@percher/shared 1.1.0 → 1.3.0

package/dist/image-rejection.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Why a moderator turned down an owner-uploaded image. The API stores the
+ * stable `code`; the label is looked up when it is shown, so its wording
+ * can change without touching stored rows. Labels are written for the app
+ * owner, who reads them on their app's Settings page.
+ */
+export type ImageKind = "icon" | "preview";
+export declare const IMAGE_REJECTION_REASONS: readonly [{
+    readonly code: "not_screenshot";
+    readonly label: "Not a screenshot of the app (logo or marketing image)";
+    readonly kinds: readonly ["preview"];
+}, {
+    readonly code: "login_or_empty";
+    readonly label: "Shows only a login or empty screen";
+    readonly kinds: readonly ["preview"];
+}, {
+    readonly code: "personal_data";
+    readonly label: "Contains personal data";
+    readonly kinds: readonly ["icon", "preview"];
+}, {
+    readonly code: "unreadable";
+    readonly label: "Too small or unreadable";
+    readonly kinds: readonly ["icon", "preview"];
+}, {
+    readonly code: "mismatch";
+    readonly label: "Does not match the app";
+    readonly kinds: readonly ["icon", "preview"];
+}, {
+    readonly code: "aup";
+    readonly label: "Breaks the Acceptable Use Policy";
+    readonly kinds: readonly ["icon", "preview"];
+}];
+export type ImageRejectionCode = (typeof IMAGE_REJECTION_REASONS)[number]["code"];
+/** The longest moderator note (or legacy free-text reason) the API stores. */
+export declare const IMAGE_REJECTION_NOTE_MAX = 280;
+/** The reasons a moderator may pick for this kind of image, in display order. */
+export declare function imageRejectionReasons(kind: ImageKind): {
+    code: ImageRejectionCode;
+    label: string;
+}[];
+/** The owner-facing label for a stored code; null for an unknown or absent code. */
+export declare function imageRejectionLabel(code: string | null | undefined): string | null;
+/** True when `code` is a reason a moderator may pick for this kind of image. */
+export declare function isImageRejectionCode(kind: ImageKind, code: unknown): code is ImageRejectionCode;
+//# sourceMappingURL=image-rejection.d.ts.map

package/dist/image-rejection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-rejection.d.ts","sourceRoot":"","sources":["../src/image-rejection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3C,eAAO,MAAM,uBAAuB;mBAE1B,gBAAgB;oBACf,uDAAuD;;;mBAGxD,gBAAgB;oBAAS,oCAAoC;;;mBAC7D,eAAe;oBAAS,wBAAwB;;;mBAChD,YAAY;oBAAS,yBAAyB;;;mBAC9C,UAAU;oBAAS,wBAAwB;;;mBAC3C,KAAK;oBAAS,kCAAkC;;EACkC,CAAC;AAE7F,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAElF,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,iFAAiF;AACjF,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,SAAS,GACd;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAI/C;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAElF;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,kBAAkB,CAE/F"}

package/dist/image-rejection.js

@@ -0,0 +1,27 @@
+export const IMAGE_REJECTION_REASONS = [
+    {
+        code: "not_screenshot",
+        label: "Not a screenshot of the app (logo or marketing image)",
+        kinds: ["preview"],
+    },
+    { code: "login_or_empty", label: "Shows only a login or empty screen", kinds: ["preview"] },
+    { code: "personal_data", label: "Contains personal data", kinds: ["icon", "preview"] },
+    { code: "unreadable", label: "Too small or unreadable", kinds: ["icon", "preview"] },
+    { code: "mismatch", label: "Does not match the app", kinds: ["icon", "preview"] },
+    { code: "aup", label: "Breaks the Acceptable Use Policy", kinds: ["icon", "preview"] },
+];
+/** The longest moderator note (or legacy free-text reason) the API stores. */
+export const IMAGE_REJECTION_NOTE_MAX = 280;
+/** The reasons a moderator may pick for this kind of image, in display order. */
+export function imageRejectionReasons(kind) {
+    return IMAGE_REJECTION_REASONS.filter((r) => r.kinds.includes(kind)).map(({ code, label }) => ({ code, label }));
+}
+/** The owner-facing label for a stored code; null for an unknown or absent code. */
+export function imageRejectionLabel(code) {
+    return IMAGE_REJECTION_REASONS.find((r) => r.code === code)?.label ?? null;
+}
+/** True when `code` is a reason a moderator may pick for this kind of image. */
+export function isImageRejectionCode(kind, code) {
+    return imageRejectionReasons(kind).some((r) => r.code === code);
+}
+//# sourceMappingURL=image-rejection.js.map

