@wizeworks/lens-cloud 0.0.0-stage → 0.3.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WizeWorks LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,64 @@
-# Temporary Holding Version
+# @wizeworks/lens-cloud
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The cloud service of [WizeLens](https://github.com/brandonkorous/wizelens): the full dashboard for many teams, with accounts,
+projects, 30 days of history computed on the server, alerts, share links, and AI access through read keys.
+
+```bash
+# Try it on your machine (Postgres in-process, data in ./.wizelens-cloud)
+npx @wizeworks/lens-cloud
+
+# For a team: Postgres in Docker
+POSTGRES_PASSWORD=<a long secret> docker compose -f deploy/docker-compose.cloud.yml up -d
+```
+
+Open http://localhost:5970/_wizelens/ and create the first account. Make an ingest key on the Team page, then on each app:
+
+```bash
+WIZELENS_HUB=http://localhost:5970
+WIZELENS_HUB_TOKEN=wl_ik_...
+```
+
+## Options
+
+| Flag | Environment variable | Default |
+|---|---|---|
+| `--database <url>` | `DATABASE_URL` | `pglite:./.wizelens-cloud` (`postgres://…`, `pglite:<folder>`, or `memory`) |
+| `--port <n>` | `PORT` | `5970` |
+| `--host <addr>` | `WIZELENS_CLOUD_HOST` | `0.0.0.0` |
+| `--public-url <url>` | `WIZELENS_CLOUD_PUBLIC_URL` | the request's own address |
+| `--signup <invite\|open>` | `WIZELENS_CLOUD_SIGNUP` | `invite` |
+| `--retention-days <n>` | `WIZELENS_CLOUD_RETENTION_DAYS` | `30` |
+| `--allow-private-webhooks` | `WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1` | off |
+
+Put it behind https. With an https public URL, the sign-in cookie is marked secure. PGlite is for trials and tests; use Postgres
+for real teams. Check a running cloud end to end with `node scripts/cloud-smoke.mjs <url>` from the repo (it needs a fresh database).
+
+## Stats
+
+Pages are computed from stats tables, never from a sample of traces: per-trace facts (request, trace, log, and slow span rows) and
+rollups in 10 s, 5 min, and 1 h buckets, so 30-day pages on busy projects answer in well under a second. A background job settles
+traces a few seconds after their last span (every 3 s, one instance at a time through a Postgres advisory lock); pages say
+"Preparing stats" while traces wait, for example right after an upgrade, when existing traces are backfilled newest first.
+Alerts on traces read the same tables. See `docs/CONTRACT.md`, "Stats tables".
+
+## Metrics
+
+Apps send OpenTelemetry metrics to `POST /v1/metrics` with the ingest key (JSON or protobuf; gauges, sums, histograms,
+exponential histograms, and summaries). WizeLens add-ons send theirs in their batches. The Metrics page reads
+`GET /_wizelens/api/models/metrics?project=&range=&env=&service=&metric=&group=&stat=&q=` (member or read key), computed from
+metric rollups (per series, in 10 s, 5 min, and 1 h buckets, written as points arrive), so every range reads all of its points.
+Points and rollups follow the organization's retention. Alert rules can watch
+one metric: `{ "metric": "metric", "metricName": "process.cpu.utilization", "metricStat": "avg", "metricService": "", ... }`, with
+`metricStat` one of `last`, `avg`, `max`, `p95`, `p99`, `rate`, and the threshold in the metric's own unit (seconds, bytes, or
+0 to 1 for ratios). Read keys get `list_metrics` and `get_metric` over MCP.
+
+## In code
+
+```ts
+import { createCloud } from "@wizeworks/lens-cloud";
+
+const cloud = await createCloud({ database: process.env.DATABASE_URL, publicUrl: "https://wizelens.example.com" });
+console.log(await cloud.listen());
+```
+
+The API, roles, keys, and storage are in [CONTRACT.md](https://github.com/brandonkorous/wizelens/blob/main/docs/CONTRACT.md#cloud-v07-phase-3). MIT licensed.

