@oneuptime/common 12.0.13 → 12.0.15

package/build/dist/Server/Utils/StatusPageCustomizationAccess.js

@@ -0,0 +1,85 @@
+import Hostname from "../../Types/API/Hostname";
+import StatusPageDomainService from "../Services/StatusPageDomainService";
+const BUILT_IN_PRIMARY_HOSTS = new Set([
+    "localhost",
+    "ingress",
+]);
+const INVALID_HOST_AUTHORITY_CHARACTER = /[\s/?#]/;
+/**
+ * Parse the HTTP Host authority without consulting Express' `req.hostname`.
+ *
+ * Express may derive `req.hostname` from X-Forwarded-Host when `trust proxy`
+ * is enabled. That header is caller-controlled on several of the Nginx routes
+ * in this repository, so it cannot decide whether tenant-controlled code is
+ * returned. Nginx overwrites the actual Host header with `$host`, which makes
+ * the raw Host the appropriate input to this security boundary.
+ */
+export const normalizeStatusPageRequestHost = (rawHost) => {
+    const authority = (rawHost === null || rawHost === void 0 ? void 0 : rawHost.trim()) || "";
+    if (!authority ||
+        authority.includes("@") ||
+        authority.includes(",") ||
+        INVALID_HOST_AUTHORITY_CHARACTER.test(authority) ||
+        !Hostname.isValid(authority)) {
+        return null;
+    }
+    try {
+        let hostname = Hostname.fromAuthority(authority)
+            .hostname.trim()
+            .toLowerCase();
+        // Treat the fully-qualified spelling of a DNS name as the same host.
+        if (hostname.endsWith(".")) {
+            hostname = hostname.slice(0, -1);
+        }
+        return hostname || null;
+    }
+    catch (_a) {
+        return null;
+    }
+};
+export const isPrimaryStatusPageHost = (hostname) => {
+    if (BUILT_IN_PRIMARY_HOSTS.has(hostname)) {
+        return true;
+    }
+    const configuredHostValue = process.env["HOST"] || "localhost";
+    const configuredHost = normalizeStatusPageRequestHost(configuredHostValue);
+    /*
+     * A malformed deployment HOST means we cannot prove that any incoming host
+     * is isolated from the authenticated application. Disable customizations
+     * globally until the configuration is corrected.
+     */
+    if (!configuredHost) {
+        return true;
+    }
+    return hostname === configuredHost;
+};
+export const canServeStatusPageCustomizations = async (data) => {
+    const requestHost = normalizeStatusPageRequestHost(data.req.get("host"));
+    if (!requestHost || isPrimaryStatusPageHost(requestHost)) {
+        return false;
+    }
+    try {
+        const statusPageDomain = await StatusPageDomainService.findOneBy({
+            query: {
+                fullDomain: requestHost,
+                statusPageId: data.statusPageId,
+                isCnameVerified: true,
+                domain: {
+                    isVerified: true,
+                },
+            },
+            select: {
+                _id: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        return Boolean(statusPageDomain);
+    }
+    catch (_a) {
+        // A lookup failure must never fall back to serving tenant-controlled code.
+        return false;
+    }
+};
+//# sourceMappingURL=StatusPageCustomizationAccess.js.map

package/build/dist/Server/Utils/StatusPageCustomizationAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StatusPageCustomizationAccess.js","sourceRoot":"","sources":["../../../../Server/Utils/StatusPageCustomizationAccess.ts"],"names":[],"mappings":"AAEA,OAAO,QAAQ,MAAM,0BAA0B,CAAC;AAEhD,OAAO,uBAAuB,MAAM,qCAAqC,CAAC;AAG1E,MAAM,sBAAsB,GAAgB,IAAI,GAAG,CAAS;IAC1D,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAW,SAAS,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAEtB,CAAC,OAA2B,EAAiB,EAAE;IAClE,MAAM,SAAS,GAAW,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,EAAE,KAAI,EAAE,CAAC;IAEhD,IACE,CAAC,SAAS;QACV,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC;QAChD,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,IAAI,QAAQ,GAAW,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC;aACrD,QAAQ,CAAC,IAAI,EAAE;aACf,WAAW,EAAE,CAAC;QAEjB,qEAAqE;QACrE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,QAAQ,IAAI,IAAI,CAAC;IAC1B,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAkC,CACpE,QAAgB,EACP,EAAE;IACX,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,mBAAmB,GAAW,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IACvE,MAAM,cAAc,GAClB,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IAEtD;;;;OAIG;IACH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,QAAQ,KAAK,cAAc,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAGpB,KAAK,EAAE,IAG/B,EAAoB,EAAE;IACrB,MAAM,WAAW,GAAkB,8BAA8B,CAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CACrB,CAAC;IAEF,IAAI,CAAC,WAAW,IAAI,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GACpB,MAAM,uBAAuB,CAAC,SAAS,CAAC;YACtC,KAAK,EAAE;gBACL,UAAU,EAAE,WAAW;gBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,eAAe,EAAE,IAAI;gBACrB,MAAM,EAAE;oBACN,UAAU,EAAE,IAAI;iBACP;aACZ;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEL,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnC,CAAC;IAAC,WAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC"}

