@percher/shared 1.1.0 → 1.3.0

package/dist/deployment-security.js

@@ -0,0 +1,146 @@
+const FAILURE_TEXT = {
+    SCANNER_UNAVAILABLE: "The security scanner is unavailable.",
+    SCANNER_ENGINE_DEGRADED: "A security scanner did not complete successfully.",
+    SCANNER_DATABASE_ERROR: "The vulnerability databases could not be verified as current.",
+    KEV_CATALOG_STALE: "The known-exploited vulnerability catalogue is not current.",
+    IMMUTABLE_SOURCE_UNAVAILABLE: "The exact image could not be identified.",
+    IMMUTABLE_SOURCE_CHANGED: "The image changed during security verification.",
+    SCAN_EVIDENCE_UNAVAILABLE: "The security scan result could not be saved or verified.",
+    SCANNER_EXECUTION_ERROR: "The security scan could not complete.",
+};
+export function deploymentSecurityActionText(action, context) {
+    switch (action) {
+        case "retry_scan":
+            if (context === "automatic_rollback")
+                return "Retry rollback only when security verification is available, or publish a verified replacement.";
+            return "Retry publishing when security verification is available. The new image was not published.";
+        case "update_dependency":
+            return "Update or replace the affected dependency, then publish again.";
+        case "wait_for_platform_fix":
+            return "Percher must fix the affected platform component before this image can be published.";
+    }
+}
+/** Fixed authored text only; never interpolate scanner-supplied values here. */
+export function deploymentSecuritySummary(block) {
+    const explanation = block.reason === "scan_unavailable"
+        ? block.scanFailureCode
+            ? FAILURE_TEXT[block.scanFailureCode]
+            : "The image could not be verified by the security scan."
+        : "The image contains a critical or known-exploited vulnerability.";
+    return block.context === "automatic_rollback"
+        ? `Automatic rollback stopped: ${explanation} The current version was kept running and may still be unhealthy.`
+        : `Publication stopped: ${explanation}`;
+}
+/** Fixed recovery instructions; scanner diagnostics never enter this channel. */
+export function deploymentSecurityRecoveryPrompt(block) {
+    if (block.context === "automatic_rollback") {
+        return block.reason === "vulnerability"
+            ? "Automatic rollback was blocked because the previous image has a critical or known-exploited vulnerability. The current version was kept running and may still be unhealthy. Review the findings and publish a fixed replacement, or wait for Percher's platform fix."
+            : "Automatic rollback stopped because the previous image could not be verified. The current version was kept running and may still be unhealthy. Retry rollback only when verification is available, or publish a verified replacement.";
+    }
+    return block.reason === "vulnerability"
+        ? "Publication was blocked by security policy. Review the vulnerability details, update affected app dependencies or wait for Percher's platform fix before publishing again."
+        : "Publication stopped because security verification was unavailable. Retry publishing when verification is available; the scan has not established whether the image is safe.";
+}
+function text(value, max) {
+    return (typeof value === "string" &&
+        value.length > 0 &&
+        value.length <= max &&
+        // biome-ignore lint/suspicious/noControlCharactersInRegex: diagnostic fields cannot forge terminal lines.
+        !/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/.test(value));
+}
+/** Validate persisted/wire data without turning it into a recovery instruction. */
+export function parseDeploymentSecurityBlock(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const v = value;
+    if (v.version !== 1)
+        return null;
+    if (v.context !== undefined && v.context !== "automatic_rollback")
+        return null;
+    if (v.reason !== "vulnerability" && v.reason !== "scan_unavailable")
+        return null;
+    if (v.imageId !== null &&
+        (typeof v.imageId !== "string" || !/^sha256:[a-f0-9]{64}$/.test(v.imageId)))
+        return null;
+    if (!Array.isArray(v.actions) ||
+        v.actions.length < 1 ||
+        v.actions.length > 3 ||
+        !v.actions.every((a) => ["retry_scan", "update_dependency", "wait_for_platform_fix"].includes(a)) ||
+        new Set(v.actions).size !== v.actions.length)
+        return null;
+    if (!Array.isArray(v.findings) ||
+        v.findings.length > 100 ||
+        !Number.isSafeInteger(v.totalFindings) ||
+        v.totalFindings < v.findings.length ||
+        typeof v.truncated !== "boolean" ||
+        v.truncated !== v.totalFindings > v.findings.length)
+        return null;
+    if (v.scanFailureCode !== undefined &&
+        (v.reason !== "scan_unavailable" ||
+            typeof v.scanFailureCode !== "string" ||
+            !Object.hasOwn(FAILURE_TEXT, v.scanFailureCode)))
+        return null;
+    if (v.reason === "scan_unavailable" &&
+        (v.totalFindings !== 0 || v.actions.length !== 1 || v.actions[0] !== "retry_scan"))
+        return null;
+    if (v.reason === "vulnerability" && (v.totalFindings === 0 || v.actions.includes("retry_scan")))
+        return null;
+    if (v.reason === "vulnerability" && v.imageId === null)
+        return null;
+    const findings = [];
+    for (const item of v.findings) {
+        if (!item || typeof item !== "object" || Array.isArray(item))
+            return null;
+        const f = item;
+        if (!text(f.cve, 128) ||
+            !text(f.component, 512) ||
+            !["Critical", "High", "Medium", "Low"].includes(f.severity) ||
+            (f.version !== null && !text(f.version, 512)) ||
+            (f.fixedIn !== null && !text(f.fixedIn, 2048)) ||
+            typeof f.exploitedKev !== "boolean" ||
+            !["user", "percher"].includes(f.responsibility))
+            return null;
+        findings.push({
+            cve: f.cve,
+            component: f.component,
+            version: f.version,
+            fixedIn: f.fixedIn,
+            severity: f.severity,
+            exploitedKev: f.exploitedKev,
+            responsibility: f.responsibility,
+        });
+    }
+    if (v.reason === "vulnerability") {
+        if (findings.length === 0 || findings.some((f) => f.severity !== "Critical" && !f.exploitedKev))
+            return null;
+        const required = new Set(findings.map((f) => f.responsibility === "percher" ? "wait_for_platform_fix" : "update_dependency"));
+        if ([...required].some((action) => !v.actions.includes(action)))
+            return null;
+        if (!v.truncated &&
+            v.actions.some((action) => !required.has(action)))
+            return null;
+    }
+    return {
+        version: 1,
+        ...(v.context === "automatic_rollback" ? { context: "automatic_rollback" } : {}),
+        reason: v.reason,
+        imageId: v.imageId,
+        actions: v.actions,
+        findings,
+        totalFindings: v.totalFindings,
+        truncated: v.truncated,
+        ...(v.scanFailureCode ? { scanFailureCode: v.scanFailureCode } : {}),
+    };
+}
+export function decodeDeploymentSecurityBlock(json) {
+    if (!json || json.length > 400_000)
+        return null;
+    try {
+        return parseDeploymentSecurityBlock(JSON.parse(json));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=deployment-security.js.map