package/dist/alerts/evaluate.d.ts

@@ -0,0 +1,10 @@
+import type { CloudApp } from "../app.js";
+import { type AlertRule } from "../repo/alerts.js";
+import { type Notice } from "./notify.js";
+/** Send a notice and keep it as an event. */
+export declare function notify(app: CloudApp, rule: AlertRule, state: Notice["state"], value: number | null, now: number): Promise<string>;
+/** Check one rule. It notifies only when the state changes: ok to firing, or firing to ok. */
+export declare function evaluateRule(app: CloudApp, rule: AlertRule, now: number): Promise<void>;
+/** Check every enabled rule once. One failing rule does not stop the others. */
+export declare function evaluateAll(app: CloudApp): Promise<void>;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/alerts/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAY,KAAK,SAAS,EAAgC,MAAM,mBAAmB,CAAC;AAG3F,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAyCnD,6CAA6C;AAC7C,wBAAsB,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKvI;AAED,8FAA8F;AAC9F,wBAAsB,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7F;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9D"}

package/dist/alerts/evaluate.js

@@ -0,0 +1,66 @@
+import { alertBreached, alignNow, alertContext, alertMessage, alertPage, computePage, metricAlertMessage, metricAlertUnit, metricAlertValueOf } from "@wizeworks/lens-core";
+import { addEvent, enabledRules, saveEvaluation } from "../repo/alerts.js";
+import { loadMetricAlertData } from "../repo/metric-read.js";
+import { cloudExecutor, projectRetentionMs } from "../scale-exec.js";
+import { deliver } from "./notify.js";
+/** Names for the notice: project and the dashboard link. */
+async function noticeOf(app, rule, state, value, now) {
+    const [p] = await app.db.query("SELECT name FROM projects WHERE id = $1", [rule.projectId]);
+    const base = app.config.publicUrl ?? `http://localhost:${app.config.port}`;
+    return {
+        rule: rule.name,
+        project: p?.name ?? rule.projectId,
+        state,
+        message: await messageOf(app, rule, state, value, now),
+        value,
+        threshold: rule.threshold,
+        timeMs: now,
+        url: `${base}/_wizelens/#/alerts?project=${rule.projectId}`,
+    };
+}
+/** One OpenTelemetry metric over the rule's window (from its rollups), and a sample series for its unit. */
+async function measureMetric(app, rule, now) {
+    const at = alignNow(now);
+    const q = { projectId: rule.projectId, env: rule.env || undefined, service: rule.metricService || undefined };
+    const data = await loadMetricAlertData(app.db, q, rule.metricName, { from: at - rule.windowMs, to: at }, at);
+    const stat = rule.metricStat || "avg";
+    return { value: metricAlertValueOf(data, stat), sample: data.series[0], stat };
+}
+async function messageOf(app, rule, state, value, now) {
+    if (rule.metric !== "metric")
+        return alertMessage(rule.metric, rule.op, value, rule.threshold, state);
+    const { sample, stat } = await measureMetric(app, rule, now);
+    const unit = sample ? metricAlertUnit(sample, stat) : "";
+    return metricAlertMessage(rule.metricName, stat, rule.op, value, rule.threshold, unit, state);
+}
+/** The metric over the rule's window: from the stats tables, or from the metric's points. */
+async function measure(app, rule, now) {
+    if (rule.metric === "metric")
+        return (await measureMetric(app, rule, now)).value;
+    const retentionMs = await projectRetentionMs(app.db, rule.projectId, app.config.retentionDays);
+    return computePage(alertPage(rule.metric), alertContext(rule.windowMs, alignNow(now)), cloudExecutor(app.db, rule.projectId, retentionMs, rule.env || undefined));
+}
+/** Send a notice and keep it as an event. */
+export async function notify(app, rule, state, value, now) {
+    const notice = await noticeOf(app, rule, state, value, now);
+    const delivery = await deliver(rule.channels, notice, app.config.fetch, app.config.allowPrivateWebhooks);
+    await addEvent(app.db, rule, { kind: state, value, message: notice.message, timeMs: now, delivery });
+    return delivery;
+}
+/** Check one rule. It notifies only when the state changes: ok to firing, or firing to ok. */
+export async function evaluateRule(app, rule, now) {
+    const value = await measure(app, rule, now);
+    const firing = rule.metric === "metric" ? value !== null && (rule.op === ">" ? value > rule.threshold : value < rule.threshold) : alertBreached(rule.metric, rule.op, value, rule.threshold);
+    const next = firing ? "firing" : "ok";
+    await saveEvaluation(app.db, rule.id, next, value, now);
+    if (next !== rule.state)
+        await notify(app, rule, firing ? "fired" : "resolved", value, now);
+}
+/** Check every enabled rule once. One failing rule does not stop the others. */
+export async function evaluateAll(app) {
+    const now = app.config.now();
+    for (const rule of await enabledRules(app.db)) {
+        await evaluateRule(app, rule, now).catch((err) => console.error(`[wizelens-cloud] alert ${rule.id} failed:`, err));
+    }
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/alerts/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE5K,OAAO,EAAE,QAAQ,EAAkB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAe,MAAM,aAAa,CAAC;AAEnD,4DAA4D;AAC5D,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IAC/G,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAmB,yCAAyC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,oBAAoB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3E,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,SAAS;QAClC,KAAK;QACL,OAAO,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC;QACtD,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG,IAAI,+BAA+B,IAAI,CAAC,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,aAAa,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IACtE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;IAC9G,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IAChH,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAChG,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,OAAO,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/F,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;AACpK,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IACpH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACzG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7L,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAa;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC"}