package/build/dist/Server/Utils/TotpAuth.js

@@ -9,6 +9,59 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import * as OTPAuth from "otpauth";
 import CaptureSpan from "./Telemetry/CaptureSpan";
+/**
+ * The HMAC algorithm every new enrolment is issued with.
+ *
+ * RFC 6238 fixes SHA1 as the default and every authenticator implements it.
+ * The `algorithm` parameter in an otpauth:// URI is, in practice, advisory:
+ * Google Authenticator and Microsoft Authenticator parse the URI, ignore the
+ * parameter, and compute SHA1 anyway. A server that issues `algorithm=SHA256`
+ * therefore hands those apps a QR code they will silently mis-implement — the
+ * app shows a confident six digits, the server computes a completely different
+ * six digits, and enrolment can never succeed no matter how many codes the
+ * user tries. That is the failure this constant exists to prevent.
+ *
+ * SHA1 is not a weakness here. HMAC-SHA1 is unaffected by the collision
+ * attacks that retired SHA1 for signatures (RFC 6234 / RFC 2104), and the
+ * output is truncated to six digits over a 30 second window regardless — the
+ * brute-force surface is the 10^6 code space, not the hash.
+ */
+export const DefaultTotpAlgorithm = "SHA1";
+/**
+ * Algorithms a submitted token is checked against, in order.
+ *
+ * OneUptime issued `SHA256` enrolments before this was understood. Those
+ * secrets are still in the database and still work in the minority of apps
+ * that do honour the parameter (1Password, Bitwarden, Aegis, FreeOTP), so
+ * dropping SHA256 from verification would lock those accounts out of their
+ * own logins.
+ *
+ * The cost is exactly one bit: two algorithms across the validation window
+ * means twice as many six-digit strings are accepted at any instant. Against
+ * a 10^6 code space that is still a vanishing fraction, and the tests pin the
+ * bound so it cannot quietly grow.
+ *
+ * Retiring SHA256 needs more than time passing. Nothing on the row records
+ * which algorithm the user's app actually computes, so "no legacy rows remain"
+ * is not a question the database can answer today — removing it means either
+ * storing the algorithm that verified, or accepting that some long-dormant
+ * account re-enrols instead of logging in.
+ */
+export const SupportedTotpAlgorithms = ["SHA1", "SHA256"];
+/**
+ * Number of 30 second steps either side of now that a token is accepted for.
+ *
+ * Three steps is +/- 90 seconds, which absorbs ordinary phone/server clock
+ * drift and the user typing the last digit as the code rolls over.
+ */
+export const TotpValidationWindow = 3;
+/**
+ * Number of digits in a token, and the length of the time step in seconds.
+ * Both are the values Google Authenticator assumes, and — like `algorithm` —
+ * both are parameters it ignores when told anything else.
+ */
+export const TotpDigits = 6;
+export const TotpPeriodInSeconds = 30;
 /**
  * Utility class for handling TOTP authentication.
  */
@@ -32,26 +85,82 @@ export default class TotpAuth {
                 email: data.email,
             }),
             // Algorithm used for the HMAC function.
-            algorithm: "SHA256",
+            algorithm: data.algorithm || DefaultTotpAlgorithm,
             // Length of the generated tokens.
-            digits: 6,
+            digits: TotpDigits,
             // Interval of time for which a token is valid, in seconds.
-            period: 30,
+            period: TotpPeriodInSeconds,
             // Arbitrary key encoded in Base32 or OTPAuth.Secret instance.
             secret: data.secret,
         });
         return totp;
     }
+    /**
+     * Strips the formatting authenticator apps add for readability.
+     *
+     * Google Authenticator renders a code as "123 456" and both the iOS and
+     * Android clipboards keep that space when the user copies it. Rejecting the
+     * paste is a self-inflicted "Invalid code" for a user who supplied exactly
+     * the right secret material, so the separators are removed before the token
+     * is compared. Anything that is not a digit is dropped, which also covers
+     * the hyphen some apps use and stray whitespace from a trimmed paste.
+     *
+     * @param token - The raw token as submitted.
+     * @returns The token reduced to its digits.
+     */
+    static normalizeToken(token) {
+        /*
+         * The token arrives straight off a JSON body, so it is only a string
+         * because the client chose to send one. A number or an object here must
+         * fail verification, not throw out of `.replace` and surface as a 500.
+         */
+        if (typeof token !== "string" || !token) {
+            return "";
+        }
+        return token.replace(/\D/g, "");
+    }
     /**
      * Verifies if a given token matches the provided secret key.
      * @param data - The data object containing the secret key and token.
      * @returns A boolean indicating whether the token is valid or not.
      */
     static verifyToken(data) {
-        const { secret, token, email } = data;
-        const totp = this.getTotp({ secret, email });
-        const delta = totp.validate({ token, window: 3 });
-        return delta !== null;
+        const { secret, email } = data;
+        if (!secret) {
+            return false;
+        }
+        const token = this.normalizeToken(data.token);
+        /*