package/dist/deployment-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-security.js","sourceRoot":"","sources":["../src/deployment-security.ts"],"names":[],"mappings":"AAmCA,MAAM,YAAY,GAA4C;IAC5D,mBAAmB,EAAE,sCAAsC;IAC3D,uBAAuB,EAAE,mDAAmD;IAC5E,sBAAsB,EAAE,+DAA+D;IACvF,iBAAiB,EAAE,6DAA6D;IAChF,4BAA4B,EAAE,0CAA0C;IACxE,wBAAwB,EAAE,iDAAiD;IAC3E,yBAAyB,EAAE,0DAA0D;IACrF,uBAAuB,EAAE,uCAAuC;CACjE,CAAC;AAEF,MAAM,UAAU,4BAA4B,CAC1C,MAAgC,EAChC,OAA8B;IAE9B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,YAAY;YACf,IAAI,OAAO,KAAK,oBAAoB;gBAClC,OAAO,iGAAiG,CAAC;YAC3G,OAAO,4FAA4F,CAAC;QACtG,KAAK,mBAAmB;YACtB,OAAO,gEAAgE,CAAC;QAC1E,KAAK,uBAAuB;YAC1B,OAAO,sFAAsF,CAAC;IAClG,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,KAA8B;IACtE,MAAM,WAAW,GACf,KAAK,CAAC,MAAM,KAAK,kBAAkB;QACjC,CAAC,CAAC,KAAK,CAAC,eAAe;YACrB,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC;YACrC,CAAC,CAAC,uDAAuD;QAC3D,CAAC,CAAC,iEAAiE,CAAC;IACxE,OAAO,KAAK,CAAC,OAAO,KAAK,oBAAoB;QAC3C,CAAC,CAAC,+BAA+B,WAAW,mEAAmE;QAC/G,CAAC,CAAC,wBAAwB,WAAW,EAAE,CAAC;AAC5C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gCAAgC,CAC9C,KAA0D;IAE1D,IAAI,KAAK,CAAC,OAAO,KAAK,oBAAoB,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC,MAAM,KAAK,eAAe;YACrC,CAAC,CAAC,sQAAsQ;YACxQ,CAAC,CAAC,sOAAsO,CAAC;IAC7O,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,KAAK,eAAe;QACrC,CAAC,CAAC,4KAA4K;QAC9K,CAAC,CAAC,6KAA6K,CAAC;AACpL,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,GAAW;IACvC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,0GAA0G;QAC1G,CAAC,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACjF,IACE,CAAC,CAAC,OAAO,KAAK,IAAI;QAClB,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAE3E,OAAO,IAAI,CAAC;IACd,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,CAAC,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACzE;QACD,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM;QAE5C,OAAO,IAAI,CAAC;IACd,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG;QACvB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,aAAwB,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC/C,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS;QAChC,CAAC,CAAC,SAAS,KAAM,CAAC,CAAC,aAAwB,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM;QAE/D,OAAO,IAAI,CAAC;IACd,IACE,CAAC,CAAC,eAAe,KAAK,SAAS;QAC/B,CAAC,CAAC,CAAC,MAAM,KAAK,kBAAkB;YAC9B,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;YACrC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;QAElD,OAAO,IAAI,CAAC;IACd,IACE,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAC/B,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;QAElF,OAAO,IAAI,CAAC;IACd,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IACE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC;YACjB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC;YACvB,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAkB,CAAC;YACrE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,YAAY,KAAK,SAAS;YACnC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAwB,CAAC;YAEzD,OAAO,IAAI,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAwB;YACnC,OAAO,EAAE,CAAC,CAAC,OAAwB;YACnC,QAAQ,EAAE,CAAC,CAAC,QAAiD;YAC7D,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,cAAc,EAAE,CAAC,CAAC,cAAoC;SACvD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,mBAAmB,CAC/E,CACF,CAAC;QACF,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,OAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,IACE,CAAC,CAAC,CAAC,SAAS;YACZ,CAAC,CAAC,OAAO,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAuD,CAAC,CACnF;YAED,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,oBAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAwB;QACnC,OAAO,EAAE,CAAC,CAAC,OAAqC;QAChD,QAAQ;QACR,aAAa,EAAE,CAAC,CAAC,aAAuB;QACxC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAA0C,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAA+B;IAE/B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/disposable-email-domains.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Returns true if the domain portion of `email` is a known disposable /
+ * throwaway address. Trims + lowercases + reads the part after the last
+ * `@`. Returns false on inputs that don't look like an email address
+ * (no `@`, empty domain) so the caller can still hand the value to
+ * BetterAuth's own validation for a proper error message.
+ */
+export declare function isDisposableEmailDomain(email: string): boolean;
+/** Number of entries in the in-memory blocklist — exposed for tests. */
+export declare function disposableDomainCount(): number;
+//# sourceMappingURL=disposable-email-domains.d.ts.map

