@oneuptime/cli 14.0.74 → 14.0.76

package/build/dist/Index.js

@@ -15844,7 +15844,7 @@ var require_main = __commonJS({
     var packageJson = require_package();
     var version = packageJson.version;
     var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
-    function parse(src) {
+    function parse2(src) {
       const obj = {};
       let lines = src.toString();
       lines = lines.replace(/\r\n?/mg, "\n");
@@ -15863,7 +15863,7 @@ var require_main = __commonJS({
       }
       return obj;
     }
-    __name(parse, "parse");
+    __name(parse2, "parse");
     function _parseVault(options) {
       options = options || {};
       const vaultPath = _vaultPath(options);
@@ -16124,7 +16124,7 @@ var require_main = __commonJS({
       _parseVault,
       config,
       decrypt,
-      parse,
+      parse: parse2,
       populate
     };
     module2.exports.configDotenv = DotenvModule.configDotenv;
@@ -26318,15 +26318,15 @@ var require_parse = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     var validate_js_1 = require_validate();
-    function parse(uuid) {
+    function parse2(uuid) {
       if (!(0, validate_js_1.default)(uuid)) {
         throw TypeError("Invalid UUID");
       }
       let v;
       return Uint8Array.of((v = parseInt(uuid.slice(0, 8), 16)) >>> 24, v >>> 16 & 255, v >>> 8 & 255, v & 255, (v = parseInt(uuid.slice(9, 13), 16)) >>> 8, v & 255, (v = parseInt(uuid.slice(14, 18), 16)) >>> 8, v & 255, (v = parseInt(uuid.slice(19, 23), 16)) >>> 8, v & 255, (v = parseInt(uuid.slice(24, 36), 16)) / 1099511627776 & 255, v / 4294967296 & 255, v >>> 24 & 255, v >>> 16 & 255, v >>> 8 & 255, v & 255);
     }
-    __name(parse, "parse");
-    exports2.default = parse;
+    __name(parse2, "parse");
+    exports2.default = parse2;
   }
 });
 
@@ -76908,7 +76908,7 @@ var require_ms = __commonJS({
       options = options || {};
       var type = typeof val;
       if (type === "string" && val.length > 0) {
-        return parse(val);
+        return parse2(val);
       } else if (type === "number" && isFinite(val)) {
         return options.long ? fmtLong(val) : fmtShort(val);
       }
@@ -76916,7 +76916,7 @@ var require_ms = __commonJS({
         "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
       );
     };
-    function parse(str) {
+    function parse2(str) {
       str = String(str);
       if (str.length > 100) {
         return;
@@ -76972,7 +76972,7 @@ var require_ms = __commonJS({
           return void 0;
       }
     }
-    __name(parse, "parse");
+    __name(parse2, "parse");
     function fmtShort(ms) {
       var msAbs = Math.abs(ms);
       if (msAbs >= d) {
@@ -88421,7 +88421,7 @@ var require_parse2 = __commonJS({
     var token;
     var key;
     var root;
-    module2.exports = /* @__PURE__ */ __name(function parse(text, reviver) {
+    module2.exports = /* @__PURE__ */ __name(function parse2(text, reviver) {
       source = String(text);
       parseState = "start";
       stack = [];
@@ -89501,10 +89501,10 @@ var require_stringify2 = __commonJS({
 var require_lib2 = __commonJS({
   "../Common/node_modules/json5/lib/index.js"(exports2, module2) {
     "use strict";
-    var parse = require_parse2();
+    var parse2 = require_parse2();
     var stringify = require_stringify2();
     var JSON53 = {
-      parse,
+      parse: parse2,
       stringify
     };
     module2.exports = JSON53;
@@ -122606,6 +122606,28 @@ var import_zod_to_openapi = __toESM(require_dist());
 var Zod = external_exports;
 var Zod_default = Zod;
 
+// ../Common/Utils/RefusedValue.ts
+var MAX_REFUSED_VALUE_LENGTH = 80;
+var REFUSED_VALUE_CUT_MARK = "\u2026";
+var isSurrogatePairAt = /* @__PURE__ */ __name((text, index) => {
+  const high = text.charCodeAt(index);
+  const low = text.charCodeAt(index + 1);
+  return high >= 55296 && high <= 56319 && low >= 56320 && low <= 57343;
+}, "isSurrogatePairAt");
+var refusedValue = /* @__PURE__ */ __name((value) => {
+  let text;
+  try {
+    text = String(value);
+  } catch {
+    return "";
+  }
+  if (text.length <= MAX_REFUSED_VALUE_LENGTH) {
+    return text;
+  }
+  const end = isSurrogatePairAt(text, MAX_REFUSED_VALUE_LENGTH - 1) ? MAX_REFUSED_VALUE_LENGTH - 1 : MAX_REFUSED_VALUE_LENGTH;
+  return text.slice(0, end) + REFUSED_VALUE_CUT_MARK;
+}, "refusedValue");
+
 // ../Common/Types/Date.ts
 var Moment = import_moment_timezone.default;
 var UNIX_NANO_INTEGER_PATTERN = /^[+-]?\d+$/;
@@ -124123,7 +124145,9 @@ var OneUptimeDate = class _OneUptimeDate {
     if (date && date["value"] && typeof date["value"] === "string" && date["_type"] && (date["_type"] === "Date" || date["_type"] === "DateTime")) {
       return (0, import_moment_timezone.default)(date["value"]).toDate();
     }
-    throw new BadDataException("Invalid date: " + date?.toString());
+    throw new BadDataException(
+      "Invalid date: " + refusedValue(date?.toString())
+    );
   }
   static asDateForDatabaseQuery(date) {
     const formatstring = "YYYY-MM-DD";
@@ -125060,7 +125084,7 @@ var Hostname = class _Hostname extends DatabaseProperty {
       this._route = value;
     } else {
       throw new BadDataException(
-        "Hostname " + value + " is not in valid format."
