From 518467d01cc75086874b5f7ad44bbadb759df153 Mon Sep 17 00:00:00 2001 From: lex00 <121451605+lex00@users.noreply.github.com> Date: Thu, 18 Jun 2026 00:39:45 -0600 Subject: [PATCH 1/2] chore: consume chant 0.8.1 (raw-CDN content fetch fixes GitHub rate limiting) 0.8.1 fixes the audit engine's GitHub fetch: content now comes from the raw CDN instead of the contents API, so large repos (actions/checkout, terraform) no longer trip GitHub's secondary rate limit. Also path-segment encoding (spaces) and per-file resilience. --- package-lock.json | 102 +++++++++++++++++++++++----------------------- package.json | 20 ++++----- 2 files changed, 61 insertions(+), 61 deletions(-) diff --git a/package-lock.json b/package-lock.json index ac8fcac..db07633 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8,16 +8,16 @@ "name": "blacklight", "version": "0.0.0", "dependencies": { - "@intentius/chant": "^0.8.0", - "@intentius/chant-lexicon-aws": "^0.8.0", - "@intentius/chant-lexicon-azure": "^0.8.0", - "@intentius/chant-lexicon-docker": "^0.8.0", - "@intentius/chant-lexicon-forgejo": "^0.8.0", - "@intentius/chant-lexicon-gcp": "^0.8.0", - "@intentius/chant-lexicon-github": "^0.8.0", - "@intentius/chant-lexicon-gitlab": "^0.8.0", - "@intentius/chant-lexicon-helm": "^0.8.0", - "@intentius/chant-lexicon-k8s": "^0.8.0" + "@intentius/chant": "^0.8.1", + "@intentius/chant-lexicon-aws": "^0.8.1", + "@intentius/chant-lexicon-azure": "^0.8.1", + "@intentius/chant-lexicon-docker": "^0.8.1", + "@intentius/chant-lexicon-forgejo": "^0.8.1", + "@intentius/chant-lexicon-gcp": "^0.8.1", + "@intentius/chant-lexicon-github": "^0.8.1", + "@intentius/chant-lexicon-gitlab": "^0.8.1", + "@intentius/chant-lexicon-helm": "^0.8.1", + "@intentius/chant-lexicon-k8s": "^0.8.1" }, "devDependencies": { "@cloudflare/workers-types": "^4.20260617.1", @@ -1099,9 +1099,9 @@ } }, "node_modules/@intentius/chant": { - "version": "0.8.0", - "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.8.0.tgz", - "integrity": "sha512-ZG8mGRJlewh04w6FMKIGdTd6frQLH9fQVY2YLVGsxyX2dc2ws0Z+K9SaiJJ8gr/Mc797cchurP2QR65QwpwJyA==", + "version": "0.8.1", + "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.8.1.tgz", + "integrity": "sha512-sBQ1Qubd/1pB1SdsL5UuPFEOfcMNTi43p1MCKLDhlxLC8r8ZHXsSbBX5gP+q2lBqPE1Rsk4x65gtAN5XJO18JQ==", "license": "Apache-2.0", "dependencies": { "fflate": "^0.8.2", @@ -1115,53 +1115,53 @@ } }, "node_modules/@intentius/chant-lexicon-aws": { - "version": "0.8.0", - "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.8.0.tgz", - "integrity": "sha512-CSyrEQMtURg+UwRO3sAvXCiFrWvOe4W5v0ZbpgGYsw07iOb386resrg6fSIEgtXDeQd/EBxYpcD5fZio0bElrA==", + "version": "0.8.1", + "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.8.1.tgz", + "integrity": "sha512-6f/cwWrCgXyCbK6DQgox7Kb4GosoNCYCLq7UABDUbs2EKDFI6VwwWKRmlIEyvG2tW3oZauO5CNxR8YnPE1L/cw==", "license": "Apache-2.0", "dependencies": { "fflate": "^0.8.2", "js-yaml": "^4.1.0" }, "peerDependencies": { - "@intentius/chant": "^0.8.0" + "@intentius/chant": "^0.8.1" } }, "node_modules/@intentius/chant-lexicon-azure": { - "version": "0.8.0", - "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-azure/-/chant-lexicon-azure-0.8.0.tgz", - "integrity": "sha512-0UgYk+9Sk19zyYU/s/2dtROipnlhfPixXi2YsH00FNWa11o9Fzm6AuLeGi9fH4Ve7GdUcL4USqDD821ZfyhOGA==", + "version": "0.8.1", + "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-azure/-/chant-lexicon-azure-0.8.1.tgz", + "integrity": "sha512-JVHdiLu4Jz5NI67HBH3hcfQY6XMeuzd/C9R3ok82I++GaLPBGOsjCuehmi55NRyB89wrrq+mTlfOpq6hQ56j7w==", "license": "Apache-2.0", "dependencies": { "fflate": "^0.8.2" }, "peerDependencies": { - "@intentius/chant": "^0.8.0" + "@intentius/chant": "^0.8.1" } }, "node_modules/@intentius/chant-lexicon-docker": { - "version": "0.8.0", - "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-docker/-/chant-lexicon-docker-0.8.0.tgz", - "integrity": "sha512-52VhsyE33P301SIwES1QojVn7qNNlb2lwU6UsnCstJ4BWR31wxApA+H3QL9ZDYlzr6vR9Mzq81x0dD2EgBK0AQ==", + "version": "0.8.1", + "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-docker/-/chant-lexicon-docker-0.8.1.tgz", + "integrity": "sha512-JC9Oe/toEON3tDDGjk+7GGss7EfhyZvDKj1nI7/+Pm+ws50dd2KLt8IUlYWi1ucOrvQJ1NU81NWOL+a11oMaVw==", "license": "Apache-2.0", "peerDependencies": { - "@intentius/chant": "^0.8.0" + "@intentius/chant": "^0.8.1" } }, "node_modules/@intentius/chant-lexicon-forgejo": { - "version": "0.8.0", - "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-forgejo/-/chant-lexicon-forgejo-0.8.0.tgz", - "integrity": "sha512-javI6iOGdjLQ3xGL036fZaIA+wIUsxbnlqOcxqsMBAlV+0AStSvZThZGZU4Z50EeYoB0W5/GLezBv48A5HuVoQ==", + "version": "0.8.1", + "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-forgejo/-/chant-lexicon-forgejo-0.8.1.tgz", + "integrity": "sha512-7EJ8VyCU23jShl9MqejEyewATvJT3G3RhPOpWZzZWqSOW+2ECrm5Bz3AJW1Wu0gxqYukrLs1ZC799HRRPBOgbQ==", "license": "Apache-2.0", "peerDependencies": { - "@intentius/chant": "^0.8.0", - "@intentius/chant-lexicon-github": "^0.8.0" + "@intentius/chant": "^0.8.1", + "@intentius/chant-lexicon-github": "^0.8.1" } }, "node_modules/@intentius/chant-lexicon-gcp": { - "version": "0.8.0", - "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-gcp/-/chant-lexicon-gcp-0.8.0.tgz", - "integrity": "sha512-Emk6BDZ83VM3w5q1kyiMonU5wksEFsYWxztWYIz4NtRC1nczK5/98tBPzFpBL/e4Ft/gCGg6ubYHcPyzguz2dg==", + "version": "0.8.1", + "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-gcp/-/chant-lexicon-gcp-0.8.1.tgz", + "integrity": "sha512-Bz5l+3P9ClqBGZOKDmvilpxKuzXWbtkg88+EAT3BheFh8j7V6vAObHWV7jLrCo9rAHSd969AzSDPmaQ93DaFkA==", "license": "Apache-2.0", "dependencies": { "@types/js-yaml": "^4.0.9", @@ -1169,26 +1169,26 @@ "js-yaml": "^4.1.0" }, "peerDependencies": { - "@intentius/chant": "^0.8.0" + "@intentius/chant": "^0.8.1" } }, "node_modules/@intentius/chant-lexicon-github": { - "version": "0.8.0", - "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-github/-/chant-lexicon-github-0.8.0.tgz", - "integrity": "sha512-ATXEQvmLCsNNluGTvguM6cgpygHaaDVW5W7Eijx9Mo7KYRGo3eMOe8krwt0waV/zLNQaPEjCnkfBmrcTBWn1Rg==", + "version": "0.8.1", + "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-github/-/chant-lexicon-github-0.8.1.tgz", + "integrity": "sha512-RURjL2BQTOb6esNghzODVL3Y5XA9SJ2D1QImtAwykAHdDuaQzmaW2jnj7UAqVcsAJKqCWkHw9kbI/NXJiYlGVg==", "license": "Apache-2.0", "peerDependencies": { - "@intentius/chant": "^0.8.0" + "@intentius/chant": "^0.8.1" } }, "node_modules/@intentius/chant-lexicon-gitlab": { - "version": "0.8.0", - "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-gitlab/-/chant-lexicon-gitlab-0.8.0.tgz", - "integrity": "sha512-JxPvyTV936sguUFEVisFW7Jc6CS5CvvuBeQ+1/k835E47AnYTf8chNabuQh1gdKrZJCTNzfH3/pTeiAEjNmpYQ==", + "version": "0.8.1", + "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-gitlab/-/chant-lexicon-gitlab-0.8.1.tgz", + "integrity": "sha512-Ep1kkGyIiCd0NXqKWGK6yPHR6smKGsUJ+JrD1xVoPDxDBimBKJljwgrAMlc7BucRd1s8zxtPi1zKCgOsAPO/kg==", "license": "Apache-2.0", "peerDependencies": { - "@intentius/chant": "^0.8.0", - "@intentius/chant-lexicon-github": "^0.8.0" + "@intentius/chant": "^0.8.1", + "@intentius/chant-lexicon-github": "^0.8.1" }, "peerDependenciesMeta": { "@intentius/chant-lexicon-github": { @@ -1197,28 +1197,28 @@ } }, "node_modules/@intentius/chant-lexicon-helm": { - "version": "0.8.0", - "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-helm/-/chant-lexicon-helm-0.8.0.tgz", - "integrity": "sha512-Qe6Wdq7H6UhEeBpxjdl04xynJAbT5mLjBiJf7X9MkfU+g7aKPGoq+yzx6/+5ZXx7kfHSTFT1ccip2NKnlExvBw==", + "version": "0.8.1", + "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-helm/-/chant-lexicon-helm-0.8.1.tgz", + "integrity": "sha512-4UmOThvnxx1K26ReaCCmv2s0tR08V26tOfW2i/R75f3rIy2qoNOQfT489OAba8c+0UC5m4j6noK4Tq6jthfAug==", "license": "Apache-2.0", "dependencies": { "@intentius/chant-lexicon-k8s": "*" }, "peerDependencies": { - "@intentius/chant": "^0.8.0" + "@intentius/chant": "^0.8.1" } }, "node_modules/@intentius/chant-lexicon-k8s": { - "version": "0.8.0", - "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.8.0.tgz", - "integrity": "sha512-FNiUT5Mt8wS9Ex6P+bmU1UbpfKayPzoTowlb40TyHqy9FEhTfowsyVv3cQVjOZEM4MV9WritliWRNYcvoTr1ug==", + "version": "0.8.1", + "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.8.1.tgz", + "integrity": "sha512-lj3hNTt5YhYu3AolIZjYNPu3U5bqTCm4HA7C5X0flxm2O26bjAE10LAyq7XxX2bvE6tNxpN4uKp6Tk4jzf5WTQ==", "license": "Apache-2.0", "dependencies": { "@types/js-yaml": "^4.0.9", "js-yaml": "^4.1.1" }, "peerDependencies": { - "@intentius/chant": "^0.8.0" + "@intentius/chant": "^0.8.1" } }, "node_modules/@jridgewell/resolve-uri": { diff --git a/package.json b/package.json index 7db7d71..2ca4153 100644 --- a/package.json +++ b/package.json @@ -14,16 +14,16 @@ "test": "vitest run" }, "dependencies": { - "@intentius/chant": "^0.8.0", - "@intentius/chant-lexicon-aws": "^0.8.0", - "@intentius/chant-lexicon-azure": "^0.8.0", - "@intentius/chant-lexicon-docker": "^0.8.0", - "@intentius/chant-lexicon-forgejo": "^0.8.0", - "@intentius/chant-lexicon-gcp": "^0.8.0", - "@intentius/chant-lexicon-github": "^0.8.0", - "@intentius/chant-lexicon-gitlab": "^0.8.0", - "@intentius/chant-lexicon-helm": "^0.8.0", - "@intentius/chant-lexicon-k8s": "^0.8.0" + "@intentius/chant": "^0.8.1", + "@intentius/chant-lexicon-aws": "^0.8.1", + "@intentius/chant-lexicon-azure": "^0.8.1", + "@intentius/chant-lexicon-docker": "^0.8.1", + "@intentius/chant-lexicon-forgejo": "^0.8.1", + "@intentius/chant-lexicon-gcp": "^0.8.1", + "@intentius/chant-lexicon-github": "^0.8.1", + "@intentius/chant-lexicon-gitlab": "^0.8.1", + "@intentius/chant-lexicon-helm": "^0.8.1", + "@intentius/chant-lexicon-k8s": "^0.8.1" }, "devDependencies": { "@cloudflare/workers-types": "^4.20260617.1", From 261c7a7dc1015c5357a8baf1659e85834427bbba Mon Sep 17 00:00:00 2001 From: lex00 <121451605+lex00@users.noreply.github.com> Date: Thu, 18 Jun 2026 00:42:30 -0600 Subject: [PATCH 2/2] feat: bind STATS KV via config (counter + rate limiting) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Workers-Builds-deployed workers can't easily add bindings in the dashboard, so declare the namespace in wrangler.toml — deploy binds it. Turns on the anonymous audit counter and per-IP/global rate limiting (both gate on env.STATS). --- wrangler.toml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/wrangler.toml b/wrangler.toml index 7f4d21a..a2adc38 100644 --- a/wrangler.toml +++ b/wrangler.toml @@ -15,7 +15,8 @@ compatibility_flags = ["nodejs_compat"] # Set with: wrangler secret put GIT_TOKEN # [vars] GIT_TOKEN is a secret, not a plain var. -# Anonymous audit counter (KV) — wired in #357 alongside rate limiting. -# [[kv_namespaces]] -# binding = "STATS" -# id = "…" +# Anonymous audit counter + per-IP/global rate limiting (#357). Bound by config +# so Workers Builds picks it up on deploy — no dashboard step. +[[kv_namespaces]] +binding = "STATS" +id = "a9d537a35aab42b19acd1f22787535a0"