package/dist/disposable-email-domains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disposable-email-domains.d.ts","sourceRoot":"","sources":["../src/disposable-email-domains.ts"],"names":[],"mappings":"AAsFA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAY9D;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C"}

package/dist/disposable-email-domains.js

@@ -0,0 +1,112 @@
+// Disposable / throwaway email domain blocklist.
+//
+// Curated subset of the 4000+ entries from
+// https://github.com/disposable-email-domains/disposable-email-domains
+// (CC0 1.0 / public domain — see that repo's LICENSE). We keep ~50 of the
+// most-abused families that show up in signup spam against small SaaS:
+// mailinator, guerrillamail, 10minutemail, tempmail-style and the common
+// rotated subdomains. The upstream list rolls in long-tail additions
+// constantly; we deliberately stay small here so the runtime check is a
+// hot Set lookup rather than a 4000-string scan, and so we can review
+// every entry. Add more as we see real signup-abuse traffic.
+//
+// Lower-cased, no whitespace. Compared against the part after the last
+// "@" of an email address (also lower-cased + trimmed).
+const DISPOSABLE_DOMAINS = new Set([
+    // Mailinator family
+    "mailinator.com",
+    "mailinator.net",
+    "mailinator2.com",
+    "binkmail.com",
+    "bobmail.info",
+    "chammy.info",
+    "devnullmail.com",
+    "letthemeatspam.com",
+    "mailnesia.com",
+    "mailtothis.com",
+    "notmailinator.com",
+    "reallymymail.com",
+    "safetymail.info",
+    "thisisnotmyrealemail.com",
+    "tradermail.info",
+    "veryrealemail.com",
+    "zippymail.info",
+    // Guerrilla Mail
+    "guerrillamail.com",
+    "guerrillamail.net",
+    "guerrillamail.org",
+    "guerrillamail.biz",
+    "guerrillamail.de",
+    "guerrillamailblock.com",
+    "sharklasers.com",
+    "grr.la",
+    "spam4.me",
+    // 10MinuteMail / temp-mail style
+    "10minutemail.com",
+    "10minutemail.net",
+    "20minutemail.com",
+    "30minutemail.com",
+    "tempmail.com",
+    "temp-mail.org",
+    "temp-mail.io",
+    "tempmailaddress.com",
+    "tempmailo.com",
+    "tempinbox.com",
+    "throwawaymail.com",
+    "yopmail.com",
+    "yopmail.fr",
+    "yopmail.net",
+    "maildrop.cc",
+    "trashmail.com",
+    "trashmail.de",
+    "trashmail.net",
+    "trash-mail.com",
+    "dispostable.com",
+    "fakeinbox.com",
+    "getnada.com",
+    "mintemail.com",
+    "mohmal.com",
+    "moakt.cc",
+    // Misc high-volume disposables seen in signup abuse
+    "formtests.info",
+    "mailcatch.com",
+    "mailnull.com",
+    "spambog.com",
+    "spambox.us",
+    "spamgourmet.com",
+    "emailondeck.com",
+    "fakemailgenerator.com",
+    "jetable.org",
+    "mytrashmail.com",
+    "owlpic.com",
+    "rcpt.at",
+    "trbvm.com",
+]);
+/**
+ * Returns true if the domain portion of `email` is a known disposable /
+ * throwaway address. Trims + lowercases + reads the part after the last
+ * `@`. Returns false on inputs that don't look like an email address
+ * (no `@`, empty domain) so the caller can still hand the value to
+ * BetterAuth's own validation for a proper error message.
+ */
+export function isDisposableEmailDomain(email) {
+    if (!email)
+        return false;
+    const at = email.lastIndexOf("@");
+    if (at <= 0 || at === email.length - 1)
+        return false;
+    const domain = email
+        .slice(at + 1)
+        .trim()
+        .toLowerCase()
+        .replace(/\.+$/, "");
+    if (!domain)
+        return false;
+    const labels = domain.split(".");
+    return labels.some((_, index) => DISPOSABLE_DOMAINS.has(labels.slice(index).join(".")));
+}
+/** Number of entries in the in-memory blocklist — exposed for tests. */
+export function disposableDomainCount() {
+    return DISPOSABLE_DOMAINS.size;
+}
+//# sourceMappingURL=disposable-email-domains.js.map