+        "Hostname " + refusedValue(value) + " is not in valid format."
       );
     }
   }
@@ -125270,11 +125294,11 @@ var Route = class _Route extends DatabaseProperty {
   }
   static validateRoute(route) {
     if (_Route.hasSchemePrefix(route)) {
-      throw new BadDataException(`Invalid route: ${route}`);
+      throw new BadDataException(`Invalid route: ${refusedValue(route)}`);
     }
     const matchRouteCharacters = /^[a-zA-Z_\d\-!#$%&'()*+,./:;=?@[\]~]*$/;
     if (route && !matchRouteCharacters.test(route)) {
-      throw new BadDataException(`Invalid route: ${route}`);
+      throw new BadDataException(`Invalid route: ${refusedValue(route)}`);
     }
   }
   get route() {
@@ -125371,10 +125395,24 @@ var nonBusinessEmailDomains = [
   "zoho",
   "yandex"
 ];
+var MAX_EMAIL_ADDRESS_LENGTH = 254;
+var ONE_EMAIL_ADDRESS = (
+  // eslint-disable-next-line no-control-regex
+  /^(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[[a-z0-9:._-]{1,64}\])$/i
+);
 var Email = class _Email extends DatabaseProperty {
   constructor(email) {
     super();
     this._email = "";
+    /*
+     * Set only by the lenient read paths (fromDatabase / fromJSON) when a stored
+     * value is not one valid mailbox. Such an Email keeps its raw string so it
+     * still round-trips and still renders, but toDatabase refuses it, so a value
+     * that is not a single address can never be written back or newly created -
+     * only a value already stored before this check existed can carry the flag.
+     * This mirrors how URL keeps a legacy value it can no longer parse.
+     */
+    this._isMalformed = false;
     this.email = email;
   }
   static {
@@ -125384,26 +125422,52 @@ var Email = class _Email extends DatabaseProperty {
     return this._email;
   }
   set email(value) {
+    if (value instanceof _Email) {
+      value = value.toString();
+    }
     if (value && typeof value === "string") {
       value = value.trim();
       value = value.toLowerCase();
     }
     if (_Email.isValid(value)) {
       this._email = value;
+      this._isMalformed = false;
     } else {
-      throw new BadDataException(`Email ${value} is not in valid format.`);
+      throw new BadDataException(
+        `Email ${refusedValue(value)} is not in valid format.`
+      );
     }
   }
+  isMalformed() {
+    return this._isMalformed;
+  }
   static isValid(value) {
-    const re = (
-      // eslint-disable-next-line no-control-regex
-      /(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9])|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])/i
-    );
-    const isValid2 = re.test(value);
-    if (!isValid2) {
+    if (typeof value !== "string" || !value || value.length > MAX_EMAIL_ADDRESS_LENGTH) {
       return false;
     }
-    return true;
+    return ONE_EMAIL_ADDRESS.test(value);
+  }
+  /*
+   * A read-only path: builds an Email from a value already stored, holding it
+   * as-is when it is not one valid mailbox, so a single legacy row cannot fail
+   * the whole query that reads it. Writes stay strict - see toDatabase. A
+   * stored address is always text, so anything else is refused here as it
+   * always was.
+   */
+  static fromStoredValueLenient(value) {
+    if (typeof value !== "string") {
+      throw new BadDataException(
+        `Email ${refusedValue(value)} is not in valid format.`
+      );
+    }
+    const trimmed = value.trim().toLowerCase();
+    if (_Email.isValid(trimmed)) {
+      return new _Email(trimmed);
+    }
+    const email = new _Email("placeholder@oneuptime.invalid");
+    email._email = trimmed;
+    email._isMalformed = true;
+    return email;
   }
   toJSON() {
     return {
@@ -125455,7 +125519,13 @@ var Email = class _Email extends DatabaseProperty {
   }
   static fromJSON(json) {
     if (json["_type"] === "Email" /* Email */) {
-      return new _Email(json["value"] || "");
+      const value = json["value"];
+      if (typeof value !== "string" || !value.trim()) {
+        throw new BadDataException(
+          `Email ${refusedValue(value ?? "")} is not in valid format.`
+        );
+      }
+      return _Email.fromStoredValueLenient(value);
     }
     throw new BadDataException("Invalid JSON: " + JSON.stringify(json));
   }
@@ -125481,13 +125551,21 @@ var Email = class _Email extends DatabaseProperty {
       if (typeof value === "string") {
         value = new _Email(value);
       }
+      if (value instanceof _Email && value.isMalformed()) {
+        throw new BadDataException(
+          `Email ${refusedValue(value.toString())} is not in valid format.`
+        );
+      }
       return value.toString();
     }
     return null;
   }
   static fromDatabase(_value) {
-    if (_value) {
-      return new _Email(_value);
+    if (_value instanceof _Email) {
+      _value = _value.toString();
+    }
+    if (_value && (typeof _value !== "string" || _value.trim())) {
+      return _Email.fromStoredValueLenient(_value);
     }
     return null;
   }
@@ -125605,7 +125683,7 @@ var URL2 = class _URL extends DatabaseProperty {
     const value = v.trim();
     if (!_URL.isValidOpaqueValue(value)) {
       throw new BadDataException(
-        "Phone number " + v + " is not in valid format."
+        "Phone number " + refusedValue(v) + " is not in valid format."
