@vex-chat/spire 1.0.2 → 1.0.4

package/dist/utils/createUint8UUID.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 import { parse as uuidParse } from "uuid";
 export function createUint8UUID() {
     return uuidToUint8(crypto.randomUUID());

package/dist/utils/createUint8UUID.js.map

@@ -1 +1 @@
-{"version":3,"file":"createUint8UUID.js","sourceRoot":"","sources":["../../src/utils/createUint8UUID.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,MAAM,UAAU,eAAe;IAC3B,OAAO,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"createUint8UUID.js","sourceRoot":"","sources":["../../src/utils/createUint8UUID.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,MAAM,UAAU,eAAe;IAC3B,OAAO,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/utils/jwtSecret.d.ts

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 /**
  * Returns the dedicated JWT HMAC signing secret.
  *

package/dist/utils/jwtSecret.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 /**
  * Returns the dedicated JWT HMAC signing secret.
  *

package/dist/utils/jwtSecret.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwtSecret.js","sourceRoot":"","sources":["../../src/utils/jwtSecret.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,mEAAmE,CACtE,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"jwtSecret.js","sourceRoot":"","sources":["../../src/utils/jwtSecret.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,mEAAmE,CACtE,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/utils/loadEnv.d.ts

@@ -1 +1,6 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 export declare function loadEnv(): void;

package/dist/utils/loadEnv.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 import { config } from "dotenv";
 /* Populate process.env with vars from .env and verify required vars are present. */
 export function loadEnv() {

package/dist/utils/loadEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,MAAM,eAAe,GAAa,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;AACL,CAAC"}
+{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,MAAM,eAAe,GAAa,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/utils/msgpack.d.ts

@@ -1,2 +1,7 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 import { Packr } from "msgpackr";
 export declare const msgpack: Packr;

package/dist/utils/msgpack.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
 import { Packr } from "msgpackr";
 // Standard msgpack encoder/decoder configured for broad compatibility.
 export const msgpack = new Packr({ moreTypes: false, useRecords: false });

package/dist/utils/msgpack.js.map

@@ -1 +1 @@
-{"version":3,"file":"msgpack.js","sourceRoot":"","sources":["../../src/utils/msgpack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEjC,uEAAuE;AACvE,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC"}
+{"version":3,"file":"msgpack.js","sourceRoot":"","sources":["../../src/utils/msgpack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEjC,uEAAuE;AACvE,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC"}

package/package.json

@@ -1,12 +1,15 @@
 {
     "name": "@vex-chat/spire",
-    "version": "1.0.2",
+    "version": "1.0.4",
     "description": "Vex server implementation in NodeJS.",
     "type": "module",
     "files": [
         "dist",
         "src",
-        "LICENSE"
+        "LICENSE",
+        "LICENSE-COMMERCIAL",
+        "LICENSING.md",
+        "CLA.md"
     ],
     "author": "Extra <extrahash@protonmail.com>",
     "license": "AGPL-3.0-or-later",
@@ -26,6 +29,8 @@
         "build": "tsc && node scripts/clean-dist-tests.mjs",
         "format": "prettier --write .",
         "format:check": "prettier --check .",
+        "copyright:check": "node scripts/copyright-headers.mjs --check",
+        "copyright:apply": "node scripts/copyright-headers.mjs",
         "lint": "eslint src/ scripts/stress/",
         "lint:fix": "eslint src/ scripts/stress/ --fix",
         "prepare": "husky || true",
@@ -37,7 +42,6 @@
         "stress:llm-triage": "node --experimental-strip-types scripts/stress/stress-llm-triage.ts",
         "gen-spk": "node scripts/gen-spk.js",
         "docs": "node ./scripts/generate-docs.js",
-        "license:check": "node scripts/fix-license-checker.mjs && npx @onebeyond/license-checker scan --allowOnly MIT MIT-0 ISC BSD-2-Clause BSD-3-Clause Apache-2.0 0BSD MPL-2.0 CC0-1.0 CC-BY-3.0 CC-BY-4.0 Unlicense BlueOak-1.0.0 Python-2.0 Zlib PSF-2.0 Artistic-2.0 AGPL-3.0-or-later WTFPL \"(MIT AND CC-BY-3.0)\" --ignoreRootPackageLicense --disableReport",
         "service:status-monitor": "node ./services/status-monitor/index.js",
         "service:status-monitor:clear-history": "node ./services/status-monitor/clear-history.js",
         "service:deploy-hook": "node ./services/deploy-hook/index.js",
@@ -45,7 +49,7 @@
     },
     "devDependencies": {
         "@changesets/cli": "2.30.0",
-        "@onebeyond/license-checker": "2.2.0",
+        "@socketsecurity/cli": "1.1.84",
         "@types/better-sqlite3": "7.6.13",
         "@types/cors": "2.8.19",
         "@types/express": "5.0.6",
@@ -55,7 +59,7 @@
         "@types/node": "25.6.0",
         "@types/uuid": "10.0.0",
         "@types/ws": "8.18.1",
-        "@vex-chat/libvex": "5.1.0",
+        "@vex-chat/libvex": "5.2.0",
         "@vitest/eslint-plugin": "1.6.15",
         "axios": "1.15.0",
         "eslint": "10.2.0",
@@ -64,6 +68,7 @@
         "eslint-plugin-perfectionist": "5.8.0",
         "husky": "9.1.7",
         "lint-staged": "16.4.0",
+        "npm-package-json-lint": "10.2.1",
         "prettier": "3.8.2",
         "type-coverage": "2.29.7",
         "typedoc": "0.28.18",