package/dist/alerts/notify.d.ts

@@ -0,0 +1,17 @@
+import type { Channel } from "../repo/alerts.js";
+export interface Notice {
+    rule: string;
+    project: string;
+    state: "fired" | "resolved" | "test";
+    message: string;
+    value: number | null;
+    threshold: number;
+    timeMs: number;
+    /** Link to the project in the dashboard. */
+    url: string;
+}
+/** A webhook may not point into the service's own network (cloud metadata, databases). Self-hosts can allow it. */
+export declare function checkTarget(url: string, allowPrivate: boolean): Promise<string | null>;
+/** Send to every channel. Returns one line per channel, for the event's delivery note. */
+export declare function deliver(channels: readonly Channel[], n: Notice, http: typeof fetch, allowPrivate: boolean): Promise<string>;
+//# sourceMappingURL=notify.d.ts.map

package/dist/alerts/notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/alerts/notify.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;CACb;AAKD,mHAAmH;AACnH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY5F;AASD,0FAA0F;AAC1F,wBAAsB,OAAO,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAcjI"}

package/dist/alerts/notify.js

@@ -0,0 +1,46 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+const PRIVATE_V4 = [/^10\./, /^127\./, /^169\.254\./, /^172\.(1[6-9]|2\d|3[01])\./, /^192\.168\./, /^0\./, /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./];
+const isPrivate = (ip) => (isIP(ip) === 6 ? /^(::1|fc|fd|fe80|::ffff:(10|127|169\.254|192\.168)\.)/i.test(ip) || ip === "::" : PRIVATE_V4.some((r) => r.test(ip)));
+/** A webhook may not point into the service's own network (cloud metadata, databases). Self-hosts can allow it. */
+export async function checkTarget(url, allowPrivate) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return "Not a valid URL.";
+    }
+    if (u.protocol !== "https:" && !(allowPrivate && u.protocol === "http:"))
+        return "Use an https:// URL.";
+    if (allowPrivate)
+        return null;
+    const addresses = isIP(u.hostname) ? [u.hostname] : (await lookup(u.hostname, { all: true }).catch(() => [])).map((a) => a.address);
+    if (addresses.length === 0)
+        return "The host name does not resolve.";
+    return addresses.some(isPrivate) ? "Webhooks cannot point at private or local addresses." : null;
+}
+function bodyOf(channel, n) {
+    if (channel.kind === "webhook")
+        return n;
+    const icon = n.state === "fired" ? ":rotating_light:" : n.state === "resolved" ? ":white_check_mark:" : ":bell:";
+    const verb = n.state === "fired" ? "Alert" : n.state === "resolved" ? "Resolved" : "Test";
+    return { text: `${icon} *${verb}: ${n.rule}* (${n.project})\n${n.message}\n<${n.url}|Open WizeLens>` };
+}
+/** Send to every channel. Returns one line per channel, for the event's delivery note. */
+export async function deliver(channels, n, http, allowPrivate) {
+    const results = await Promise.all(channels.map(async (c) => {
+        const problem = await checkTarget(c.url, allowPrivate);
+        if (problem)
+            return `${c.kind}: ${problem}`;
+        try {
+            const res = await http(c.url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(bodyOf(c, n)), signal: AbortSignal.timeout(5000), redirect: "error" });
+            return `${c.kind}: ${res.ok ? "sent" : `HTTP ${res.status}`}`;
+        }
+        catch (err) {
+            return `${c.kind}: ${err instanceof Error ? err.message : "failed"}`;
+        }
+    }));
+    return results.join("; ") || "no channels";
+}
+//# sourceMappingURL=notify.js.map