       );
     }
     this._opaqueValue = value;
@@ -125743,7 +125821,7 @@ var URL2 = class _URL extends DatabaseProperty {
     ].includes(scheme);
     if (hasAuthorityMarker || isDangerousInAnHref) {
       throw new BadDataException(
-        "URL scheme " + scheme + ": is not supported."
+        "URL scheme " + refusedValue(scheme) + ": is not supported."
       );
     }
   }
@@ -125902,7 +125980,7 @@ var URL2 = class _URL extends DatabaseProperty {
       }
       if (value instanceof _URL && value.isMalformed()) {
         throw new BadDataException(
-          "URL " + value.toString() + " is not in valid format."
+          "URL " + refusedValue(value.toString()) + " is not in valid format."
         );
       }
       return value.toString();
@@ -126865,7 +126943,9 @@ var Color = class _Color extends DatabaseProperty {
     const re = /^#?([a-f\d]{2})([a-f\d]{2})([a-f\d]{2})$/i;
     const result = re.exec(color.toString());
     if (!result) {
-      throw new BadDataException("Invalid color: " + color.toString());
+      throw new BadDataException(
+        "Invalid color: " + refusedValue(color.toString())
+      );
     }
     return {
       red: parseInt(result[1] ? result[1] : "0", 16),
@@ -126946,7 +127026,9 @@ var Domain = class _Domain extends DatabaseProperty {
   set domain(v) {
     const isValid2 = _Domain.isValidDomain(v);
     if (!isValid2) {
-      throw new BadDataException("Domain " + v + " is not in valid format.");
+      throw new BadDataException(
+        "Domain " + refusedValue(v) + " is not in valid format."
+      );
     }
     this._domain = v;
   }
@@ -127697,7 +127779,7 @@ var ObjectID = class _ObjectID extends DatabaseProperty {
   static validateUUID(id) {
     if (!_ObjectID.isValidUUID(id.toString())) {
       throw new BadDataException(
-        `Invalid ID format: "${id}". Expected a valid UUID (e.g., "550e8400-e29b-41d4-a716-446655440000").`
+        `Invalid ID format: "${refusedValue(id)}". Expected a valid UUID (e.g., "550e8400-e29b-41d4-a716-446655440000").`
       );
     }
   }
@@ -135749,7 +135831,9 @@ var Phone = class _Phone extends DatabaseProperty {
     const re = /^[+]?[(]?[0-9]{3}[)]?[-\s.]?[0-9]{3}[-\s.]?[0-9]{4,7}$/;
     const isValid2 = re.test(v);
     if (!isValid2) {
-      throw new BadDataException(`Phone is not in valid format: ${v}`);
+      throw new BadDataException(
+        `Phone is not in valid format: ${refusedValue(v)}`
+      );
     }
     this._phone = v;
   }
@@ -344951,6 +345035,10 @@ var StatusPageSCIM = class extends DatabaseBaseModel {
     this.name = void 0;
     this.description = void 0;
     this.bearerToken = void 0;
+    this.oauthClientSecretHash = void 0;
+    this.oauthClientSecretExpiresAt = void 0;
+    this.oauthPreviousClientSecretHash = void 0;
+    this.oauthPreviousClientSecretExpiresAt = void 0;
     this.autoProvisionUsers = void 0;
     this.autoDeprovisionUsers = void 0;
     this.createdByUser = void 0;
@@ -345187,6 +345275,118 @@ __decorateClass([
     length: ColumnLength_default.LongText
   })
 ], StatusPageSCIM.prototype, "bearerToken", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [
+      Permission_default.ProjectOwner,
+      Permission_default.ProjectAdmin,
+      Permission_default.CreateStatusPageSSO
+    ],
+    read: [],
+    update: [
+      Permission_default.ProjectOwner,
+      Permission_default.ProjectAdmin,
+      Permission_default.EditStatusPageSSO
+    ]
+  }),
+  TableColumn_default({
+    required: false,
+    hideColumnInDocumentation: true,
+    type: TableColumnType_default.LongText,
+    title: "OAuth Client Secret Hash",
+    description: "SHA-256 hash of the connection's OAuth 2.0 client secret. The secret itself is shown once, when it is made, and never kept."
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText
+  })
+], StatusPageSCIM.prototype, "oauthClientSecretHash", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [
+      Permission_default.ProjectOwner,
+      Permission_default.ProjectAdmin,
+      Permission_default.CreateStatusPageSSO
+    ],
+    read: [
+      Permission_default.ProjectOwner,
+      Permission_default.ProjectAdmin,
+      Permission_default.ReadStatusPageSSO
+    ],
+    update: [
+      Permission_default.ProjectOwner,
+      Permission_default.ProjectAdmin,
+      Permission_default.EditStatusPageSSO
+    ]
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.Date,
+    title: "OAuth Client Secret Expires At",
+    description: "When the connection's OAuth 2.0 client secret stops working. No access token is issued with an expired secret."
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.Date
+  })
+], StatusPageSCIM.prototype, "oauthClientSecretExpiresAt", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [
+      Permission_default.ProjectOwner,
+      Permission_default.ProjectAdmin,
+      Permission_default.CreateStatusPageSSO
+    ],
+    read: [],
+    update: [
+      Permission_default.ProjectOwner,
+      Permission_default.ProjectAdmin,
+      Permission_default.EditStatusPageSSO
+    ]
+  }),
+  TableColumn_default({
+    required: false,
+    hideColumnInDocumentation: true,
+    type: TableColumnType_default.LongText,
+    title: "Previous OAuth Client Secret Hash",
+    description: "SHA-256 hash of the client secret the current one replaced, which keeps working until it expires or is deleted."
