `Unset it for the default (${r.fallback}).`)
+        .join("\n"));
+}
+//# sourceMappingURL=switches.js.map

package/dist/switches.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"switches.js","sourceRoot":"","sources":["../src/switches.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAsCH,MAAM,GAAG,GAAG,CAAC,GAAG,CAAU,CAAC;AAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAU,CAAC;AAC/B,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,CAAU,CAAC;AAE9C,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,mCAAmC;AACnC,MAAM,IAAI,GAAG,CACX,IAAY,EACZ,OAAgC,EAChC,OAAe,EACf,OAA0B,EAC1B,GAAG,GAA2B,UAAU,EACxC,QAAQ,GAAsB,aAAa,EAC5B,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE,SAAS;IACf,IAAI;IACJ,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO,EAAE,GAAG;CACb,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,QAAQ,GAA0B;IAC7C,iBAAiB;IACjB,IAAI,CACF,6BAA6B,EAC7B,CAAC,KAAK,CAAC,EACP,8GAA8G,EAC9G,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,KAAK,CAAC,EACP,4GAA4G,EAC5G,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IACD,IAAI,CACF,0BAA0B,EAC1B,CAAC,KAAK,CAAC,EACP,2DAA2D,EAC3D,GAAG,CACJ;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,QAAQ,CAAC,EACV,mHAAmH,EACnH,GAAG,CACJ;IAED,gCAAgC;IAChC,IAAI,CACF,0BAA0B,EAC1B,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjB,+FAA+F,EAC/F,IAAI,CACL;IACD,IAAI,CACF,iCAAiC,EACjC,CAAC,KAAK,CAAC,EACP,uEAAuE,EACvE,GAAG,CACJ;IACD,IAAI,CACF,0BAA0B,EAC1B,CAAC,KAAK,CAAC,EACP,sFAAsF,EACtF,GAAG,CACJ;IACD,IAAI,CACF,mCAAmC,EACnC,CAAC,KAAK,CAAC,EACP,qFAAqF,EACrF,GAAG,CACJ;IACD,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,kDAAkD,EAAE,GAAG,CAAC;IAC9F,IAAI,CACF,sBAAsB,EACtB,CAAC,KAAK,CAAC,EACP,kEAAkE,EAClE,GAAG,CACJ;IAED,qBAAqB;IACrB,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,CAAC,EACP,mFAAmF,EACnF,GAAG,CACJ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,0EAA0E;QACnF,MAAM,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;QAC3B,OAAO,EAAE,UAAU;KACpB;IACD,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,CAAC,EACP,qEAAqE,EACrE,IAAI,CACL;IACD,IAAI,CACF,kCAAkC,EAClC,CAAC,KAAK,CAAC,EACP,kEAAkE,EAClE,IAAI,CACL;IAED,+BAA+B;IAC/B,IAAI,CACF,oCAAoC,EACpC,CAAC,KAAK,CAAC,EACP,qDAAqD,EACrD,GAAG,CACJ;IACD,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,gCAAgC,EAAE,GAAG,CAAC;IAC5E,IAAI,CAAC,yBAAyB,EAAE,CAAC,KAAK,CAAC,EAAE,mCAAmC,EAAE,GAAG,CAAC;IAClF,IAAI,CACF,mCAAmC,EACnC,CAAC,KAAK,CAAC,EACP,qDAAqD,EACrD,GAAG,CACJ;IACD,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,CAAC,EACP,mEAAmE,EACnE,GAAG,CACJ;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,KAAK,CAAC,EACP,8DAA8D,EAC9D,GAAG,CACJ;IACD,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjB,yDAAyD,EACzD,GAAG,CACJ;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,KAAK,CAAC,EACP,qEAAqE,EACrE,GAAG,CACJ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,6EAA6E;QACtF,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;QAC/B,OAAO,EAAE,UAAU;KACpB;IAED,kBAAkB;IAClB,IAAI,CACF,8BAA8B,EAC9B,CAAC,KAAK,CAAC,EACP,kDAAkD,EAClD,IAAI,EACJ,SAAS,EACT,CAAC,OAAO,CAAC,CACV;IACD,IAAI,CACF,gCAAgC,EAChC,CAAC,KAAK,CAAC,EACP,mEAAmE,EACnE,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IACD,IAAI,CACF,6BAA6B,EAC7B,CAAC,KAAK,CAAC,EACP,kEAAkE,EAClE,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IAED,oBAAoB;IACpB,IAAI,CACF,uBAAuB,EACvB,CAAC,KAAK,CAAC,EACP,yDAAyD,EACzD,IAAI,CACL;IACD,IAAI,CACF,oBAAoB,EACpB,CAAC,KAAK,CAAC,EACP,gEAAgE,EAChE,IAAI,CACL;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,wDAAwD;QACjE,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;QACjC,OAAO,EAAE,KAAK;KACf;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,EAAE,4CAA4C,EAAE,IAAI,CAAC;IAEnF,YAAY;IACZ;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;QACpC,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,IAAI;KAChB;IACD,IAAI,CACF,yBAAyB,EACzB,CAAC,WAAW,CAAC,EACb,6DAA6D,EAC7D,GAAG,CACJ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,OAAO,EAAE,uCAAuC;KACjD;IACD,IAAI,CAAC,0BAA0B,EAAE,CAAC,WAAW,CAAC,EAAE,oCAAoC,EAAE,GAAG,CAAC;IAC1F,IAAI,CAAC,iCAAiC,EAAE,CAAC,WAAW,CAAC,EAAE,iCAAiC,EAAE,GAAG,CAAC;IAC9F,IAAI,CACF,gCAAgC,EAChC,CAAC,WAAW,CAAC,EACb,8EAA8E,EAC9E,GAAG,CACJ;IAED,mCAAmC;IACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,+BAA+B,EAAE,GAAG,CAAC;IAChF;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,gFAAgF;KAC1F;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,kEAAkE;KAC5E;IAED,4BAA4B;IAC5B,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnF,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,kDAAkD,EAAE,GAAG,CAAC;IAE7F,0BAA0B;IAC1B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,4CAA4C;QACrD,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,OAAO,EAAE,UAAU;KACpB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAoC,IAAI,GAAG,CACpE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACjC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,GAAuB;IACnE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC;IACpD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,UAAU,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,KAAK,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;QACD,KAAK,UAAU;YACb,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAID,SAAS,UAAU,CACjB,IAAY,EACZ,IAAO;IAEP,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,IAAI,SAAS,CAAC,CAAC;IACvF,OAAO,IAAwC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAQ;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;AACpC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAQ;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACnF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAuC,EACvC,MAAqB;IAErB,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACvD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QACvD,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,SAAS;YACrB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM;gBACpB,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAuC,EACvC,MAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,IAAI,KAAK,CACb,OAAO;SACJ,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,YAAY,MAAM,wBAAwB,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,0CAA0C;QACnH,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACpE,6BAA6B,CAAC,CAAC,QAAQ,IAAI,CAC9C;SACA,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;AACJ,CAAC"}