package/dist/image-rejection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-rejection.js","sourceRoot":"","sources":["../src/image-rejection.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,uDAAuD;QAC9D,KAAK,EAAE,CAAC,SAAS,CAAC;KACnB;IACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,oCAAoC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;IAC3F,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE;IACtF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE;IACpF,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE;IACjF,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE;CACI,CAAC;AAI7F,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CACnC,IAAe;IAEf,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACzC,CAAC,CAAC,KAA8B,CAAC,QAAQ,CAAC,IAAI,CAAC,CACjD,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,IAA+B;IACjE,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AAC7E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,IAAe,EAAE,IAAa;IACjE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAClE,CAAC"}

package/dist/index.d.ts

@@ -3,22 +3,34 @@ export { BILLING_TEST_ACCOUNTS_ENV, isBillingTestAccount, parseBillingTestAccoun
 export { BRAND, ICON_COLOURS, type IconColourKey, iconColourHex } from "./brand.js";
 export { CLIENT_IP_ATTESTATION_MAX_SKEW_MS, CLIENT_IP_ATTESTATION_VERSION, CLIENT_IP_HEADER, CLIENT_IP_MAX_LENGTH, CLIENT_IP_PROOF_HEADER, type ClientIpAttestationParts, clientIpAttestationPayload, formatClientIpProof, parseClientIpProof, } from "./client-ip-attestation.js";
 export { crashAssistantPrompt } from "./crash-prompt.js";
+export { type DataExpressionErrorReason, type DataExpressionResult, type DataQueryInvalidExtra, type DataSchemaField, parseDataFields, parseDataFilter, parseDataSort, } from "./data-filter.js";
+export { DATA_ACCESS_MODES, DATA_ACCESS_SCOPES, DATA_ACCESS_SETTER_ERROR_STATUS, DATA_ACT_AS_UNAVAILABLE_REASONS, DATA_ACTING_AS, DATA_COLLECTION_RE, DATA_IDENTITY_KINDS, DATA_IDENTITY_LABEL_FIELD_TYPES, DATA_IDENTITY_LABELS, DATA_LIMITS, DATA_NOT_RUNNING_REASONS, DATA_RATE_LIMIT_SOURCES, DATA_RECORD_ERROR_STATUS, DATA_RECORD_ID_RE, DATA_RULE_CLASSES, DATA_RULE_DENIED_REASONS, DATA_RULE_OPS, type DataAccess, type DataAccessMode, type DataAccessNoticePayload, type DataAccessScope, type DataAccessSet, type DataAccessSetterErrorCode, type DataAccessUpdate, type DataActAsUnavailableExtra, type DataActAsUnavailableReason, type DataActingAs, type DataCollectionAccess, type DataCollectionSummary, type DataConflictExtra, type DataCreateInput, type DataFieldSummary, type DataIdentity, type DataIdentityCandidatesRequest, type DataIdentityCandidatesResponse, type DataIdentityCollection, type DataIdentityLabelFieldType, type DataNotRunningReason, type DataPaginatedRecords, type DataQueryOptions, type DataRateLimitedExtra, type DataRateLimitSource, type DataRecord, type DataRecordErrorCode, type DataRuleClass, type DataRuleDeniedExtra, type DataRuleDeniedReason, type DataRuleOp, type DataSchemaResponse, type DataTokenAccessNoticePayload, type DataTokenAccessRow, type DataTokenAccessUpdate, type DataUpdateInput, type DataValidationFields, type OAuthGrantsDataTools, } from "./data-records.js";
+export { type DeploymentSecurityAction, type DeploymentSecurityBlock, type DeploymentSecurityFinding, decodeDeploymentSecurityBlock, deploymentSecurityActionText, deploymentSecurityRecoveryPrompt, deploymentSecuritySummary, parseDeploymentSecurityBlock, type SecurityScanFailureCode, } from "./deployment-security.js";
+export { disposableDomainCount, isDisposableEmailDomain } from "./disposable-email-domains.js";
 export { DOMAIN_RE } from "./domain-name.js";
+export { EMAIL_BUDGET_LIMITS, EMAIL_BUDGET_SCHEMA, EmailBudget, type EmailBudgetConnection, type EmailCategory, } from "./email-budget.js";
+export { EMAIL_CHANGE_LINK_LIFETIME_SECONDS, EMAIL_CHANGE_SCHEMA } from "./email-change.js";
+export { EMAIL_BRAND_HEADER, emailNotificationSettingsUrl, renderEmail } from "./email-template.js";
 export { ENV_MASK, isMaskedEnvValue, maskEnvValue } from "./env-mask.js";
 export { ENV_NAME_RE } from "./env-name.js";
 export { escapeHtml } from "./escape-html.js";
+export { IMAGE_REJECTION_NOTE_MAX, IMAGE_REJECTION_REASONS, type ImageKind, type ImageRejectionCode, imageRejectionLabel, imageRejectionReasons, isImageRejectionCode, } from "./image-rejection.js";
 export { INTERNAL_SIG_HEADER, INTERNAL_SIG_MAX_SKEW_MS, INTERNAL_SIG_VERSION, INTERNAL_TS_HEADER, type InternalSigParts, internalSigPayload, } from "./internal-sig.js";
+export { ipSubnetKey, parseIpAddress } from "./ip-prefix.js";
 export { CURRENT_TERMS_VERSION, LEGAL_DOCUMENT_HASHES, LEGAL_DOCUMENT_LAST_UPDATED, LEGAL_DOCUMENT_VERSIONS, type TermsAcceptanceEvidence, } from "./legal.js";