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText
+  })
+], StatusPageSCIM.prototype, "oauthPreviousClientSecretHash", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [
+      Permission_default.ProjectOwner,
+      Permission_default.ProjectAdmin,
+      Permission_default.CreateStatusPageSSO
+    ],
+    read: [
+      Permission_default.ProjectOwner,
+      Permission_default.ProjectAdmin,
+      Permission_default.ReadStatusPageSSO
+    ],
+    update: [
+      Permission_default.ProjectOwner,
+      Permission_default.ProjectAdmin,
+      Permission_default.EditStatusPageSSO
+    ]
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.Date,
+    title: "Previous OAuth Client Secret Expires At",
+    description: "When the previous OAuth 2.0 client secret stops working, unless it is deleted before."
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.Date
+  })
+], StatusPageSCIM.prototype, "oauthPreviousClientSecretExpiresAt", 2);
 __decorateClass([
   ColumnAccessControl_default({
     create: [
@@ -353825,6 +354025,200 @@ UserProjectSsoConsent = __decorateClass([
   })
 ], UserProjectSsoConsent);
 
+// ../Common/Models/DatabaseModels/UserProjectSsoIdentity.ts
+var UserProjectSsoIdentity = class extends DatabaseBaseModel {
+  constructor() {
+    super(...arguments);
+    this.user = void 0;
+    this.userId = void 0;
+    this.project = void 0;
+    this.projectId = void 0;
+    this.projectSso = void 0;
+    this.projectSsoId = void 0;
+    this.objectId = void 0;
+  }
+};
+__name(UserProjectSsoIdentity, "UserProjectSsoIdentity");
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    manyToOneRelationColumn: "userId",
+    type: TableColumnType_default.Entity,
+    modelType: User_default,
+    title: "User",
+    description: "The account that is bound."
+  }),
+  ManyToOne(
+    () => {
+      return User_default;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify"
+    }
+  ),
+  JoinColumn({ name: "userId" })
+], UserProjectSsoIdentity.prototype, "user", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index(),
+  TableColumn_default({
+    type: TableColumnType_default.ObjectID,
+    required: true,
+    title: "User ID",
+    description: "ID of the account that is bound."
+  }),
+  Column({
+    type: ColumnType_default.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer()
+  })
+], UserProjectSsoIdentity.prototype, "userId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    manyToOneRelationColumn: "projectId",
+    type: TableColumnType_default.Entity,
+    modelType: Project,
+    title: "Project",
+    description: "The project whose SAML provider the account signs in through."
+  }),
+  ManyToOne(
+    () => {
+      return Project;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify"
+    }
+  ),
+  JoinColumn({ name: "projectId" })
+], UserProjectSsoIdentity.prototype, "project", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index(),
+  TableColumn_default({
+    type: TableColumnType_default.ObjectID,
+    required: true,
+    title: "Project ID",
+    description: "ID of the project whose SAML provider the account signs in through."
+  }),
+  Column({
+    type: ColumnType_default.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer()
+  })
+], UserProjectSsoIdentity.prototype, "projectId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    manyToOneRelationColumn: "projectSsoId",
+    type: TableColumnType_default.Entity,
+    modelType: ProjectSSO,
+    title: "Project SSO",
+    description: "The SAML provider the binding holds for."
+  }),
+  ManyToOne(
+    () => {
+      return ProjectSSO;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify"
+    }
+  ),
+  JoinColumn({ name: "projectSsoId" })
+], UserProjectSsoIdentity.prototype, "projectSso", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index(),
+  TableColumn_default({
+    type: TableColumnType_default.ObjectID,
+    required: true,
+    title: "Project SSO ID",
+    description: "ID of the SAML provider the binding holds for."
+  }),
+  Column({
+    type: ColumnType_default.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer()
+  })
+], UserProjectSsoIdentity.prototype, "projectSsoId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    type: TableColumnType_default.ShortText,
+    required: true,
+    title: "Object ID",
+    description: "The identity provider's immutable ID for the person: Microsoft Entra ID's object ID, a GUID kept in lower case."
+  }),
+  Column({
+    type: ColumnType_default.ShortText,
+    length: ColumnLength_default.ShortText,
+    nullable: false
+  })
+], UserProjectSsoIdentity.prototype, "objectId", 2);
+UserProjectSsoIdentity = __decorateClass([
+  TableAccessControl_default({
+    create: [],
+    read: [],
+    delete: [],
+    update: []
+  }),
+  Index(
+    "IDX_UserProjectSsoIdentity_projectSsoId_userId",
+    ["projectSsoId", "userId"],
+    {
+      unique: true,
+      where: '"deletedAt" IS NULL'
+    }
+  ),
+  TableMetadata_default({
+    tableName: "UserProjectSsoIdentity",
+    singularName: "Project SSO Identity",
+    pluralName: "Project SSO Identities",
+    icon: IconProp_default.Lock,
+    tableDescription: "Binds an account to the identity provider's immutable ID for the person it signed in as through a project's SAML provider."