+         * otpauth compares the submitted string against the codes it generates,
+         * so a token of the wrong length can never match — but it would still be
+         * run through one HMAC per algorithm per window step first. Reject it up
+         * front instead.
+         */
+        if (token.length !== TotpDigits) {
+            return false;
+        }
+        for (const algorithm of SupportedTotpAlgorithms) {
+            let totp;
+            try {
+                totp = this.getTotp({ secret, email, algorithm });
+            }
+            catch (_a) {
+                /*
+                 * A secret that is not valid base32 throws in the OTPAuth.Secret
+                 * constructor. That is a corrupt row, not a wrong code, and it fails
+                 * identically for every algorithm — so stop rather than repeat it.
+                 */
+                return false;
+            }
+            const delta = totp.validate({
+                token,
+                window: TotpValidationWindow,
+            });
+            if (delta !== null) {
+                return true;
+            }
+        }
+        return false;
     }
     /**
      * Generates a URI for the given secret key and user email, which can be used to set up two-factor authentication.
@@ -60,7 +169,11 @@ export default class TotpAuth {
      */
     static generateUri(data) {
         const { secret, userEmail } = data;
-        const totp = this.getTotp({ secret, email: userEmail });
+        const totp = this.getTotp({
+            secret,
+            email: userEmail,
+            algorithm: DefaultTotpAlgorithm,
+        });
         return totp.toString();
     }
 }
@@ -82,6 +195,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", OTPAuth.TOTP)
 ], TotpAuth, "getTotp", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", String)
+], TotpAuth, "normalizeToken", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Utils/TotpAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"TotpAuth.js","sourceRoot":"","sources":["../../../../Server/Utils/TotpAuth.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,QAAQ;IAC3B;;;OAGG;IAEW,AAAP,MAAM,CAAC,cAAc;QAC1B,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;IACrC,CAAC;IAGa,AAAP,MAAM,CAAC,QAAQ,CAAC,IAAsB;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAGa,AAAP,MAAM,CAAC,OAAO,CAAC,IAAsC;QAC1D,MAAM,IAAI,GAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;YAC1C,sDAAsD;YACtD,MAAM,EAAE,WAAW;YACnB,sBAAsB;YACtB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC;YACF,wCAAwC;YACxC,SAAS,EAAE,QAAQ;YACnB,kCAAkC;YAClC,MAAM,EAAE,CAAC;YACT,2DAA2D;YAC3D,MAAM,EAAE,EAAE;YACV,8DAA8D;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAIzB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAEtC,MAAM,IAAI,GAAiB,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAkB,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAEjE,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAGzB;QACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEnC,MAAM,IAAI,GAAiB,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEtE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAnEe;IADb,WAAW,EAAE;;;;oCAGb;AAGa;IADb,WAAW,EAAE;;;;8BAGb;AAGa;IADb,WAAW,EAAE;;;oCACiD,OAAO,CAAC,IAAI;6BAmB1E;AAQa;IADb,WAAW,EAAE;;;;iCAab;AAQa;IADb,WAAW,EAAE;;;;iCAUb"}
+{"version":3,"file":"TotpAuth.js","sourceRoot":"","sources":["../../../../Server/Utils/TotpAuth.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW,MAAM,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW,CAAC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAW,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAW,EAAE,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,QAAQ;IAC3B;;;OAGG;IAEW,AAAP,MAAM,CAAC,cAAc;QAC1B,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;IACrC,CAAC;IAGa,AAAP,MAAM,CAAC,QAAQ,CAAC,IAAsB;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAGa,AAAP,MAAM,CAAC,OAAO,CAAC,IAIrB;QACC,MAAM,IAAI,GAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;YAC1C,sDAAsD;YACtD,MAAM,EAAE,WAAW;YACnB,sBAAsB;YACtB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC;YACF,wCAAwC;YACxC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,oBAAoB;YACjD,kCAAkC;YAClC,MAAM,EAAE,UAAU;YAClB,2DAA2D;YAC3D,MAAM,EAAE,mBAAmB;YAC3B,8DAA8D;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IAEW,AAAP,MAAM,CAAC,cAAc,CAAC,KAAa;QACxC;;;;WAIG;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAIzB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAW,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEtD;;;;;WAKG;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;YAChD,IAAI,IAAkB,CAAC;YAEvB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACpD,CAAC;YAAC,WAAM,CAAC;gBACP;;;;mBAIG;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,KAAK,GAAkB,IAAI,CAAC,QAAQ,CAAC;gBACzC,KAAK;gBACL,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;YAEH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAGzB;QACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEnC,MAAM,IAAI,GAAiB,IAAI,CAAC,OAAO,CAAC;YACtC,MAAM;YACN,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,oBAAoB;SAChC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AA1Ie;IADb,WAAW,EAAE;;;;oCAGb;AAGa;IADb,WAAW,EAAE;;;;8BAGb;AAGa;IADb,WAAW,EAAE;;;oCAKV,OAAO,CAAC,IAAI;6BAmBf;AAgBa;IADb,WAAW,EAAE;;;;oCAYb;AAQa;IADb,WAAW,EAAE;;;;iCAiDb;AAQa;IADb,WAAW,EAAE;;;;iCAcb"}