 export { canonicalLegalChangeJson, compareVersions, declaredVersion, LEGAL_CHANGE_ID_PATTERN, LEGAL_CHANGES, LEGAL_VERSION_PATTERN, type LegalChange, type LegalChangeDocument, type LegalChangeEnforcement, type LegalChangeReason, type LegalDocumentKey, MATERIAL_CHANGE_NOTICE_MS, openMaterialChanges, pendingAcknowledgement, SIGNUP_DISCLOSURE_HEADER, } from "./legal-changes.js";
-export { MAX_ANON_TARBALL_BYTES, MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MIN_UPLOAD_CHUNK_BYTES, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
+export { MAX_ANON_TARBALL_BYTES, MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MFA_MANAGEMENT_SECONDS, MIN_UPLOAD_CHUNK_BYTES, STAFF_MFA_PROOF_SECONDS, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
 export { MAX_LOG_SEARCH_LENGTH } from "./logs.js";
 export { MAX_OAUTH_CLIENT_NAME_DISPLAY_CODE_POINTS, normaliseOAuthClientName, } from "./oauth-client-name.js";
-export { describeOAuthScope, OAUTH_SCOPE_LABELS, parseOAuthScopes } from "./oauth-scopes.js";
+export { DATA_ACCESS_MODE_LABELS, describeOAuthScope, OAUTH_SCOPE_LABELS, parseOAuthScopes, } from "./oauth-scopes.js";
 export { DEFAULT_DOMAIN_SUFFIX, DEFAULT_MCP_HTTP_PORT, DEFAULT_POCKETBASE_IMAGE, MCP_TOOL_COUNT_HOSTED, MCP_TOOL_COUNT_LOCAL, } from "./platform.js";
 export { canonicalInjectedKey, isPercherInjected, PERCHER_INJECTED_ENV_KEYS, } from "./platform-env.js";
 export { DEFAULT_NODE_VERSION_LABEL, DEFAULT_NODE_VERSION_MAJOR } from "./runtime.js";
+export { parseSignupCapacity, SIGNUP_CAPACITY_MAX_AGE_MS, SIGNUP_CAPACITY_MESSAGE, type SignupCapacityReason, type SignupCapacityState, } from "./signup-capacity.js";
+export { signupDayWindow } from "./signup-day.js";
 export { normalizeSignupInviteCode, SIGNUP_INVITE_CODE_ALPHABET, SIGNUP_INVITE_CODE_LENGTH, SIGNUP_INVITE_CODE_PREFIX, SIGNUP_INVITE_HEADER, } from "./signup-invite.js";
 export { assertValidSwitches, type BooleanSwitch, type EnumSwitch, type PresenceSwitch, reportSwitches, SWITCH_BY_NAME, SWITCHES, type SwitchReader, type SwitchReport, type SwitchSpec, type SwitchState, switchEnabled, switchState, switchValue, } from "./switches.js";
 export { BUN_MAX_IDLE_TIMEOUT_SECONDS, HTTP_IDLE_TIMEOUT_SECONDS, type HttpIdleTimeoutSurface, TIMEOUTS, type TimeoutKey, } from "./timeouts.js";
+export { chargeVerifiedSignup, initializeVerifiedSignupCutover, type SignupQuotaConnection, VerifiedSignupLimitError, verifiedSignupQuota, } from "./verified-signup.js";
 export { WAITLIST_THROTTLE_WINDOW_MS } from "./waitlist.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,cAAc,EACd,cAAc,EACd,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,QAAQ,EACR,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,eAAe,EACf,eAAe,EACf,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,+BAA+B,EAC/B,+BAA+B,EAC/B,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,EACpB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,aAAa,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,6BAA6B,EAC7B,4BAA4B,EAC5B,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,KAAK,qBAAqB,EAC1B,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kCAAkC,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,cAAc,EACd,cAAc,EACd,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,QAAQ,EACR,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,KAAK,qBAAqB,EAC1B,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -3,22 +3,34 @@ export { BILLING_TEST_ACCOUNTS_ENV, isBillingTestAccount, parseBillingTestAccoun
 export { BRAND, ICON_COLOURS, iconColourHex } from "./brand.js";
 export { CLIENT_IP_ATTESTATION_MAX_SKEW_MS, CLIENT_IP_ATTESTATION_VERSION, CLIENT_IP_HEADER, CLIENT_IP_MAX_LENGTH, CLIENT_IP_PROOF_HEADER, clientIpAttestationPayload, formatClientIpProof, parseClientIpProof, } from "./client-ip-attestation.js";
 export { crashAssistantPrompt } from "./crash-prompt.js";
+export { parseDataFields, parseDataFilter, parseDataSort, } from "./data-filter.js";
+export { DATA_ACCESS_MODES, DATA_ACCESS_SCOPES, DATA_ACCESS_SETTER_ERROR_STATUS, DATA_ACT_AS_UNAVAILABLE_REASONS, DATA_ACTING_AS, DATA_COLLECTION_RE, DATA_IDENTITY_KINDS, DATA_IDENTITY_LABEL_FIELD_TYPES, DATA_IDENTITY_LABELS, DATA_LIMITS, DATA_NOT_RUNNING_REASONS, DATA_RATE_LIMIT_SOURCES, DATA_RECORD_ERROR_STATUS, DATA_RECORD_ID_RE, DATA_RULE_CLASSES, DATA_RULE_DENIED_REASONS, DATA_RULE_OPS, } from "./data-records.js";
+export { decodeDeploymentSecurityBlock, deploymentSecurityActionText, deploymentSecurityRecoveryPrompt, deploymentSecuritySummary, parseDeploymentSecurityBlock, } from "./deployment-security.js";
+export { disposableDomainCount, isDisposableEmailDomain } from "./disposable-email-domains.js";