+  }),
+  Entity({
+    name: "UserProjectSsoIdentity"
+  })
+], UserProjectSsoIdentity);
+
 // ../Common/Models/DatabaseModels/UserNotificationSetting.ts
 var UserNotificationSetting = class extends DatabaseBaseModel {
   constructor() {
@@ -447487,6 +447881,10 @@ var ProjectSCIM = class extends DatabaseBaseModel {
     this.name = void 0;
     this.description = void 0;
     this.bearerToken = void 0;
+    this.oauthClientSecretHash = void 0;
+    this.oauthClientSecretExpiresAt = void 0;
+    this.oauthPreviousClientSecretHash = void 0;
+    this.oauthPreviousClientSecretExpiresAt = void 0;
     this.teams = void 0;
     this.autoProvisionUsers = void 0;
     this.autoDeprovisionUsers = void 0;
@@ -447636,6 +448034,78 @@ __decorateClass([
     length: ColumnLength_default.LongText
   })
 ], ProjectSCIM.prototype, "bearerToken", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [Permission_default.ProjectOwner],
+    read: [],
+    update: [Permission_default.ProjectOwner]
+  }),
+  TableColumn_default({
+    required: false,
+    hideColumnInDocumentation: true,
+    type: TableColumnType_default.LongText,
+    title: "OAuth Client Secret Hash",
+    description: "SHA-256 hash of the connection's OAuth 2.0 client secret. The secret itself is shown once, when it is made, and never kept."
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText
+  })
+], ProjectSCIM.prototype, "oauthClientSecretHash", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [Permission_default.ProjectOwner],
+    read: [Permission_default.ProjectOwner],
+    update: [Permission_default.ProjectOwner]
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.Date,
+    title: "OAuth Client Secret Expires At",
+    description: "When the connection's OAuth 2.0 client secret stops working. No access token is issued with an expired secret."
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.Date
+  })
+], ProjectSCIM.prototype, "oauthClientSecretExpiresAt", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [Permission_default.ProjectOwner],
+    read: [],
+    update: [Permission_default.ProjectOwner]
+  }),
+  TableColumn_default({
+    required: false,
+    hideColumnInDocumentation: true,
+    type: TableColumnType_default.LongText,
+    title: "Previous OAuth Client Secret Hash",
+    description: "SHA-256 hash of the client secret the current one replaced, which keeps working until it expires or is deleted."
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText
+  })
+], ProjectSCIM.prototype, "oauthPreviousClientSecretHash", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [Permission_default.ProjectOwner],
+    read: [Permission_default.ProjectOwner],
+    update: [Permission_default.ProjectOwner]
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.Date,
+    title: "Previous OAuth Client Secret Expires At",
+    description: "When the previous OAuth 2.0 client secret stops working, unless it is deleted before."
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.Date
+  })
+], ProjectSCIM.prototype, "oauthPreviousClientSecretExpiresAt", 2);
 __decorateClass([
   ColumnAccessControl_default({
     create: [Permission_default.ProjectOwner],
@@ -448364,6 +448834,256 @@ ProjectSCIMLog = __decorateClass([
   })
 ], ProjectSCIMLog);
 
+// ../Common/Models/DatabaseModels/ProjectSCIMUser.ts
+var ProjectSCIMUser = class extends DatabaseBaseModel {
+  constructor() {
+    super(...arguments);
+    this.project = void 0;
+    this.projectId = void 0;
+    this.projectScim = void 0;
+    this.projectScimId = void 0;
+    this.user = void 0;
+    this.userId = void 0;
+    this.isActive = void 0;
+    this.userName = void 0;
+    this.externalId = void 0;
+    this.scimAttributes = void 0;
+  }
+};
+__name(ProjectSCIMUser, "ProjectSCIMUser");
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    manyToOneRelationColumn: "projectId",
+    type: TableColumnType_default.Entity,
+    modelType: Project,
+    title: "Project",
+    description: "The project the connection belongs to."
+  }),
+  ManyToOne(
+    () => {
+      return Project;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify"
+    }
+  ),
+  JoinColumn({ name: "projectId" })
+], ProjectSCIMUser.prototype, "project", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index(),
+  TableColumn_default({
+    type: TableColumnType_default.ObjectID,
+    required: true,
+    title: "Project ID",
+    description: "ID of the project the connection belongs to."
+  }),
+  Column({
+    type: ColumnType_default.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer()
+  })
+], ProjectSCIMUser.prototype, "projectId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    manyToOneRelationColumn: "projectScimId",
+    type: TableColumnType_default.Entity,
+    modelType: ProjectSCIM,
+    title: "SCIM Connection",
+    description: "The connection that provisioned the user."
+  }),
+  ManyToOne(
+    () => {
+      return ProjectSCIM;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify"
+    }
+  ),
+  JoinColumn({ name: "projectScimId" })
+], ProjectSCIMUser.prototype, "projectScim", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index(),
+  TableColumn_default({
+    type: TableColumnType_default.ObjectID,
+    required: true,
+    title: "SCIM Connection ID",
+    description: "ID of the connection that provisioned the user."
+  }),
+  Column({
+    type: ColumnType_default.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer()
+  })
+], ProjectSCIMUser.prototype, "projectScimId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    manyToOneRelationColumn: "userId",
+    type: TableColumnType_default.Entity,
+    modelType: User_default,
+    title: "User",
+    description: "The OneUptime account the SCIM user is."
+  }),
+  ManyToOne(
+    () => {
+      return User_default;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify"
+    }
+  ),
+  JoinColumn({ name: "userId" })
+], ProjectSCIMUser.prototype, "user", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index(),
+  TableColumn_default({
+    type: TableColumnType_default.ObjectID,
+    required: true,
+    title: "User ID",
+    description: "ID of the OneUptime account the SCIM user is."
+  }),
+  Column({
+    type: ColumnType_default.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer()
+  })
+], ProjectSCIMUser.prototype, "userId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    type: TableColumnType_default.Boolean,
+    required: true,
+    title: "Active",
+    description: "Whether the identity provider has the user active (SCIM's active attribute)."
