@percher/shared 1.2.0 → 1.3.0

package/dist/data-records.d.ts

@@ -33,7 +33,7 @@ export declare const DATA_LIMITS: {
     /** `GET /api/collections` paging for the schema route. */
     readonly schemaPerPage: 200;
     readonly schemaMaxPages: 10;
-    /** PocketBase's `DefaultSortExprLimit` (v0.40.3 `tools/search/provider.go:25`). */
+    /** PocketBase's `DefaultSortExprLimit` (v0.40.5 `tools/search/provider.go:25`). */
     readonly sortMaxItems: 8;
     /** `duration` sent to PocketBase's impersonate endpoint. */
     readonly actAsTokenSeconds: 900;

package/dist/data-records.js

@@ -33,7 +33,7 @@ export const DATA_LIMITS = {
     /** `GET /api/collections` paging for the schema route. */
     schemaPerPage: 200,
     schemaMaxPages: 10,
-    /** PocketBase's `DefaultSortExprLimit` (v0.40.3 `tools/search/provider.go:25`). */
+    /** PocketBase's `DefaultSortExprLimit` (v0.40.5 `tools/search/provider.go:25`). */
     sortMaxItems: 8,
     /** `duration` sent to PocketBase's impersonate endpoint. */
     actAsTokenSeconds: 900,

package/dist/deployment-security.d.ts

@@ -0,0 +1,32 @@
+/** Durable publication decision. Scanner strings are diagnostic data, never instructions. */
+export type SecurityScanFailureCode = "SCANNER_UNAVAILABLE" | "SCANNER_ENGINE_DEGRADED" | "SCANNER_DATABASE_ERROR" | "KEV_CATALOG_STALE" | "IMMUTABLE_SOURCE_UNAVAILABLE" | "IMMUTABLE_SOURCE_CHANGED" | "SCAN_EVIDENCE_UNAVAILABLE" | "SCANNER_EXECUTION_ERROR";
+export type DeploymentSecurityAction = "retry_scan" | "update_dependency" | "wait_for_platform_fix";
+export interface DeploymentSecurityFinding {
+    cve: string;
+    component: string;
+    version: string | null;
+    fixedIn: string | null;
+    severity: "Critical" | "High" | "Medium" | "Low";
+    exploitedKev: boolean;
+    responsibility: "user" | "percher";
+}
+export interface DeploymentSecurityBlock {
+    version: 1;
+    context?: "automatic_rollback";
+    reason: "vulnerability" | "scan_unavailable";
+    imageId: string | null;
+    actions: DeploymentSecurityAction[];
+    findings: DeploymentSecurityFinding[];
+    totalFindings: number;
+    truncated: boolean;
+    scanFailureCode?: SecurityScanFailureCode;
+}
+export declare function deploymentSecurityActionText(action: DeploymentSecurityAction, context?: "automatic_rollback"): string;
+/** Fixed authored text only; never interpolate scanner-supplied values here. */
+export declare function deploymentSecuritySummary(block: DeploymentSecurityBlock): string;
+/** Fixed recovery instructions; scanner diagnostics never enter this channel. */
+export declare function deploymentSecurityRecoveryPrompt(block: Pick<DeploymentSecurityBlock, "reason" | "context">): string;
+/** Validate persisted/wire data without turning it into a recovery instruction. */
+export declare function parseDeploymentSecurityBlock(value: unknown): DeploymentSecurityBlock | null;
+export declare function decodeDeploymentSecurityBlock(json: string | null | undefined): DeploymentSecurityBlock | null;
+//# sourceMappingURL=deployment-security.d.ts.map

package/dist/deployment-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-security.d.ts","sourceRoot":"","sources":["../src/deployment-security.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAC/B,qBAAqB,GACrB,yBAAyB,GACzB,wBAAwB,GACxB,mBAAmB,GACnB,8BAA8B,GAC9B,0BAA0B,GAC1B,2BAA2B,GAC3B,yBAAyB,CAAC;AAE9B,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,mBAAmB,GAAG,uBAAuB,CAAC;AAEpG,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,MAAM,EAAE,eAAe,GAAG,kBAAkB,CAAC;IAC7C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,CAAC,EAAE,uBAAuB,CAAC;CAC3C;AAaD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,wBAAwB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,MAAM,CAWR;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAUhF;AAED,iFAAiF;AACjF,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,QAAQ,GAAG,SAAS,CAAC,GACzD,MAAM,CASR;AAYD,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAiG3F;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,uBAAuB,GAAG,IAAI,CAOhC"}

package/dist/deployment-security.js

@@ -0,0 +1,146 @@
+const FAILURE_TEXT = {
+    SCANNER_UNAVAILABLE: "The security scanner is unavailable.",
+    SCANNER_ENGINE_DEGRADED: "A security scanner did not complete successfully.",
+    SCANNER_DATABASE_ERROR: "The vulnerability databases could not be verified as current.",
+    KEV_CATALOG_STALE: "The known-exploited vulnerability catalogue is not current.",
+    IMMUTABLE_SOURCE_UNAVAILABLE: "The exact image could not be identified.",
+    IMMUTABLE_SOURCE_CHANGED: "The image changed during security verification.",
+    SCAN_EVIDENCE_UNAVAILABLE: "The security scan result could not be saved or verified.",
+    SCANNER_EXECUTION_ERROR: "The security scan could not complete.",
+};
+export function deploymentSecurityActionText(action, context) {
+    switch (action) {
+        case "retry_scan":
+            if (context === "automatic_rollback")
+                return "Retry rollback only when security verification is available, or publish a verified replacement.";
+            return "Retry publishing when security verification is available. The new image was not published.";
+        case "update_dependency":
+            return "Update or replace the affected dependency, then publish again.";
+        case "wait_for_platform_fix":
+            return "Percher must fix the affected platform component before this image can be published.";
+    }
+}
+/** Fixed authored text only; never interpolate scanner-supplied values here. */
+export function deploymentSecuritySummary(block) {
+    const explanation = block.reason === "scan_unavailable"
+        ? block.scanFailureCode
+            ? FAILURE_TEXT[block.scanFailureCode]
+            : "The image could not be verified by the security scan."
+        : "The image contains a critical or known-exploited vulnerability.";
+    return block.context === "automatic_rollback"
+        ? `Automatic rollback stopped: ${explanation} The current version was kept running and may still be unhealthy.`
+        : `Publication stopped: ${explanation}`;
+}
+/** Fixed recovery instructions; scanner diagnostics never enter this channel. */
+export function deploymentSecurityRecoveryPrompt(block) {
+    if (block.context === "automatic_rollback") {
+        return block.reason === "vulnerability"
+            ? "Automatic rollback was blocked because the previous image has a critical or known-exploited vulnerability. The current version was kept running and may still be unhealthy. Review the findings and publish a fixed replacement, or wait for Percher's platform fix."
+            : "Automatic rollback stopped because the previous image could not be verified. The current version was kept running and may still be unhealthy. Retry rollback only when verification is available, or publish a verified replacement.";
+    }
+    return block.reason === "vulnerability"
+        ? "Publication was blocked by security policy. Review the vulnerability details, update affected app dependencies or wait for Percher's platform fix before publishing again."
+        : "Publication stopped because security verification was unavailable. Retry publishing when verification is available; the scan has not established whether the image is safe.";
+}
+function text(value, max) {
+    return (typeof value === "string" &&
+        value.length > 0 &&
+        value.length <= max &&
+        // biome-ignore lint/suspicious/noControlCharactersInRegex: diagnostic fields cannot forge terminal lines.
+        !/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/.test(value));
+}
+/** Validate persisted/wire data without turning it into a recovery instruction. */
+export function parseDeploymentSecurityBlock(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const v = value;
+    if (v.version !== 1)
+        return null;
+    if (v.context !== undefined && v.context !== "automatic_rollback")
+        return null;
+    if (v.reason !== "vulnerability" && v.reason !== "scan_unavailable")
+        return null;
+    if (v.imageId !== null &&
+        (typeof v.imageId !== "string" || !/^sha256:[a-f0-9]{64}$/.test(v.imageId)))
+        return null;
+    if (!Array.isArray(v.actions) ||
+        v.actions.length < 1 ||
+        v.actions.length > 3 ||
+        !v.actions.every((a) => ["retry_scan", "update_dependency", "wait_for_platform_fix"].includes(a)) ||
+        new Set(v.actions).size !== v.actions.length)
+        return null;
+    if (!Array.isArray(v.findings) ||
+        v.findings.length > 100 ||
+        !Number.isSafeInteger(v.totalFindings) ||
+        v.totalFindings < v.findings.length ||
+        typeof v.truncated !== "boolean" ||
+        v.truncated !== v.totalFindings > v.findings.length)
+        return null;
+    if (v.scanFailureCode !== undefined &&
+        (v.reason !== "scan_unavailable" ||
+            typeof v.scanFailureCode !== "string" ||
+            !Object.hasOwn(FAILURE_TEXT, v.scanFailureCode)))
+        return null;
+    if (v.reason === "scan_unavailable" &&
+        (v.totalFindings !== 0 || v.actions.length !== 1 || v.actions[0] !== "retry_scan"))
+        return null;
+    if (v.reason === "vulnerability" && (v.totalFindings === 0 || v.actions.includes("retry_scan")))
+        return null;
+    if (v.reason === "vulnerability" && v.imageId === null)
+        return null;
+    const findings = [];
+    for (const item of v.findings) {
+        if (!item || typeof item !== "object" || Array.isArray(item))
+            return null;
+        const f = item;
+        if (!text(f.cve, 128) ||
+            !text(f.component, 512) ||
+            !["Critical", "High", "Medium", "Low"].includes(f.severity) ||
+            (f.version !== null && !text(f.version, 512)) ||
+            (f.fixedIn !== null && !text(f.fixedIn, 2048)) ||
+            typeof f.exploitedKev !== "boolean" ||
+            !["user", "percher"].includes(f.responsibility))
+            return null;
+        findings.push({
+            cve: f.cve,
+            component: f.component,
+            version: f.version,
+            fixedIn: f.fixedIn,
+            severity: f.severity,
+            exploitedKev: f.exploitedKev,
+            responsibility: f.responsibility,
+        });
+    }
+    if (v.reason === "vulnerability") {
+        if (findings.length === 0 || findings.some((f) => f.severity !== "Critical" && !f.exploitedKev))
+            return null;
+        const required = new Set(findings.map((f) => f.responsibility === "percher" ? "wait_for_platform_fix" : "update_dependency"));
+        if ([...required].some((action) => !v.actions.includes(action)))
+            return null;
+        if (!v.truncated &&
+            v.actions.some((action) => !required.has(action)))
+            return null;
+    }
+    return {
+        version: 1,
+        ...(v.context === "automatic_rollback" ? { context: "automatic_rollback" } : {}),
+        reason: v.reason,
+        imageId: v.imageId,
+        actions: v.actions,
+        findings,
+        totalFindings: v.totalFindings,
+        truncated: v.truncated,
+        ...(v.scanFailureCode ? { scanFailureCode: v.scanFailureCode } : {}),
+    };
+}
+export function decodeDeploymentSecurityBlock(json) {
+    if (!json || json.length > 400_000)
+        return null;
+    try {
+        return parseDeploymentSecurityBlock(JSON.parse(json));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=deployment-security.js.map