 export { DOMAIN_RE } from "./domain-name.js";
+export { EMAIL_BUDGET_LIMITS, EMAIL_BUDGET_SCHEMA, EmailBudget, } from "./email-budget.js";
+export { EMAIL_CHANGE_LINK_LIFETIME_SECONDS, EMAIL_CHANGE_SCHEMA } from "./email-change.js";
+export { EMAIL_BRAND_HEADER, emailNotificationSettingsUrl, renderEmail } from "./email-template.js";
 export { ENV_MASK, isMaskedEnvValue, maskEnvValue } from "./env-mask.js";
 export { ENV_NAME_RE } from "./env-name.js";
 export { escapeHtml } from "./escape-html.js";
+export { IMAGE_REJECTION_NOTE_MAX, IMAGE_REJECTION_REASONS, imageRejectionLabel, imageRejectionReasons, isImageRejectionCode, } from "./image-rejection.js";
 export { INTERNAL_SIG_HEADER, INTERNAL_SIG_MAX_SKEW_MS, INTERNAL_SIG_VERSION, INTERNAL_TS_HEADER, internalSigPayload, } from "./internal-sig.js";
+export { ipSubnetKey, parseIpAddress } from "./ip-prefix.js";
 export { CURRENT_TERMS_VERSION, LEGAL_DOCUMENT_HASHES, LEGAL_DOCUMENT_LAST_UPDATED, LEGAL_DOCUMENT_VERSIONS, } from "./legal.js";
 export { canonicalLegalChangeJson, compareVersions, declaredVersion, LEGAL_CHANGE_ID_PATTERN, LEGAL_CHANGES, LEGAL_VERSION_PATTERN, MATERIAL_CHANGE_NOTICE_MS, openMaterialChanges, pendingAcknowledgement, SIGNUP_DISCLOSURE_HEADER, } from "./legal-changes.js";
-export { MAX_ANON_TARBALL_BYTES, MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MIN_UPLOAD_CHUNK_BYTES, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
+export { MAX_ANON_TARBALL_BYTES, MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MFA_MANAGEMENT_SECONDS, MIN_UPLOAD_CHUNK_BYTES, STAFF_MFA_PROOF_SECONDS, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
 export { MAX_LOG_SEARCH_LENGTH } from "./logs.js";
 export { MAX_OAUTH_CLIENT_NAME_DISPLAY_CODE_POINTS, normaliseOAuthClientName, } from "./oauth-client-name.js";
-export { describeOAuthScope, OAUTH_SCOPE_LABELS, parseOAuthScopes } from "./oauth-scopes.js";
+export { DATA_ACCESS_MODE_LABELS, describeOAuthScope, OAUTH_SCOPE_LABELS, parseOAuthScopes, } from "./oauth-scopes.js";
 export { DEFAULT_DOMAIN_SUFFIX, DEFAULT_MCP_HTTP_PORT, DEFAULT_POCKETBASE_IMAGE, MCP_TOOL_COUNT_HOSTED, MCP_TOOL_COUNT_LOCAL, } from "./platform.js";
 export { canonicalInjectedKey, isPercherInjected, PERCHER_INJECTED_ENV_KEYS, } from "./platform-env.js";
 export { DEFAULT_NODE_VERSION_LABEL, DEFAULT_NODE_VERSION_MAJOR } from "./runtime.js";
+export { parseSignupCapacity, SIGNUP_CAPACITY_MAX_AGE_MS, SIGNUP_CAPACITY_MESSAGE, } from "./signup-capacity.js";
+export { signupDayWindow } from "./signup-day.js";
 export { normalizeSignupInviteCode, SIGNUP_INVITE_CODE_ALPHABET, SIGNUP_INVITE_CODE_LENGTH, SIGNUP_INVITE_CODE_PREFIX, SIGNUP_INVITE_HEADER, } from "./signup-invite.js";
 export { assertValidSwitches, reportSwitches, SWITCH_BY_NAME, SWITCHES, switchEnabled, switchState, switchValue, } from "./switches.js";
 export { BUN_MAX_IDLE_TIMEOUT_SECONDS, HTTP_IDLE_TIMEOUT_SECONDS, TIMEOUTS, } from "./timeouts.js";
+export { chargeVerifiedSignup, initializeVerifiedSignupCutover, VerifiedSignupLimitError, verifiedSignupQuota, } from "./verified-signup.js";
 export { WAITLIST_THROTTLE_WINDOW_MS } from "./waitlist.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAsB,aAAa,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EAEtB,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAElB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,GAExB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EAMrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EAInB,cAAc,EACd,cAAc,EACd,QAAQ,EAKR,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EAEzB,QAAQ,GAET,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAsB,aAAa,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EAEtB,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAKL,eAAe,EACf,eAAe,EACf,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,+BAA+B,EAC/B,+BAA+B,EAC/B,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,EACpB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,aAAa,GAuCd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,6BAA6B,EAC7B,4BAA4B,EAC5B,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,GAGZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kCAAkC,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EAGvB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAElB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,GAExB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EAMrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EAInB,cAAc,EACd,cAAc,EACd,QAAQ,EAKR,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EAEzB,QAAQ,GAET,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAE/B,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}