package/dist/disposable-email-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disposable-email-domains.js","sourceRoot":"","sources":["../src/disposable-email-domains.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,2CAA2C;AAC3C,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,6DAA6D;AAC7D,EAAE;AACF,uEAAuE;AACvE,wDAAwD;AAExD,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,oBAAoB;IACpB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,oBAAoB;IACpB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjB,0BAA0B;IAC1B,iBAAiB;IACjB,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,wBAAwB;IACxB,iBAAiB;IACjB,QAAQ;IACR,UAAU;IACV,iCAAiC;IACjC,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,cAAc;IACd,eAAe;IACf,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,eAAe;IACf,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,aAAa;IACb,aAAa;IACb,eAAe;IACf,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,eAAe;IACf,aAAa;IACb,eAAe;IACf,YAAY;IACZ,UAAU;IACV,oDAAoD;IACpD,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,aAAa;IACb,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,uBAAuB;IACvB,aAAa;IACb,iBAAiB;IACjB,YAAY;IACZ,SAAS;IACT,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK;SACjB,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;SACb,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB;IACnC,OAAO,kBAAkB,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/email-budget.d.ts

@@ -0,0 +1,60 @@
+/** Resend free tier: 100/day, 3,000/month. UTC calendar windows. */
+export declare const EMAIL_BUDGET_LIMITS: {
+    readonly daily: 95;
+    readonly monthly: 2900;
+    readonly notificationDaily: 45;
+    readonly crashPerAppDaily: 3;
+};
+export type EmailCategory = "auth" | "operator" | "legal" | "notification";
+interface EmailBudgetCounts {
+    total: number;
+    auth: number;
+    operator: number;
+    legal: number;
+    notification: number;
+}
+export interface EmailBudgetConnection {
+    run(query: string, params?: (string | number)[]): void;
+    /** Drizzle's raw Bun SQLite queries return positional rows. */
+    get<T extends unknown[]>(query: string, params?: (string | number)[]): T | undefined;
+}
+interface EmailBudgetDatabase extends EmailBudgetConnection {
+    immediate<T>(work: (connection: EmailBudgetConnection) => T): T;
+}
+interface EmailBudgetDecision {
+    allowed: boolean;
+    category: EmailCategory;
+    dayKey: string;
+    reason?: "notification_daily" | "daily" | "monthly" | "crash_daily";
+    overCeiling: boolean;
+}
+/** Dashboard-only startup must coexist with the API's migration. */
+export declare const EMAIL_BUDGET_SCHEMA = "\nCREATE TABLE IF NOT EXISTS email_budget_counters (\n  period TEXT PRIMARY KEY NOT NULL,\n  total INTEGER NOT NULL DEFAULT 0,\n  auth INTEGER NOT NULL DEFAULT 0,\n  operator INTEGER NOT NULL DEFAULT 0,\n  legal INTEGER NOT NULL DEFAULT 0,\n  notification INTEGER NOT NULL DEFAULT 0,\n  warning INTEGER NOT NULL DEFAULT 0\n);\nCREATE TABLE IF NOT EXISTS email_budget_crashes (\n  day TEXT NOT NULL,\n  app_id TEXT NOT NULL,\n  count INTEGER NOT NULL DEFAULT 0,\n  PRIMARY KEY (day, app_id)\n);";
+/** Attempts, not successful deliveries: uncertain sends never release capacity. */
+export declare class EmailBudget {
+    private readonly db;
+    private readonly now;
+    onWarning?: (usage: ReturnType<EmailBudget["usage"]>) => Promise<unknown>;
+    constructor(db: EmailBudgetDatabase, now?: () => Date);
+    reserve(category: EmailCategory, options?: {
+        count?: number;
+        crashAppId?: string;
+    }): EmailBudgetDecision;
+    usage(at?: Date): {
+        dayKey: string;
+        monthKey: string;
+        day: EmailBudgetCounts;
+        month: EmailBudgetCounts;
+        limits: {
+            readonly daily: 95;
+            readonly monthly: 2900;
+            readonly notificationDaily: 45;
+            readonly crashPerAppDaily: 3;
+        };
+        uncountedOperatorSenders: string[];
+    };
+    /** The dashboard leaves a durable pending warning; API monitoring drains it. */
+    dispatchWarning(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=email-budget.d.ts.map

