@rexezuge/shared 0.0.0-stage → 1.0.1

package/dist/EmailUtil.js

@@ -0,0 +1,31 @@
+import { isValidEmailFormat, MAX_EMAIL_LENGTH } from './Identity';
+/**
+ * Email address value helpers.
+ *
+ * ## Provenance
+ *
+ * Converged from Durable-DAV's `EmailUtil.ts` (a shape check) and Mail-Meow's
+ * `EmailUtil.ts` (address normalization). Durable-DAV's predicate `isValidEmailFormat`
+ * canonically lives in `Identity.ts` — the wider group's home, and the stricter
+ * of the two regexes found (see the merge note there) — and is re-exported here
+ * so `EmailUtil` is the one-stop surface for validation + normalization.
+ *
+ * `normalizeEmail` comes from Mail-Meow, whose header records why a single
+ * normalization rule is a correctness concern, not a cosmetic one: "This function
+ * used to exist four times, and the copies disagreed." One copy trimmed and
+ * lowercased, the others lowercased only, so `"  Alice@Example.com "` and
+ * `"alice@example.com"` were the same account to one layer and different accounts
+ * to another — a different account key on each side of a boundary, and a stored
+ * registry row that its own service could not resolve.
+ *
+ * ## Design decision
+ *
+ * The kit keeps `normalizeEmail` and re-exports the validator; it does not
+ * re-introduce Edge-Git's `EmailAddress` value class, which is sugar over the
+ * same trim+lowercase and would be a second spelling of the same rule.
+ */
+function normalizeEmail(email) {
+    return email.trim().toLowerCase();
+}
+export { normalizeEmail, isValidEmailFormat, MAX_EMAIL_LENGTH };
+//# sourceMappingURL=EmailUtil.js.map

package/dist/EmailUtil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailUtil.js","sourceRoot":"","sources":["../src/EmailUtil.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/ErrorSanitizationUtil.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Secret-safe error/log sanitization (Layer 0).
+ *
+ * ## Provenance
+ *
+ * Converged from `ErrorSanitizationUtil.ts` in Durable-DAV, Durable-DAV-Router,
+ * Edge-Git, Edge-Sonic, Mail-Meow and Mail-Otter. All six redact the same secret
+ * shapes (Bearer/Basic headers, token and secret key=value pairs, query-string
+ * tokens, JWTs, Google OAuth tokens) and differ only in which extras they add:
+ *
+ * - Durable-DAV, Edge-Git, Durable-DAV-Router and Edge-Sonic also redact a
+ *   repo-specific personal-access-token scheme (`<repo>-pat:<token>`), sanitize
+ *   the **stack** as well as the message, and expose `stackForLog`.
+ * - Mail-Meow and Mail-Otter omit all three and return `name: <redacted message>`
+ *   without a stack.
+ *
+ * ## Design decisions
+ *
+ * - **Stack sanitization is kept.** A stack trace repeats the error message and
+ *   can name the very secret the message carries, so redacting the message but
+ *   logging the raw stack — which Mail-Meow/Mail-Otter effectively do — is a
+ *   one-line leak. This is the stricter of the two shapes, so it is the one kept.
+ *   `stackForLog` stays for the structured-log payload path.
+ * - **The PAT scheme is generalized, not dropped and not repo-hardcoded.** Four
+ *   repos each added their own `durable-dav-pat:` / `edge-git-pat:` /
+ *   `durable-dav-router-pat:` / `edge-sonic-pat:` literal. Hard-coding those
+ *   prefixes here would leak five repo identities into a shared package; dropping
+ *   the class would undo a safeguard four of six repos independently judged
+ *   necessary. The converged form is one generic `<word>-pat:<token>` pattern
+ *   that covers every repo's scheme without naming any.
+ * - **Two correctness lessons from Mail-Otter's header are preserved in code and
+ *   comment.** `\bbearer`/`\bbasic` keep the leading word boundary — without it
+ *   the pattern parsed as "word boundary, then the literal `earer`", matched
+ *   nothing, and Authorization headers leaked verbatim while the suite stayed
+ *   green only because a Google token in the sample was caught elsewhere. And the
+ *   `SECRET_KV` set takes Mail-Meow's superset (`client_id`, bare `code`) over the
+ *   narrower alternatives.
+ */
+declare class ErrorSanitizationUtil {
+    /**
+     * Redact every recognizable secret shape from a single string.
+     *
+     * Replacements are inline string literals (not variables or templates) so a
+     * `unicorn/no-unsafe-string-replacement`-style rule is satisfied and so CodeQL
+     * models each `.replaceAll(regex, literal)` as a `js/clear-text-logging` masking
+     * barrier. Order matters only in that the PAT scheme runs first; the rest are
+     * disjoint.
+     */
+    static sanitizeMessage(message: string): string;
+    /**
+     * A redacted `name: message` (and stack) for a plain log line.
+     *
+     * Both the message and the stack are sanitized — see the header for why the
+     * stack must be.
+     */
+    static sanitizeErrorForLogging(error: unknown): string;
+    /**
+     * A redacted error, for a structured log payload.
+     *
+     * `error instanceof Error ? (error.stack ?? error.message) : error` was written
+     * out at many call sites, and every one of them bypassed the redaction above —
+     * so an error whose message carried a credential would be logged in the clear. A
+     * logging helper that only redacts when the caller remembers to call it is not a
+     * redaction boundary; this is the single point every payload goes through.
+     */
+    static stackForLog(error: unknown): unknown;
+}
+export { ErrorSanitizationUtil };
+//# sourceMappingURL=ErrorSanitizationUtil.d.ts.map