package/dist/waitlist-token.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The personal "remove me" links for the two lists that hold an address
+ * until someone asks us to delete it: the pre-launch waitlist
+ * (`waitlist_signups`) and a closed tier's "tell me when it opens" list
+ * (`plan_interests`). A token names one row and proves the link came from
+ * Percher: `<rowId>.<mac>` for the waitlist, `plan.<rowId>.<mac>` for a plan
+ * interest. The mac is an HMAC of the row id under a key derived from the
+ * platform's internal secret with a fixed label per list, so the key is used
+ * for nothing else, no new secret has to be provisioned, and a token for one
+ * list never verifies for the other. The API builds the links (the waitlist
+ * export, the plan-interest emails) and the dashboard verifies them, so they
+ * live here once.
+ *
+ * A subpath export, never the barrel: `node:crypto` must not reach the
+ * dashboard's client bundle (see secure-compare.ts).
+ */
+declare const PURPOSES: {
+    readonly signup: {
+        readonly label: "percher-waitlist-removal-v1";
+        readonly prefix: "";
+    };
+    readonly plan_interest: {
+        readonly label: "percher-plan-interest-removal-v1";
+        readonly prefix: "plan.";
+    };
+};
+export type RemovalPurpose = keyof typeof PURPOSES;
+export declare function waitlistRemovalToken(secret: string, rowId: string): string;
+export declare function planInterestRemovalToken(secret: string, rowId: string): string;
+/**
+ * Which list and row a genuine token names, otherwise null. The prefix picks
+ * the label, and the label is part of the key, so moving a token to the other
+ * list by adding or dropping the prefix fails the mac.
+ */
+export declare function verifyRemovalToken(secret: string, token: string | null | undefined): {
+    purpose: RemovalPurpose;
+    rowId: string;
+} | null;
+/** The waitlist row id when the token is a genuine waitlist link, otherwise null. */
+export declare function verifyWaitlistRemovalToken(secret: string, token: string | null | undefined): string | null;
+/**
+ * The public page a token opens; `origin` is the dashboard origin. Both lists
+ * use the same page. The query name is `token` because Caddy's access-log
+ * filter blanks that name in the URI and the Referer (infra/Caddyfile.prod);
+ * a new name would be logged.
+ */
+export declare function waitlistRemovalUrl(origin: string, token: string): string;
+export {};
+//# sourceMappingURL=waitlist-token.d.ts.map

package/dist/waitlist-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waitlist-token.d.ts","sourceRoot":"","sources":["../src/waitlist-token.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,QAAQ;aACZ,MAAM;iBAAI,KAAK,EAAE,6BAA6B;iBAAE,MAAM,EAAE,EAAE;;aAC1D,aAAa;iBAAI,KAAK,EAAE,kCAAkC;iBAAE,MAAM,EAAE,OAAO;;CACnE,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,QAAQ,CAAC;AAcnD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUnD;AAED,qFAAqF;AACrF,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAGf;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/waitlist-token.js