package/dist/deployment-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-security.js","sourceRoot":"","sources":["../src/deployment-security.ts"],"names":[],"mappings":"AAmCA,MAAM,YAAY,GAA4C;IAC5D,mBAAmB,EAAE,sCAAsC;IAC3D,uBAAuB,EAAE,mDAAmD;IAC5E,sBAAsB,EAAE,+DAA+D;IACvF,iBAAiB,EAAE,6DAA6D;IAChF,4BAA4B,EAAE,0CAA0C;IACxE,wBAAwB,EAAE,iDAAiD;IAC3E,yBAAyB,EAAE,0DAA0D;IACrF,uBAAuB,EAAE,uCAAuC;CACjE,CAAC;AAEF,MAAM,UAAU,4BAA4B,CAC1C,MAAgC,EAChC,OAA8B;IAE9B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,YAAY;YACf,IAAI,OAAO,KAAK,oBAAoB;gBAClC,OAAO,iGAAiG,CAAC;YAC3G,OAAO,4FAA4F,CAAC;QACtG,KAAK,mBAAmB;YACtB,OAAO,gEAAgE,CAAC;QAC1E,KAAK,uBAAuB;YAC1B,OAAO,sFAAsF,CAAC;IAClG,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,KAA8B;IACtE,MAAM,WAAW,GACf,KAAK,CAAC,MAAM,KAAK,kBAAkB;QACjC,CAAC,CAAC,KAAK,CAAC,eAAe;YACrB,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC;YACrC,CAAC,CAAC,uDAAuD;QAC3D,CAAC,CAAC,iEAAiE,CAAC;IACxE,OAAO,KAAK,CAAC,OAAO,KAAK,oBAAoB;QAC3C,CAAC,CAAC,+BAA+B,WAAW,mEAAmE;QAC/G,CAAC,CAAC,wBAAwB,WAAW,EAAE,CAAC;AAC5C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gCAAgC,CAC9C,KAA0D;IAE1D,IAAI,KAAK,CAAC,OAAO,KAAK,oBAAoB,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC,MAAM,KAAK,eAAe;YACrC,CAAC,CAAC,sQAAsQ;YACxQ,CAAC,CAAC,sOAAsO,CAAC;IAC7O,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,KAAK,eAAe;QACrC,CAAC,CAAC,4KAA4K;QAC9K,CAAC,CAAC,6KAA6K,CAAC;AACpL,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,GAAW;IACvC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,0GAA0G;QAC1G,CAAC,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACjF,IACE,CAAC,CAAC,OAAO,KAAK,IAAI;QAClB,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAE3E,OAAO,IAAI,CAAC;IACd,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,CAAC,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACzE;QACD,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM;QAE5C,OAAO,IAAI,CAAC;IACd,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG;QACvB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,aAAwB,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC/C,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS;QAChC,CAAC,CAAC,SAAS,KAAM,CAAC,CAAC,aAAwB,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM;QAE/D,OAAO,IAAI,CAAC;IACd,IACE,CAAC,CAAC,eAAe,KAAK,SAAS;QAC/B,CAAC,CAAC,CAAC,MAAM,KAAK,kBAAkB;YAC9B,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;YACrC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;QAElD,OAAO,IAAI,CAAC;IACd,IACE,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAC/B,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;QAElF,OAAO,IAAI,CAAC;IACd,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IACE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC;YACjB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC;YACvB,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAkB,CAAC;YACrE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,YAAY,KAAK,SAAS;YACnC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAwB,CAAC;YAEzD,OAAO,IAAI,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAwB;YACnC,OAAO,EAAE,CAAC,CAAC,OAAwB;YACnC,QAAQ,EAAE,CAAC,CAAC,QAAiD;YAC7D,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,cAAc,EAAE,CAAC,CAAC,cAAoC;SACvD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,mBAAmB,CAC/E,CACF,CAAC;QACF,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,OAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,IACE,CAAC,CAAC,CAAC,SAAS;YACZ,CAAC,CAAC,OAAO,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAuD,CAAC,CACnF;YAED,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,oBAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAwB;QACnC,OAAO,EAAE,CAAC,CAAC,OAAqC;QAChD,QAAQ;QACR,aAAa,EAAE,CAAC,CAAC,aAAuB;QACxC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAA0C,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAA+B;IAE/B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/email-change.d.ts

@@ -0,0 +1,11 @@
+/** How long a change-email link stays usable after it is sent. */
+export declare const EMAIL_CHANGE_LINK_LIFETIME_SECONDS: number;
+/**
+ * Pending account email changes. The dashboard writes a row per attempt and
+ * the API claims a row in the same transaction that moves the address, so a
+ * link is single-use and only the newest one works. Rows cascade away with the
+ * auth identity, which is how account erasure removes the addresses they hold.
+ * Dashboard-owned like auth_user; the API creates it only in tests.
+ */
+export declare const EMAIL_CHANGE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS account_email_changes (\n  id TEXT PRIMARY KEY NOT NULL,\n  user_id TEXT NOT NULL,\n  from_email TEXT NOT NULL,\n  to_email TEXT,\n  token_hash TEXT UNIQUE,\n  created_at INTEGER NOT NULL,\n  completed_at INTEGER,\n  FOREIGN KEY (user_id) REFERENCES auth_user(id) ON UPDATE no action ON DELETE cascade\n);\nCREATE INDEX IF NOT EXISTS idx_account_email_changes_user_created\n  ON account_email_changes (user_id, created_at);";
+//# sourceMappingURL=email-change.d.ts.map

package/dist/email-change.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-change.d.ts","sourceRoot":"","sources":["../src/email-change.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,kCAAkC,QAAe,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,ycAYkB,CAAC"}

package/dist/email-change.js

@@ -0,0 +1,23 @@
+/** How long a change-email link stays usable after it is sent. */
+export const EMAIL_CHANGE_LINK_LIFETIME_SECONDS = 24 * 60 * 60;
+/**
+ * Pending account email changes. The dashboard writes a row per attempt and
+ * the API claims a row in the same transaction that moves the address, so a
+ * link is single-use and only the newest one works. Rows cascade away with the
+ * auth identity, which is how account erasure removes the addresses they hold.
+ * Dashboard-owned like auth_user; the API creates it only in tests.
+ */
+export const EMAIL_CHANGE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS account_email_changes (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  from_email TEXT NOT NULL,
+  to_email TEXT,
+  token_hash TEXT UNIQUE,
+  created_at INTEGER NOT NULL,
+  completed_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES auth_user(id) ON UPDATE no action ON DELETE cascade
+);
+CREATE INDEX IF NOT EXISTS idx_account_email_changes_user_created
+  ON account_email_changes (user_id, created_at);`;
+//# sourceMappingURL=email-change.js.map

package/dist/email-change.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-change.js","sourceRoot":"","sources":["../src/email-change.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;kDAYe,CAAC"}

package/dist/email-template.d.ts

@@ -0,0 +1,19 @@
+/** Fixed first-party asset; the live wordmark identifies us with images blocked.
+ * Only its URL ships in npm. The mark artwork stays in the private package. */
+export declare const EMAIL_BRAND_HEADER: string;
+type EmailFooter = "none" | {
+    kind: "notifications";
+    dashboardUrl: string;
+};
+/** Use the dashboard origin, not an app/deploy path or its query string. */
+export declare function emailNotificationSettingsUrl(dashboardUrl: string): string;
+/** Callers escape values in bodyHtml and explicitly choose the footer policy.
+ * Notification settings apply only to mail with an effective preference gate;
+ * security/legal notices and signed waitlist removal links keep their own copy. */
+export declare function renderEmail(input: {
+    bodyHtml: string;
+    footer: EmailFooter;
+    lang?: "en" | "sv";
+}): string;
+export {};
+//# sourceMappingURL=email-template.d.ts.map

package/dist/email-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-template.d.ts","sourceRoot":"","sources":["../src/email-template.ts"],"names":[],"mappings":"AAGA;+EAC+E;AAC/E,eAAO,MAAM,kBAAkB,QAGxB,CAAC;AAER,KAAK,WAAW,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAUzE;AAED;;mFAEmF;AACnF,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACpB,GAAG,MAAM,CA4BT"}