package/dist/ErrorSanitizationUtil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ErrorSanitizationUtil.d.ts","sourceRoot":"","sources":["../src/ErrorSanitizationUtil.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAaH,cAAM,qBAAqB;IACzB;;;;;;;;OAQG;WACW,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAYtD;;;;;OAKG;WACW,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAS7D;;;;;;;;OAQG;WACW,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CAGnD;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/ErrorSanitizationUtil.js

@@ -0,0 +1,98 @@
+/**
+ * Secret-safe error/log sanitization (Layer 0).
+ *
+ * ## Provenance
+ *
+ * Converged from `ErrorSanitizationUtil.ts` in Durable-DAV, Durable-DAV-Router,
+ * Edge-Git, Edge-Sonic, Mail-Meow and Mail-Otter. All six redact the same secret
+ * shapes (Bearer/Basic headers, token and secret key=value pairs, query-string
+ * tokens, JWTs, Google OAuth tokens) and differ only in which extras they add:
+ *
+ * - Durable-DAV, Edge-Git, Durable-DAV-Router and Edge-Sonic also redact a
+ *   repo-specific personal-access-token scheme (`<repo>-pat:<token>`), sanitize
+ *   the **stack** as well as the message, and expose `stackForLog`.
+ * - Mail-Meow and Mail-Otter omit all three and return `name: <redacted message>`
+ *   without a stack.
+ *
+ * ## Design decisions
+ *
+ * - **Stack sanitization is kept.** A stack trace repeats the error message and
+ *   can name the very secret the message carries, so redacting the message but
+ *   logging the raw stack — which Mail-Meow/Mail-Otter effectively do — is a
+ *   one-line leak. This is the stricter of the two shapes, so it is the one kept.
+ *   `stackForLog` stays for the structured-log payload path.
+ * - **The PAT scheme is generalized, not dropped and not repo-hardcoded.** Four
+ *   repos each added their own `durable-dav-pat:` / `edge-git-pat:` /
+ *   `durable-dav-router-pat:` / `edge-sonic-pat:` literal. Hard-coding those
+ *   prefixes here would leak five repo identities into a shared package; dropping
+ *   the class would undo a safeguard four of six repos independently judged
+ *   necessary. The converged form is one generic `<word>-pat:<token>` pattern
+ *   that covers every repo's scheme without naming any.
+ * - **Two correctness lessons from Mail-Otter's header are preserved in code and
+ *   comment.** `\bbearer`/`\bbasic` keep the leading word boundary — without it
+ *   the pattern parsed as "word boundary, then the literal `earer`", matched
+ *   nothing, and Authorization headers leaked verbatim while the suite stayed
+ *   green only because a Google token in the sample was caught elsewhere. And the
+ *   `SECRET_KV` set takes Mail-Meow's superset (`client_id`, bare `code`) over the
+ *   narrower alternatives.
+ */
+const BEARER_PATTERN = /\bbearer\s+\S+/gi;
+const BASIC_PATTERN = /\bbasic\s+\S+/gi;
+// Any repo's personal-access-token scheme: `<something>-pat:<token>`. Generic on
+// purpose — see the header — so no specific repo's prefix is baked in.
+const PAT_PATTERN = /\b[\w-]+-pat:[\w-]+/gi;
+const TOKEN_KV_PATTERN = /((?:access|refresh|id)[_-]?token\s*[:=]\s*).\S*/gi;
+const SECRET_KV_PATTERN = /((?:client[_-]?secret|client[_-]?id|auth[_-]?code|code[_-]?verifier|\bcode)\s*[:=]\s*).\S*/gi;
+const TOKEN_QUERY_PATTERN = /([?&](?:access_token|refresh_token|code|client_secret)=).[^&\s;}]*/gi;
+const JWT_PATTERN = /eyJ[\w-].+[\w-].+[\w./+=~-]/g;
+const GOOGLE_TOKEN_PATTERN = /ya29..[\w.-]+/g;
+class ErrorSanitizationUtil {
+    /**
+     * Redact every recognizable secret shape from a single string.
+     *
+     * Replacements are inline string literals (not variables or templates) so a
+     * `unicorn/no-unsafe-string-replacement`-style rule is satisfied and so CodeQL
+     * models each `.replaceAll(regex, literal)` as a `js/clear-text-logging` masking
+     * barrier. Order matters only in that the PAT scheme runs first; the rest are
+     * disjoint.
+     */
+    static sanitizeMessage(message) {
+        return message
+            .replaceAll(PAT_PATTERN, '[REDACTED-PAT]')
+            .replaceAll(BEARER_PATTERN, 'Bearer [REDACTED]')
+            .replaceAll(BASIC_PATTERN, 'Basic [REDACTED]')
+            .replaceAll(TOKEN_KV_PATTERN, '$1[REDACTED]')
+            .replaceAll(SECRET_KV_PATTERN, '$1[REDACTED]')
+            .replaceAll(TOKEN_QUERY_PATTERN, '$1[REDACTED]')
+            .replaceAll(JWT_PATTERN, '[REDACTED-JWT]')
+            .replaceAll(GOOGLE_TOKEN_PATTERN, '[REDACTED]');
+    }
+    /**
+     * A redacted `name: message` (and stack) for a plain log line.
+     *
+     * Both the message and the stack are sanitized — see the header for why the
+     * stack must be.
+     */
+    static sanitizeErrorForLogging(error) {
+        if (error instanceof Error) {
+            const redacted = this.sanitizeMessage(error.message);
+            const stack = error.stack ? `\n${this.sanitizeMessage(error.stack)}` : '';
+            return `${error.name}: ${redacted}${stack}`;
+        }
+        return this.sanitizeMessage(String(error));
+    }
+    /**
+     * A redacted error, for a structured log payload.
+     *
+     * `error instanceof Error ? (error.stack ?? error.message) : error` was written
+     * out at many call sites, and every one of them bypassed the redaction above —
+     * so an error whose message carried a credential would be logged in the clear. A
+     * logging helper that only redacts when the caller remembers to call it is not a
+     * redaction boundary; this is the single point every payload goes through.
+     */
+    static stackForLog(error) {
+        return this.sanitizeErrorForLogging(error);
+    }
+}
+export { ErrorSanitizationUtil };
+//# sourceMappingURL=ErrorSanitizationUtil.js.map