package/dist/alerts/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/alerts/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAehC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,EAAE,0CAA0C,CAAC,CAAC;AACvJ,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,wDAAwD,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE3K,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,YAAqB;IAClE,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACxG,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACrE,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC,IAAI,CAAC;AACnG,CAAC;AAED,SAAS,MAAM,CAAC,OAAgB,EAAE,CAAS;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjH,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,GAAG,iBAAiB,EAAE,CAAC;AACzG,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,QAA4B,EAAE,CAAS,EAAE,IAAkB,EAAE,YAAqB;IAC9G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,OAAO;YAAE,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7L,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;AAC7C,CAAC"}

package/dist/app.d.ts

@@ -0,0 +1,18 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { CloudConfig } from "./config.js";
+import type { Db } from "./db/db.js";
+import type { RouteCtx } from "./http/router.js";
+/** Everything a request handler needs. */
+export interface CloudApp {
+    db: Db;
+    config: CloudConfig;
+    version: string;
+    startedMs: number;
+    /** The address for links: the public URL, or the one this request came in on. */
+    baseUrl(req: IncomingMessage): string;
+}
+export interface Ctx extends RouteCtx {
+    app: CloudApp;
+}
+export type { IncomingMessage, ServerResponse };
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,0CAA0C;AAC1C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,GAAI,SAAQ,QAAQ;IACnC,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC"}

package/dist/app.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":""}

package/dist/auth/crypto.d.ts

@@ -0,0 +1,19 @@
+/** "scrypt$<salt>$<hash>", both base64url. */
+export declare function hashPassword(password: string): Promise<string>;
+export declare function checkPassword(password: string, stored: string): Promise<boolean>;
+/** Kinds of secret tokens. The prefix tells a person what a token is for. */
+export declare const TOKEN_PREFIX: {
+    readonly session: "wl_s_";
+    readonly invite: "wl_inv_";
+    readonly ingest: "wl_ik_";
+    readonly read: "wl_rk_";
+    readonly share: "wl_sh_";
+};
+export type TokenKind = keyof typeof TOKEN_PREFIX;
+/** A new random token. Only its hash is stored. */
+export declare const newToken: (kind: TokenKind) => string;
+export declare const hashToken: (token: string) => string;
+export declare const newId: () => string;
+/** A URL-safe short name from free text, for example "My Shop!" -> "my-shop". */
+export declare const slugOf: (text: string) => string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/auth/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAOA,8CAA8C;AAC9C,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpE;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMtF;AAED,6EAA6E;AAC7E,eAAO,MAAM,YAAY;aAAK,OAAO,EAAE,OAAO;aAAE,MAAM,EAAE,SAAS;aAAE,MAAM,EAAE,QAAQ;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,QAAQ;CAAW,CAAC;AAChI,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC;AAElD,mDAAmD;AACnD,eAAO,MAAM,QAAQ,SAAU,SAAS,KAAG,MAAyE,CAAC;AAErH,eAAO,MAAM,SAAS,UAAW,MAAM,KAAG,MAA0D,CAAC;AAErG,eAAO,MAAM,KAAK,QAAO,MAAsB,CAAC;AAEhD,iFAAiF;AACjF,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAMX,CAAC"}