package/dist/internal-sig.d.ts

@@ -8,8 +8,8 @@
  * window, and the raw secret never has to ride on the wire once enforce is on.
  *
  * This module is the single source of truth for the canonical string both sides
- * HMAC, so the API verifier and every signer (the dashboard today; the external
- * CLABBE runner per docs/integrations/CLABBE_SECURITY_INGEST.md) can't drift. It
+ * HMAC, so the API verifier and every signer (the dashboard and the external
+ * security runner, per the security-ingest contract in docs/integrations) can't drift. It
  * is dependency-free on purpose — no crypto here — so it bundles cleanly into the
  * dashboard (Node) as well as the API (Bun). Each side wraps it with its own
  * `node:crypto` HMAC.

package/dist/internal-sig.js

@@ -8,8 +8,8 @@
  * window, and the raw secret never has to ride on the wire once enforce is on.
  *
  * This module is the single source of truth for the canonical string both sides
- * HMAC, so the API verifier and every signer (the dashboard today; the external
- * CLABBE runner per docs/integrations/CLABBE_SECURITY_INGEST.md) can't drift. It
+ * HMAC, so the API verifier and every signer (the dashboard and the external
+ * security runner, per the security-ingest contract in docs/integrations) can't drift. It
  * is dependency-free on purpose — no crypto here — so it bundles cleanly into the
  * dashboard (Node) as well as the API (Bun). Each side wraps it with its own
  * `node:crypto` HMAC.

package/dist/ip-prefix.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Binary IP parsing and subnet-prefix keying.
+ *
+ * Any limit keyed on "the network this request came from" needs the address
+ * reduced to a prefix, and that reduction has to happen on BYTES. The textual
+ * form of an IPv6 address is not positional: "2001:db8::1" and
+ * "2001:0db8:0000:0000:0000:0000:0000:0001" are the same address, and
+ * "2001::abcd:1" has its hextets in entirely different places than a naive
+ * split(":") suggests. Masking by slicing the text therefore puts one address
+ * in several buckets and unrelated addresses in one — which is exactly the
+ * evasion a subnet key exists to prevent.
+ */
+/** A parsed address as raw bytes: 4 for IPv4, 16 for IPv6. */
+export type ParsedIp = {
+    family: 4;
+    bytes: Uint8Array;
+} | {
+    family: 6;
+    bytes: Uint8Array;
+};
+/**
+ * Parse an address to bytes, or null if it is not one.
+ *
+ * An IPv6 zone id ("fe80::1%eth0") is dropped — it names a local interface,
+ * not a different host. An IPv4-mapped address ("::ffff:203.0.113.7") is
+ * returned as the IPv4 it carries, so one client cannot occupy two buckets by
+ * choosing a spelling, and so every mapped client does not collapse into one
+ * shared bucket.
+ *
+ * Brackets and zone ids belong to IPv6 alone, so "[1.2.3.4]" and
+ * "1.2.3.4%eth0" are rejected rather than quietly read as IPv4 — this decides
+ * whether a caller is refused or filed under a real network, and a spelling no
+ * address ever has means a caller we cannot key.
+ */
+export declare function parseIpAddress(ip: string): ParsedIp | null;
+/**
+ * Collapse an address to its subnet key, e.g. "203.0.113.0/24" or
+ * "2001:db8:1::/48". Returns null for anything that is not an address, so a
+ * caller that must not guess (an admission cap) can refuse, while one with a
+ * safe fallback (a rate limiter) can bucket the raw string instead.
+ */
+export declare function ipSubnetKey(ip: string, v4Bits: number, v6Bits: number): string | null;
+//# sourceMappingURL=ip-prefix.d.ts.map