package/dist/ErrorSanitizationUtil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ErrorSanitizationUtil.js","sourceRoot":"","sources":["../src/ErrorSanitizationUtil.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,iFAAiF;AACjF,uEAAuE;AACvE,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAC5C,MAAM,gBAAgB,GAAG,mDAAmD,CAAC;AAC7E,MAAM,iBAAiB,GAAG,8FAA8F,CAAC;AACzH,MAAM,mBAAmB,GAAG,sEAAsE,CAAC;AACnG,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C,MAAM,qBAAqB;IACzB;;;;;;;;OAQG;IACI,MAAM,CAAC,eAAe,CAAC,OAAe;QAC3C,OAAO,OAAO;aACX,UAAU,CAAC,WAAW,EAAE,gBAAgB,CAAC;aACzC,UAAU,CAAC,cAAc,EAAE,mBAAmB,CAAC;aAC/C,UAAU,CAAC,aAAa,EAAE,kBAAkB,CAAC;aAC7C,UAAU,CAAC,gBAAgB,EAAE,cAAc,CAAC;aAC5C,UAAU,CAAC,iBAAiB,EAAE,cAAc,CAAC;aAC7C,UAAU,CAAC,mBAAmB,EAAE,cAAc,CAAC;aAC/C,UAAU,CAAC,WAAW,EAAE,gBAAgB,CAAC;aACzC,UAAU,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,uBAAuB,CAAC,KAAc;QAClD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,GAAG,KAAK,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/IdGenerator.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Identifiers behind an interface, so ids can be pinned in a test.
+ *
+ * ## Provenance
+ *
+ * Taken from ChordDHT-Tracker's `IdGenerator.ts` — the only repo that factored
+ * id generation behind a seam. `CryptoIdGenerator` is the production path (one
+ * `crypto.randomUUID`), `FixedIdGenerator` is the test double that replays a
+ * queued set and then synthesizes deterministic stand-ins so a test can assert
+ * on the exact ids a code path produced.
+ */
+interface IdGenerator {
+    randomUUID(): string;
+}
+declare class CryptoIdGenerator implements IdGenerator {
+    randomUUID(): string;
+}
+declare class FixedIdGenerator implements IdGenerator {
+    private readonly queue;
+    private counter;
+    constructor(ids?: string | string[]);
+    queueId(id: string): void;
+    randomUUID(): string;
+}
+export { CryptoIdGenerator, FixedIdGenerator };
+export type { IdGenerator };
+//# sourceMappingURL=IdGenerator.d.ts.map