package/build/dist/Server/Utils/UserRegistrationToken.js

@@ -0,0 +1,170 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { AccountsRoute } from "../../ServiceRoute";
+import Route from "../../Types/API/Route";
+import URL from "../../Types/API/URL";
+import OneUptimeDate from "../../Types/Date";
+import ObjectID from "../../Types/ObjectID";
+import EmailVerificationToken from "../../Models/DatabaseModels/EmailVerificationToken";
+import DatabaseConfig from "../DatabaseConfig";
+import EmailVerificationTokenService from "../Services/EmailVerificationTokenService";
+import CaptureSpan from "./Telemetry/CaptureSpan";
+/*
+ * An invited user exists in the database before they have ever authenticated.
+ * TeamMemberService creates the row so the membership has something to point
+ * at, and that row carries no password until the person registers.
+ *
+ * /signup is what hands that unclaimed row over, so the hand-over has to be
+ * gated on something only the mailbox owner can hold. Knowing the address is
+ * not enough: addresses at a company are guessable by construction, which is
+ * exactly how GHSA-qg84-6hrg-mr5g turned a pending invitation into an account
+ * takeover -- the guard there was `if (alreadySavedUser.password)`, and an
+ * unclaimed row's password is null, which is falsy.
+ *
+ * This token is that gate. It is minted when the invitation is sent, travels
+ * only inside the invitation email, and is spent the first time it is used.
+ *
+ * It reuses EmailVerificationToken rather than adding a table of its own: the
+ * shape is identical (user, email, opaque token, expiry) and the semantics are
+ * the same claim -- "the holder of this controls this mailbox". Spending one is
+ * therefore also proof of address ownership, which is why the signup path marks
+ * the account verified on the way through.
+ */
+/*
+ * Invitations are read when the person gets round to them, not when they are
+ * sent, so these live longer than the 24 hours an email-verification link gets.
+ * Expiring in a week still bounds how long a leaked invite mail stays useful.
+ */
+export const REGISTRATION_TOKEN_EXPIRY_IN_DAYS = 7;
+export default class UserRegistrationToken {
+    /*
+     * Mint a token for `email` and return it. The caller is responsible for
+     * putting it somewhere only the mailbox owner will see -- which in practice
+     * means a link in an email addressed to that same mailbox, and nowhere else.
+     * It must never be written into an API response.
+     */
+    static async generateRegistrationToken(data) {
+        const token = ObjectID.generate();
+        const emailVerificationToken = new EmailVerificationToken();
+        emailVerificationToken.userId = data.userId;
+        emailVerificationToken.email = data.email;
+        emailVerificationToken.token = token;
+        emailVerificationToken.expires = OneUptimeDate.getSomeDaysAfter(REGISTRATION_TOKEN_EXPIRY_IN_DAYS);
+        await EmailVerificationTokenService.create({
+            data: emailVerificationToken,
+            props: {
+                isRoot: true,
+            },
+        });
+        return token;
+    }
+    /*
+     * The /accounts/register link an invited person follows. The email is carried
+     * alongside the token only to prefill (and lock) the form field; the token is
+     * the part that authorizes anything.
+     */
+    static async getRegistrationLink(data) {
+        const host = await DatabaseConfig.getHost();
+        const httpProtocol = await DatabaseConfig.getHttpProtocol();
+        return URL.fromString(new URL(httpProtocol, host, new Route(AccountsRoute.toString())).toString())
+            .addRoute("/register")
+            .addQueryParam("email", data.email.toString(), true)
+            .addQueryParam("token", data.token.toString(), true);
+    }
+    // Mint a token and build the link that carries it, in one step.
+    static async generateRegistrationLink(data) {
+        const token = await this.generateRegistrationToken({
+            userId: data.userId,
+            email: data.email,
+        });
+        return await this.getRegistrationLink({
+            email: data.email,
+            token: token,
+        });
+    }
+    /*
+     * Spend a token. Returns true only if it exists, was minted for this exact
+     * address, has not expired, and had not already been spent.
+     *
+     * The delete is what makes it single-use, and it is deliberately the last
+     * word: `deleteOneBy` reports how many rows it removed, so two requests
+     * racing on the same token produce exactly one winner (the loser deletes
+     * nothing and gets false back) rather than two callers who both read a live
+     * token and both proceed.
+     *
+     * Every failure returns the same `false`. The caller must not report which
+     * check failed -- "expired" and "no such token" would tell someone probing
+     * with guessed tokens which of them had ever been real.
+     */
+    static async consumeRegistrationToken(data) {
+        const savedToken = await EmailVerificationTokenService.findOneBy({
+            query: {
+                token: data.token,
+            },
+            select: {
+                _id: true,
+                email: true,
+                expires: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!savedToken || !savedToken.email || !savedToken.expires) {
+            return false;
+        }
+        /*
+         * A token is bound to the address it was mailed to. Without this, a token
+         * from any invitation the attacker had legitimately received would claim
+         * any other unclaimed account. Email lowercases on construction, so the
+         * string comparison is already case-insensitive.
+         */
+        if (savedToken.email.toString() !== data.email.toString()) {
+            return false;
+        }
+        if (OneUptimeDate.hasExpired(savedToken.expires)) {
+            return false;
+        }
+        const deletedCount = await EmailVerificationTokenService.deleteOneBy({
+            query: {
+                _id: savedToken._id,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        return deletedCount === 1;
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserRegistrationToken, "generateRegistrationToken", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserRegistrationToken, "getRegistrationLink", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserRegistrationToken, "generateRegistrationLink", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserRegistrationToken, "consumeRegistrationToken", null);
+//# sourceMappingURL=UserRegistrationToken.js.map