package/dist/ip-prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-prefix.d.ts","sourceRoot":"","sources":["../src/ip-prefix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,QAAQ,GAAG;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AA+F3F;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAyB1D;AAmDD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQrF"}

package/dist/ip-prefix.js

@@ -0,0 +1,225 @@
+/**
+ * Binary IP parsing and subnet-prefix keying.
+ *
+ * Any limit keyed on "the network this request came from" needs the address
+ * reduced to a prefix, and that reduction has to happen on BYTES. The textual
+ * form of an IPv6 address is not positional: "2001:db8::1" and
+ * "2001:0db8:0000:0000:0000:0000:0000:0001" are the same address, and
+ * "2001::abcd:1" has its hextets in entirely different places than a naive
+ * split(":") suggests. Masking by slicing the text therefore puts one address
+ * in several buckets and unrelated addresses in one — which is exactly the
+ * evasion a subnet key exists to prevent.
+ */
+const HEXTET_RE = /^[0-9a-fA-F]{1,4}$/;
+const OCTET_RE = /^\d{1,3}$/;
+/** Zone id characters we accept (RFC 4007 scope zones as they are actually
+ *  written: an interface name or an index). Deliberately narrow — the zone is
+ *  discarded, so anything unusual here is a spelling no address has — and this
+ *  module's boundary is that such a caller is refused rather than filed under
+ *  somebody's network. */
+const ZONE_RE = /^[0-9A-Za-z._~-]+$/;
+function parseIpv4Bytes(text) {
+    const parts = text.split(".");
+    if (parts.length !== 4)
+        return null;
+    const bytes = new Uint8Array(4);
+    for (let i = 0; i < 4; i++) {
+        const part = parts[i];
+        // Leading zeros are rejected rather than parsed: "010" is 8 in one
+        // reading and 10 in another, and two readings of one address are two
+        // buckets. Canonical spellings only, same as node's net.isIP.
+        if (!OCTET_RE.test(part) || (part.length > 1 && part.startsWith("0")))
+            return null;
+        const n = Number(part);
+        if (n > 255)
+            return null;
+        bytes[i] = n;
+    }
+    return bytes;
+}
+/**
+ * Read one side of a "::" split into 16-bit groups, or null if any token is
+ * not a legal hextet.
+ *
+ * `allowEmbeddedIpv4` is only true for the side that ends the whole address:
+ * an embedded dotted quad occupies the last 32 bits, so "192.0.2.1::" and
+ * "1:192.0.2.1::" are not addresses. Accepting them mapped them onto real
+ * prefixes ("192.0.2.1::" landed in c000:201::/56), which is worse than
+ * rejecting them — a caller that cannot be keyed must be refused, not filed
+ * under somebody else's network.
+ */
+function groupsFrom(part, allowEmbeddedIpv4) {
+    if (part === "")
+        return [];
+    const tokens = part.split(":");
+    const groups = [];
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (token.includes(".")) {
+            if (!allowEmbeddedIpv4 || i !== tokens.length - 1)
+                return null;
+            const v4 = parseIpv4Bytes(token);
+            if (!v4)
+                return null;
+            groups.push((v4[0] << 8) | v4[1]);
+            groups.push((v4[2] << 8) | v4[3]);
+            continue;
+        }
+        if (!HEXTET_RE.test(token))
+            return null;
+        groups.push(Number.parseInt(token, 16));
+    }
+    return groups;
+}
+function parseIpv6Bytes(text) {
+    const halves = text.split("::");
+    if (halves.length > 2)
+        return null;
+    // With no "::" the single side ends the address; with one, the tail does —
+    // even when the tail is empty, which is what makes "192.0.2.1::" invalid.
+    const head = groupsFrom(halves[0], halves.length === 1);
+    if (!head)
+        return null;
+    let groups;
+    if (halves.length === 1) {
+        if (head.length !== 8)
+            return null;
+        groups = head;
+    }
+    else {
+        const tail = groupsFrom(halves[1], true);
+        if (!tail)
+            return null;
+        // "::" must stand for at least one zero group, so a full 8 either side
+        // of it is not a valid spelling of an address.
+        const gap = 8 - head.length - tail.length;
+        if (gap < 1)
+            return null;
+        groups = [...head, ...new Array(gap).fill(0), ...tail];
+    }
+    const bytes = new Uint8Array(16);