package/dist/IdGenerator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdGenerator.d.ts","sourceRoot":"","sources":["../src/IdGenerator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,UAAU,WAAW;IACnB,UAAU,IAAI,MAAM,CAAC;CACtB;AAED,cAAM,iBAAkB,YAAW,WAAW;IACrC,UAAU,IAAI,MAAM;CAG5B;AAED,cAAM,gBAAiB,YAAW,WAAW;IAC3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,OAAO,CAAK;gBAER,GAAG,GAAE,MAAM,GAAG,MAAM,EAAO;IAOhC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIzB,UAAU,IAAI,MAAM;CAM5B;AAED,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/IdGenerator.js

@@ -0,0 +1,28 @@
+class CryptoIdGenerator {
+    randomUUID() {
+        return crypto.randomUUID();
+    }
+}
+class FixedIdGenerator {
+    queue = [];
+    counter = 0;
+    constructor(ids = []) {
+        const initial = Array.isArray(ids) ? ids : [ids];
+        for (const id of initial) {
+            if (id)
+                this.queue.push(id);
+        }
+    }
+    queueId(id) {
+        this.queue.push(id);
+    }
+    randomUUID() {
+        const next = this.queue.shift();
+        if (next !== undefined)
+            return next;
+        this.counter += 1;
+        return `fixed-uuid-${this.counter.toString()}`;
+    }
+}
+export { CryptoIdGenerator, FixedIdGenerator };
+//# sourceMappingURL=IdGenerator.js.map

package/dist/IdGenerator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdGenerator.js","sourceRoot":"","sources":["../src/IdGenerator.ts"],"names":[],"mappings":"AAeA,MAAM,iBAAiB;IACd,UAAU;QACf,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,gBAAgB;IACH,KAAK,GAAa,EAAE,CAAC;IAC9B,OAAO,GAAG,CAAC,CAAC;IAEpB,YAAY,MAAyB,EAAE;QACrC,MAAM,OAAO,GAAa,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,EAAE;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEM,OAAO,CAAC,EAAU;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IAEM,UAAU;QACf,MAAM,IAAI,GAAuB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,OAAO,cAAc,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;IACjD,CAAC;CACF;AAED,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/Identity.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Identity-string well-formedness (Layer 0).
+ *
+ * ## Provenance
+ *
+ * Converged from Durable-DAV-Router's, Edge-Git's and Edge-Sonic's
+ * `Identity.ts`. Router and Edge-Sonic are byte-identical and hold exactly one
+ * helper — `isValidEmailFormat` — described as "a cheap sanity check on an
+ * identity the service did not choose". Edge-Git's is larger: the same predicate
+ * plus an `EmailAddress` value object and a `RepoFullName`/`repoDoKey` pair. The
+ * value object duplicates `normalizeEmail` (see `EmailUtil.ts`); the
+ * `owner/name` repo identifier, `.git`-stripping and Durable-Object key helpers
+ * are **git business logic and are left local** — they are the same kind of
+ * repo-specific concern as `GitOids`/`BranchValidation`.
+ *
+ * ## Design decision
+ *
+ * This file is the definitional home of `isValidEmailFormat` because that is what
+ * the wider group (Router, Edge-Sonic, Edge-Git) file under "Identity". Two
+ * regexes circulated for the same predicate: Durable-DAV's
+ * `/^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/` and the Router/Edge-Git/Sonic
+ * `/^[^@\s]+@[^\s@][^\s.@]*\.[^\s@]+$/`. Durable-DAV's is the **stricter** one —
+ * it rejects a leading dot in the domain (`a@.b.c`) and consecutive dots, which
+ * the other admits — so per the kit rule the stricter form is kept. `EmailUtil`
+ * re-exports the predicate so the whole email surface is one import.
+ *
+ * Deliberately permissive about the local part (RFC 5322 allows far more than
+ * this) and strict about the obvious mistakes: no whitespace, exactly one `@`,
+ * a dot-separated domain, and a bounded total length. It is a shape check, not a
+ * deliverability check — the authoritative validation is the identity provider.
+ */
+declare const EMAIL_FORMAT_RE: RegExp;
+declare const MAX_EMAIL_LENGTH = 254;
+declare function isValidEmailFormat(raw: string): boolean;
+export { isValidEmailFormat, MAX_EMAIL_LENGTH, EMAIL_FORMAT_RE };
+//# sourceMappingURL=Identity.d.ts.map