package/build/dist/Server/Utils/UserRegistrationToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserRegistrationToken.js","sourceRoot":"","sources":["../../../../Server/Utils/UserRegistrationToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,KAAK,MAAM,uBAAuB,CAAC;AAC1C,OAAO,GAAG,MAAM,qBAAqB,CAAC;AACtC,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAE7C,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,sBAAsB,MAAM,oDAAoD,CAAC;AACxF,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAC/C,OAAO,6BAA6B,MAAM,2CAA2C,CAAC;AACtF,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAW,CAAC,CAAC;AAE3D,MAAM,CAAC,OAAO,OAAO,qBAAqB;IACxC;;;;;OAKG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAG7C;QACC,MAAM,KAAK,GAAa,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAE5C,MAAM,sBAAsB,GAC1B,IAAI,sBAAsB,EAAE,CAAC;QAC/B,sBAAsB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5C,sBAAsB,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1C,sBAAsB,CAAC,KAAK,GAAG,KAAK,CAAC;QACrC,sBAAsB,CAAC,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAC7D,iCAAiC,CAClC,CAAC;QAEF,MAAM,6BAA6B,CAAC,MAAM,CAAC;YACzC,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAGvC;QACC,MAAM,IAAI,GAAa,MAAM,cAAc,CAAC,OAAO,EAAE,CAAC;QACtD,MAAM,YAAY,GAAa,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;QAEtE,OAAO,GAAG,CAAC,UAAU,CACnB,IAAI,GAAG,CACL,YAAY,EACZ,IAAI,EACJ,IAAI,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CACpC,CAAC,QAAQ,EAAE,CACb;aACE,QAAQ,CAAC,WAAW,CAAC;aACrB,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;aACnD,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,gEAAgE;IAE5C,AAAb,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAG5C;QACC,MAAM,KAAK,GAAa,MAAM,IAAI,CAAC,yBAAyB,CAAC;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC;YACpC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAG5C;QACC,MAAM,UAAU,GACd,MAAM,6BAA6B,CAAC,SAAS,CAAC;YAC5C,KAAK,EAAE;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,IAAI;aACd;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEL,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;;WAKG;QACH,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,YAAY,GAChB,MAAM,6BAA6B,CAAC,WAAW,CAAC;YAC9C,KAAK,EAAE;gBACL,GAAG,EAAE,UAAU,CAAC,GAAI;aACrB;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEL,OAAO,YAAY,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF;AAnIqB;IADnB,WAAW,EAAE;;;;4DAwBb;AAQmB;IADnB,WAAW,EAAE;;;;sDAkBb;AAImB;IADnB,WAAW,EAAE;;;;2DAcb;AAiBmB;IADnB,WAAW,EAAE;;;;2DAiDb"}

