Vendor pgstencil main eaba6d3 (first audited commit)

[nedtwigg]

Vendors pgstencil main at eaba6d3, the first pgstencil commit whose security-audit check run passed.

main currently vendors ddbf96c. That commit is on pgstencil main but has no security-audit check run, so the FAIL IF added in #745 fails tonight's audit until this merges.

What changed in the packed code (diffplug/pgstencil#14):

• Better Auth's IP rate-limit keys are stored as HMACs.
• The client IP comes from the socket, or from an opted-in header. Hosted's Workers path keeps cf-connecting-ip.
• A new auth migration, 005_hashed_rate_limit_keys.sql, deletes the old plaintext rateLimit rows. It runs with the committed Better Auth migrations before the next Hosted deploy.
• pgstencil-0.1.0.tgz changed too: paths.js gains migrationsDirectory, which refuses a pgstencil.json migrations path outside the project root, and defaultMigrations now goes through it. It has no effect on Dormouse. The repo has no pgstencil.json, nothing imports defaultMigrations, and Hosted passes explicit directories through hosted/server/migrations.ts.

Unrelated to the bump: the refresh install dropped some dev-only duplicate lockfile snapshots. These are the supports-color-free copies of @babel/core, @babel/traverse, the two @babel/helper-module-* entries, debug@4.4.3, react-docgen@8.0.3, @storybook/react and @storybook/react-vite. The root Storybook resolutions now point at the supports-color@10.2.2 variants. No shipped package changes identity or version, which is why the dependency disclosure is unchanged.

Verified:

• pnpm --filter dormouse-hosted typecheck and test (16 deploy tests, 19 vitest).
• verifyPackages(), pnpm lint:specs, and an unchanged dependency disclosure.
• gh api .../compare/eaba6d3...main returns identical, and the commit's security-audit conclusion is success.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	fc65621
Status:	✅  Deploy successful!
Preview URL:	https://bef1de02.mouseterm.pages.dev
Branch Preview URL:	https://vendor-pgstencil-main.mouseterm.pages.dev

View logs

[dormouse-bot]

Feedback on the draft, not a merge verdict — mark it ready and I'll do the full pass. Both points are about the body rather than the code; the audited conditions in docs/specs/security-hosted.md → "Deployment boundary" all hold (archive hashes match vendor/build.json, both provenance.json files name eaba6d3, the compare against pgstencil main is identical, and that commit's security-audit run is success).

vendor/pgstencil-0.1.0.tgz changed too, and "What changed in the packed code" only covers the auth package. The core package's dist/paths.js gains migrationsDirectory(root, configured) — a containment check that throws when a pgstencil.json migrations path resolves outside the project root — and defaultMigrations now goes through it. That's the Q3/Q4/Q5/Q8 bullet of diffplug/pgstencil#14, so the linked PR covers it, but the enumeration here doesn't. It is inert for Dormouse: there's no pgstencil.json in the repo, nothing imports defaultMigrations, and Hosted passes explicit directories through hosted/server/migrations.ts. Still worth a line, because that spec makes these bytes an audited artifact and this body is the human-readable record of what moved inside them.

pnpm-lock.yaml also carries a dev-only peer dedupe unrelated to the bump. The supports-color-free duplicate snapshots of @babel/core, @babel/traverse, the two @babel/helper-module-* entries, debug@4.4.3, react-docgen@8.0.3, and both Storybook packages are dropped, and the root @storybook/react / @storybook/react-vite resolutions re-point at the supports-color@10.2.2 variants. No shipped package's identity or version moves, which is why the dependency disclosure is genuinely unchanged — but on a supply-chain PR a sentence saying so saves the next reader from diffing the lockfile to find out.