@@ -0,0 +1,71 @@
+import { createHmac } from "node:crypto";
+import { secretEquals } from "./secure-compare.js";
+/**
+ * The personal "remove me" links for the two lists that hold an address
+ * until someone asks us to delete it: the pre-launch waitlist
+ * (`waitlist_signups`) and a closed tier's "tell me when it opens" list
+ * (`plan_interests`). A token names one row and proves the link came from
+ * Percher: `<rowId>.<mac>` for the waitlist, `plan.<rowId>.<mac>` for a plan
+ * interest. The mac is an HMAC of the row id under a key derived from the
+ * platform's internal secret with a fixed label per list, so the key is used
+ * for nothing else, no new secret has to be provisioned, and a token for one
+ * list never verifies for the other. The API builds the links (the waitlist
+ * export, the plan-interest emails) and the dashboard verifies them, so they
+ * live here once.
+ *
+ * A subpath export, never the barrel: `node:crypto` must not reach the
+ * dashboard's client bundle (see secure-compare.ts).
+ */
+const PURPOSES = {
+    signup: { label: "percher-waitlist-removal-v1", prefix: "" },
+    plan_interest: { label: "percher-plan-interest-removal-v1", prefix: "plan." },
+};
+const MAC_CHARS = 32;
+function mac(secret, purpose, rowId) {
+    const key = createHmac("sha256", secret).update(PURPOSES[purpose].label).digest();
+    return createHmac("sha256", key).update(rowId).digest("base64url").slice(0, MAC_CHARS);
+}
+function removalToken(secret, purpose, rowId) {
+    if (!secret)
+        throw new Error("A removal token needs the internal secret");
+    return `${PURPOSES[purpose].prefix}${rowId}.${mac(secret, purpose, rowId)}`;
+}
+export function waitlistRemovalToken(secret, rowId) {
+    return removalToken(secret, "signup", rowId);
+}
+export function planInterestRemovalToken(secret, rowId) {
+    return removalToken(secret, "plan_interest", rowId);
+}
+/**
+ * Which list and row a genuine token names, otherwise null. The prefix picks
+ * the label, and the label is part of the key, so moving a token to the other
+ * list by adding or dropping the prefix fails the mac.
+ */
+export function verifyRemovalToken(secret, token) {
+    if (!secret || !token || token.length > 200)
+        return null;
+    const purpose = token.startsWith(PURPOSES.plan_interest.prefix)
+        ? "plan_interest"
+        : "signup";
+    const body = token.slice(PURPOSES[purpose].prefix.length);
+    const dot = body.lastIndexOf(".");
+    if (dot <= 0)
+        return null;
+    const rowId = body.slice(0, dot);
+    return secretEquals(body.slice(dot + 1), mac(secret, purpose, rowId)) ? { purpose, rowId } : null;
+}
+/** The waitlist row id when the token is a genuine waitlist link, otherwise null. */
+export function verifyWaitlistRemovalToken(secret, token) {
+    const verified = verifyRemovalToken(secret, token);
+    return verified?.purpose === "signup" ? verified.rowId : null;
+}
+/**
+ * The public page a token opens; `origin` is the dashboard origin. Both lists
+ * use the same page. The query name is `token` because Caddy's access-log
+ * filter blanks that name in the URI and the Referer (infra/Caddyfile.prod);
+ * a new name would be logged.
+ */
+export function waitlistRemovalUrl(origin, token) {
+    return `${origin.replace(/\/+$/, "")}/waitlist/leave?token=${encodeURIComponent(token)}`;
+}
+//# sourceMappingURL=waitlist-token.js.map

package/dist/waitlist-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waitlist-token.js","sourceRoot":"","sources":["../src/waitlist-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5D,aAAa,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,MAAM,EAAE,OAAO,EAAE;CACrE,CAAC;AAIX,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,SAAS,GAAG,CAAC,MAAc,EAAE,OAAuB,EAAE,KAAa;IACjE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IAClF,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,OAAuB,EAAE,KAAa;IAC1E,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC1E,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,KAAa;IAChE,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,KAAa;IACpE,OAAO,YAAY,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,KAAgC;IAEhC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAmB,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;QAC7E,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,QAAQ,CAAC;IACb,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,0BAA0B,CACxC,MAAc,EACd,KAAgC;IAEhC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,QAAQ,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAa;IAC9D,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,yBAAyB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3F,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@percher/shared",
-  "version": "1.0.2",
+  "version": "1.2.0",
   "description": "Shared constants and contracts (timeouts, etc.) used across the Percher CLI, API, MCP, and worker. Internal — values change in lockstep across packages.",
   "type": "module",
   "main": "./dist/index.js",
@@ -36,6 +36,16 @@
       "import": "./dist/pow.js",
       "default": "./dist/pow.js"
     },
+    "./secure-compare": {
+      "types": "./dist/secure-compare.d.ts",
+      "import": "./dist/secure-compare.js",
+      "default": "./dist/secure-compare.js"
+    },
+    "./waitlist-token": {
+      "types": "./dist/waitlist-token.d.ts",
+      "import": "./dist/waitlist-token.js",
+      "default": "./dist/waitlist-token.js"
+    },
     "./signup-invite-hash": {
       "types": "./dist/signup-invite-hash.d.ts",
       "import": "./dist/signup-invite-hash.js",