package/dist/email-template.js

@@ -0,0 +1,53 @@
+import { BRAND } from "./brand.js";
+import { escapeHtml } from "./escape-html.js";
+/** Fixed first-party asset; the live wordmark identifies us with images blocked.
+ * Only its URL ships in npm. The mark artwork stays in the private package. */
+export const EMAIL_BRAND_HEADER = `<p style="margin:0 0 20px;line-height:28px;">
+    <img src="https://percher.app/email-mark.png" width="28" height="28" alt="" style="display:inline-block;vertical-align:middle;border:0;margin-right:7px;" />
+    <span style="font-size:19px;font-weight:700;letter-spacing:-0.01em;color:${BRAND.ink};vertical-align:middle;">Percher</span>
+  </p>`;
+/** Use the dashboard origin, not an app/deploy path or its query string. */
+export function emailNotificationSettingsUrl(dashboardUrl) {
+    try {
+        const url = new URL(dashboardUrl);
+        if (url.protocol === "https:" || url.protocol === "http:") {
+            return `${url.origin}/login?next=%2Faccount%23notifications`;
+        }
+    }
+    catch {
+        // A malformed dashboard link must not turn the footer into an unsafe URL.
+    }
+    return "https://percher.app/login?next=%2Faccount%23notifications";
+}
+/** Callers escape values in bodyHtml and explicitly choose the footer policy.
+ * Notification settings apply only to mail with an effective preference gate;
+ * security/legal notices and signed waitlist removal links keep their own copy. */
+export function renderEmail(input) {
+    const footer = input.footer === "none"
+        ? ""
+        : `<p style="margin:24px 0 0;padding-top:16px;border-top:1px solid #e5e5e5;font-size:12px;line-height:1.5;color:#666;"><a href="${escapeHtml(emailNotificationSettingsUrl(input.footer.dashboardUrl))}" style="color:#666;">Manage notifications</a></p>`;
+    return `<!doctype html>
+<html lang="${input.lang === "sv" ? "sv" : "en"}">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <style>
+    .percher-email-content h1,.percher-email-content h2{margin:0 0 16px;font-size:22px;line-height:1.3;}
+    .percher-email-content pre{white-space:pre-wrap;word-break:break-word;}
+    @media only screen and (max-width:480px){.percher-email-content{padding:20px!important;}.percher-email-outer{padding:12px 8px!important;}}
+  </style>
+</head>
+<body style="margin:0;padding:0;background:#f5f5f5;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="border-collapse:collapse;background:#f5f5f5;"><tr><td class="percher-email-outer" align="center" style="padding:24px 12px;">
+    <!--[if mso]><table role="presentation" width="600" cellpadding="0" cellspacing="0"><tr><td><![endif]-->
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:600px;margin:0 auto;background:#fff;border:1px solid #e5e5e5;border-radius:8px;table-layout:fixed;"><tr><td class="percher-email-content" style="padding:28px;font-family:Arial,Helvetica,sans-serif;font-size:15px;line-height:1.6;color:${BRAND.ink};overflow-wrap:anywhere;word-break:break-word;">
+      ${EMAIL_BRAND_HEADER}
+      ${input.bodyHtml.trim()}
+      ${footer}
+    </td></tr></table>
+    <!--[if mso]></td></tr></table><![endif]-->
+  </td></tr></table>
+</body>
+</html>`;
+}
+//# sourceMappingURL=email-template.js.map

package/dist/email-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-template.js","sourceRoot":"","sources":["../src/email-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C;+EAC+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG;;+EAE6C,KAAK,CAAC,GAAG;OACjF,CAAC;AAIR,4EAA4E;AAC5E,MAAM,UAAU,4BAA4B,CAAC,YAAoB;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC1D,OAAO,GAAG,GAAG,CAAC,MAAM,wCAAwC,CAAC;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,2DAA2D,CAAC;AACrE,CAAC;AAED;;mFAEmF;AACnF,MAAM,UAAU,WAAW,CAAC,KAI3B;IACC,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,KAAK,MAAM;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,gIAAgI,UAAU,CAAC,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,oDAAoD,CAAC;IAC9P,OAAO;cACK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;;;;;;;;;;;;;yUAa0R,KAAK,CAAC,GAAG;QAC1U,kBAAkB;QAClB,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;QACrB,MAAM;;;;;QAKN,CAAC;AACT,CAAC"}