+  }),
+  Column({
+    type: ColumnType_default.Boolean,
+    nullable: false,
+    default: true
+  })
+], ProjectSCIMUser.prototype, "isActive", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    type: TableColumnType_default.LongText,
+    required: false,
+    title: "User Name",
+    description: "The userName the identity provider sent, as it sent it. Usually the account's email address."
+  }),
+  Column({
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText,
+    nullable: true
+  })
+], ProjectSCIMUser.prototype, "userName", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    type: TableColumnType_default.LongText,
+    required: false,
+    title: "External ID",
+    description: "The identity provider's own id for the user (SCIM's externalId), as it sent it."
+  }),
+  Column({
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText,
+    nullable: true
+  })
+], ProjectSCIMUser.prototype, "externalId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    type: TableColumnType_default.JSON,
+    required: false,
+    title: "SCIM Attributes",
+    description: "The rest of what the identity provider last sent for the user: displayName, name and emails."
+  }),
+  Column({
+    type: ColumnType_default.JSON,
+    nullable: true
+  })
+], ProjectSCIMUser.prototype, "scimAttributes", 2);
+ProjectSCIMUser = __decorateClass([
+  TableAccessControl_default({
+    create: [],
+    read: [],
+    delete: [],
+    update: []
+  }),
+  Index(
+    "IDX_ProjectSCIMUser_projectScimId_userId",
+    ["projectScimId", "userId"],
+    {
+      unique: true,
+      where: '"deletedAt" IS NULL'
+    }
+  ),
+  TableMetadata_default({
+    tableName: "ProjectSCIMUser",
+    singularName: "SCIM User",
+    pluralName: "SCIM Users",
+    icon: IconProp_default.User,
+    tableDescription: "A user a project's SCIM connection provisioned: whether the identity provider has them active, and what it sent for them."
+  }),
+  Entity({
+    name: "ProjectSCIMUser"
+  })
+], ProjectSCIMUser);
+
 // ../Common/Models/DatabaseModels/StatusPageSCIMLog.ts
 var StatusPageSCIMLog = class extends DatabaseBaseModel {
   constructor() {
@@ -450322,6 +451042,479 @@ MarketplaceCharge = __decorateClass([
   })
 ], MarketplaceCharge);
 
+// ../Common/Models/DatabaseModels/VercelMarketplaceInstallation.ts
+var VercelMarketplaceInstallation = class extends DatabaseBaseModel {
+  constructor() {
+    super(...arguments);
+    this.installationId = void 0;
+    this.vercelAccountId = void 0;
+    this.accessToken = void 0;
+    this.tokenType = void 0;
+    this.scopes = void 0;
+    this.acceptedPolicies = void 0;
+    this.accountName = void 0;
+    this.accountUrl = void 0;
+    this.contactEmail = void 0;
+    this.contactName = void 0;
+    this.status = void 0;
+    this.deleteRequestedAt = void 0;
+    this.invoicedUntil = void 0;
+    this.billingDataSentAt = void 0;
+    this.lastBillingError = void 0;
+  }
+};
+__name(VercelMarketplaceInstallation, "VercelMarketplaceInstallation");
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index({ unique: true }),
+  TableColumn_default({
+    required: true,
+    type: TableColumnType_default.ShortText,
+    title: "Installation ID",
+    description: "Vercel's ID of the installation (icfg_...). A reinstall gets a new one.",
+    example: "icfg_7BsYazjxsiKpsDTXiAUcOJmP"
+  }),
+  Column({
+    nullable: false,
+    type: ColumnType_default.ShortText,
+    length: ColumnLength_default.ShortText
+  })
+], VercelMarketplaceInstallation.prototype, "installationId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index(),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.ShortText,
+    title: "Vercel Account ID",
+    description: "The Vercel team (account) that installed OneUptime.",
+    example: "team_LLHUOMOoDlqOp8wPE4kFo9pE"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.ShortText,
+    length: ColumnLength_default.ShortText
+  })
+], VercelMarketplaceInstallation.prototype, "vercelAccountId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.VeryLongText,
+    encrypted: true,
+    title: "Access Token",
+    description: "The token Vercel gave OneUptime for this installation, which calls Vercel's marketplace API. Encrypted at rest and never returned by the API.",
+    hideColumnInDocumentation: true
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.VeryLongText
+  })
+], VercelMarketplaceInstallation.prototype, "accessToken", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.ShortText,
+    title: "Token Type",
+    description: "The access token's type, as Vercel gave it (Bearer).",
+    example: "Bearer"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.ShortText,
+    length: ColumnLength_default.ShortText
+  })
+], VercelMarketplaceInstallation.prototype, "tokenType", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.JSON,
+    title: "Scopes",
+    description: "The Vercel API scopes the team granted the integration, such as read:project."
