@vielzeug/codex 26.10.16 → 26.10.18

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Helmuth Saatkamp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/data/catalog.json

@@ -35,7 +35,7 @@
         "rune"
       ],
       "slug": "archive",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -108,7 +108,7 @@
         "coins"
       ],
       "slug": "arsenal",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -160,7 +160,7 @@
         "refine"
       ],
       "slug": "assay",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -199,7 +199,7 @@
         "vault"
       ],
       "slug": "beacon",
-      "version": "0.1.0"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -241,7 +241,7 @@
         "ward"
       ],
       "slug": "clockwork",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -273,7 +273,7 @@
         "refine"
       ],
       "slug": "codex",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -343,7 +343,7 @@
         "spell"
       ],
       "slug": "coins",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -384,7 +384,7 @@
         "rune"
       ],
       "slug": "conduit",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -426,7 +426,7 @@
         "postmaster"
       ],
       "slug": "courier",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -472,7 +472,7 @@
         "refine"
       ],
       "slug": "dnd",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -514,7 +514,7 @@
         "herald"
       ],
       "slug": "familiar",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -581,7 +581,7 @@
         "courier"
       ],
       "slug": "flux",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -621,7 +621,7 @@
         "ore"
       ],
       "slug": "focus",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -662,7 +662,7 @@
         "assay"
       ],
       "slug": "forge",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -700,7 +700,7 @@
         "keymap"
       ],
       "slug": "gesture",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -744,7 +744,7 @@
         "familiar"
       ],
       "slug": "herald",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -787,7 +787,7 @@
         "tempo"
       ],
       "slug": "illusionist",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -832,7 +832,7 @@
         "ore"
       ],
       "slug": "keymap",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -879,7 +879,7 @@
         "vault"
       ],
       "slug": "ledger",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -925,7 +925,7 @@
         "courier"
       ],
       "slug": "lingua",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -963,7 +963,7 @@
         "herald"
       ],
       "slug": "mesh",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1000,7 +1000,7 @@
         "ore"
       ],
       "slug": "necromancer",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1040,7 +1040,7 @@
         "prism"
       ],
       "slug": "orbit",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1105,7 +1105,7 @@
         "orbit"
       ],
       "slug": "ore",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1149,7 +1149,7 @@
         "ripple"
       ],
       "slug": "postmaster",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1189,7 +1189,7 @@
         "orbit"
       ],
       "slug": "prism",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1253,7 +1253,7 @@
         "clockwork"
       ],
       "slug": "pulse",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1375,7 +1375,7 @@
         "keymap"
       ],
       "slug": "refine",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1420,7 +1420,7 @@
         "ledger"
       ],
       "slug": "ripple",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1474,7 +1474,7 @@
         "familiar"
       ],
       "slug": "rune",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1515,7 +1515,7 @@
         "refine"
       ],
       "slug": "sandbox",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1566,7 +1566,7 @@
         "ripple"
       ],
       "slug": "scout",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1619,7 +1619,7 @@
         "refine"
       ],
       "slug": "scroll",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1666,7 +1666,7 @@
         "gesture"
       ],
       "slug": "sentinel",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1706,7 +1706,7 @@
         "refine"
       ],
       "slug": "sigil",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1751,7 +1751,7 @@
         "wayfinder"
       ],
       "slug": "sourcerer",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1810,7 +1810,7 @@
         "vault"
       ],
       "slug": "spell",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1851,7 +1851,7 @@
         "ripple"
       ],
       "slug": "tandem",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1895,7 +1895,7 @@
         "herald"
       ],
       "slug": "tavern",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -1963,7 +1963,7 @@
         "vault"
       ],
       "slug": "tempo",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -2014,7 +2014,7 @@
         "ripple"
       ],
       "slug": "vault",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -2060,7 +2060,7 @@
         "refine"
       ],
       "slug": "ward",
-      "version": "26.10.15"
+      "version": "26.10.17"
     },
     {
       "availableDocPages": [
@@ -2114,8 +2114,8 @@
         "herald"
       ],
       "slug": "wayfinder",
-      "version": "26.10.15"
+      "version": "26.10.17"
     }
   ],
-  "version": "26.10.15"
+  "version": "26.10.17"
 }