+    for (let i = 0; i < 8; i++) {
+        const g = groups[i];
+        bytes[i * 2] = g >> 8;
+        bytes[i * 2 + 1] = g & 0xff;
+    }
+    return bytes;
+}
+function isIpv4Mapped(bytes) {
+    for (let i = 0; i < 10; i++)
+        if (bytes[i] !== 0)
+            return false;
+    return bytes[10] === 0xff && bytes[11] === 0xff;
+}
+/**
+ * Parse an address to bytes, or null if it is not one.
+ *
+ * An IPv6 zone id ("fe80::1%eth0") is dropped — it names a local interface,
+ * not a different host. An IPv4-mapped address ("::ffff:203.0.113.7") is
+ * returned as the IPv4 it carries, so one client cannot occupy two buckets by
+ * choosing a spelling, and so every mapped client does not collapse into one
+ * shared bucket.
+ *
+ * Brackets and zone ids belong to IPv6 alone, so "[1.2.3.4]" and
+ * "1.2.3.4%eth0" are rejected rather than quietly read as IPv4 — this decides
+ * whether a caller is refused or filed under a real network, and a spelling no
+ * address ever has means a caller we cannot key.
+ */
+export function parseIpAddress(ip) {
+    if (!ip)
+        return null;
+    let text = ip.trim();
+    const bracketed = text.startsWith("[") && text.endsWith("]");
+    if (bracketed)
+        text = text.slice(1, -1);
+    const zone = text.indexOf("%");
+    const zoned = zone !== -1;
+    if (zoned) {
+        // The zone is discarded, so it was previously taken on trust — which let
+        // "fe80::1%a%b", "fe80::1%a b" and a zone full of control characters all
+        // parse as fe80::1. They reach no wrong bucket, but they are not addresses.
+        if (!ZONE_RE.test(text.slice(zone + 1)))
+            return null;
+        text = text.slice(0, zone);
+    }
+    if (!text)
+        return null;
+    if (!text.includes(":")) {
+        if (bracketed || zoned)
+            return null;
+        const v4 = parseIpv4Bytes(text);
+        return v4 ? { family: 4, bytes: v4 } : null;
+    }
+    const v6 = parseIpv6Bytes(text);
+    if (!v6)
+        return null;
+    if (isIpv4Mapped(v6))
+        return { family: 4, bytes: v6.slice(12) };
+    return { family: 6, bytes: v6 };
+}
+function maskBytes(bytes, bits) {
+    const out = new Uint8Array(bytes.length);
+    const wholeBytes = bits >> 3;
+    out.set(bytes.subarray(0, wholeBytes));
+    const remainder = bits & 7;
+    if (remainder > 0 && wholeBytes < bytes.length) {
+        out[wholeBytes] = bytes[wholeBytes] & (0xff << (8 - remainder));
+    }
+    return out;
+}
+/** Render IPv6 bytes in the canonical RFC 5952 form: lowercase, no leading
+ *  zeros, the longest run of zero groups (leftmost on a tie) compressed. */
+function formatIpv6(bytes) {
+    const groups = [];
+    for (let i = 0; i < 16; i += 2) {
+        groups.push((bytes[i] << 8) | bytes[i + 1]);
+    }
+    let bestStart = -1;
+    let bestLen = 0;
+    let runStart = -1;
+    let runLen = 0;
+    for (let i = 0; i < 8; i++) {
+        if (groups[i] === 0) {
+            if (runStart < 0) {
+                runStart = i;
+                runLen = 0;
+            }
+            runLen++;
+            if (runLen > bestLen) {
+                bestLen = runLen;
+                bestStart = runStart;
+            }
+        }
+        else {
+            runStart = -1;
+            runLen = 0;
+        }
+    }
+    const hex = (g) => g.toString(16);
+    // A single zero group is written out; "::" stands for two or more.
+    if (bestLen < 2)
+        return groups.map(hex).join(":");
+    const head = groups.slice(0, bestStart).map(hex).join(":");
+    const tail = groups
+        .slice(bestStart + bestLen)
+        .map(hex)
+        .join(":");
+    return `${head}::${tail}`;
+}
+/**
+ * Collapse an address to its subnet key, e.g. "203.0.113.0/24" or
+ * "2001:db8:1::/48". Returns null for anything that is not an address, so a
+ * caller that must not guess (an admission cap) can refuse, while one with a
+ * safe fallback (a rate limiter) can bucket the raw string instead.
+ */
+export function ipSubnetKey(ip, v4Bits, v6Bits) {
+    const parsed = parseIpAddress(ip);
+    if (!parsed)
+        return null;
+    if (parsed.family === 4) {
+        const masked = maskBytes(parsed.bytes, v4Bits);
+        return `${masked.join(".")}/${v4Bits}`;
+    }
+    return `${formatIpv6(maskBytes(parsed.bytes, v6Bits))}/${v6Bits}`;
+}
+//# sourceMappingURL=ip-prefix.js.map