package/dist/Identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identity.d.ts","sourceRoot":"","sources":["../src/Identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,QAAA,MAAM,eAAe,QAAsC,CAAC;AAE5D,QAAA,MAAM,gBAAgB,MAAM,CAAC;AAE7B,iBAAS,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGhD;AAED,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC"}

package/dist/Identity.js

@@ -0,0 +1,39 @@
+/**
+ * Identity-string well-formedness (Layer 0).
+ *
+ * ## Provenance
+ *
+ * Converged from Durable-DAV-Router's, Edge-Git's and Edge-Sonic's
+ * `Identity.ts`. Router and Edge-Sonic are byte-identical and hold exactly one
+ * helper — `isValidEmailFormat` — described as "a cheap sanity check on an
+ * identity the service did not choose". Edge-Git's is larger: the same predicate
+ * plus an `EmailAddress` value object and a `RepoFullName`/`repoDoKey` pair. The
+ * value object duplicates `normalizeEmail` (see `EmailUtil.ts`); the
+ * `owner/name` repo identifier, `.git`-stripping and Durable-Object key helpers
+ * are **git business logic and are left local** — they are the same kind of
+ * repo-specific concern as `GitOids`/`BranchValidation`.
+ *
+ * ## Design decision
+ *
+ * This file is the definitional home of `isValidEmailFormat` because that is what
+ * the wider group (Router, Edge-Sonic, Edge-Git) file under "Identity". Two
+ * regexes circulated for the same predicate: Durable-DAV's
+ * `/^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/` and the Router/Edge-Git/Sonic
+ * `/^[^@\s]+@[^\s@][^\s.@]*\.[^\s@]+$/`. Durable-DAV's is the **stricter** one —
+ * it rejects a leading dot in the domain (`a@.b.c`) and consecutive dots, which
+ * the other admits — so per the kit rule the stricter form is kept. `EmailUtil`
+ * re-exports the predicate so the whole email surface is one import.
+ *
+ * Deliberately permissive about the local part (RFC 5322 allows far more than
+ * this) and strict about the obvious mistakes: no whitespace, exactly one `@`,
+ * a dot-separated domain, and a bounded total length. It is a shape check, not a
+ * deliverability check — the authoritative validation is the identity provider.
+ */
+const EMAIL_FORMAT_RE = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/;
+const MAX_EMAIL_LENGTH = 254;
+function isValidEmailFormat(raw) {
+    const trimmed = raw.trim();
+    return trimmed !== '' && trimmed.length <= MAX_EMAIL_LENGTH && EMAIL_FORMAT_RE.test(trimmed);
+}
+export { isValidEmailFormat, MAX_EMAIL_LENGTH, EMAIL_FORMAT_RE };
+//# sourceMappingURL=Identity.js.map

package/dist/Identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identity.js","sourceRoot":"","sources":["../src/Identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,gBAAgB,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/F,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC"}

package/dist/LanguageTag.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Single canonical language-tag implementation for backend + web.
+ *
+ * ## Provenance
+ *
+ * Converged from Durable-DAV-Router's `LanguageTag.ts` and Edge-Git's
+ * `LanguageTag.ts`. The two are byte-identical — both were written to replace
+ * the older `canonicalizeBackendLocaleTag` (shared) / `canonicalizeTag` (web
+ * `i18n.ts`) split, which had drifted. Edge-Sonic has no such file (its web layer
+ * uses the shared one directly), so it contributes nothing here beyond confirming
+ * the shape.
+ *
+ * Import from here in both layers. This is generic BCP-47 casing, distinct from
+ * `LocaleUtil`'s `canonicalizeLocaleTag`, which additionally titlecases a
+ * four-letter script subtag for locale negotiation against a fixed table.
+ */
+declare function canonicalizeLanguageTag(tag: string): string;
+/**
+ * A BCP-47 language tag, canonicalized: `zh_TW`, `zh-tw`, and `zh-TW` all
+ * canonicalize to `zh-TW`.
+ */
+type LanguageTag = string;
+export { canonicalizeLanguageTag };
+export type { LanguageTag };
+//# sourceMappingURL=LanguageTag.d.ts.map

package/dist/LanguageTag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LanguageTag.d.ts","sourceRoot":"","sources":["../src/LanguageTag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,iBAAS,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQpD;AAED;;;GAGG;AACH,KAAK,WAAW,GAAG,MAAM,CAAC;AAE1B,OAAO,EAAE,uBAAuB,EAAE,CAAC;AACnC,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/LanguageTag.js