package/dist/auth/crypto.js

@@ -0,0 +1,33 @@
+import { createHash, randomBytes, randomUUID, scrypt, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+const scryptAsync = promisify(scrypt);
+const SCRYPT = { N: 16384, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
+const KEY_LENGTH = 32;
+/** "scrypt$<salt>$<hash>", both base64url. */
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const key = await scryptAsync(password, salt, KEY_LENGTH, SCRYPT);
+    return `scrypt$${salt.toString("base64url")}$${key.toString("base64url")}`;
+}
+export async function checkPassword(password, stored) {
+    const [kind, salt, hash] = stored.split("$");
+    if (kind !== "scrypt" || !salt || !hash)
+        return false;
+    const expected = Buffer.from(hash, "base64url");
+    const key = await scryptAsync(password, Buffer.from(salt, "base64url"), expected.length, SCRYPT);
+    return key.length === expected.length && timingSafeEqual(key, expected);
+}
+/** Kinds of secret tokens. The prefix tells a person what a token is for. */
+export const TOKEN_PREFIX = { session: "wl_s_", invite: "wl_inv_", ingest: "wl_ik_", read: "wl_rk_", share: "wl_sh_" };
+/** A new random token. Only its hash is stored. */
+export const newToken = (kind) => `${TOKEN_PREFIX[kind]}${randomBytes(24).toString("base64url")}`;
+export const hashToken = (token) => createHash("sha256").update(token).digest("hex");
+export const newId = () => randomUUID();
+/** A URL-safe short name from free text, for example "My Shop!" -> "my-shop". */
+export const slugOf = (text) => text
+    .toLowerCase()
+    .normalize("NFKD")
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 40) || "item";
+//# sourceMappingURL=crypto.js.map

package/dist/auth/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAyF,CAAC;AAC9H,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAClE,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAClE,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAc;IAClE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAW,CAAC;AAGhI,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAe,EAAU,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAErH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,UAAU,EAAE,CAAC;AAEhD,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI;KACD,WAAW,EAAE;KACb,SAAS,CAAC,MAAM,CAAC;KACjB,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;KAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;KACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC"}

package/dist/auth/principal.d.ts

@@ -0,0 +1,33 @@
+import type { Ctx } from "../app.js";
+import { type ApiKey, type Project } from "../repo/projects.js";
+import { type User } from "../repo/users.js";
+import { type Permission, type Role } from "./roles.js";
+export declare const SESSION_COOKIE = "wizelens_session";
+/** Who is calling: a signed-in person, or a read key (AI agents and scripts). */
+export type Principal = {
+    kind: "user";
+    user: User;
+} | {
+    kind: "key";
+    key: ApiKey & {
+        orgId: string;
+    };
+};
+export declare function principalOf(ctx: Ctx): Promise<Principal | undefined>;
+/** A signed-in person, or 401. Changes also need the dashboard header, so other sites cannot send them. */
+export declare function requireUser(ctx: Ctx): Promise<User>;
+/** The caller's role in an organization, when it allows `permission`; otherwise 403 (or 404 when not a member). */
+export declare function requireOrg(ctx: Ctx, orgId: string, permission: Permission): Promise<{
+    user: User;
+    role: Role;
+}>;
+export interface ProjectAccess {
+    project: Project;
+    /** "user:<id>" or "key:<id>", for the audit log. */
+    actor: string;
+    role: Role;
+    principal: Principal;
+}
+/** Access to one project's data, for a person or a read key. */
+export declare function requireProject(ctx: Ctx, projectId: string, permission?: Permission): Promise<ProjectAccess>;
+//# sourceMappingURL=principal.d.ts.map

package/dist/auth/principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGrC,OAAO,EAAE,KAAK,MAAM,EAAc,KAAK,OAAO,EAAgB,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,KAAK,IAAI,EAAiB,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAO,KAAK,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAE7D,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAExG,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAU1E;AAED,2GAA2G;AAC3G,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;AAED,mHAAmH;AACnH,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAMrH;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gEAAgE;AAChE,wBAAsB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,UAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAWzH"}