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.JSON
+  })
+], VercelMarketplaceInstallation.prototype, "scopes", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.JSON,
+    title: "Accepted Policies",
+    description: "The policies the team accepted while installing (terms of service, privacy policy...), with when.",
+    example: { toc: "2026-10-18T10:00:00Z" }
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.JSON
+  })
+], VercelMarketplaceInstallation.prototype, "acceptedPolicies", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.LongText,
+    title: "Account Name",
+    description: "The Vercel team's name.",
+    example: "Acme"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText
+  })
+], VercelMarketplaceInstallation.prototype, "accountName", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.LongText,
+    title: "Account URL",
+    description: "The installation in the Vercel dashboard.",
+    example: "https://vercel.com/acme/~/integrations/oneuptime"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText
+  })
+], VercelMarketplaceInstallation.prototype, "accountUrl", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.Email,
+    title: "Contact Email",
+    description: "Who Vercel names as the team's contact for the installation.",
+    example: "owner@acme.com"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.Email,
+    length: ColumnLength_default.Email
+  })
+], VercelMarketplaceInstallation.prototype, "contactEmail", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.LongText,
+    title: "Contact Name",
+    description: "The contact's name, where Vercel gives one.",
+    example: "Ada Lovelace"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText
+  })
+], VercelMarketplaceInstallation.prototype, "contactName", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index(),
+  TableColumn_default({
+    required: true,
+    type: TableColumnType_default.ShortText,
+    title: "Status",
+    description: "Active, DeletePending (uninstalled; the final invoice is still to be sent) or Deleted.",
+    example: "Active"
+  }),
+  Column({
+    nullable: false,
+    type: ColumnType_default.ShortText,
+    length: ColumnLength_default.ShortText
+  })
+], VercelMarketplaceInstallation.prototype, "status", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.Date,
+    title: "Delete Requested At",
+    description: "When Vercel asked OneUptime to delete the installation.",
+    example: "2026-10-18T10:00:00.000Z"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.Date
+  })
+], VercelMarketplaceInstallation.prototype, "deleteRequestedAt", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.Date,
+    title: "Invoiced Until",
+    description: "The end of the last period OneUptime sent Vercel an invoice for. The next invoice starts here.",
+    example: "2026-10-01T00:00:00.000Z"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.Date
+  })
+], VercelMarketplaceInstallation.prototype, "invoicedUntil", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.Date,
+    title: "Billing Data Sent At",
+    description: "When OneUptime last sent Vercel the running totals of the current period.",
+    example: "2026-10-18T10:10:00.000Z"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.Date
+  })
+], VercelMarketplaceInstallation.prototype, "billingDataSentAt", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.LongText,
+    title: "Last Billing Error",
+    description: "Why Vercel last refused, or could not be sent, this installation's usage or invoice. Empty once one goes through."
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText
+  })
+], VercelMarketplaceInstallation.prototype, "lastBillingError", 2);
+VercelMarketplaceInstallation = __decorateClass([
+  TableAccessControl_default({
+    create: [],
+    read: [],
+    update: [],
+    delete: []
+  }),
+  CrudApiEndpoint_default(new Route("/vercel-marketplace-installation")),
+  TableMetadata_default({
+    tableName: "VercelMarketplaceInstallation",
+    singularName: "Vercel Marketplace Installation",
+    pluralName: "Vercel Marketplace Installations",
+    icon: IconProp_default.Billing,
+    tableDescription: "Vercel teams that installed OneUptime from Vercel Marketplace, and the access token OneUptime calls Vercel with for them."
+  }),
+  Entity({
+    name: "VercelMarketplaceInstallation"
+  })
+], VercelMarketplaceInstallation);
+
+// ../Common/Models/DatabaseModels/VercelMarketplaceConnection.ts
+var VercelMarketplaceConnection = class extends DatabaseBaseModel {
+  constructor() {
+    super(...arguments);
+    this.marketplaceSubscriptionId = void 0;
+    this.projectId = void 0;
+    this.vercelProjectId = void 0;
+    this.vercelProjectName = void 0;
+    this.productionDomain = void 0;
+    this.monitorId = void 0;
+  }
+};
+__name(VercelMarketplaceConnection, "VercelMarketplaceConnection");
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index(),
+  TableColumn_default({
+    required: true,
+    type: TableColumnType_default.ObjectID,
+    title: "Marketplace Subscription ID",
+    description: "The resource the Vercel project is connected to: its marketplace purchase.",
+    example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+  }),
+  Column({
+    nullable: false,
+    type: ColumnType_default.ObjectID,
+    transformer: ObjectID.getDatabaseTransformer()
+  })
+], VercelMarketplaceConnection.prototype, "marketplaceSubscriptionId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  Index(),
+  TableColumn_default({
+    required: true,
+    type: TableColumnType_default.ObjectID,
+    title: "Project ID",
+    description: "The OneUptime project of the resource.",
+    example: "5f8b9c0d-e1f2-3a4b-5c6d-7e8f9a0b1c2d"
+  }),
+  Column({
+    nullable: false,
+    type: ColumnType_default.ObjectID,
+    transformer: ObjectID.getDatabaseTransformer()
+  })
+], VercelMarketplaceConnection.prototype, "projectId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: true,
+    type: TableColumnType_default.ShortText,
+    title: "Vercel Project ID",
+    description: "The connected Vercel project.",
+    example: "prj_ndlgr43fadlPyCtREAqxxdyFK"
+  }),
+  Column({
+    nullable: false,
+    type: ColumnType_default.ShortText,
+    length: ColumnLength_default.ShortText
+  })
+], VercelMarketplaceConnection.prototype, "vercelProjectId", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.LongText,
+    title: "Vercel Project Name",
+    description: "The Vercel project's name, as Vercel last gave it.",
+    example: "storefront"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText
+  })
+], VercelMarketplaceConnection.prototype, "vercelProjectName", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.LongText,
+    title: "Production Domain",
+    description: "The Vercel project's production domain, which the monitor checks. Empty until the project has one.",
+    example: "storefront.vercel.app"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.LongText,
+    length: ColumnLength_default.LongText
+  })
+], VercelMarketplaceConnection.prototype, "productionDomain", 2);
+__decorateClass([
+  ColumnAccessControl_default({
+    create: [],
+    read: [],
+    update: []
+  }),
+  TableColumn_default({
+    required: false,
+    type: TableColumnType_default.ObjectID,
+    title: "Monitor ID",
+    description: "The website monitor OneUptime made for the production domain, if it made one.",
+    example: "b1c2d3e4-f5a6-7890-abcd-ef1234567890"
+  }),
+  Column({
+    nullable: true,
+    type: ColumnType_default.ObjectID,
+    transformer: ObjectID.getDatabaseTransformer()
+  })
+], VercelMarketplaceConnection.prototype, "monitorId", 2);
+VercelMarketplaceConnection = __decorateClass([
+  TableAccessControl_default({
+    create: [],
+    read: [],
+    update: [],
+    delete: []
+  }),
+  CrudApiEndpoint_default(new Route("/vercel-marketplace-connection")),
+  TableMetadata_default({
+    tableName: "VercelMarketplaceConnection",
+    singularName: "Vercel Marketplace Connection",
+    pluralName: "Vercel Marketplace Connections",
+    icon: IconProp_default.Link,
+    tableDescription: "Vercel projects connected to a OneUptime resource from Vercel Marketplace, and the monitor that watches each one's production domain."