package/dist/email-budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-budget.d.ts","sourceRoot":"","sources":["../src/email-budget.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,eAAO,MAAM,mBAAmB;aAC9B,KAAK,EAAE,EAAE;aACT,OAAO,EAAE,IAAK;aACd,iBAAiB,EAAE,EAAE;aACrB,gBAAgB,EAAE,CAAC;CACX,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC;AAC3E,UAAU,iBAAiB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;IACvD,+DAA+D;IAC/D,GAAG,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;CACtF;AACD,UAAU,mBAAoB,SAAQ,qBAAqB;IACzD,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,qBAAqB,KAAK,CAAC,GAAG,CAAC,CAAC;CACjE;AACD,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;IACpE,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,kfAe7B,CAAC;AAoBJ,mFAAmF;AACnF,qBAAa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJtB,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1E,YACmB,EAAE,EAAE,mBAAmB,EACvB,GAAG,GAAE,MAAM,IAAuB,EACjD;IAEJ,OAAO,CACL,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GACpD,mBAAmB,CAgErB;IAED,KAAK,CAAC,EAAE,OAAa;;;;;;4BAhJd,EAAE;8BACA,IAAK;wCACK,EAAE;uCACH,CAAC;;;MAwJlB;IAED,gFAAgF;IAC1E,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAarC;CACF"}

package/dist/email-budget.js

@@ -0,0 +1,135 @@
+/** Resend free tier: 100/day, 3,000/month. UTC calendar windows. */
+export const EMAIL_BUDGET_LIMITS = {
+    daily: 95,
+    monthly: 2_900,
+    notificationDaily: 45,
+    crashPerAppDaily: 3,
+};
+/** Dashboard-only startup must coexist with the API's migration. */
+export const EMAIL_BUDGET_SCHEMA = `
+CREATE TABLE IF NOT EXISTS email_budget_counters (
+  period TEXT PRIMARY KEY NOT NULL,
+  total INTEGER NOT NULL DEFAULT 0,
+  auth INTEGER NOT NULL DEFAULT 0,
+  operator INTEGER NOT NULL DEFAULT 0,
+  legal INTEGER NOT NULL DEFAULT 0,
+  notification INTEGER NOT NULL DEFAULT 0,
+  warning INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE IF NOT EXISTS email_budget_crashes (
+  day TEXT NOT NULL,
+  app_id TEXT NOT NULL,
+  count INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (day, app_id)
+);`;
+const emptyCounts = () => ({
+    total: 0,
+    auth: 0,
+    operator: 0,
+    legal: 0,
+    notification: 0,
+});
+function readCounts(db, period) {
+    const row = db.get("SELECT total, auth, operator, legal, notification FROM email_budget_counters WHERE period = ?", [period]);
+    if (!row)
+        return emptyCounts();
+    const [total, auth, operator, legal, notification] = row;
+    return { total, auth, operator, legal, notification };
+}
+/** Attempts, not successful deliveries: uncertain sends never release capacity. */
+export class EmailBudget {
+    db;
+    now;
+    onWarning;
+    constructor(db, now = () => new Date()) {
+        this.db = db;
+        this.now = now;
+    }
+    reserve(category, options = {}) {
+        if (!["auth", "operator", "legal", "notification"].includes(category))
+            throw new Error("Invalid email category");
+        const count = options.count ?? 1;
+        if (!Number.isSafeInteger(count) || count < 1)
+            throw new Error("Invalid email recipient count");
+        if (options.crashAppId !== undefined && (category !== "notification" || !options.crashAppId))
+            throw new Error("Invalid crash email category or app");
+        const dayKey = this.now().toISOString().slice(0, 10);
+        const periods = [`day:${dayKey}`, `month:${dayKey.slice(0, 7)}`];
+        const decision = this.db.immediate((db) => {
+            for (const period of periods)
+                db.run("INSERT OR IGNORE INTO email_budget_counters (period) VALUES (?)", [period]);
+            const day = readCounts(db, periods[0]);
+            const month = readCounts(db, periods[1]);
+            const reason = day.total + count > EMAIL_BUDGET_LIMITS.daily
+                ? "daily"
+                : month.total + count > EMAIL_BUDGET_LIMITS.monthly
+                    ? "monthly"
+                    : category === "notification" &&
+                        day.notification + count > EMAIL_BUDGET_LIMITS.notificationDaily
+                        ? "notification_daily"
+                        : undefined;
+            if (category === "notification" && reason)
+                return { allowed: false, category, dayKey, reason, overCeiling: false };
+            if (options.crashAppId !== undefined) {
+                const crash = db.get("SELECT count FROM email_budget_crashes WHERE day = ? AND app_id = ?", [dayKey, options.crashAppId]);
+                if ((crash?.[0] ?? 0) >= EMAIL_BUDGET_LIMITS.crashPerAppDaily)
+                    return {
+                        allowed: false,
+                        category,
+                        dayKey,
+                        reason: "crash_daily",
+                        overCeiling: false,
+                    };
+                db.run("INSERT INTO email_budget_crashes (day, app_id, count) VALUES (?, ?, 1) ON CONFLICT(day, app_id) DO UPDATE SET count = count + 1", [dayKey, options.crashAppId]);
+            }
+            for (const period of periods)
+                db.run(`UPDATE email_budget_counters SET total = total + ?, ${category} = ${category} + ? WHERE period = ?`, [count, count, period]);
+            if (reason)
+                db.run("UPDATE email_budget_counters SET warning = 1 WHERE period = ? AND warning = 0", [
+                    periods[0],
+                ]);
+            return { allowed: true, category, dayKey, reason, overCeiling: reason !== undefined };
+        });
+        if (!decision.allowed || decision.overCeiling) {
+            const line = JSON.stringify({
+                event: decision.allowed ? "email_budget_priority_overflow" : "email_budget_skipped",
+                ...decision,
+                crashAppId: options.crashAppId,
+            });
+            if (decision.overCeiling)
+                console.error(line);
+            else
+                console.warn(line);
+        }
+        return decision;
+    }
+    usage(at = this.now()) {
+        const dayKey = at.toISOString().slice(0, 10);
+        const monthKey = dayKey.slice(0, 7);
+        return {
+            dayKey,
+            monthKey,
+            day: readCounts(this.db, `day:${dayKey}`),
+            month: readCounts(this.db, `month:${monthKey}`),
+            limits: EMAIL_BUDGET_LIMITS,
+            uncountedOperatorSenders: ["infra/scripts/lib/backup-alert.py"],
+        };
+    }
+    /** The dashboard leaves a durable pending warning; API monitoring drains it. */
+    async dispatchWarning() {
+        if (!this.onWarning)
+            return;
+        const claimed = this.db.get("UPDATE email_budget_counters SET warning = 2 WHERE period = (SELECT period FROM email_budget_counters WHERE period LIKE 'day:%' AND warning = 1 ORDER BY period LIMIT 1) AND warning = 1 RETURNING period");
+        if (!claimed)
+            return;
+        const [period] = claimed;
+        // Claim before dispatch: an operator warning itself goes through this budget.
+        try {
+            await this.onWarning(this.usage(new Date(`${period.slice(4)}T00:00:00Z`)));
+        }
+        catch {
+            console.error(JSON.stringify({ event: "email_budget_warning_failed", period }));
+        }
+    }
+}
+//# sourceMappingURL=email-budget.js.map