@@ -0,0 +1,29 @@
+/**
+ * Single canonical language-tag implementation for backend + web.
+ *
+ * ## Provenance
+ *
+ * Converged from Durable-DAV-Router's `LanguageTag.ts` and Edge-Git's
+ * `LanguageTag.ts`. The two are byte-identical — both were written to replace
+ * the older `canonicalizeBackendLocaleTag` (shared) / `canonicalizeTag` (web
+ * `i18n.ts`) split, which had drifted. Edge-Sonic has no such file (its web layer
+ * uses the shared one directly), so it contributes nothing here beyond confirming
+ * the shape.
+ *
+ * Import from here in both layers. This is generic BCP-47 casing, distinct from
+ * `LocaleUtil`'s `canonicalizeLocaleTag`, which additionally titlecases a
+ * four-letter script subtag for locale negotiation against a fixed table.
+ */
+function canonicalizeLanguageTag(tag) {
+    const normalized = tag.trim().replaceAll('_', '-');
+    const parts = normalized.split('-').filter(Boolean);
+    if (parts.length === 0)
+        return 'en';
+    const language = (parts[0] ?? 'en').toLowerCase();
+    if (parts.length === 1)
+        return language;
+    const rest = parts.slice(1).map((part) => (part.length === 2 ? part.toUpperCase() : part.toLowerCase()));
+    return [language, ...rest].join('-');
+}
+export { canonicalizeLanguageTag };
+//# sourceMappingURL=LanguageTag.js.map

package/dist/LanguageTag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LanguageTag.js","sourceRoot":"","sources":["../src/LanguageTag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAQD,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/LocaleUtil.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Locale negotiation against a fixed support table.
+ *
+ * ## Provenance
+ *
+ * Converged from AWS-AccessBridge's, Mail-Meow's and Mail-Otter's
+ * `LocaleUtil.ts`. The three share the same 12-locale table
+ * (`en, de, fr, es, it, nl, pt, pl, ja, zh-CN, zh-TW, ko`) and the same
+ * `isSupported`/`normalize`; Mail-Meow and Mail-Otter additionally carry
+ * `negotiate`, `displayName` and `LOCALE_DISPLAY_NAMES`. The two fuller forms are
+ * byte-identical and are kept — AWS is the subset.
+ *
+ * ## Design decision
+ *
+ * The kit kept the fuller Mail-Meow/Mail-Otter surface. `normalize` is the load-
+ * bearing operation: it canonicalizes a tag, maps regional fallbacks toward the
+ * supported table (a bare `zh` becomes `zh-CN`), and — distinct from the generic
+ * `canonicalizeLanguageTag` — titlecases a four-letter script subtag so
+ * `zh-hans-cn` canonicalizes correctly before negotiation. Non-negotiable input
+ * falls back to `DEFAULT_LOCALE` rather than throwing; an Accept-Language header
+ * is a hint, not a contract.
+ */
+declare const DEFAULT_LOCALE = "en";
+declare const SUPPORTED_LOCALES: readonly ["en", "de", "fr", "es", "it", "nl", "pt", "pl", "ja", "zh-CN", "zh-TW", "ko"];
+type SupportedLocale = (typeof SUPPORTED_LOCALES)[number];
+declare const LOCALE_DISPLAY_NAMES: Record<SupportedLocale, string>;
+declare class LocaleUtil {
+    static isSupported(locale: string | null | undefined): boolean;
+    static normalize(locale: string | null | undefined): SupportedLocale;
+    static negotiate(preferred: string | null | undefined, fallback?: string | null): SupportedLocale;
+    static displayName(locale: string | null | undefined): string;
+}
+export { LocaleUtil, DEFAULT_LOCALE, SUPPORTED_LOCALES, LOCALE_DISPLAY_NAMES };
+export type { SupportedLocale };
+//# sourceMappingURL=LocaleUtil.d.ts.map

package/dist/LocaleUtil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocaleUtil.d.ts","sourceRoot":"","sources":["../src/LocaleUtil.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,QAAA,MAAM,cAAc,OAAO,CAAC;AAE5B,QAAA,MAAM,iBAAiB,yFAA0F,CAAC;AAElH,KAAK,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,QAAA,MAAM,oBAAoB,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAazD,CAAC;AAiBF,cAAM,UAAU;WACA,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;WAMvD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,eAAe;WAqB7D,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,eAAe;WAK1F,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM;CAIrE;AAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/LocaleUtil.js

