0.11.34 — the address that never arrived

The client address reached the function issuing the link through an optional parameter. The caller never passed it, so the parameter was empty always, from the day the mechanism was written. The database showed it plainly: the address column beside login tokens held not a single value.

The empty column is the milder consequence. The same address goes to the anti-bot check, where it binds the token to the machine that received it — which is precisely the part that catches a token copied and used elsewhere. The check worked, but without that part.

The address is now taken from the request inside the function itself, rather than at the caller. The parameter remains as an override, but nobody has to remember it any more — and remembering is what failed.

Fourteen type errors came along with it, all pre-existing. Nine share one cause: since TypeScript 5.7, Uint8Array is generic and by default admits a shared buffer, which Web Crypto will not accept. The rest were a missing field in a comment handler's input declaration, a hand-written props shape instead of the router's own type, `as const` on a conditional expression, and six uses of `any`.

The formatter configuration belongs to the engine as of this release. It had none before and wrapped differently from every instance — see 0.11.33.