package/dist/email-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-budget.js","sourceRoot":"","sources":["../src/email-budget.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,EAAE;IACT,OAAO,EAAE,KAAK;IACd,iBAAiB,EAAE,EAAE;IACrB,gBAAgB,EAAE,CAAC;CACX,CAAC;AA0BX,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;GAehC,CAAC;AAEJ,MAAM,WAAW,GAAG,GAAsB,EAAE,CAAC,CAAC;IAC5C,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;IACX,KAAK,EAAE,CAAC;IACR,YAAY,EAAE,CAAC;CAChB,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,EAAyB,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAChB,+FAA+F,EAC/F,CAAC,MAAM,CAAC,CACT,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,WAAW,EAAE,CAAC;IAC/B,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,GAAG,CAAC;IACzD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,MAAM,OAAO,WAAW;IAIH,EAAE;IACF,GAAG;IAJtB,SAAS,CAAiE;IAE1E,YACmB,EAAuB,EACvB,GAAG,GAAe,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;kBADlC,EAAE;mBACF,GAAG;IACnB,CAAC;IAEJ,OAAO,CACL,QAAuB,EACvB,OAAO,GAA4C,EAAE;QAErD,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,cAAc,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,CAAC,OAAO,MAAM,EAAE,EAAE,SAAS,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAU,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,CAAsB,CAAC,EAAE,EAAE,EAAE;YAC7D,KAAK,MAAM,MAAM,IAAI,OAAO;gBAC1B,EAAE,CAAC,GAAG,CAAC,iEAAiE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YACtF,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,MAAM,GACV,GAAG,CAAC,KAAK,GAAG,KAAK,GAAG,mBAAmB,CAAC,KAAK;gBAC3C,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,GAAG,mBAAmB,CAAC,OAAO;oBACjD,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,KAAK,cAAc;wBACzB,GAAG,CAAC,YAAY,GAAG,KAAK,GAAG,mBAAmB,CAAC,iBAAiB;wBAClE,CAAC,CAAC,oBAAoB;wBACtB,CAAC,CAAC,SAAS,CAAC;YACpB,IAAI,QAAQ,KAAK,cAAc,IAAI,MAAM;gBACvC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC1E,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAClB,qEAAqE,EACrE,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAC7B,CAAC;gBACF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,mBAAmB,CAAC,gBAAgB;oBAC3D,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,QAAQ;wBACR,MAAM;wBACN,MAAM,EAAE,aAAsB;wBAC9B,WAAW,EAAE,KAAK;qBACnB,CAAC;gBACJ,EAAE,CAAC,GAAG,CACJ,iIAAiI,EACjI,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAC7B,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,OAAO;gBAC1B,EAAE,CAAC,GAAG,CACJ,uDAAuD,QAAQ,MAAM,QAAQ,uBAAuB,EACpG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CACvB,CAAC;YACJ,IAAI,MAAM;gBACR,EAAE,CAAC,GAAG,CAAC,+EAA+E,EAAE;oBACtF,OAAO,CAAC,CAAC,CAAC;iBACX,CAAC,CAAC;YACL,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC1B,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,sBAAsB;gBACnF,GAAG,QAAQ;gBACX,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,WAAW;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;gBACzC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;QACnB,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,OAAO;YACL,MAAM;YACN,QAAQ;YACR,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,MAAM,EAAE,CAAC;YACzC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,QAAQ,EAAE,CAAC;YAC/C,MAAM,EAAE,mBAAmB;YAC3B,wBAAwB,EAAE,CAAC,mCAAmC,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,CACzB,2MAA2M,CAC5M,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;QACzB,8EAA8E;QAC9E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF"}