package/dist/ip-prefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-prefix.js","sourceRoot":"","sources":["../src/ip-prefix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,MAAM,SAAS,GAAG,oBAAoB,CAAC;AACvC,MAAM,QAAQ,GAAG,WAAW,CAAC;AAC7B;;;;0BAI0B;AAC1B,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAErC,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAChC,mEAAmE;QACnE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QACzB,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,iBAA0B;IAC1D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;QAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,iBAAiB,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,CAAE,EAAE,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC,GAAI,EAAE,CAAC,CAAC,CAAY,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,CAAE,EAAE,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC,GAAI,EAAE,CAAC,CAAC,CAAY,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAW,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,MAAgB,CAAC;IACrB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAW,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,uEAAuE;QACvE,+CAA+C;QAC/C,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1C,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;QAC9B,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,SAAS;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC;IAC1B,IAAI,KAAK,EAAE,CAAC;QACV,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,YAAY,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,IAAY;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC;IAC3B,IAAI,SAAS,GAAG,CAAC,IAAI,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,GAAI,KAAK,CAAC,UAAU,CAAY,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;4EAC4E;AAC5E,SAAS,UAAU,CAAC,KAAiB;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC,GAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAY,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM,GAAG,CAAC,CAAC;YACb,CAAC;YACD,MAAM,EAAE,CAAC;YACT,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC;gBACrB,OAAO,GAAG,MAAM,CAAC;gBACjB,SAAS,GAAG,QAAQ,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1C,mEAAmE;IACnE,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM;SAChB,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;SAC1B,GAAG,CAAC,GAAG,CAAC;SACR,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,MAAc,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;AACpE,CAAC"}

package/dist/legal-changes.d.ts

@@ -46,9 +46,9 @@ export interface LegalChange {
     materiality: "material" | "editorial";
     reason: LegalChangeReason;
     enforcement: LegalChangeEnforcement;
-    /** ISO instant, UTC. When the notice may start going out. */
+    /** ISO instant, UTC. First send instant of the notice batch. */
     announceAt: string;
-    /** ISO instant, UTC. When the new documents govern. */
+    /** ISO instant, UTC. Existing-account effect; material changes need 30 full days after the last send. */
     effectiveAt: string;
     /** Every document whose version header moves in this change. */
     documents: readonly LegalChangeDocument[];
@@ -62,6 +62,8 @@ export interface LegalChange {
     };
     /** Set when the same change also modifies the Service itself (2019/770 Art. 19). */
     modifiesService?: boolean;
+    /** This change governs new accounts from signup, before the existing-account date. */
+    appliesToNewAccountsFromSignup?: boolean;
 }
 /** Newest last. Editorial corrections record the published document history. */
 export declare const LEGAL_CHANGES: readonly LegalChange[];

package/dist/legal-changes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legal-changes.d.ts","sourceRoot":"","sources":["../src/legal-changes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AAEH,sFAAsF;AACtF,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,UAAU,GACV,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,sBAAsB,GAAG,kBAAkB,CAAC;AAEjG,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,uBAAuB,CAAC;AAEpE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,gBAAgB,CAAC;IACtB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,2FAA2F;IAC3F,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,WAAW,EAAE,UAAU,GAAG,WAAW,CAAC;IACtC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,WAAW,EAAE,sBAAsB,CAAC;IACpC,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC1C;;;OAGG;IACH,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,gFAAgF;AAChF,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EA+D/C,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;AAEtE,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,QAA2B,CAAC;AAElE,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAiD,CAAC;AAEtF,2FAA2F;AAC3F,eAAO,MAAM,qBAAqB,QAAyB,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAgBpE;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,SAAS,WAAW,EAAkB,GAC9C,WAAW,EAAE,CAIf;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,OAAO,GAAE,SAAS,WAAW,EAAkB,GAC9C,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA6BnE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/C,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,SAAS,WAAW,EAAkB,GAC9C,WAAW,GAAG,IAAI,CAiBpB"}
+{"version":3,"file":"legal-changes.d.ts","sourceRoot":"","sources":["../src/legal-changes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AAEH,sFAAsF;AACtF,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,UAAU,GACV,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,sBAAsB,GAAG,kBAAkB,CAAC;AAEjG,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,uBAAuB,CAAC;AAEpE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,gBAAgB,CAAC;IACtB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,2FAA2F;IAC3F,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,WAAW,EAAE,UAAU,GAAG,WAAW,CAAC;IACtC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,WAAW,EAAE,sBAAsB,CAAC;IACpC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,yGAAyG;IACzG,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC1C;;;OAGG;IACH,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,sFAAsF;IACtF,8BAA8B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED,gFAAgF;AAChF,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EA0L/C,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;AAEtE,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,QAA2B,CAAC;AAElE,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAiD,CAAC;AAEtF,2FAA2F;AAC3F,eAAO,MAAM,qBAAqB,QAAyB,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAiBpE;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,SAAS,WAAW,EAAkB,GAC9C,WAAW,EAAE,CAIf;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,OAAO,GAAE,SAAS,WAAW,EAAkB,GAC9C,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA6BnE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/C,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,SAAS,WAAW,EAAkB,GAC9C,WAAW,GAAG,IAAI,CAiBpB"}