package/src/ClientManager.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Database } from "./Database.ts";
 import type {
     BaseMsg,

package/src/Database.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { ServerDatabase } from "./db/schema.ts";
 import type { SpireOptions } from "./Spire.ts";
 import type {

package/src/Spire.ts

@@ -1,5 +1,11 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { ActionToken, BaseMsg, NotifyMsg, User } from "@vex-chat/types";
-import type { Server } from "http";
+import type { IncomingMessage, Server } from "http";
 
 import { EventEmitter } from "events";
 import { execSync } from "node:child_process";
@@ -25,6 +31,7 @@ import {
 } from "@vex-chat/types";
 
 import jwt from "jsonwebtoken";
+import morgan from "morgan";
 import { stringify as uuidStringify } from "uuid";
 import { WebSocketServer } from "ws";
 import { z } from "zod/v4";
@@ -42,7 +49,6 @@ export const TOKEN_EXPIRY = 1000 * 60 * 10;
 export const JWT_EXPIRY = "7d";
 export const DEVICE_AUTH_JWT_EXPIRY = "1h";
 const DEVICE_CHALLENGE_EXPIRY = 1000 * 60; // 60 seconds
-const STATUS_LATENCY_BUDGET_MS = 250;
 
 // 3-19 chars long
 const usernameRegex = /^(\w{3,19})$/;
@@ -126,6 +132,14 @@ const getCommitSha = (): string => {
     }
 };
 
+/** Hyphenated UUIDs in paths/query — replaced so request logs are less identifying. */
+function redactUuidsForLog(url: string): string {
+    return url.replace(
+        /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi,
+        "[uuid]",
+    );
+}
+
 export interface SpireOptions {
     apiPort?: number;
     dbType?: "mysql" | "sqlite3" | "sqlite3mem" | "sqlite";
@@ -227,6 +241,14 @@ export class Spire extends EventEmitter {
     }
 
     private init(apiPort: number): void {
+        // Request traces (UUIDs redacted in `url` token). Enabled in all envs,
+        // including production / Docker — dependency is non-dev.
+        morgan.token("url", (req: IncomingMessage) => {
+            const r = req as IncomingMessage & { originalUrl?: string };
+            return redactUuidsForLog(r.originalUrl ?? r.url ?? "");
+        });
+        this.api.use(morgan("dev"));
+
         this.api.use((_req, _res, next) => {
             this.requestsTotal += 1;
 
@@ -427,12 +449,16 @@ export class Spire extends EventEmitter {
             res.json({ dbReady: true, ok: true });
         });
 
-        this.api.get("/status", async (_req, res) => {
+        this.api.get("/status", async (req, res) => {
             const started = Date.now();
             const dbHealthy = this.dbReady ? await this.db.isHealthy() : false;
             const checkDurationMs = Date.now() - started;
 
             const ok = dbHealthy;
+            if (!devApiKeySkipsRateLimits(req)) {
+                res.json({ ok });
+                return;
+            }
             const canaryEnv = process.env["CANARY"]?.trim().toLowerCase();
             res.json({
                 canary:
@@ -440,20 +466,9 @@ export class Spire extends EventEmitter {
                     canaryEnv === "true" ||
                     canaryEnv === "yes",
                 checkDurationMs,
-                commitSha: this.commitSha,
-                dbHealthy,
-                dbReady: this.dbReady,
-                latencyBudgetMs: STATUS_LATENCY_BUDGET_MS,
-                metrics: {
-                    requestsTotal: this.requestsTotal,
-                },
                 now: new Date(),
                 ok,
-                startedAt: this.startedAt.toISOString(),
-                uptimeSeconds: Math.floor(process.uptime()),
                 version: this.version,
-                withinLatencyBudget:
-                    checkDurationMs <= STATUS_LATENCY_BUDGET_MS,
             });
         });
 

package/src/__tests__/Database.spec.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { SpireOptions } from "../Spire.ts";
 import type { PreKeysWS } from "@vex-chat/types";
 

package/src/ambient-modules.d.ts

@@ -1 +1,7 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 declare module "ed2curve";

package/src/db/schema.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Insertable, Selectable, Updateable } from "kysely";
 