package/build/dist/Server/Utils/VerificationCode.js

@@ -0,0 +1,120 @@
+import { EncryptionSecret } from "../EnvironmentConfig";
+import crypto from "crypto";
+/*
+ * The cryptography behind notification-channel ownership checks: the codes
+ * mailed/texted/read out to a user to prove they hold the address or number
+ * they just added.
+ *
+ * This is deliberately server-only. Common/Types/Text is bundled into the
+ * dashboard and therefore has to tolerate a runtime with no CSPRNG; a code
+ * minted here has no such excuse, so nothing in this file falls back to
+ * Math.random. If the platform cannot produce secure randomness, generation
+ * throws and the channel simply cannot be added.
+ *
+ * WHY THE STORED VALUE IS A DIGEST
+ *
+ * A six-digit code is only a secret for as long as it is in flight. Storing
+ * the plaintext puts a live account-takeover token in a database column, a
+ * backup, a replica and every log line that ever dumps the row - and the
+ * column sits on a table (UserEmail and friends) whose entire access-control
+ * design exists because reading somebody else's row IS the attack. Keeping a
+ * keyed digest means a database dump alone yields nothing: the attacker also
+ * needs the deployment's EncryptionSecret, and even holding both, recovering
+ * the code means re-running the HMAC over the code space per row, because...
+ *
+ * WHY THE ROW ID IS IN THE MESSAGE
+ *
+ * ...the digest is domain-separated by the row it belongs to. Without that,
+ * one HMAC table of all 10^6 codes inverts every row in the table at once,
+ * and two rows that happened to draw the same code would be visibly equal.
+ * With it, the same code on two rows produces two unrelated digests.
+ *
+ * A fast hash is right here, unlike a password: the input is a value the
+ * server minted at random, so there is nothing to guess offline that the
+ * attempt counter is not already bounding online. The scheme version prefix
+ * is there so a future change of construction can be told apart from this one
+ * rather than silently invalidating or, worse, colliding with it.
+ */
+const HASH_SCHEME_VERSION = "v1";
+/*
+ * Six digits, matching what the notification templates and the dashboard's
+ * code input already expect. The code space is small on purpose - it has to
+ * be readable off a phone screen - which is exactly why every control around
+ * it (expiry, attempt counter, lockout, rate limit) is load-bearing rather
+ * than defence in depth.
+ */
+export const VERIFICATION_CODE_LENGTH = 6;
+export default class VerificationCode {
+    /*
+     * A fresh code, drawn uniformly from the whole code space.
+     *
+     * crypto.randomInt does the rejection sampling itself, so there is no modulo
+     * bias here and no need to hand-roll one. Leading zeros are kept: "000123"
+     * is a perfectly good code, and dropping them would quietly shrink the
+     * space by 10%.
+     */
+    static generate(length = VERIFICATION_CODE_LENGTH) {
+        let code = "";
+        for (let i = 0; i < length; i++) {
+            code += crypto.randomInt(0, 10).toString();
+        }
+        return code;
+    }
+    /*
+     * The digest to store for `code` on the row identified by `channelId`.
+     *
+     * Both inputs are length-prefixed into the message rather than merely
+     * concatenated, so no pair of (id, code) values can be rearranged into the
+     * same byte string as another pair.
+     */
+    static hashCode(data) {
+        const message = [
+            HASH_SCHEME_VERSION,
+            data.channelId.toString(),
+            data.code,
+        ]
+            .map((part) => {
+            return `${part.length}:${part}`;
+        })
+            .join("");
+        return crypto
+            .createHmac("sha256", EncryptionSecret.toString())
+            .update(message)
+            .digest("hex");
+    }
+    /*
+     * Compare two digests without leaking, through timing, how many leading
+     * bytes matched.
+     *
+     * `===` on strings short-circuits at the first differing character, and the
+     * attacker here controls the plaintext that produces one side of the
+     * comparison. That is a much weaker oracle than it is for a password check -
+     * they would be recovering a digest of a value that expires in minutes - but
+     * a constant-time compare costs nothing and removes the question.
+     *
+     * Lengths are compared first. Both digests are always 64 hex characters, so
+     * an early return only happens on malformed input, where the length is not
+     * the secret.
+     */
+    static isHashEqual(a, b) {
+        if (!a || !b || a.length !== b.length) {
+            return false;
+        }
+        return crypto.timingSafeEqual(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
+    }
+    /*
+     * A digest that no code can ever produce, for burning the outstanding
+     * challenge.
+     *
+     * Used when a row is locked out or successfully verified. The column is NOT
+     * NULL, so "there is no live code" cannot be expressed as null; it is
+     * expressed as a digest drawn at random from a 256-bit space, which the
+     * 10^6 possible codes cannot hit. Rotating rather than leaving the old
+     * digest in place matters: it means a lockout is not merely a pause an
+     * attacker can wait out with the same target still valid behind it.
+     */
+    static generateUnusableHash() {
+        return crypto.randomBytes(32).toString("hex");
+    }
+}
+//# sourceMappingURL=VerificationCode.js.map

package/build/dist/Server/Utils/VerificationCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VerificationCode.js","sourceRoot":"","sources":["../../../../Server/Utils/VerificationCode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,mBAAmB,GAAW,IAAI,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAW,CAAC,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,gBAAgB;IACnC;;;;;;;OAOG;IACI,MAAM,CAAC,QAAQ,CAAC,SAAiB,wBAAwB;QAC9D,IAAI,IAAI,GAAW,EAAE,CAAC;QAEtB,KAAK,IAAI,CAAC,GAAW,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,QAAQ,CAAC,IAA2C;QAChE,MAAM,OAAO,GAAW;YACtB,mBAAmB;YACnB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;YACzB,IAAI,CAAC,IAAI;SACV;aACE,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE;YACpB,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC;aACjD,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,WAAW,CAAC,CAAS,EAAE,CAAS;QAC5C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CACvB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,oBAAoB;QAChC,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;CACF"}

package/build/dist/Types/Email/EmailTemplateType.js

@@ -4,6 +4,7 @@ var EmailTemplateType;
     EmailTemplateType["ForgotPassword"] = "ForgotPassword.hbs";
     EmailTemplateType["ProbeOffline"] = "ProbeOffline.hbs";
     EmailTemplateType["SignupWelcomeEmail"] = "SignupWelcomeEmail.hbs";
+    EmailTemplateType["CompleteRegistration"] = "CompleteRegistration.hbs";
     EmailTemplateType["ProbeConnectionStatusChange"] = "ProbeConnectionStatusChange.hbs";
     EmailTemplateType["AIAgentConnectionStatusChange"] = "AIAgentConnectionStatusChange.hbs";
     EmailTemplateType["AIAgentOwnerAdded"] = "AIAgentOwnerAdded.hbs";