package/dist/auth/principal.js

@@ -0,0 +1,64 @@
+import { bearerOf, cookieOf, fail, HttpError } from "../http/http.js";
+import { membership } from "../repo/orgs.js";
+import { keyByToken, projectInOrg } from "../repo/projects.js";
+import { userBySession } from "../repo/users.js";
+import { can } from "./roles.js";
+export const SESSION_COOKIE = "wizelens_session";
+export async function principalOf(ctx) {
+    const now = ctx.app.config.now();
+    const bearer = bearerOf(ctx.req);
+    if (bearer?.startsWith("wl_rk_")) {
+        const key = await keyByToken(ctx.app.db, bearer, now);
+        return key?.kind === "read" ? { kind: "key", key } : undefined;
+    }
+    const token = cookieOf(ctx.req, SESSION_COOKIE);
+    const user = token ? await userBySession(ctx.app.db, token, now) : undefined;
+    return user ? { kind: "user", user } : undefined;
+}
+/** A signed-in person, or 401. Changes also need the dashboard header, so other sites cannot send them. */
+export async function requireUser(ctx) {
+    const p = await principalOf(ctx);
+    if (p?.kind !== "user")
+        return fail(401, "Sign in first.");
+    const method = ctx.req.method ?? "GET";
+    if (method !== "GET" && ctx.req.headers["x-wizelens-client"] !== "dashboard")
+        fail(403, "Missing the X-WizeLens-Client header.");
+    return p.user;
+}
+/** The caller's role in an organization, when it allows `permission`; otherwise 403 (or 404 when not a member). */
+export async function requireOrg(ctx, orgId, permission) {
+    const user = await requireUser(ctx);
+    const m = await membership(ctx.app.db, user.id, orgId);
+    if (!m)
+        fail(404, "Organization not found.");
+    if (!can(m.role, permission))
+        fail(403, `Your role (${m.role}) cannot do this.`);
+    return { user, role: m.role };
+}
+/** Access to one project's data, for a person or a read key. */
+export async function requireProject(ctx, projectId, permission = "read") {
+    const p = await principalOf(ctx);
+    if (!p)
+        return fail(401, "Sign in, or send a read key.");
+    if (p.kind === "key")
+        return keyAccess(ctx, p, projectId, permission);
+    const [row] = await ctx.app.db.query("SELECT org_id FROM projects WHERE id = $1", [projectId]);
+    const m = row ? await membership(ctx.app.db, p.user.id, row.org_id) : undefined;
+    const project = m ? await projectInOrg(ctx.app.db, m.id, projectId) : undefined;
+    if (!m || !project)
+        return fail(404, "Project not found.");
+    if (!can(m.role, permission))
+        fail(403, `Your role (${m.role}) cannot do this.`);
+    if (permission !== "read")
+        await requireUser(ctx);
+    return { project, actor: `user:${p.user.id}`, role: m.role, principal: p };
+}
+async function keyAccess(ctx, p, projectId, permission) {
+    if (permission !== "read")
+        throw new HttpError(403, "Read keys can only read.");
+    const project = p.key.projectIds.includes(projectId) ? await projectInOrg(ctx.app.db, p.key.orgId, projectId) : undefined;
+    if (!project)
+        return fail(404, "Project not found.");
+    return { project, actor: `key:${p.key.id}`, role: "viewer", principal: p };
+}
+//# sourceMappingURL=principal.js.map

package/dist/auth/principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAe,UAAU,EAAgB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAa,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAA8B,MAAM,YAAY,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAKjD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,WAAW;QAAE,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;IACjI,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAQ,EAAE,KAAa,EAAE,UAAsB;IAC9E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAE,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAE,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAUD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAQ,EAAE,SAAiB,EAAE,UAAU,GAAe,MAAM;IAC/F,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACnH,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACjF,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,CAA8B,EAAE,SAAiB,EAAE,UAAsB;IAC1G,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1H,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC"}