package/dist/index.d.ts

@@ -5,17 +5,21 @@ export { CLIENT_IP_ATTESTATION_MAX_SKEW_MS, CLIENT_IP_ATTESTATION_VERSION, CLIEN
 export { crashAssistantPrompt } from "./crash-prompt.js";
 export { type DataExpressionErrorReason, type DataExpressionResult, type DataQueryInvalidExtra, type DataSchemaField, parseDataFields, parseDataFilter, parseDataSort, } from "./data-filter.js";
 export { DATA_ACCESS_MODES, DATA_ACCESS_SCOPES, DATA_ACCESS_SETTER_ERROR_STATUS, DATA_ACT_AS_UNAVAILABLE_REASONS, DATA_ACTING_AS, DATA_COLLECTION_RE, DATA_IDENTITY_KINDS, DATA_IDENTITY_LABEL_FIELD_TYPES, DATA_IDENTITY_LABELS, DATA_LIMITS, DATA_NOT_RUNNING_REASONS, DATA_RATE_LIMIT_SOURCES, DATA_RECORD_ERROR_STATUS, DATA_RECORD_ID_RE, DATA_RULE_CLASSES, DATA_RULE_DENIED_REASONS, DATA_RULE_OPS, type DataAccess, type DataAccessMode, type DataAccessNoticePayload, type DataAccessScope, type DataAccessSet, type DataAccessSetterErrorCode, type DataAccessUpdate, type DataActAsUnavailableExtra, type DataActAsUnavailableReason, type DataActingAs, type DataCollectionAccess, type DataCollectionSummary, type DataConflictExtra, type DataCreateInput, type DataFieldSummary, type DataIdentity, type DataIdentityCandidatesRequest, type DataIdentityCandidatesResponse, type DataIdentityCollection, type DataIdentityLabelFieldType, type DataNotRunningReason, type DataPaginatedRecords, type DataQueryOptions, type DataRateLimitedExtra, type DataRateLimitSource, type DataRecord, type DataRecordErrorCode, type DataRuleClass, type DataRuleDeniedExtra, type DataRuleDeniedReason, type DataRuleOp, type DataSchemaResponse, type DataTokenAccessNoticePayload, type DataTokenAccessRow, type DataTokenAccessUpdate, type DataUpdateInput, type DataValidationFields, type OAuthGrantsDataTools, } from "./data-records.js";
+export { type DeploymentSecurityAction, type DeploymentSecurityBlock, type DeploymentSecurityFinding, decodeDeploymentSecurityBlock, deploymentSecurityActionText, deploymentSecurityRecoveryPrompt, deploymentSecuritySummary, parseDeploymentSecurityBlock, type SecurityScanFailureCode, } from "./deployment-security.js";
 export { disposableDomainCount, isDisposableEmailDomain } from "./disposable-email-domains.js";
 export { DOMAIN_RE } from "./domain-name.js";
 export { EMAIL_BUDGET_LIMITS, EMAIL_BUDGET_SCHEMA, EmailBudget, type EmailBudgetConnection, type EmailCategory, } from "./email-budget.js";
+export { EMAIL_CHANGE_LINK_LIFETIME_SECONDS, EMAIL_CHANGE_SCHEMA } from "./email-change.js";
+export { EMAIL_BRAND_HEADER, emailNotificationSettingsUrl, renderEmail } from "./email-template.js";
 export { ENV_MASK, isMaskedEnvValue, maskEnvValue } from "./env-mask.js";
 export { ENV_NAME_RE } from "./env-name.js";
 export { escapeHtml } from "./escape-html.js";
 export { IMAGE_REJECTION_NOTE_MAX, IMAGE_REJECTION_REASONS, type ImageKind, type ImageRejectionCode, imageRejectionLabel, imageRejectionReasons, isImageRejectionCode, } from "./image-rejection.js";
 export { INTERNAL_SIG_HEADER, INTERNAL_SIG_MAX_SKEW_MS, INTERNAL_SIG_VERSION, INTERNAL_TS_HEADER, type InternalSigParts, internalSigPayload, } from "./internal-sig.js";
+export { ipSubnetKey, parseIpAddress } from "./ip-prefix.js";
 export { CURRENT_TERMS_VERSION, LEGAL_DOCUMENT_HASHES, LEGAL_DOCUMENT_LAST_UPDATED, LEGAL_DOCUMENT_VERSIONS, type TermsAcceptanceEvidence, } from "./legal.js";
 export { canonicalLegalChangeJson, compareVersions, declaredVersion, LEGAL_CHANGE_ID_PATTERN, LEGAL_CHANGES, LEGAL_VERSION_PATTERN, type LegalChange, type LegalChangeDocument, type LegalChangeEnforcement, type LegalChangeReason, type LegalDocumentKey, MATERIAL_CHANGE_NOTICE_MS, openMaterialChanges, pendingAcknowledgement, SIGNUP_DISCLOSURE_HEADER, } from "./legal-changes.js";
-export { MAX_ANON_TARBALL_BYTES, MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MIN_UPLOAD_CHUNK_BYTES, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
+export { MAX_ANON_TARBALL_BYTES, MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MFA_MANAGEMENT_SECONDS, MIN_UPLOAD_CHUNK_BYTES, STAFF_MFA_PROOF_SECONDS, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
 export { MAX_LOG_SEARCH_LENGTH } from "./logs.js";
 export { MAX_OAUTH_CLIENT_NAME_DISPLAY_CODE_POINTS, normaliseOAuthClientName, } from "./oauth-client-name.js";
 export { DATA_ACCESS_MODE_LABELS, describeOAuthScope, OAUTH_SCOPE_LABELS, parseOAuthScopes, } from "./oauth-scopes.js";
@@ -27,5 +31,6 @@ export { signupDayWindow } from "./signup-day.js";
 export { normalizeSignupInviteCode, SIGNUP_INVITE_CODE_ALPHABET, SIGNUP_INVITE_CODE_LENGTH, SIGNUP_INVITE_CODE_PREFIX, SIGNUP_INVITE_HEADER, } from "./signup-invite.js";
 export { assertValidSwitches, type BooleanSwitch, type EnumSwitch, type PresenceSwitch, reportSwitches, SWITCH_BY_NAME, SWITCHES, type SwitchReader, type SwitchReport, type SwitchSpec, type SwitchState, switchEnabled, switchState, switchValue, } from "./switches.js";
 export { BUN_MAX_IDLE_TIMEOUT_SECONDS, HTTP_IDLE_TIMEOUT_SECONDS, type HttpIdleTimeoutSurface, TIMEOUTS, type TimeoutKey, } from "./timeouts.js";
+export { chargeVerifiedSignup, initializeVerifiedSignupCutover, type SignupQuotaConnection, VerifiedSignupLimitError, verifiedSignupQuota, } from "./verified-signup.js";
 export { WAITLIST_THROTTLE_WINDOW_MS } from "./waitlist.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,eAAe,EACf,eAAe,EACf,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,+BAA+B,EAC/B,+BAA+B,EAC/B,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,EACpB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,aAAa,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,KAAK,qBAAqB,EAC1B,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,cAAc,EACd,cAAc,EACd,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,QAAQ,EACR,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,eAAe,EACf,eAAe,EACf,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,+BAA+B,EAC/B,+BAA+B,EAC/B,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,EACpB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,aAAa,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,6BAA6B,EAC7B,4BAA4B,EAC5B,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,KAAK,qBAAqB,EAC1B,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kCAAkC,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,cAAc,EACd,cAAc,EACd,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,QAAQ,EACR,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,KAAK,qBAAqB,EAC1B,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -5,17 +5,21 @@ export { CLIENT_IP_ATTESTATION_MAX_SKEW_MS, CLIENT_IP_ATTESTATION_VERSION, CLIEN
 export { crashAssistantPrompt } from "./crash-prompt.js";
 export { parseDataFields, parseDataFilter, parseDataSort, } from "./data-filter.js";
 export { DATA_ACCESS_MODES, DATA_ACCESS_SCOPES, DATA_ACCESS_SETTER_ERROR_STATUS, DATA_ACT_AS_UNAVAILABLE_REASONS, DATA_ACTING_AS, DATA_COLLECTION_RE, DATA_IDENTITY_KINDS, DATA_IDENTITY_LABEL_FIELD_TYPES, DATA_IDENTITY_LABELS, DATA_LIMITS, DATA_NOT_RUNNING_REASONS, DATA_RATE_LIMIT_SOURCES, DATA_RECORD_ERROR_STATUS, DATA_RECORD_ID_RE, DATA_RULE_CLASSES, DATA_RULE_DENIED_REASONS, DATA_RULE_OPS, } from "./data-records.js";
+export { decodeDeploymentSecurityBlock, deploymentSecurityActionText, deploymentSecurityRecoveryPrompt, deploymentSecuritySummary, parseDeploymentSecurityBlock, } from "./deployment-security.js";
 export { disposableDomainCount, isDisposableEmailDomain } from "./disposable-email-domains.js";
 export { DOMAIN_RE } from "./domain-name.js";
 export { EMAIL_BUDGET_LIMITS, EMAIL_BUDGET_SCHEMA, EmailBudget, } from "./email-budget.js";
+export { EMAIL_CHANGE_LINK_LIFETIME_SECONDS, EMAIL_CHANGE_SCHEMA } from "./email-change.js";
+export { EMAIL_BRAND_HEADER, emailNotificationSettingsUrl, renderEmail } from "./email-template.js";
 export { ENV_MASK, isMaskedEnvValue, maskEnvValue } from "./env-mask.js";
 export { ENV_NAME_RE } from "./env-name.js";
 export { escapeHtml } from "./escape-html.js";
 export { IMAGE_REJECTION_NOTE_MAX, IMAGE_REJECTION_REASONS, imageRejectionLabel, imageRejectionReasons, isImageRejectionCode, } from "./image-rejection.js";
 export { INTERNAL_SIG_HEADER, INTERNAL_SIG_MAX_SKEW_MS, INTERNAL_SIG_VERSION, INTERNAL_TS_HEADER, internalSigPayload, } from "./internal-sig.js";
+export { ipSubnetKey, parseIpAddress } from "./ip-prefix.js";
 export { CURRENT_TERMS_VERSION, LEGAL_DOCUMENT_HASHES, LEGAL_DOCUMENT_LAST_UPDATED, LEGAL_DOCUMENT_VERSIONS, } from "./legal.js";
 export { canonicalLegalChangeJson, compareVersions, declaredVersion, LEGAL_CHANGE_ID_PATTERN, LEGAL_CHANGES, LEGAL_VERSION_PATTERN, MATERIAL_CHANGE_NOTICE_MS, openMaterialChanges, pendingAcknowledgement, SIGNUP_DISCLOSURE_HEADER, } from "./legal-changes.js";
-export { MAX_ANON_TARBALL_BYTES, MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MIN_UPLOAD_CHUNK_BYTES, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
+export { MAX_ANON_TARBALL_BYTES, MAX_INLINE_PUBLISH_BYTES, MAX_OPEN_UPLOAD_SESSIONS_PER_USER, MAX_TARBALL_BYTES, MAX_UPLOAD_CHUNK_BYTES, MAX_UPLOAD_SESSION_FILES, MFA_MANAGEMENT_SECONDS, MIN_UPLOAD_CHUNK_BYTES, STAFF_MFA_PROOF_SECONDS, UPLOAD_SESSION_MAX_LIFETIME_MS, UPLOAD_SESSION_TTL_MS, } from "./limits.js";
 export { MAX_LOG_SEARCH_LENGTH } from "./logs.js";
 export { MAX_OAUTH_CLIENT_NAME_DISPLAY_CODE_POINTS, normaliseOAuthClientName, } from "./oauth-client-name.js";
 export { DATA_ACCESS_MODE_LABELS, describeOAuthScope, OAUTH_SCOPE_LABELS, parseOAuthScopes, } from "./oauth-scopes.js";
@@ -27,5 +31,6 @@ export { signupDayWindow } from "./signup-day.js";
 export { normalizeSignupInviteCode, SIGNUP_INVITE_CODE_ALPHABET, SIGNUP_INVITE_CODE_LENGTH, SIGNUP_INVITE_CODE_PREFIX, SIGNUP_INVITE_HEADER, } from "./signup-invite.js";
 export { assertValidSwitches, reportSwitches, SWITCH_BY_NAME, SWITCHES, switchEnabled, switchState, switchValue, } from "./switches.js";
 export { BUN_MAX_IDLE_TIMEOUT_SECONDS, HTTP_IDLE_TIMEOUT_SECONDS, TIMEOUTS, } from "./timeouts.js";
+export { chargeVerifiedSignup, initializeVerifiedSignupCutover, VerifiedSignupLimitError, verifiedSignupQuota, } from "./verified-signup.js";
 export { WAITLIST_THROTTLE_WINDOW_MS } from "./waitlist.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAsB,aAAa,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EAEtB,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAKL,eAAe,EACf,eAAe,EACf,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,+BAA+B,EAC/B,+BAA+B,EAC/B,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,EACpB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,aAAa,GAuCd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,GAGZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EAGvB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAElB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,GAExB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EAMrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EAInB,cAAc,EACd,cAAc,EACd,QAAQ,EAKR,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EAEzB,QAAQ,GAET,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAsB,aAAa,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EAEtB,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAKL,eAAe,EACf,eAAe,EACf,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,+BAA+B,EAC/B,+BAA+B,EAC/B,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,EACpB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,aAAa,GAuCd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,6BAA6B,EAC7B,4BAA4B,EAC5B,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,GAGZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kCAAkC,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EAGvB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAElB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,GAExB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EAMrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EAInB,cAAc,EACd,cAAc,EACd,QAAQ,EAKR,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EAEzB,QAAQ,GAET,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAE/B,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC"}

package/dist/ip-prefix.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Binary IP parsing and subnet-prefix keying.
+ *
+ * Any limit keyed on "the network this request came from" needs the address
+ * reduced to a prefix, and that reduction has to happen on BYTES. The textual
+ * form of an IPv6 address is not positional: "2001:db8::1" and
+ * "2001:0db8:0000:0000:0000:0000:0000:0001" are the same address, and
+ * "2001::abcd:1" has its hextets in entirely different places than a naive
+ * split(":") suggests. Masking by slicing the text therefore puts one address
+ * in several buckets and unrelated addresses in one — which is exactly the
+ * evasion a subnet key exists to prevent.
+ */
+/** A parsed address as raw bytes: 4 for IPv4, 16 for IPv6. */
+export type ParsedIp = {
+    family: 4;
+    bytes: Uint8Array;
+} | {
+    family: 6;
+    bytes: Uint8Array;
+};
+/**
+ * Parse an address to bytes, or null if it is not one.
+ *
+ * An IPv6 zone id ("fe80::1%eth0") is dropped — it names a local interface,
+ * not a different host. An IPv4-mapped address ("::ffff:203.0.113.7") is
+ * returned as the IPv4 it carries, so one client cannot occupy two buckets by
+ * choosing a spelling, and so every mapped client does not collapse into one
+ * shared bucket.
+ *
+ * Brackets and zone ids belong to IPv6 alone, so "[1.2.3.4]" and
+ * "1.2.3.4%eth0" are rejected rather than quietly read as IPv4 — this decides
+ * whether a caller is refused or filed under a real network, and a spelling no
+ * address ever has means a caller we cannot key.
+ */
+export declare function parseIpAddress(ip: string): ParsedIp | null;
+/**
+ * Collapse an address to its subnet key, e.g. "203.0.113.0/24" or
+ * "2001:db8:1::/48". Returns null for anything that is not an address, so a
+ * caller that must not guess (an admission cap) can refuse, while one with a
+ * safe fallback (a rate limiter) can bucket the raw string instead.
+ */
+export declare function ipSubnetKey(ip: string, v4Bits: number, v6Bits: number): string | null;
+//# sourceMappingURL=ip-prefix.d.ts.map

package/dist/ip-prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-prefix.d.ts","sourceRoot":"","sources":["../src/ip-prefix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,QAAQ,GAAG;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AA+F3F;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAyB1D;AAmDD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQrF"}