@@ -0,0 +1,97 @@
+/**
+ * Locale negotiation against a fixed support table.
+ *
+ * ## Provenance
+ *
+ * Converged from AWS-AccessBridge's, Mail-Meow's and Mail-Otter's
+ * `LocaleUtil.ts`. The three share the same 12-locale table
+ * (`en, de, fr, es, it, nl, pt, pl, ja, zh-CN, zh-TW, ko`) and the same
+ * `isSupported`/`normalize`; Mail-Meow and Mail-Otter additionally carry
+ * `negotiate`, `displayName` and `LOCALE_DISPLAY_NAMES`. The two fuller forms are
+ * byte-identical and are kept — AWS is the subset.
+ *
+ * ## Design decision
+ *
+ * The kit kept the fuller Mail-Meow/Mail-Otter surface. `normalize` is the load-
+ * bearing operation: it canonicalizes a tag, maps regional fallbacks toward the
+ * supported table (a bare `zh` becomes `zh-CN`), and — distinct from the generic
+ * `canonicalizeLanguageTag` — titlecases a four-letter script subtag so
+ * `zh-hans-cn` canonicalizes correctly before negotiation. Non-negotiable input
+ * falls back to `DEFAULT_LOCALE` rather than throwing; an Accept-Language header
+ * is a hint, not a contract.
+ */
+const DEFAULT_LOCALE = 'en';
+const SUPPORTED_LOCALES = ['en', 'de', 'fr', 'es', 'it', 'nl', 'pt', 'pl', 'ja', 'zh-CN', 'zh-TW', 'ko'];
+const LOCALE_DISPLAY_NAMES = {
+    en: 'English',
+    de: 'Deutsch',
+    fr: 'Français',
+    es: 'Español',
+    it: 'Italiano',
+    nl: 'Nederlands',
+    pt: 'Português',
+    pl: 'Polski',
+    ja: '日本語',
+    'zh-CN': '简体中文',
+    'zh-TW': '繁體中文',
+    ko: '한국어',
+};
+function canonicalizeLocaleTag(tag) {
+    const normalized = tag.trim().replaceAll('_', '-');
+    const parts = normalized.split('-').filter(Boolean);
+    if (parts.length === 0)
+        return '';
+    const language = (parts[0] ?? '').toLowerCase();
+    if (parts.length === 1)
+        return language;
+    const rest = parts.slice(1).map((part, index) => {
+        if (index === parts.length - 2 && part.length === 4) {
+            return part.charAt(0).toUpperCase() + part.slice(1).toLowerCase();
+        }
+        return part.length === 2 ? part.toUpperCase() : part.toLowerCase();
+    });
+    return [language, ...rest].join('-');
+}
+class LocaleUtil {
+    static isSupported(locale) {
+        if (!locale || typeof locale !== 'string')
+            return false;
+        const canonical = canonicalizeLocaleTag(locale);
+        return SUPPORTED_LOCALES.includes(canonical);
+    }
+    static normalize(locale) {
+        if (!locale || typeof locale !== 'string')
+            return DEFAULT_LOCALE;
+        const canonical = canonicalizeLocaleTag(locale);
+        if (SUPPORTED_LOCALES.includes(canonical)) {
+            return canonical;
+        }
+        const base = canonical.split('-', 1)[0]?.toLowerCase() ?? '';
+        if (base === 'zh')
+            return 'zh-CN';
+        const baseMatch = SUPPORTED_LOCALES.find((s) => s.toLowerCase() === base);
+        if (baseMatch)
+            return baseMatch;
+        try {
+            const negotiated = Intl.getCanonicalLocales(canonical);
+            const primary = negotiated[0]?.split('-', 1)[0]?.toLowerCase() ?? '';
+            const fallback = SUPPORTED_LOCALES.find((s) => s.toLowerCase() === primary);
+            if (fallback)
+                return fallback;
+        }
+        catch {
+            // Ignore invalid tags and fall through to default.
+        }
+        return DEFAULT_LOCALE;
+    }
+    static negotiate(preferred, fallback) {
+        const primary = this.normalize(preferred);
+        return primary === DEFAULT_LOCALE ? this.normalize(fallback) : primary;
+    }
+    static displayName(locale) {
+        const normalized = this.normalize(locale);
+        return LOCALE_DISPLAY_NAMES[normalized] ?? normalized;
+    }
+}
+export { LocaleUtil, DEFAULT_LOCALE, SUPPORTED_LOCALES, LOCALE_DISPLAY_NAMES };
+//# sourceMappingURL=LocaleUtil.js.map