package/dist/auth/roles.d.ts

@@ -0,0 +1,10 @@
+/** Roles in an organization, from most to least power. */
+export declare const ROLES: readonly ["owner", "admin", "member", "viewer"];
+export type Role = (typeof ROLES)[number];
+export declare const isRole: (v: unknown) => v is Role;
+/** What each role may do. Read: data, members. Write: alerts, shares. Manage: projects, keys, members, settings. */
+export type Permission = "read" | "write" | "manage" | "own";
+export declare const can: (role: Role, permission: Permission) => boolean;
+/** An admin may not give a role above their own. */
+export declare const canGrant: (actor: Role, target: Role) => boolean;
+//# sourceMappingURL=roles.d.ts.map

package/dist/auth/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,eAAO,MAAM,KAAK,YAAI,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AACrE,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1C,eAAO,MAAM,MAAM,MAAO,OAAO,KAAG,CAAC,IAAI,IAAyE,CAAC;AAEnH,oHAAoH;AACpH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAK7D,eAAO,MAAM,GAAG,SAAU,IAAI,cAAc,UAAU,KAAG,OAA2C,CAAC;AAErG,oDAAoD;AACpD,eAAO,MAAM,QAAQ,UAAW,IAAI,UAAU,IAAI,KAAG,OAAwC,CAAC"}

package/dist/auth/roles.js

@@ -0,0 +1,9 @@
+/** Roles in an organization, from most to least power. */
+export const ROLES = ["owner", "admin", "member", "viewer"];
+export const isRole = (v) => typeof v === "string" && ROLES.includes(v);
+const LEVEL = { owner: 3, admin: 2, member: 1, viewer: 0 };
+const NEEDS = { read: 0, write: 1, manage: 2, own: 3 };
+export const can = (role, permission) => LEVEL[role] >= NEEDS[permission];
+/** An admin may not give a role above their own. */
+export const canGrant = (actor, target) => LEVEL[actor] >= LEVEL[target];
+//# sourceMappingURL=roles.js.map

package/dist/auth/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGrE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAU,EAAa,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAK,KAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAKnH,MAAM,KAAK,GAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACjF,MAAM,KAAK,GAA+B,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEnF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAU,EAAE,UAAsB,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;AAErG,oDAAoD;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAW,EAAE,MAAY,EAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC"}

package/dist/cli-args.d.ts

@@ -0,0 +1,5 @@
+import type { CloudOptions } from "./config.js";
+export declare const USAGE = "wizelens-cloud: the WizeLens service for many teams.\n\nUsage: wizelens-cloud [options]\n\n  --database <url>          postgres://..., pglite:<folder>, or memory.\n                            Default pglite:./.wizelens-cloud.          (DATABASE_URL)\n  --port <n>                Default 5970.                               (PORT)\n  --host <addr>             Default 0.0.0.0.                            (WIZELENS_CLOUD_HOST)\n  --public-url <url>        The address people use, for links.          (WIZELENS_CLOUD_PUBLIC_URL)\n  --signup <invite|open>    Who can make an account. Default invite.    (WIZELENS_CLOUD_SIGNUP)\n  --retention-days <n>      Default for new organizations. Default 30.  (WIZELENS_CLOUD_RETENTION_DAYS)\n  --allow-private-webhooks  Let alert webhooks reach private addresses. (WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1)\n  --help                    Show this help.\n";
+/** Options from the command line, then from the environment. */
+export declare function optionsFromArgs(argv: string[], env: NodeJS.ProcessEnv): CloudOptions | "help";
+//# sourceMappingURL=cli-args.d.ts.map

package/dist/cli-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAE5D,eAAO,MAAM,KAAK,83BAajB,CAAC;AAKF,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,YAAY,GAAG,MAAM,CAwB7F"}