 // ── Table interfaces ────────────────────────────────────────────────────

package/src/index.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import { Spire } from "./Spire.ts";
 
 export { Spire };

package/src/middleware/validate.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { NextFunction, Request, Response } from "express";
 import type { z } from "zod/v4";
 

package/src/migrations/2026-04-06_initial-schema.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import { type Kysely, sql } from "kysely";
 
 export async function down(db: Kysely<unknown>): Promise<void> {

package/src/migrations/2026-04-14_argon2id-password-hashing.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import { type Kysely, sql } from "kysely";
 
 export async function down(db: Kysely<unknown>): Promise<void> {

package/src/run.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { SpireOptions } from "./Spire.ts";
 
 import { Spire } from "./Spire.ts";

package/src/server/avatar.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
 

package/src/server/errors.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 /**
  * Centralized HTTP error handling.
  *

package/src/server/file.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Database } from "../Database.ts";
 import type { FileSQL } from "@vex-chat/types";
 

package/src/server/index.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Database } from "../Database.ts";
 import type { Emoji } from "@vex-chat/types";
 
@@ -192,16 +198,10 @@ export const initApp = (
             type: "application/msgpack",
         }),
     );
-    api.use(helmet());
-    api.use(msgpackParser);
-    api.use(checkAuth);
-    api.use(checkDevice);
 
-    // Browser clients (web, Tauri, Capacitor, etc.) hit Spire from arbitrary
-    // origins when self-hosted or embedded in third-party apps. libvex uses
-    // `Authorization: Bearer` only (no cookies), so reflecting `Origin` is the
-    // usual bearer-API pattern. Set `CORS_ORIGINS` to a comma-separated allowlist
-    // when an operator wants to restrict which frontends may call the API.
+    // CORS before helmet/auth so browser preflight (OPTIONS) and PATCH get
+    // Access-Control-* headers. Node clients ignore CORS; browsers do not.
+    // Set `CORS_ORIGINS` to a comma-separated allowlist to restrict frontends.
     const corsRaw = process.env["CORS_ORIGINS"];
     const corsOrigins = corsRaw
         ? corsRaw
@@ -212,6 +212,15 @@ export const initApp = (
     api.use(
         cors({
             credentials: true,
+            methods: [
+                "GET",
+                "HEAD",
+                "POST",
+                "PUT",
+                "PATCH",
+                "DELETE",
+                "OPTIONS",
+            ],
             origin:
                 corsOrigins.length > 0
                     ? corsOrigins
@@ -219,6 +228,11 @@ export const initApp = (
         }),
     );
 
+    api.use(helmet());
+    api.use(msgpackParser);
+    api.use(checkAuth);
+    api.use(checkDevice);
+
     api.get("/server/:id", protect, async (req, res) => {
         const server = await db.retrieveServer(getParam(req, "id"));
 

package/src/server/invite.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Database } from "../Database.ts";
 import type { TokenScopes } from "@vex-chat/types";
 

package/src/server/openapi.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 /**
  * API documentation endpoints (development only).
  *

package/src/server/permissions.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Permission } from "@vex-chat/types";
 
 /**

package/src/server/rateLimit.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Request } from "express";
 
 import { timingSafeEqual } from "node:crypto";

package/src/server/user.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Database } from "../Database.ts";
 
 import express from "express";

package/src/server/utils.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Device, User, UserRecord } from "@vex-chat/types";
 import type { Request } from "express";
 

package/src/types/express.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import type { Device, User } from "@vex-chat/types";
 
 /**

package/src/utils/createUint8UUID.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import { parse as uuidParse } from "uuid";
 
 export function createUint8UUID(): Uint8Array {

package/src/utils/jwtSecret.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 /**
  * Returns the dedicated JWT HMAC signing secret.
  *

package/src/utils/loadEnv.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import { config } from "dotenv";
 
 /* Populate process.env with vars from .env and verify required vars are present. */

package/src/utils/msgpack.ts

@@ -1,3 +1,9 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
 import { Packr } from "msgpackr";
 
 // Standard msgpack encoder/decoder configured for broad compatibility.