package/build/dist/Types/Email/EmailTemplateType.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmailTemplateType.js","sourceRoot":"","sources":["../../../../Types/Email/EmailTemplateType.ts"],"names":[],"mappings":"AAAA,IAAK,iBA+FJ;AA/FD,WAAK,iBAAiB;IACpB,wDAAmC,CAAA;IACnC,0DAAqC,CAAA;IACrC,sDAAiC,CAAA;IACjC,kEAA6C,CAAA;IAC7C,oFAA+D,CAAA;IAC/D,wFAAmE,CAAA;IACnE,gEAA2C,CAAA;IAC3C,wFAAmE,CAAA;IACnE,wDAAmC,CAAA;IACnC,4DAAuC,CAAA;IACvC,4DAAuC,CAAA;IACvC,sDAAiC,CAAA;IACjC,sDAAiC,CAAA;IACjC,0EAAqD,CAAA;IACrD,wFAAmE,CAAA;IACnE,gFAA2D,CAAA;IAC3D,oGAA+E,CAAA;IAC/E,kFAA6D,CAAA;IAC7D,wFAAmE,CAAA;IACnE,0FAAqE,CAAA;IACrE,kHAA6F,CAAA;IAC7F,0HAAqG,CAAA;IACrG,4HAAuG,CAAA;IACvG,8EAAyD,CAAA;IACzD,gFAA2D,CAAA;IAC3D,0EAAqD,CAAA;IACrD,0HAAqG,CAAA;IACrG,8CAAyB,CAAA;IACzB,gEAA2C,CAAA;IAC3C,oFAA+D,CAAA;IAC/D,oEAA+C,CAAA;IAC/C,gFAA2D,CAAA;IAE3D,wEAAmD,CAAA;IAEnD,kEAA6C,CAAA;IAC7C,gFAA2D,CAAA;IAC3D,4EAAuD,CAAA;IACvD,sFAAiE,CAAA;IACjE,oEAA+C,CAAA;IAC/C,4FAAuE,CAAA;IAEvE,4DAAuC,CAAA;IACvC,0EAAqD,CAAA;IACrD,sEAAiD,CAAA;IACjD,gFAA2D,CAAA;IAC3D,sFAAiE,CAAA;IAEjE,0EAAqD,CAAA;IACrD,wFAAmE,CAAA;IACnE,oFAA+D,CAAA;IAC/D,8FAAyE,CAAA;IACzE,oFAA+D,CAAA;IAE/D,gFAA2D,CAAA;IAC3D,8FAAyE,CAAA;IACzE,0FAAqE,CAAA;IACrE,oGAA+E,CAAA;IAC/E,gGAA2E,CAAA;IAE3E,8EAAyD,CAAA;IACzD,wFAAmE,CAAA;IACnE,sFAAiE,CAAA;IAEjE,oGAA+E,CAAA;IAC/E,0FAAqE,CAAA;IACrE,wGAAmF,CAAA;IACnF,8GAAyF,CAAA;IACzF,oHAA+F,CAAA;IAC/F,0FAAqE,CAAA;IACrE,sEAAiD,CAAA;IACjD,gGAA2E,CAAA;IAC3E,wDAAmC,CAAA;IACnC,8DAAyC,CAAA;IACzC,oEAA+C,CAAA;IAC/C,8DAAyC,CAAA;IACzC,4EAAuD,CAAA;IACvD,kFAA6D,CAAA;IAE7D,4EAAuD,CAAA;IACvD,oFAA+D,CAAA;IAC/D,oFAA+D,CAAA;IAC/D,0EAAqD,CAAA;IACrD,8FAAyE,CAAA;IAEzE,kFAA6D,CAAA;IAC7D,4CAAuB,CAAA;IAEvB,gFAA2D,CAAA;IAC3D,kEAA6C,CAAA;IAC7C,wEAAmD,CAAA;IAEnD,8FAAyE,CAAA;IACzE,4FAAuE,CAAA;AACzE,CAAC,EA/FI,iBAAiB,KAAjB,iBAAiB,QA+FrB;AAED,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"EmailTemplateType.js","sourceRoot":"","sources":["../../../../Types/Email/EmailTemplateType.ts"],"names":[],"mappings":"AAAA,IAAK,iBAgGJ;AAhGD,WAAK,iBAAiB;IACpB,wDAAmC,CAAA;IACnC,0DAAqC,CAAA;IACrC,sDAAiC,CAAA;IACjC,kEAA6C,CAAA;IAC7C,sEAAiD,CAAA;IACjD,oFAA+D,CAAA;IAC/D,wFAAmE,CAAA;IACnE,gEAA2C,CAAA;IAC3C,wFAAmE,CAAA;IACnE,wDAAmC,CAAA;IACnC,4DAAuC,CAAA;IACvC,4DAAuC,CAAA;IACvC,sDAAiC,CAAA;IACjC,sDAAiC,CAAA;IACjC,0EAAqD,CAAA;IACrD,wFAAmE,CAAA;IACnE,gFAA2D,CAAA;IAC3D,oGAA+E,CAAA;IAC/E,kFAA6D,CAAA;IAC7D,wFAAmE,CAAA;IACnE,0FAAqE,CAAA;IACrE,kHAA6F,CAAA;IAC7F,0HAAqG,CAAA;IACrG,4HAAuG,CAAA;IACvG,8EAAyD,CAAA;IACzD,gFAA2D,CAAA;IAC3D,0EAAqD,CAAA;IACrD,0HAAqG,CAAA;IACrG,8CAAyB,CAAA;IACzB,gEAA2C,CAAA;IAC3C,oFAA+D,CAAA;IAC/D,oEAA+C,CAAA;IAC/C,gFAA2D,CAAA;IAE3D,wEAAmD,CAAA;IAEnD,kEAA6C,CAAA;IAC7C,gFAA2D,CAAA;IAC3D,4EAAuD,CAAA;IACvD,sFAAiE,CAAA;IACjE,oEAA+C,CAAA;IAC/C,4FAAuE,CAAA;IAEvE,4DAAuC,CAAA;IACvC,0EAAqD,CAAA;IACrD,sEAAiD,CAAA;IACjD,gFAA2D,CAAA;IAC3D,sFAAiE,CAAA;IAEjE,0EAAqD,CAAA;IACrD,wFAAmE,CAAA;IACnE,oFAA+D,CAAA;IAC/D,8FAAyE,CAAA;IACzE,oFAA+D,CAAA;IAE/D,gFAA2D,CAAA;IAC3D,8FAAyE,CAAA;IACzE,0FAAqE,CAAA;IACrE,oGAA+E,CAAA;IAC/E,gGAA2E,CAAA;IAE3E,8EAAyD,CAAA;IACzD,wFAAmE,CAAA;IACnE,sFAAiE,CAAA;IAEjE,oGAA+E,CAAA;IAC/E,0FAAqE,CAAA;IACrE,wGAAmF,CAAA;IACnF,8GAAyF,CAAA;IACzF,oHAA+F,CAAA;IAC/F,0FAAqE,CAAA;IACrE,sEAAiD,CAAA;IACjD,gGAA2E,CAAA;IAC3E,wDAAmC,CAAA;IACnC,8DAAyC,CAAA;IACzC,oEAA+C,CAAA;IAC/C,8DAAyC,CAAA;IACzC,4EAAuD,CAAA;IACvD,kFAA6D,CAAA;IAE7D,4EAAuD,CAAA;IACvD,oFAA+D,CAAA;IAC/D,oFAA+D,CAAA;IAC/D,0EAAqD,CAAA;IACrD,8FAAyE,CAAA;IAEzE,kFAA6D,CAAA;IAC7D,4CAAuB,CAAA;IAEvB,gFAA2D,CAAA;IAC3D,kEAA6C,CAAA;IAC7C,wEAAmD,CAAA;IAEnD,8FAAyE,CAAA;IACzE,4FAAuE,CAAA;AACzE,CAAC,EAhGI,iBAAiB,KAAjB,iBAAiB,QAgGrB;AAED,eAAe,iBAAiB,CAAC"}

package/build/dist/Types/Marketing/MarketingConversion.js

@@ -1,8 +1,18 @@
 export var MarketingConversionType;
 (function (MarketingConversionType) {
     MarketingConversionType["SignUp"] = "SignUp";
+    // A verified Cal.com booking. See Docs/analytics/enterprise-conversion-tracking.md.
+    MarketingConversionType["MeetingBooked"] = "MeetingBooked";
     MarketingConversionType["PaidSubscription"] = "PaidSubscription";
 })(MarketingConversionType || (MarketingConversionType = {}));
+/*
+ * Conversion types that ad platforms have an explicit conversion-action
+ * mapping for. Every provider picks its platform conversion action by
+ * branching on SignUp vs not-SignUp, so a type that is not listed here would
+ * be uploaded as a purchase — add a type only once every provider has a
+ * mapping for it. Types left out stay ledger-only and are recorded as Skipped.
+ */
+export const AdUploadableMarketingConversionTypes = [MarketingConversionType.SignUp, MarketingConversionType.PaidSubscription];
 export var MarketingConversionUploadStatus;
 (function (MarketingConversionUploadStatus) {
     MarketingConversionUploadStatus["Uploaded"] = "Uploaded";

package/build/dist/Types/Marketing/MarketingConversion.js.map

@@ -1 +1 @@
-{"version":3,"file":"MarketingConversion.js","sourceRoot":"","sources":["../../../../Types/Marketing/MarketingConversion.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,4CAAiB,CAAA;IACjB,gEAAqC,CAAA;AACvC,CAAC,EAHW,uBAAuB,KAAvB,uBAAuB,QAGlC;AAED,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,wDAAqB,CAAA;IACrB,oDAAiB,CAAA;IACjB,gEAAgE;IAChE,sDAAmB,CAAA;AACrB,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C"}
+{"version":3,"file":"MarketingConversion.js","sourceRoot":"","sources":["../../../../Types/Marketing/MarketingConversion.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,uBAKX;AALD,WAAY,uBAAuB;IACjC,4CAAiB,CAAA;IACjB,oFAAoF;IACpF,0DAA+B,CAAA;IAC/B,gEAAqC,CAAA;AACvC,CAAC,EALW,uBAAuB,KAAvB,uBAAuB,QAKlC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,CAAC,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;AAE7E,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,wDAAqB,CAAA;IACrB,oDAAiB,CAAA;IACjB,gEAAgE;IAChE,sDAAmB,CAAA;AACrB,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C"}

package/build/dist/Types/Monitor/CriteriaFilter.js

@@ -328,6 +328,7 @@ export const CriteriaFilterSchema = Zod.object({
     evaluateOverTimeOptions: Zod.object({
         timeValueInMinutes: Zod.number().optional(),
         evaluateOverTimeType: Zod.string().optional(),
+        onNoDataPolicy: Zod.string().optional(),
     }).optional(),
 });
 //# sourceMappingURL=CriteriaFilter.js.map