package/dist/ip-prefix.js

@@ -0,0 +1,225 @@
+/**
+ * Binary IP parsing and subnet-prefix keying.
+ *
+ * Any limit keyed on "the network this request came from" needs the address
+ * reduced to a prefix, and that reduction has to happen on BYTES. The textual
+ * form of an IPv6 address is not positional: "2001:db8::1" and
+ * "2001:0db8:0000:0000:0000:0000:0000:0001" are the same address, and
+ * "2001::abcd:1" has its hextets in entirely different places than a naive
+ * split(":") suggests. Masking by slicing the text therefore puts one address
+ * in several buckets and unrelated addresses in one — which is exactly the
+ * evasion a subnet key exists to prevent.
+ */
+const HEXTET_RE = /^[0-9a-fA-F]{1,4}$/;
+const OCTET_RE = /^\d{1,3}$/;
+/** Zone id characters we accept (RFC 4007 scope zones as they are actually
+ *  written: an interface name or an index). Deliberately narrow — the zone is
+ *  discarded, so anything unusual here is a spelling no address has — and this
+ *  module's boundary is that such a caller is refused rather than filed under
+ *  somebody's network. */
+const ZONE_RE = /^[0-9A-Za-z._~-]+$/;
+function parseIpv4Bytes(text) {
+    const parts = text.split(".");
+    if (parts.length !== 4)
+        return null;
+    const bytes = new Uint8Array(4);
+    for (let i = 0; i < 4; i++) {
+        const part = parts[i];
+        // Leading zeros are rejected rather than parsed: "010" is 8 in one
+        // reading and 10 in another, and two readings of one address are two
+        // buckets. Canonical spellings only, same as node's net.isIP.
+        if (!OCTET_RE.test(part) || (part.length > 1 && part.startsWith("0")))
+            return null;
+        const n = Number(part);
+        if (n > 255)
+            return null;
+        bytes[i] = n;
+    }
+    return bytes;
+}
+/**
+ * Read one side of a "::" split into 16-bit groups, or null if any token is
+ * not a legal hextet.
+ *
+ * `allowEmbeddedIpv4` is only true for the side that ends the whole address:
+ * an embedded dotted quad occupies the last 32 bits, so "192.0.2.1::" and
+ * "1:192.0.2.1::" are not addresses. Accepting them mapped them onto real
+ * prefixes ("192.0.2.1::" landed in c000:201::/56), which is worse than
+ * rejecting them — a caller that cannot be keyed must be refused, not filed
+ * under somebody else's network.
+ */
+function groupsFrom(part, allowEmbeddedIpv4) {
+    if (part === "")
+        return [];
+    const tokens = part.split(":");
+    const groups = [];
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (token.includes(".")) {
+            if (!allowEmbeddedIpv4 || i !== tokens.length - 1)
+                return null;
+            const v4 = parseIpv4Bytes(token);
+            if (!v4)
+                return null;
+            groups.push((v4[0] << 8) | v4[1]);
+            groups.push((v4[2] << 8) | v4[3]);
+            continue;
+        }
+        if (!HEXTET_RE.test(token))
+            return null;
+        groups.push(Number.parseInt(token, 16));
+    }
+    return groups;
+}
+function parseIpv6Bytes(text) {
+    const halves = text.split("::");
+    if (halves.length > 2)
+        return null;
+    // With no "::" the single side ends the address; with one, the tail does —
+    // even when the tail is empty, which is what makes "192.0.2.1::" invalid.
+    const head = groupsFrom(halves[0], halves.length === 1);
+    if (!head)
+        return null;
+    let groups;
+    if (halves.length === 1) {
+        if (head.length !== 8)
+            return null;
+        groups = head;
+    }
+    else {
+        const tail = groupsFrom(halves[1], true);
+        if (!tail)
+            return null;
+        // "::" must stand for at least one zero group, so a full 8 either side
+        // of it is not a valid spelling of an address.
+        const gap = 8 - head.length - tail.length;
+        if (gap < 1)
+            return null;
+        groups = [...head, ...new Array(gap).fill(0), ...tail];
+    }
+    const bytes = new Uint8Array(16);
+    for (let i = 0; i < 8; i++) {
+        const g = groups[i];
+        bytes[i * 2] = g >> 8;
+        bytes[i * 2 + 1] = g & 0xff;
+    }
+    return bytes;
+}
+function isIpv4Mapped(bytes) {
+    for (let i = 0; i < 10; i++)
+        if (bytes[i] !== 0)
+            return false;
+    return bytes[10] === 0xff && bytes[11] === 0xff;
+}
+/**
+ * Parse an address to bytes, or null if it is not one.
+ *
+ * An IPv6 zone id ("fe80::1%eth0") is dropped — it names a local interface,
+ * not a different host. An IPv4-mapped address ("::ffff:203.0.113.7") is
+ * returned as the IPv4 it carries, so one client cannot occupy two buckets by
+ * choosing a spelling, and so every mapped client does not collapse into one
+ * shared bucket.
+ *
+ * Brackets and zone ids belong to IPv6 alone, so "[1.2.3.4]" and
+ * "1.2.3.4%eth0" are rejected rather than quietly read as IPv4 — this decides
+ * whether a caller is refused or filed under a real network, and a spelling no
+ * address ever has means a caller we cannot key.
+ */
+export function parseIpAddress(ip) {
+    if (!ip)
+        return null;
+    let text = ip.trim();
+    const bracketed = text.startsWith("[") && text.endsWith("]");
+    if (bracketed)
+        text = text.slice(1, -1);
+    const zone = text.indexOf("%");
+    const zoned = zone !== -1;
+    if (zoned) {
+        // The zone is discarded, so it was previously taken on trust — which let
+        // "fe80::1%a%b", "fe80::1%a b" and a zone full of control characters all
+        // parse as fe80::1. They reach no wrong bucket, but they are not addresses.
+        if (!ZONE_RE.test(text.slice(zone + 1)))
+            return null;
+        text = text.slice(0, zone);
+    }
+    if (!text)
+        return null;
+    if (!text.includes(":")) {
+        if (bracketed || zoned)
+            return null;
+        const v4 = parseIpv4Bytes(text);
+        return v4 ? { family: 4, bytes: v4 } : null;
+    }
+    const v6 = parseIpv6Bytes(text);
+    if (!v6)
+        return null;
+    if (isIpv4Mapped(v6))
+        return { family: 4, bytes: v6.slice(12) };
+    return { family: 6, bytes: v6 };
+}
+function maskBytes(bytes, bits) {
+    const out = new Uint8Array(bytes.length);
+    const wholeBytes = bits >> 3;
+    out.set(bytes.subarray(0, wholeBytes));
+    const remainder = bits & 7;
+    if (remainder > 0 && wholeBytes < bytes.length) {
+        out[wholeBytes] = bytes[wholeBytes] & (0xff << (8 - remainder));
+    }
+    return out;
+}
+/** Render IPv6 bytes in the canonical RFC 5952 form: lowercase, no leading
+ *  zeros, the longest run of zero groups (leftmost on a tie) compressed. */
+function formatIpv6(bytes) {
+    const groups = [];
+    for (let i = 0; i < 16; i += 2) {
+        groups.push((bytes[i] << 8) | bytes[i + 1]);
+    }
+    let bestStart = -1;
+    let bestLen = 0;
+    let runStart = -1;
+    let runLen = 0;
+    for (let i = 0; i < 8; i++) {
+        if (groups[i] === 0) {
+            if (runStart < 0) {
+                runStart = i;
+                runLen = 0;
+            }
+            runLen++;
+            if (runLen > bestLen) {
+                bestLen = runLen;
+                bestStart = runStart;
+            }
+        }
+        else {
+            runStart = -1;
+            runLen = 0;
+        }
+    }
+    const hex = (g) => g.toString(16);
+    // A single zero group is written out; "::" stands for two or more.
+    if (bestLen < 2)
+        return groups.map(hex).join(":");
+    const head = groups.slice(0, bestStart).map(hex).join(":");
+    const tail = groups
+        .slice(bestStart + bestLen)
+        .map(hex)
+        .join(":");
+    return `${head}::${tail}`;
+}
+/**
+ * Collapse an address to its subnet key, e.g. "203.0.113.0/24" or
+ * "2001:db8:1::/48". Returns null for anything that is not an address, so a
+ * caller that must not guess (an admission cap) can refuse, while one with a
+ * safe fallback (a rate limiter) can bucket the raw string instead.
+ */
+export function ipSubnetKey(ip, v4Bits, v6Bits) {
+    const parsed = parseIpAddress(ip);
+    if (!parsed)
+        return null;
+    if (parsed.family === 4) {
+        const masked = maskBytes(parsed.bytes, v4Bits);
+        return `${masked.join(".")}/${v4Bits}`;
+    }
+    return `${formatIpv6(maskBytes(parsed.bytes, v6Bits))}/${v6Bits}`;
+}
+//# sourceMappingURL=ip-prefix.js.map

package/dist/ip-prefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-prefix.js","sourceRoot":"","sources":["../src/ip-prefix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,MAAM,SAAS,GAAG,oBAAoB,CAAC;AACvC,MAAM,QAAQ,GAAG,WAAW,CAAC;AAC7B;;;;0BAI0B;AAC1B,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAErC,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAChC,mEAAmE;QACnE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QACzB,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,iBAA0B;IAC1D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;QAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,iBAAiB,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,CAAE,EAAE,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC,GAAI,EAAE,CAAC,CAAC,CAAY,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,CAAE,EAAE,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC,GAAI,EAAE,CAAC,CAAC,CAAY,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAW,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,MAAgB,CAAC;IACrB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAW,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,uEAAuE;QACvE,+CAA+C;QAC/C,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1C,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;QAC9B,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,SAAS;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC;IAC1B,IAAI,KAAK,EAAE,CAAC;QACV,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,YAAY,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,IAAY;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC;IAC3B,IAAI,SAAS,GAAG,CAAC,IAAI,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,GAAI,KAAK,CAAC,UAAU,CAAY,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;4EAC4E;AAC5E,SAAS,UAAU,CAAC,KAAiB;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC,GAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAY,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM,GAAG,CAAC,CAAC;YACb,CAAC;YACD,MAAM,EAAE,CAAC;YACT,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC;gBACrB,OAAO,GAAG,MAAM,CAAC;gBACjB,SAAS,GAAG,QAAQ,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1C,mEAAmE;IACnE,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM;SAChB,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;SAC1B,GAAG,CAAC,GAAG,CAAC;SACR,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,MAAc,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;AACpE,CAAC"}