package/data/llms-full.txt

@@ -1,6 +1,6 @@
 # Vielzeug: Full Documentation
 
-> Complete documentation for 43 packages. Version: 26.10.15
+> Complete documentation for 43 packages. Version: 26.10.17
 
 ---
 
@@ -312,7 +312,11 @@ Magic links expire after 15 minutes and work once. The durable per-email budget
 The issuer-global admission budget is durable D1 state in `auth_sign_in_budget`:
 20 requests per 60-second window before account creation or email delivery.
 This supplements, rather than replaces, the durable per-email budget. No external
-rate-limiter binding is required.
+rate-limiter binding is required for sign-in admission; the budgets do not cover
+`POST /auth/verify` or `GET /auth/session`, which deployments rate-limit at the
+edge. Edge rules should block rather than challenge `GET /auth/session`: clients
+check it with a `fetch`, which cannot solve a challenge interstitial. The verify
+GET is a browser navigation from the email link, so a challenge is solvable there.
 Admission spends are not refunded after later database or email failures.
 Request emails are trimmed and lowercased before validation. `SENDER_ADDRESS`
 must already be canonical; `OPERATOR_EMAILS` entries are trimmed and lowercased
@@ -477,7 +481,7 @@ Effective hide, unhide, operator removal and publisher erasure append audit rows
 | `ARCHIVE_OPERATOR_ROLE`                                       | `'archive-operator'`                                                       |
 | `SESSION_COOKIE_NAME`, `SESSION_COOKIE_PATH`                  | `'archive_session'`, `'/api/v1'`                                           |
 | `SESSION_MAX_AGE_SECONDS`                                     | `2592000`                                                                  |
-| `OPERATOR_SESSION_MAX_AGE_SECONDS`                            | `3600` (60 minutes); shared root contract                                   |
+| `OPERATOR_SESSION_MAX_AGE_SECONDS`                            | `3600` (60 minutes); shared root contract                                  |
 | `ACCOUNT_HEADER`                                              | `'X-Archive-Account'`; required issuer-account UUID on coordinated erasure |
 | `PUBLISHER_HEADER`, `REQUEST_MARKER_HEADER`                   | `'x-archive-publisher'`, `'x-archive-request'`                             |
 | `ILL_FORMED_TEXT`, `isWellFormedText(value: string): boolean` | Reject control characters and lone UTF-16 surrogates                       |
@@ -1033,7 +1037,10 @@ well-formed, or the route answers 503 without naming what is missing:
 Both limiter bindings must run 60-second windows (`simple` limiters:
 `period: 60`): the platform binding does not expose its period at runtime, so the
 Worker's 429 `Retry-After` header is fixed at 60 seconds — a longer window would
-make the header lie.
+make the header lie. The read limit keys on `cf-connecting-ip`, which Cloudflare
+sets authoritatively for requests that reach the Worker through its network. Keep
+that network path: never front the Worker with a proxy that forwards a
+client-supplied header of the same name.
 