+  }),
+  Entity({
+    name: "VercelMarketplaceConnection"
+  }),
+  Index(["marketplaceSubscriptionId", "vercelProjectId"], { unique: true })
+], VercelMarketplaceConnection);
+
 // ../Common/Models/DatabaseModels/UserNotificationEmailRollupItem.ts
 var UserNotificationEmailRollupItem = class extends DatabaseBaseModel {
   constructor() {
@@ -452224,6 +453417,7 @@ var AllModelTypes = [
   DataSource2,
   UserSession_default,
   UserProjectSsoConsent,
+  UserProjectSsoIdentity,
   UserTotpAuth_default,
   UserTwoFactorBackupCode_default,
   UserWebAuthn_default,
@@ -452263,6 +453457,7 @@ var AllModelTypes = [
   OnCallDutyPolicyTimeLog,
   ProjectSCIM,
   ProjectSCIMLog,
+  ProjectSCIMUser,
   StatusPageSCIMLog,
   KubernetesCluster,
   KubernetesAiAgent,
@@ -452369,6 +453564,8 @@ var AllModelTypes = [
   MarketplaceSubscription,
   MarketplaceUsageReport,
   MarketplaceCharge,
+  VercelMarketplaceInstallation,
+  VercelMarketplaceConnection,
   UserNotificationEmailRollupItem,
   UserNotificationEmailRollupBatch,
   UserNotificationEmailRollupSetting_default,
@@ -471841,6 +473038,71 @@ var HTTPResponseBodyReader = class {
   }
 };
 
+// ../Common/Utils/SameServerRedirect.ts
+function parse(address) {
+  try {
+    return new globalThis.URL(address);
+  } catch {
+    return null;
+  }
+}
+__name(parse, "parse");
+function isServerAddress(address) {
+  return (address.protocol === "http:" || address.protocol === "https:") && address.hostname !== "";
+}
+__name(isServerAddress, "isServerAddress");
+function namesAUser(address) {
+  return address.username !== "" || address.password !== "";
+}
+__name(namesAUser, "namesAUser");
+var isRedirectOnSameServer = /* @__PURE__ */ __name((requestUrl, redirectUrl) => {
+  const from = parse(requestUrl);
+  const to = parse(redirectUrl);
+  if (!from || !to || !isServerAddress(from) || !isServerAddress(to) || namesAUser(to)) {
+    return false;
+  }
+  if (to.hostname !== from.hostname) {
+    return false;
+  }
+  if (to.protocol === from.protocol) {
+    return to.port === from.port;
+  }
+  return from.protocol === "http:" && to.protocol === "https:" && from.port === "" && to.port === "";
+}, "isRedirectOnSameServer");
+function originOf(address) {
+  const parsed = parse(address);
+  if (!parsed || parsed.origin === "null") {
+    return null;
+  }
+  return parsed.origin;
+}
+__name(originOf, "originOf");
+var RedirectOffServerError = class extends Error {
+  static {
+    __name(this, "RedirectOffServerError");
+  }
+  constructor(data) {
+    const from = originOf(data.requestUrl) || "its server";
+    const to = originOf(data.redirectUrl);
+    super(
+      to ? `The request to ${from} was redirected to ${to}, another server, so it was not sent on: a request that carries a key follows redirects only on the server it was sent to. If the server is at ${to}, set its address to that.` : `The request to ${from} was redirected to an address that could not be read, so it was not sent on: a request that carries a key follows redirects only on the server it was sent to.`
+    );
+    this.name = "RedirectOffServerError";
+  }
+};
+var getSameServerRedirectCheck = /* @__PURE__ */ __name((requestUrl) => {
+  return (redirectOptions) => {
+    const href = redirectOptions["href"];
+    const redirectUrl = typeof href === "string" ? href : "";
+    if (!isRedirectOnSameServer(requestUrl, redirectUrl)) {
+      throw new RedirectOffServerError({
+        requestUrl,
+        redirectUrl
+      });
+    }
+  };
+}, "getSameServerRedirectCheck");
+
 // ../Common/Utils/ProbeNetworkFailureUtil.ts
 var PROBE_SIDE_CAUSE_PREFIX = "This probe ";
 var OUTPUT_MARKERS = [
@@ -472481,6 +473743,11 @@ var API = class _API {
       if (options?.doNotFollowRedirects) {
         axiosOptions.maxRedirects = 0;
       }
+      if (options?.sameServerRedirectsOnly) {
+        axiosOptions.beforeRedirect = getSameServerRedirectCheck(
+          options?.dispatchUrl ?? url2.toString()
+        );
+      }
       if (options?.maxContentLength !== void 0) {
         axiosOptions.maxContentLength = options.maxContentLength;
       }