package/dist/limits.d.ts

@@ -60,4 +60,15 @@ export declare const UPLOAD_SESSION_MAX_LIFETIME_MS: number;
 export declare const MAX_OPEN_UPLOAD_SESSIONS_PER_USER = 2;
 /** Max files a single upload-session manifest may declare. */
 export declare const MAX_UPLOAD_SESSION_FILES = 400;
+/**
+ * Lifetime of a staff MFA proof (12 h). The dashboard (`lib/mfa.ts`) and the
+ * API staff gate (`middleware/staff-mfa.ts`) read this one value.
+ */
+export declare const STAFF_MFA_PROOF_SECONDS: number;
+/**
+ * How recent a proof must be for a sensitive MFA action (5 min): disabling the
+ * factor, new recovery codes, an email change and minting an operator token.
+ * The dashboard (`lib/mfa.ts`) and the API operator-token route read this value.
+ */
+export declare const MFA_MANAGEMENT_SECONDS: number;
 //# sourceMappingURL=limits.d.ts.map

package/dist/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAoB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD;;;;;;GAMG;AAEH;;8BAE8B;AAC9B,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;;iEAKiE;AACjE,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;qDAIqD;AACrD,eAAO,MAAM,qBAAqB,QAAqB,CAAC;AAExD;;4BAE4B;AAC5B,eAAO,MAAM,8BAA8B,QAAsB,CAAC;AAElE;yEACyE;AACzE,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB,MAAM,CAAC"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAoB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD;;;;;;GAMG;AAEH;;8BAE8B;AAC9B,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;;iEAKiE;AACjE,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;qDAIqD;AACrD,eAAO,MAAM,qBAAqB,QAAqB,CAAC;AAExD;;4BAE4B;AAC5B,eAAO,MAAM,8BAA8B,QAAsB,CAAC;AAElE;yEACyE;AACzE,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,uBAAuB,QAAe,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAS,CAAC"}

package/dist/limits.js

@@ -60,4 +60,15 @@ export const UPLOAD_SESSION_MAX_LIFETIME_MS = 24 * 60 * 60 * 1000;
 export const MAX_OPEN_UPLOAD_SESSIONS_PER_USER = 2;
 /** Max files a single upload-session manifest may declare. */
 export const MAX_UPLOAD_SESSION_FILES = 400;
+/**
+ * Lifetime of a staff MFA proof (12 h). The dashboard (`lib/mfa.ts`) and the
+ * API staff gate (`middleware/staff-mfa.ts`) read this one value.
+ */
+export const STAFF_MFA_PROOF_SECONDS = 12 * 60 * 60;
+/**
+ * How recent a proof must be for a sensitive MFA action (5 min): disabling the
+ * factor, new recovery codes, an email change and minting an operator token.
+ * The dashboard (`lib/mfa.ts`) and the API operator-token route read this value.
+ */
+export const MFA_MANAGEMENT_SECONDS = 5 * 60;
 //# sourceMappingURL=limits.js.map

package/dist/limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzD;;;;;;GAMG;AAEH;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;;iEAKiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;qDAIqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD;;4BAE4B;AAC5B,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElE;yEACyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC"}
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzD;;;;;;GAMG;AAEH;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;;iEAKiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;qDAIqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD;;4BAE4B;AAC5B,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElE;yEACyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,CAAC"}

package/dist/oauth-scopes.js

@@ -4,7 +4,7 @@ export const OAUTH_SCOPE_LABELS = {
     "mcp:account": "View your account",
     mcp: "Use the hosted Percher MCP tools",
 };
-const DATA_ACCESS_SUFFIX = "records in your apps' databases, including data your app's users entered. Every record the assistant reads is sent to it and may be processed by its provider under the provider's terms. Revoke in Settings → Connections; copies already sent are not recalled.";
+const DATA_ACCESS_SUFFIX = "records in your apps' databases, including data your app's users entered. Every record the assistant reads is sent to it and may be processed by its provider under the provider's terms. Revoke in Account → Connections; copies already sent are not recalled.";
 /**
  * A grant's database-tool access, for the Connections editor and the
  * security email. Not a scope: data access is a grant attribute, so these

package/dist/oauth-scopes.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-scopes.js","sourceRoot":"","sources":["../src/oauth-scopes.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,MAAM,kBAAkB,GAAqC;IAClE,UAAU,EAAE,yDAAyD;IACrE,eAAe,EAAE,iCAAiC;IAClD,aAAa,EAAE,mBAAmB;IAClC,GAAG,EAAE,kCAAkC;CACxC,CAAC;AAEF,MAAM,kBAAkB,GACtB,mQAAmQ,CAAC;AAEtQ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA6C;IAC/E,SAAS,EAAE,mCAAmC,kBAAkB,EAAE;IAClE,IAAI,EAAE,QAAQ,kBAAkB,EAAE;CACnC,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AAC5C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"oauth-scopes.js","sourceRoot":"","sources":["../src/oauth-scopes.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,MAAM,kBAAkB,GAAqC;IAClE,UAAU,EAAE,yDAAyD;IACrE,eAAe,EAAE,iCAAiC;IAClD,aAAa,EAAE,mBAAmB;IAClC,GAAG,EAAE,kCAAkC;CACxC,CAAC;AAEF,MAAM,kBAAkB,GACtB,kQAAkQ,CAAC;AAErQ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA6C;IAC/E,SAAS,EAAE,mCAAmC,kBAAkB,EAAE;IAClE,IAAI,EAAE,QAAQ,kBAAkB,EAAE;CACnC,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AAC5C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC"}

package/dist/platform.d.ts

@@ -6,7 +6,7 @@
  * without depending on each other.
  */
 /** Default PocketBase sidecar image when PERCHER_POCKETBASE_IMAGE is unset. */
-export declare const DEFAULT_POCKETBASE_IMAGE = "percher/pocketbase:0.40.3-hardened.1";
+export declare const DEFAULT_POCKETBASE_IMAGE = "percher/pocketbase:0.40.5-hardened.1";
 /** Default app domain suffix when PERCHER_DOMAIN_SUFFIX is unset. */
 export declare const DEFAULT_DOMAIN_SUFFIX = "percher.run";
 /** Default hosted-MCP HTTP port when PERCHER_MCP_HTTP_PORT is unset. */

package/dist/platform.js

@@ -6,7 +6,7 @@
  * without depending on each other.
  */
 /** Default PocketBase sidecar image when PERCHER_POCKETBASE_IMAGE is unset. */
-export const DEFAULT_POCKETBASE_IMAGE = "percher/pocketbase:0.40.3-hardened.1";
+export const DEFAULT_POCKETBASE_IMAGE = "percher/pocketbase:0.40.5-hardened.1";
 /** Default app domain suffix when PERCHER_DOMAIN_SUFFIX is unset. */
 export const DEFAULT_DOMAIN_SUFFIX = "percher.run";
 /** Default hosted-MCP HTTP port when PERCHER_MCP_HTTP_PORT is unset. */

package/dist/switches.js

@@ -82,7 +82,7 @@ export const SWITCHES = [
     bool("PERCHER_CANARY_EDGE_KEEPS_LIVE", ["api"], "keep a deploy live when the canary failure was Percher's own edge", ONE, "enabled", ["0"]),
     bool("PERCHER_DRAIN_AT_SETTLEMENT", ["api"], "drain the predecessor at canary settlement instead of on a timer", ONE, "enabled", ["0"]),
     // Security scanning
-    bool("SECURITY_BLOCK_DEPLOY", ["api"], "block the swap on red scan findings instead of advising", TRUE),
+    bool("SECURITY_BLOCK_DEPLOY", ["api"], "require fresh image verification and block Critical or CISA KEV findings", TRUE),
     bool("SECURITY_AUTO_HOLD", ["api"], "runtime re-scan places red apps on security hold automatically", TRUE),
     {
         kind: "enum",