package/dist/email-change.d.ts

@@ -0,0 +1,11 @@
+/** How long a change-email link stays usable after it is sent. */
+export declare const EMAIL_CHANGE_LINK_LIFETIME_SECONDS: number;
+/**
+ * Pending account email changes. The dashboard writes a row per attempt and
+ * the API claims a row in the same transaction that moves the address, so a
+ * link is single-use and only the newest one works. Rows cascade away with the
+ * auth identity, which is how account erasure removes the addresses they hold.
+ * Dashboard-owned like auth_user; the API creates it only in tests.
+ */
+export declare const EMAIL_CHANGE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS account_email_changes (\n  id TEXT PRIMARY KEY NOT NULL,\n  user_id TEXT NOT NULL,\n  from_email TEXT NOT NULL,\n  to_email TEXT,\n  token_hash TEXT UNIQUE,\n  created_at INTEGER NOT NULL,\n  completed_at INTEGER,\n  FOREIGN KEY (user_id) REFERENCES auth_user(id) ON UPDATE no action ON DELETE cascade\n);\nCREATE INDEX IF NOT EXISTS idx_account_email_changes_user_created\n  ON account_email_changes (user_id, created_at);";
+//# sourceMappingURL=email-change.d.ts.map

package/dist/email-change.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-change.d.ts","sourceRoot":"","sources":["../src/email-change.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,kCAAkC,QAAe,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,ycAYkB,CAAC"}

package/dist/email-change.js

@@ -0,0 +1,23 @@
+/** How long a change-email link stays usable after it is sent. */
+export const EMAIL_CHANGE_LINK_LIFETIME_SECONDS = 24 * 60 * 60;
+/**
+ * Pending account email changes. The dashboard writes a row per attempt and
+ * the API claims a row in the same transaction that moves the address, so a
+ * link is single-use and only the newest one works. Rows cascade away with the
+ * auth identity, which is how account erasure removes the addresses they hold.
+ * Dashboard-owned like auth_user; the API creates it only in tests.
+ */
+export const EMAIL_CHANGE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS account_email_changes (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  from_email TEXT NOT NULL,
+  to_email TEXT,
+  token_hash TEXT UNIQUE,
+  created_at INTEGER NOT NULL,
+  completed_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES auth_user(id) ON UPDATE no action ON DELETE cascade
+);
+CREATE INDEX IF NOT EXISTS idx_account_email_changes_user_created
+  ON account_email_changes (user_id, created_at);`;
+//# sourceMappingURL=email-change.js.map

package/dist/email-change.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-change.js","sourceRoot":"","sources":["../src/email-change.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;kDAYe,CAAC"}

package/dist/email-template.d.ts

@@ -0,0 +1,19 @@
+/** Fixed first-party asset; the live wordmark identifies us with images blocked.
+ * Only its URL ships in npm. The mark artwork stays in the private package. */
+export declare const EMAIL_BRAND_HEADER: string;
+type EmailFooter = "none" | {
+    kind: "notifications";
+    dashboardUrl: string;
+};
+/** Use the dashboard origin, not an app/deploy path or its query string. */
+export declare function emailNotificationSettingsUrl(dashboardUrl: string): string;
+/** Callers escape values in bodyHtml and explicitly choose the footer policy.
+ * Notification settings apply only to mail with an effective preference gate;
+ * security/legal notices and signed waitlist removal links keep their own copy. */
+export declare function renderEmail(input: {
+    bodyHtml: string;
+    footer: EmailFooter;
+    lang?: "en" | "sv";
+}): string;
+export {};
+//# sourceMappingURL=email-template.d.ts.map