 Generated Env types (wrangler's `worker-configuration.d.ts`) satisfy the package's
 structural `ArchiveWorkerEnv` — no `@cloudflare/workers-types` dependency, no casts.
@@ -1081,6 +1088,19 @@ The issuer first admits sign-in requests through its singleton durable
 `auth_sign_in_budget` table: 20 requests per 60 seconds before creating accounts
 or delivering email. No rate-limiter binding is required. It then
 permits three sign-in emails per email in an hourly durable window.
+Those durable budgets guard `POST /auth/sign-in` only. `POST /auth/verify` and
+`GET /auth/session` stay public: tokens are 256-bit, single-use and expire in
+15 minutes, so guessing is not the risk — but every request still costs the
+issuer: the verify GET renders the confirmation page, the verify POST performs a
+D1 token write, and the session check performs an RS256 verification plus an
+account read for a well-formed signed token. Put per-client-IP Cloudflare
+rate-limit rules (or an equivalent edge control) in front of both routes in
+production. Prefer a block action: applications check `GET /auth/session` with
+a `fetch`, and a fetch cannot solve a challenge interstitial, so challenging
+that route breaks legitimate sign-in. The verify GET is a browser navigation
+opened from the email link, so a challenge is solvable there if you want one.
+Set thresholds with CGNAT headroom (shared mobile/office egress IPs) and tune
+from observed traffic.
 Later database or delivery failures do not refund global admission.
 Using or expiring a link never refunds sends; failed delivery also spends the
 allowance. Links expire after 15 minutes. Operator sessions expire after 60 minutes
@@ -1296,8 +1316,11 @@ database or schema failures. It never writes, sends email or probes the catalog.
 Operator authority is the session token's optional `roles` claim carrying
 `ARCHIVE_OPERATOR_ROLE` (`'archive-operator'`) — minted by your issuer, verified with
 the same signature, audience and issuer checks as any session, and never a separate
-credential. Moderation routes additionally require a registered publisher row: one
-accountable identity per action.
+credential. Mint operator sessions with a lifetime of at most
+`OPERATOR_SESSION_MAX_AGE_SECONDS` (3600 seconds): the catalog rejects any token
+carrying the operator role whose signed lifetime or age exceeds it, so reusing the
+ordinary long session expiry 401s operator sessions immediately. Moderation routes
+additionally require a registered publisher row: one accountable identity per action.
 
 - **Report** — any registered publisher reports a visible entry with a bounded
   free-text reason (`reportReasonChars`). Idempotent per (entry, reporter): the same
@@ -1422,6 +1445,8 @@ export function useRecipes() {
 - Grant the operator role claim only through your issuer, and only to accounts that
   are also registered publishers.
 - Wire a sanitized `tap()` sink and register the rate-limit pepper as a production secret.
+- Rate-limit the issuer's public `verify` and `session` routes at the edge; the
+  durable budgets cover sign-in admission only.
 
 ### Examples
 
@@ -16911,8 +16936,9 @@ boolean attributes (`?attr=`), explicit property bindings (`.prop=`), events (`@
 `.stop`/`.prevent`/`.once`/`.capture` modifiers), refs (`ref=`), and nested templates.
 
 `.prop=${value}` always writes the element property (never an attribute): the explicit channel for structured
-values (arrays, objects, callbacks). Prototype-polluting names (`__proto__`, `constructor`, `prototype`) are
-rejected at compile time.
+values (arrays, objects, callbacks). Prototype-polluting names (`__proto__`, `constructor`, `prototype`) and
+raw-HTML-parsing names (`innerHTML`, `outerHTML`, `srcdoc`) are rejected at compile time: render sanitized
+HTML through the `unsafeHtml()` directive instead of a property binding.
 
 `@event.stop`, `.prevent`, `.once`, and `.capture` are shorthand for the matching listener behavior
 (`stopPropagation`/`preventDefault` applied before the handler runs; `once`/`capture` passed as listener

package/data/llms.txt

@@ -1,6 +1,6 @@
 # Vielzeug
 
-> 43 focused TypeScript packages. Version: 26.10.15
+> 43 focused TypeScript packages. Version: 26.10.17
 
 Install any package independently: `pnpm add @vielzeug/<name>`
 

package/data/manifest.json

@@ -4,5 +4,5 @@
   "refine": "refine.json",
   "schemaVersion": 1,
   "search": "search.json",
-  "version": "26.10.15"
+  "version": "26.10.17"
 }