package/dist/LocaleUtil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocaleUtil.js","sourceRoot":"","sources":["../src/LocaleUtil.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAU,CAAC;AAIlH,MAAM,oBAAoB,GAAoC;IAC5D,EAAE,EAAE,SAAS;IACb,EAAE,EAAE,SAAS;IACb,EAAE,EAAE,UAAU;IACd,EAAE,EAAE,SAAS;IACb,EAAE,EAAE,UAAU;IACd,EAAE,EAAE,YAAY;IAChB,EAAE,EAAE,WAAW;IACf,EAAE,EAAE,QAAQ;IACZ,EAAE,EAAE,KAAK;IACT,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,MAAM;IACf,EAAE,EAAE,KAAK;CACV,CAAC;AAEF,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU;IACP,MAAM,CAAC,WAAW,CAAC,MAAiC;QACzD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACxD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAChD,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACtE,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,MAAiC;QACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,cAAc,CAAC;QACjE,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAK,iBAAuC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjE,OAAO,SAA4B,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC7D,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QAClC,MAAM,SAAS,GAAI,iBAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;QACjG,IAAI,SAAS;YAAE,OAAO,SAA4B,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YACrE,MAAM,QAAQ,GAAI,iBAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC;YACnG,IAAI,QAAQ;gBAAE,OAAO,QAA2B,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,SAAoC,EAAE,QAAwB;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACzE,CAAC;IAEM,MAAM,CAAC,WAAW,CAAC,MAAiC;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,oBAAoB,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;IACxD,CAAC;CACF;AAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/PasswordFingerprint.d.ts

@@ -0,0 +1,30 @@
+/**
+ * A cheap, deterministic tag for a presented password.
+ *
+ * ## Provenance
+ *
+ * Taken from Durable-DAV's `packages/shared/src/utils/PasswordFingerprint.ts`
+ * (the only repo that factored this). It is one unsalted SHA-256 that delegates
+ * to `CryptoUtil.sha256Hex`.
+ *
+ * **Not a credential, and not a secret.** It is one unsalted SHA-256, so it is
+ * exactly as crackable as the legacy unsalted digest it is sometimes confused
+ * with — a rainbow table recovers it instantly, and two users who chose the same
+ * password share a value. It exists to be a memo *key* and nothing else. Any
+ * code that treats it as a password hash is wrong.
+ *
+ * ## Why it exists
+ *
+ * Password verification is memoized so a repeated request does not pay a PBKDF2
+ * derivation again. The memo must distinguish "this exact password was already
+ * verified against this stored hash" from "someone presented a different password
+ * for this username". Keying on `username` alone would accept **any** password
+ * for a recently-used username — a total authentication bypass. The lookup key
+ * therefore includes this fingerprint: it makes the key specific to the password
+ * actually presented, at the cost of one SHA-256 (microseconds) instead of one
+ * PBKDF2 derivation (milliseconds, and on the Workers Free plan more than the
+ * entire CPU budget).
+ */
+declare function passwordFingerprint(password: string): Promise<string>;
+export { passwordFingerprint };
+//# sourceMappingURL=PasswordFingerprint.d.ts.map

package/dist/PasswordFingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordFingerprint.d.ts","sourceRoot":"","sources":["../src/PasswordFingerprint.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,iBAAe,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/PasswordFingerprint.js

@@ -0,0 +1,33 @@
+import { CryptoUtil } from './CryptoUtil';
+/**
+ * A cheap, deterministic tag for a presented password.
+ *
+ * ## Provenance
+ *
+ * Taken from Durable-DAV's `packages/shared/src/utils/PasswordFingerprint.ts`
+ * (the only repo that factored this). It is one unsalted SHA-256 that delegates
+ * to `CryptoUtil.sha256Hex`.
+ *
+ * **Not a credential, and not a secret.** It is one unsalted SHA-256, so it is
+ * exactly as crackable as the legacy unsalted digest it is sometimes confused
+ * with — a rainbow table recovers it instantly, and two users who chose the same
+ * password share a value. It exists to be a memo *key* and nothing else. Any
+ * code that treats it as a password hash is wrong.
+ *
+ * ## Why it exists
+ *
+ * Password verification is memoized so a repeated request does not pay a PBKDF2
+ * derivation again. The memo must distinguish "this exact password was already
+ * verified against this stored hash" from "someone presented a different password
+ * for this username". Keying on `username` alone would accept **any** password
+ * for a recently-used username — a total authentication bypass. The lookup key
+ * therefore includes this fingerprint: it makes the key specific to the password
+ * actually presented, at the cost of one SHA-256 (microseconds) instead of one
+ * PBKDF2 derivation (milliseconds, and on the Workers Free plan more than the
+ * entire CPU budget).
+ */
+async function passwordFingerprint(password) {
+    return CryptoUtil.sha256Hex(password);
+}
+export { passwordFingerprint };
+//# sourceMappingURL=PasswordFingerprint.js.map