package/dist/cli-args.js

@@ -0,0 +1,45 @@
+import { parseArgs } from "node:util";
+export const USAGE = `wizelens-cloud: the WizeLens service for many teams.
+
+Usage: wizelens-cloud [options]
+
+  --database <url>          postgres://..., pglite:<folder>, or memory.
+                            Default pglite:./.wizelens-cloud.          (DATABASE_URL)
+  --port <n>                Default 5970.                               (PORT)
+  --host <addr>             Default 0.0.0.0.                            (WIZELENS_CLOUD_HOST)
+  --public-url <url>        The address people use, for links.          (WIZELENS_CLOUD_PUBLIC_URL)
+  --signup <invite|open>    Who can make an account. Default invite.    (WIZELENS_CLOUD_SIGNUP)
+  --retention-days <n>      Default for new organizations. Default 30.  (WIZELENS_CLOUD_RETENTION_DAYS)
+  --allow-private-webhooks  Let alert webhooks reach private addresses. (WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1)
+  --help                    Show this help.
+`;
+const int = (v) => (v && /^\d+$/.test(v) ? Number(v) : undefined);
+const signupOf = (v) => (v === "open" || v === "invite" ? v : undefined);
+/** Options from the command line, then from the environment. */
+export function optionsFromArgs(argv, env) {
+    const { values: a } = parseArgs({
+        args: argv,
+        options: {
+            database: { type: "string" },
+            port: { type: "string" },
+            host: { type: "string" },
+            "public-url": { type: "string" },
+            signup: { type: "string" },
+            "retention-days": { type: "string" },
+            "allow-private-webhooks": { type: "boolean" },
+            help: { type: "boolean", short: "h" },
+        },
+    });
+    if (a.help)
+        return "help";
+    return {
+        database: a.database ?? env.DATABASE_URL,
+        port: int(a.port ?? env.PORT),
+        host: a.host ?? env.WIZELENS_CLOUD_HOST,
+        publicUrl: a["public-url"] ?? env.WIZELENS_CLOUD_PUBLIC_URL,
+        signup: signupOf(a.signup ?? env.WIZELENS_CLOUD_SIGNUP),
+        retentionDays: int(a["retention-days"] ?? env.WIZELENS_CLOUD_RETENTION_DAYS),
+        allowPrivateWebhooks: a["allow-private-webhooks"] ?? env.WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS === "1",
+    };
+}
+//# sourceMappingURL=cli-args.js.map

package/dist/cli-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAapB,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACtF,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAA0B,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAErH,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,GAAsB;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC;QAC9B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACtC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY;QACxC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,mBAAmB;QACvC,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,yBAAyB;QAC3D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,qBAAqB,CAAC;QACvD,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,6BAA6B,CAAC;QAC5E,oBAAoB,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC,qCAAqC,KAAK,GAAG;KACvG,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import { optionsFromArgs, USAGE } from "./cli-args.js";
+import { CLOUD_VERSION, createCloud } from "./server.js";
+async function main() {
+    const options = optionsFromArgs(process.argv.slice(2), process.env);
+    if (options === "help")
+        return void process.stdout.write(USAGE);
+    const cloud = await createCloud(options);
+    const url = await cloud.listen();
+    const db = cloud.app.db.kind === "postgres" ? "Postgres" : `PGlite (${cloud.app.config.database})`;
+    console.info([
+        `WizeLens Cloud ${CLOUD_VERSION}`,
+        `  Dashboard   ${url}/_wizelens/`,
+        `  Add-ons     WIZELENS_HUB=${url}  WIZELENS_HUB_TOKEN=<ingest key>`,
+        `  OTLP/HTTP   OTEL_EXPORTER_OTLP_ENDPOINT=${url}  (header Authorization=Bearer <ingest key>)`,
+        `  Database    ${db}`,
+    ].join("\n"));
+    if (cloud.app.db.kind === "pglite")
+        console.info("  Note: PGlite is for trials and tests. Use Postgres for real teams.");
+    const stop = () => void cloud.close().then(() => process.exit(0));
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+}
+main().catch((err) => {
+    console.error(`[wizelens-cloud] ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEzD,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC;IACnG,OAAO,CAAC,IAAI,CACV;QACE,kBAAkB,aAAa,EAAE;QACjC,iBAAiB,GAAG,aAAa;QACjC,8BAA8B,GAAG,mCAAmC;QACpE,6CAA6C,GAAG,8CAA8C;QAC9F,iBAAiB,EAAE,EAAE;KACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACzH,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}