package/dist/switches.js.map

@@ -1 +1 @@
-{"version":3,"file":"switches.js","sourceRoot":"","sources":["../src/switches.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAsCH,MAAM,GAAG,GAAG,CAAC,GAAG,CAAU,CAAC;AAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAU,CAAC;AAC/B,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,CAAU,CAAC;AAE9C,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,mCAAmC;AACnC,MAAM,IAAI,GAAG,CACX,IAAY,EACZ,OAAgC,EAChC,OAAe,EACf,OAA0B,EAC1B,GAAG,GAA2B,UAAU,EACxC,QAAQ,GAAsB,aAAa,EAC5B,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE,SAAS;IACf,IAAI;IACJ,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO,EAAE,GAAG;CACb,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,QAAQ,GAA0B;IAC7C,iBAAiB;IACjB,IAAI,CACF,6BAA6B,EAC7B,CAAC,KAAK,CAAC,EACP,8GAA8G,EAC9G,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,KAAK,CAAC,EACP,4GAA4G,EAC5G,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IACD,IAAI,CACF,0BAA0B,EAC1B,CAAC,KAAK,CAAC,EACP,2DAA2D,EAC3D,GAAG,CACJ;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,QAAQ,CAAC,EACV,mHAAmH,EACnH,GAAG,CACJ;IAED,gCAAgC;IAChC,IAAI,CACF,0BAA0B,EAC1B,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjB,+FAA+F,EAC/F,IAAI,CACL;IACD,IAAI,CACF,iCAAiC,EACjC,CAAC,KAAK,CAAC,EACP,uEAAuE,EACvE,GAAG,CACJ;IACD,IAAI,CACF,0BAA0B,EAC1B,CAAC,KAAK,CAAC,EACP,sFAAsF,EACtF,GAAG,CACJ;IACD,IAAI,CACF,mCAAmC,EACnC,CAAC,KAAK,CAAC,EACP,qFAAqF,EACrF,GAAG,CACJ;IACD,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,kDAAkD,EAAE,GAAG,CAAC;IAC9F,IAAI,CACF,sBAAsB,EACtB,CAAC,KAAK,CAAC,EACP,kEAAkE,EAClE,GAAG,CACJ;IAED,qBAAqB;IACrB,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,CAAC,EACP,mFAAmF,EACnF,GAAG,CACJ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,0EAA0E;QACnF,MAAM,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;QAC3B,OAAO,EAAE,UAAU;KACpB;IACD,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,CAAC,EACP,qEAAqE,EACrE,IAAI,CACL;IACD,IAAI,CACF,kCAAkC,EAClC,CAAC,KAAK,CAAC,EACP,kEAAkE,EAClE,IAAI,CACL;IAED,+BAA+B;IAC/B,IAAI,CACF,oCAAoC,EACpC,CAAC,KAAK,CAAC,EACP,qDAAqD,EACrD,GAAG,CACJ;IACD,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,gCAAgC,EAAE,GAAG,CAAC;IAC5E,IAAI,CAAC,yBAAyB,EAAE,CAAC,KAAK,CAAC,EAAE,mCAAmC,EAAE,GAAG,CAAC;IAClF,IAAI,CACF,mCAAmC,EACnC,CAAC,KAAK,CAAC,EACP,qDAAqD,EACrD,GAAG,CACJ;IACD,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,CAAC,EACP,mEAAmE,EACnE,GAAG,CACJ;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,KAAK,CAAC,EACP,8DAA8D,EAC9D,GAAG,CACJ;IACD,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjB,yDAAyD,EACzD,GAAG,CACJ;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,KAAK,CAAC,EACP,qEAAqE,EACrE,GAAG,CACJ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,6EAA6E;QACtF,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;QAC/B,OAAO,EAAE,UAAU;KACpB;IAED,kBAAkB;IAClB,IAAI,CACF,8BAA8B,EAC9B,CAAC,KAAK,CAAC,EACP,kDAAkD,EAClD,IAAI,EACJ,SAAS,EACT,CAAC,OAAO,CAAC,CACV;IACD,IAAI,CACF,gCAAgC,EAChC,CAAC,KAAK,CAAC,EACP,mEAAmE,EACnE,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IACD,IAAI,CACF,6BAA6B,EAC7B,CAAC,KAAK,CAAC,EACP,kEAAkE,EAClE,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IAED,oBAAoB;IACpB,IAAI,CACF,uBAAuB,EACvB,CAAC,KAAK,CAAC,EACP,yDAAyD,EACzD,IAAI,CACL;IACD,IAAI,CACF,oBAAoB,EACpB,CAAC,KAAK,CAAC,EACP,gEAAgE,EAChE,IAAI,CACL;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,wDAAwD;QACjE,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;QACjC,OAAO,EAAE,KAAK;KACf;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,EAAE,4CAA4C,EAAE,IAAI,CAAC;IAEnF,YAAY;IACZ;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;QACpC,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,IAAI;KAChB;IACD,IAAI,CACF,yBAAyB,EACzB,CAAC,WAAW,CAAC,EACb,6DAA6D,EAC7D,GAAG,CACJ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,OAAO,EAAE,uCAAuC;KACjD;IACD,IAAI,CAAC,0BAA0B,EAAE,CAAC,WAAW,CAAC,EAAE,oCAAoC,EAAE,GAAG,CAAC;IAC1F,IAAI,CAAC,iCAAiC,EAAE,CAAC,WAAW,CAAC,EAAE,iCAAiC,EAAE,GAAG,CAAC;IAC9F,IAAI,CACF,gCAAgC,EAChC,CAAC,WAAW,CAAC,EACb,8EAA8E,EAC9E,GAAG,CACJ;IAED,mCAAmC;IACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,+BAA+B,EAAE,GAAG,CAAC;IAChF;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,gFAAgF;KAC1F;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,kEAAkE;KAC5E;IAED,4BAA4B;IAC5B,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnF,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,kDAAkD,EAAE,GAAG,CAAC;IAE7F,0BAA0B;IAC1B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,4CAA4C;QACrD,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,OAAO,EAAE,UAAU;KACpB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAoC,IAAI,GAAG,CACpE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACjC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,GAAuB;IACnE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC;IACpD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,UAAU,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,KAAK,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;QACD,KAAK,UAAU;YACb,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAID,SAAS,UAAU,CACjB,IAAY,EACZ,IAAO;IAEP,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,IAAI,SAAS,CAAC,CAAC;IACvF,OAAO,IAAwC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAQ;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;AACpC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAQ;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACnF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAuC,EACvC,MAAqB;IAErB,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACvD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QACvD,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,SAAS;YACrB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM;gBACpB,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAuC,EACvC,MAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,IAAI,KAAK,CACb,OAAO;SACJ,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,YAAY,MAAM,wBAAwB,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,0CAA0C;QACnH,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACpE,6BAA6B,CAAC,CAAC,QAAQ,IAAI,CAC9C;SACA,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;AACJ,CAAC"}
+{"version":3,"file":"switches.js","sourceRoot":"","sources":["../src/switches.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAsCH,MAAM,GAAG,GAAG,CAAC,GAAG,CAAU,CAAC;AAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAU,CAAC;AAC/B,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,CAAU,CAAC;AAE9C,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,mCAAmC;AACnC,MAAM,IAAI,GAAG,CACX,IAAY,EACZ,OAAgC,EAChC,OAAe,EACf,OAA0B,EAC1B,GAAG,GAA2B,UAAU,EACxC,QAAQ,GAAsB,aAAa,EAC5B,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE,SAAS;IACf,IAAI;IACJ,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO,EAAE,GAAG;CACb,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,QAAQ,GAA0B;IAC7C,iBAAiB;IACjB,IAAI,CACF,6BAA6B,EAC7B,CAAC,KAAK,CAAC,EACP,8GAA8G,EAC9G,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,KAAK,CAAC,EACP,4GAA4G,EAC5G,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IACD,IAAI,CACF,0BAA0B,EAC1B,CAAC,KAAK,CAAC,EACP,2DAA2D,EAC3D,GAAG,CACJ;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,QAAQ,CAAC,EACV,mHAAmH,EACnH,GAAG,CACJ;IAED,gCAAgC;IAChC,IAAI,CACF,0BAA0B,EAC1B,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjB,+FAA+F,EAC/F,IAAI,CACL;IACD,IAAI,CACF,iCAAiC,EACjC,CAAC,KAAK,CAAC,EACP,uEAAuE,EACvE,GAAG,CACJ;IACD,IAAI,CACF,0BAA0B,EAC1B,CAAC,KAAK,CAAC,EACP,sFAAsF,EACtF,GAAG,CACJ;IACD,IAAI,CACF,mCAAmC,EACnC,CAAC,KAAK,CAAC,EACP,qFAAqF,EACrF,GAAG,CACJ;IACD,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,kDAAkD,EAAE,GAAG,CAAC;IAC9F,IAAI,CACF,sBAAsB,EACtB,CAAC,KAAK,CAAC,EACP,kEAAkE,EAClE,GAAG,CACJ;IAED,qBAAqB;IACrB,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,CAAC,EACP,mFAAmF,EACnF,GAAG,CACJ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,0EAA0E;QACnF,MAAM,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;QAC3B,OAAO,EAAE,UAAU;KACpB;IACD,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,CAAC,EACP,qEAAqE,EACrE,IAAI,CACL;IACD,IAAI,CACF,kCAAkC,EAClC,CAAC,KAAK,CAAC,EACP,kEAAkE,EAClE,IAAI,CACL;IAED,+BAA+B;IAC/B,IAAI,CACF,oCAAoC,EACpC,CAAC,KAAK,CAAC,EACP,qDAAqD,EACrD,GAAG,CACJ;IACD,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,gCAAgC,EAAE,GAAG,CAAC;IAC5E,IAAI,CAAC,yBAAyB,EAAE,CAAC,KAAK,CAAC,EAAE,mCAAmC,EAAE,GAAG,CAAC;IAClF,IAAI,CACF,mCAAmC,EACnC,CAAC,KAAK,CAAC,EACP,qDAAqD,EACrD,GAAG,CACJ;IACD,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,CAAC,EACP,mEAAmE,EACnE,GAAG,CACJ;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,KAAK,CAAC,EACP,8DAA8D,EAC9D,GAAG,CACJ;IACD,IAAI,CACF,4BAA4B,EAC5B,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjB,yDAAyD,EACzD,GAAG,CACJ;IACD,IAAI,CACF,+BAA+B,EAC/B,CAAC,KAAK,CAAC,EACP,qEAAqE,EACrE,GAAG,CACJ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,6EAA6E;QACtF,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;QAC/B,OAAO,EAAE,UAAU;KACpB;IAED,kBAAkB;IAClB,IAAI,CACF,8BAA8B,EAC9B,CAAC,KAAK,CAAC,EACP,kDAAkD,EAClD,IAAI,EACJ,SAAS,EACT,CAAC,OAAO,CAAC,CACV;IACD,IAAI,CACF,gCAAgC,EAChC,CAAC,KAAK,CAAC,EACP,mEAAmE,EACnE,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IACD,IAAI,CACF,6BAA6B,EAC7B,CAAC,KAAK,CAAC,EACP,kEAAkE,EAClE,GAAG,EACH,SAAS,EACT,CAAC,GAAG,CAAC,CACN;IAED,oBAAoB;IACpB,IAAI,CACF,uBAAuB,EACvB,CAAC,KAAK,CAAC,EACP,0EAA0E,EAC1E,IAAI,CACL;IACD,IAAI,CACF,oBAAoB,EACpB,CAAC,KAAK,CAAC,EACP,gEAAgE,EAChE,IAAI,CACL;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,wDAAwD;QACjE,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;QACjC,OAAO,EAAE,KAAK;KACf;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,EAAE,4CAA4C,EAAE,IAAI,CAAC;IAEnF,YAAY;IACZ;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;QACpC,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,IAAI;KAChB;IACD,IAAI,CACF,yBAAyB,EACzB,CAAC,WAAW,CAAC,EACb,6DAA6D,EAC7D,GAAG,CACJ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,OAAO,EAAE,uCAAuC;KACjD;IACD,IAAI,CAAC,0BAA0B,EAAE,CAAC,WAAW,CAAC,EAAE,oCAAoC,EAAE,GAAG,CAAC;IAC1F,IAAI,CAAC,iCAAiC,EAAE,CAAC,WAAW,CAAC,EAAE,iCAAiC,EAAE,GAAG,CAAC;IAC9F,IAAI,CACF,gCAAgC,EAChC,CAAC,WAAW,CAAC,EACb,8EAA8E,EAC9E,GAAG,CACJ;IAED,mCAAmC;IACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,+BAA+B,EAAE,GAAG,CAAC;IAChF;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,gFAAgF;KAC1F;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,kEAAkE;KAC5E;IAED,4BAA4B;IAC5B,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnF,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,kDAAkD,EAAE,GAAG,CAAC;IAE7F,0BAA0B;IAC1B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,4CAA4C;QACrD,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,OAAO,EAAE,UAAU;KACpB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAoC,IAAI,GAAG,CACpE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACjC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,GAAuB;IACnE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC;IACpD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,UAAU,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,KAAK,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;QACD,KAAK,UAAU;YACb,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAID,SAAS,UAAU,CACjB,IAAY,EACZ,IAAO;IAEP,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,IAAI,SAAS,CAAC,CAAC;IACvF,OAAO,IAAwC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAQ;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;AACpC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAQ;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACnF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAuC,EACvC,MAAqB;IAErB,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACvD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QACvD,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,SAAS;YACrB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM;gBACpB,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAuC,EACvC,MAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,IAAI,KAAK,CACb,OAAO;SACJ,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,YAAY,MAAM,wBAAwB,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,0CAA0C;QACnH,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACpE,6BAA6B,CAAC,CAAC,QAAQ,IAAI,CAC9C;SACA,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;AACJ,CAAC"}

