The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stack-auth-hosted-components	Ready	Preview, Comment	Mar 28, 2026 0:08am
stack-backend	Ready	Preview, Comment	Mar 28, 2026 0:08am
stack-dashboard	Ready	Preview, Comment	Mar 28, 2026 0:08am
stack-demo	Ready	Preview, Comment	Mar 28, 2026 0:08am
stack-docs	Ready	Preview, Comment	Mar 28, 2026 0:08am

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Greptile Summary

This PR bumps the private apps/backend/src/private/implementation git submodule (a93d7ea → e4f32c6), which contains the reworked weighted sign-up risk engine and a new blacklist capability. The accompanying pnpm-lock.yaml diff is auto-generated and removes the now-gone packages/private workspace importer, updates nitro's peer-dep resolution to include rolldown@1.0.0-rc.3, and tightens a few eslint resolution strings.

Because the implementation lives in a private submodule that is not checked out in this review environment, the actual algorithmic changes (new weights, blacklist logic) cannot be inspected. The public-facing interface (SignUpRiskEngine, SignUpRiskScores, DerivedSignUpHeuristicFacts) is unchanged, and the open-source fallback (implementation-fallback/index.ts) still satisfies that interface by returning neutral zero scores.

Key observations:

• The SignUpRiskScores schema (bot, free_trial_abuse) and the SignUpRiskEngine interface are unchanged, so the new private implementation must satisfy the same contract.
• The inline snapshot test in risk-scores.tsx (line 150) expects { bot: 0, free_trial_abuse: 0 } for all-null/zero inputs; a sensible weighted engine with a blacklist should still return zeros for those inputs, but this cannot be verified without submodule access.
• The pnpm-lock.yaml changes appear correct and are consistent with the removal of the packages/private workspace directory.

Confidence Score: 4/5

Safe to merge assuming the private submodule satisfies the existing SignUpRiskEngine interface and the inline snapshot test passes in CI

The only changed public artifact is the lockfile, which looks correct. The private submodule's new commit cannot be reviewed here, so the score is capped at 4/5 due to limited visibility rather than any identified defect.

apps/backend/src/private/implementation — the submodule commit contains all substantive changes but is not accessible for review

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Sign-up Request] --> B[calculateSignUpRiskAssessment]
    B --> C{Private submodule available?}
    C -- Yes --> D[signUpRiskEngine.calculateRiskAssessment]
    C -- No / fallback --> E[Neutral scores bot=0, free_trial_abuse=0]
    D --> F{Weighted risk engine}
    F --> G[checkPrimaryEmailRisk via Emailable]
    F --> H[loadRecentSignUpStats from DB]
    F --> I[Blacklist check]
    G --> J[SignUpRiskAssessment scores + heuristicFacts]
    H --> J
    I --> J
    E --> J
    J --> K[Sign-up rule evaluation via CEL evaluator]
    K --> L{Blocked?}
    L -- Yes --> M[Restrict user restricted_by_admin=true]
    L -- No --> N[Allow sign-up]

_{Reviews (1): Last reviewed commit: "update submodule" | Re-trigger Greptile}