package/dist/email-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-template.d.ts","sourceRoot":"","sources":["../src/email-template.ts"],"names":[],"mappings":"AAGA;+EAC+E;AAC/E,eAAO,MAAM,kBAAkB,QAGxB,CAAC;AAER,KAAK,WAAW,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAUzE;AAED;;mFAEmF;AACnF,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACpB,GAAG,MAAM,CA4BT"}

package/dist/email-template.js

@@ -0,0 +1,53 @@
+import { BRAND } from "./brand.js";
+import { escapeHtml } from "./escape-html.js";
+/** Fixed first-party asset; the live wordmark identifies us with images blocked.
+ * Only its URL ships in npm. The mark artwork stays in the private package. */
+export const EMAIL_BRAND_HEADER = `<p style="margin:0 0 20px;line-height:28px;">
+    <img src="https://percher.app/email-mark.png" width="28" height="28" alt="" style="display:inline-block;vertical-align:middle;border:0;margin-right:7px;" />
+    <span style="font-size:19px;font-weight:700;letter-spacing:-0.01em;color:${BRAND.ink};vertical-align:middle;">Percher</span>
+  </p>`;
+/** Use the dashboard origin, not an app/deploy path or its query string. */
+export function emailNotificationSettingsUrl(dashboardUrl) {
+    try {
+        const url = new URL(dashboardUrl);
+        if (url.protocol === "https:" || url.protocol === "http:") {
+            return `${url.origin}/login?next=%2Faccount%23notifications`;
+        }
+    }
+    catch {
+        // A malformed dashboard link must not turn the footer into an unsafe URL.
+    }
+    return "https://percher.app/login?next=%2Faccount%23notifications";
+}
+/** Callers escape values in bodyHtml and explicitly choose the footer policy.
+ * Notification settings apply only to mail with an effective preference gate;
+ * security/legal notices and signed waitlist removal links keep their own copy. */
+export function renderEmail(input) {
+    const footer = input.footer === "none"
+        ? ""
+        : `<p style="margin:24px 0 0;padding-top:16px;border-top:1px solid #e5e5e5;font-size:12px;line-height:1.5;color:#666;"><a href="${escapeHtml(emailNotificationSettingsUrl(input.footer.dashboardUrl))}" style="color:#666;">Manage notifications</a></p>`;
+    return `<!doctype html>
+<html lang="${input.lang === "sv" ? "sv" : "en"}">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <style>
+    .percher-email-content h1,.percher-email-content h2{margin:0 0 16px;font-size:22px;line-height:1.3;}
+    .percher-email-content pre{white-space:pre-wrap;word-break:break-word;}
+    @media only screen and (max-width:480px){.percher-email-content{padding:20px!important;}.percher-email-outer{padding:12px 8px!important;}}
+  </style>
+</head>
+<body style="margin:0;padding:0;background:#f5f5f5;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="border-collapse:collapse;background:#f5f5f5;"><tr><td class="percher-email-outer" align="center" style="padding:24px 12px;">
+    <!--[if mso]><table role="presentation" width="600" cellpadding="0" cellspacing="0"><tr><td><![endif]-->
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:600px;margin:0 auto;background:#fff;border:1px solid #e5e5e5;border-radius:8px;table-layout:fixed;"><tr><td class="percher-email-content" style="padding:28px;font-family:Arial,Helvetica,sans-serif;font-size:15px;line-height:1.6;color:${BRAND.ink};overflow-wrap:anywhere;word-break:break-word;">
+      ${EMAIL_BRAND_HEADER}
+      ${input.bodyHtml.trim()}
+      ${footer}
+    </td></tr></table>
+    <!--[if mso]></td></tr></table><![endif]-->
+  </td></tr></table>
+</body>
+</html>`;
+}
+//# sourceMappingURL=email-template.js.map

package/dist/email-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-template.js","sourceRoot":"","sources":["../src/email-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C;+EAC+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG;;+EAE6C,KAAK,CAAC,GAAG;OACjF,CAAC;AAIR,4EAA4E;AAC5E,MAAM,UAAU,4BAA4B,CAAC,YAAoB;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC1D,OAAO,GAAG,GAAG,CAAC,MAAM,wCAAwC,CAAC;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,2DAA2D,CAAC;AACrE,CAAC;AAED;;mFAEmF;AACnF,MAAM,UAAU,WAAW,CAAC,KAI3B;IACC,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,KAAK,MAAM;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,gIAAgI,UAAU,CAAC,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,oDAAoD,CAAC;IAC9P,OAAO;cACK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;;;;;;;;;;;;;yUAa0R,KAAK,CAAC,GAAG;QAC1U,kBAAkB;QAClB,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;QACrB,MAAM;;;;;QAKN,CAAC;AACT,CAAC"}