package/dist/verified-signup.d.ts

@@ -0,0 +1,24 @@
+export interface SignupQuotaConnection {
+    run(query: string, params?: (string | number | null)[]): void;
+    get<T>(query: string, params?: (string | number | null)[]): T | undefined;
+}
+export declare class VerifiedSignupLimitError extends Error {
+    readonly code = "DAILY_CAP";
+    constructor();
+}
+/** Distinct namespace: historical pending-account totals remain unchanged. */
+export declare function verifiedSignupQuota(db: SignupQuotaConnection, now?: Date): {
+    day: string;
+    count: number;
+    limit: number | null;
+    remaining: number | null;
+    resetAt: number;
+};
+/** Caller holds an immediate transaction covering this charge and verification. */
+export declare function chargeVerifiedSignup(db: SignupQuotaConnection, now?: Date): void;
+/** One-time upgrade repair. Caller holds the same writer transaction as admission.
+ * Snapshot pre-existing identity-bound proof before any new verification write.
+ * Absent dashboard schema is not a completed cutover. Invalid schema must fail.
+ */
+export declare function initializeVerifiedSignupCutover(db: SignupQuotaConnection, now: Date): void;
+//# sourceMappingURL=verified-signup.d.ts.map

package/dist/verified-signup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-signup.d.ts","sourceRoot":"","sources":["../src/verified-signup.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IAC9D,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;CAC3E;AACD,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,eAAe;IAC5B,cAIC;CACF;AACD,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,qBAAqB,EAAE,GAAG,OAAa;;;;;;EAyB9E;AACD,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,qBAAqB,EAAE,GAAG,OAAa,QAY/E;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,qBAAqB,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAwB1F"}

package/dist/verified-signup.js

@@ -0,0 +1,58 @@
+import { signupDayWindow } from "./signup-day.js";
+export class VerifiedSignupLimitError extends Error {
+    code = "DAILY_CAP";
+    constructor() {
+        super("Today's registration quota is full. Try this link again tomorrow; request a new verification email if it has expired.");
+    }
+}
+/** Distinct namespace: historical pending-account totals remain unchanged. */
+export function verifiedSignupQuota(db, now = new Date()) {
+    const { day, startMs, endMs } = signupDayWindow(now);
+    const key = `verified:${day}`;
+    const stored = db.get("SELECT count FROM signup_daily_registrations WHERE day = ?", [key]);
+    const count = stored?.count ??
+        db.get("SELECT COUNT(*) AS count FROM users WHERE email_verified_at >= ? AND email_verified_at < ?", [Math.floor(startMs / 1000), Math.floor(endMs / 1000)])?.count ??
+        0;
+    const raw = db.get("SELECT value FROM platform_flags WHERE key = 'signup_daily_cap'")?.value;
+    const limit = raw && /^\d{1,9}$/.test(raw) && Number(raw) > 0 ? Number(raw) : null;
+    return {
+        day,
+        count,
+        limit,
+        remaining: limit === null ? null : Math.max(0, limit - count),
+        resetAt: endMs,
+    };
+}
+/** Caller holds an immediate transaction covering this charge and verification. */
+export function chargeVerifiedSignup(db, now = new Date()) {
+    const quota = verifiedSignupQuota(db, now);
+    const key = `verified:${quota.day}`;
+    db.run("INSERT INTO signup_daily_registrations(day,count) VALUES(?,?) ON CONFLICT(day) DO NOTHING", [key, quota.count]);
+    const charged = db.get("UPDATE signup_daily_registrations SET count=count+1 WHERE day=? AND (? IS NULL OR count < ?) RETURNING day", [key, quota.limit, quota.limit]);
+    if (!charged)
+        throw new VerifiedSignupLimitError();
+}
+/** One-time upgrade repair. Caller holds the same writer transaction as admission.
+ * Snapshot pre-existing identity-bound proof before any new verification write.
+ * Absent dashboard schema is not a completed cutover. Invalid schema must fail.
+ */
+export function initializeVerifiedSignupCutover(db, now) {
+    const marker = "verified_signup_cutover_v1";
+    if (db.get("SELECT value FROM platform_flags WHERE key=?", [marker]))
+        return;
+    if (!db.get("SELECT name FROM sqlite_master WHERE type='table' AND name='auth_user'"))
+        return;
+    db.get("SELECT id,email,percher_user_id,email_verified FROM auth_user LIMIT 0");
+    const quota = verifiedSignupQuota(db, now);
+    const key = `verified:${quota.day}`;
+    db.run("INSERT INTO signup_daily_registrations(day,count) VALUES(?,?) ON CONFLICT(day) DO NOTHING", [key, quota.count]);
+    const predicate = "email_verified_at IS NULL AND status!='deleting' AND EXISTS (SELECT 1 FROM auth_user a WHERE a.percher_user_id=users.id AND lower(a.email)=lower(users.email) AND a.email_verified=1)";
+    const repaired = db.get(`SELECT COUNT(*) AS count FROM users WHERE ${predicate}`)?.count ?? 0;
+    db.run(`UPDATE users SET email_verified_at=?,status=CASE WHEN status='pending' AND accepted_terms_at IS NOT NULL THEN 'active' ELSE status END WHERE ${predicate}`, [Math.floor(now.getTime() / 1000)]);
+    db.run("INSERT INTO platform_flags(key,value,updated_at) VALUES(?,?,?)", [
+        marker,
+        JSON.stringify({ version: 1, at: now.getTime(), repaired }),
+        Math.floor(now.getTime() / 1000),
+    ]);
+}
+//# sourceMappingURL=verified-signup.js.map

package/dist/verified-signup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-signup.js","sourceRoot":"","sources":["../src/verified-signup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAM/C,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,WAAW,CAAC;IAC5B;QACE,KAAK,CACH,uHAAuH,CACxH,CAAC;IACJ,CAAC;CACF;AACD,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,EAAyB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC7E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,YAAY,GAAG,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB,4DAA4D,EAC5D,CAAC,GAAG,CAAC,CACN,CAAC;IACF,MAAM,KAAK,GACT,MAAM,EAAE,KAAK;QACb,EAAE,CAAC,GAAG,CACJ,4FAA4F,EAC5F,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CACvD,EAAE,KAAK;QACR,CAAC,CAAC;IACJ,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAChB,iEAAiE,CAClE,EAAE,KAAK,CAAC;IACT,MAAM,KAAK,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,OAAO;QACL,GAAG;QACH,KAAK;QACL,KAAK;QACL,SAAS,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;QAC7D,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AACD,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,EAAyB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC9E,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,GAAG,EAAE,CAAC;IACpC,EAAE,CAAC,GAAG,CACJ,2FAA2F,EAC3F,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CACnB,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CACpB,4GAA4G,EAC5G,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAChC,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,EAAyB,EAAE,GAAS;IAClF,MAAM,MAAM,GAAG,4BAA4B,CAAC;IAC5C,IAAI,EAAE,CAAC,GAAG,CAAC,8CAA8C,EAAE,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO;IAC7E,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,wEAAwE,CAAC;QAAE,OAAO;IAC9F,EAAE,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,GAAG,EAAE,CAAC;IACpC,EAAE,CAAC,GAAG,CACJ,2FAA2F,EAC3F,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CACnB,CAAC;IACF,MAAM,SAAS,GACb,uLAAuL,CAAC;IAC1L,MAAM,QAAQ,GACZ,EAAE,CAAC,GAAG,CAAoB,6CAA6C,SAAS,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IAClG,EAAE,CAAC,GAAG,CACJ,gJAAgJ,SAAS,EAAE,EAC3J,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CACnC,CAAC;IACF,EAAE,CAAC,GAAG,CAAC,gEAAgE,EAAE;QACvE,MAAM;QACN,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;KACjC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@percher/shared",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Shared constants and contracts (timeouts, etc.) used across the Percher CLI, API, MCP, and worker. Internal — values change in lockstep across packages.",
   "type": "module",
   "main": "./dist/index.js",