@wizeworks/lens-cloud 0.0.0-stage → 0.3.0-alpha.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WizeWorks LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,116 @@
-# Temporary Holding Version
+# @wizeworks/lens-cloud
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The cloud service of [WizeLens](https://github.com/brandonkorous/wizelens): the full dashboard for many teams, with accounts,
+projects, 30 days of history computed on the server, alerts, share links, and AI access through read keys.
+
+```bash
+# Try it on your machine (Postgres in-process, data in ./.wizelens-cloud)
+npx @wizeworks/lens-cloud
+
+# For a team: Postgres in Docker
+POSTGRES_PASSWORD=<a long secret> docker compose -f deploy/docker-compose.cloud.yml up -d
+```
+
+The cloud prints a one-time setup link while it has no account. Open it and create the first account. Make an ingest key on the
+Team page, then on each app:
+
+```bash
+WIZELENS_HUB=http://localhost:5970
+WIZELENS_HUB_TOKEN=wl_ik_...
+```
+
+## Options
+
+| Flag | Environment variable | Default |
+|---|---|---|
+| `--database <url>` | `DATABASE_URL` | `pglite:./.wizelens-cloud` (`postgres://…`, `pglite:<folder>`, or `memory`) |
+| `--port <n>` | `PORT` | `5970` |
+| `--host <addr>` | `WIZELENS_CLOUD_HOST` | `0.0.0.0` |
+| `--public-url <url>` | `WIZELENS_CLOUD_PUBLIC_URL` | the request's own address |
+| `--signup <invite\|open>` | `WIZELENS_CLOUD_SIGNUP` | `invite` |
+| `--retention-days <n>` | `WIZELENS_CLOUD_RETENTION_DAYS` | `30` |
+| `--allow-private-webhooks` | `WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1` | off |
+| `--auth-secret <text>` | `WIZELENS_CLOUD_AUTH_SECRET` | required with Postgres (32+ random characters; `2:new,1:old` rotates) |
+| `--resend-api-key <key>` | `WIZELENS_CLOUD_RESEND_API_KEY` | none: mail through the [Resend](https://resend.com) API (`re_…`) |
+| `--resend-webhook-secret <s>` | `WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET` | none: the `whsec_…` secret of the Resend webhook (see below) |
+| `--smtp-url <url>` | `WIZELENS_CLOUD_SMTP_URL` | none: or mail over SMTP (`smtp://user:pass@host:587` or `smtps://…:465`) |
+| `--mail-from <address>` | `WIZELENS_CLOUD_MAIL_FROM` | `WizeLens <no-reply@<public host>>` |
+| `--trust-proxy` | `WIZELENS_CLOUD_TRUST_PROXY=1` | off (client address from the last `X-Forwarded-For` entry) |
+| `--setup-token <text>` | `WIZELENS_CLOUD_SETUP_TOKEN` | random, printed at start while no account exists |
+| `--[no-]check-pwned-passwords` | `WIZELENS_CLOUD_CHECK_PWNED=1\|0` | on with Postgres, off with PGlite |
+| `--sso-origins <list>` | `WIZELENS_CLOUD_SSO_ORIGINS` | none: identity provider origins for OIDC single sign-on, comma separated (`https://acme.okta.com`) |
+
+Put it behind https, and set `--public-url` to the https address: cookies are then Secure, and passkeys and email links use it.
+Sending mail needs `--public-url`. Without `--resend-api-key` or `--smtp-url`, nobody gets email: reset and invite links are in
+the log, and email addresses are not confirmed. PGlite is for trials and tests; use Postgres for real teams.
+
+## Email
+
+Use Resend or SMTP, not both. With Resend, each email is sent with an idempotency key and tried up to 4 times on 429 and 5xx answers.
+Add a Resend webhook to `<public-url>/_wizelens/api/mail/resend` with the events `email.bounced` and `email.complained`, and set
+`--resend-webhook-secret` to its signing secret. The cloud checks the signature, then keeps a suppression list: after a hard bounce
+no mail goes to that address, and after a spam complaint only mail the person asked for (confirm, reset, change, delete) goes
+there. Confirming the address again by link clears it.
+
+What the cloud sends, beyond sign-in links and invites:
+
+- **Security notices**, always, to the person: password changed, email changed (to the old address), two-step sign-in on or off,
+  passkey added or removed, new backup codes, and a sign-in on a browser and system the account never used.
+- **Team changes**, to owners and admins: members invited, joined, left, removed, or given a new role (that member hears too), keys,
+  single sign-on, projects, share links, and settings. One email per batch, without the reader's own changes. A deleted
+  organization is told to every member.
+- **Project health**, to owners and admins: a project that sends data in most hours went quiet for 2 hours, and when it is back.
+- **Alerts**, from alert rules.
+- **Digests**, per person and project: daily, weekly (Mondays), and monthly (the 1st), at the person's hour and time zone. Weekly
+  is on by default. Each has requests, error rate, average and p95 time, SQL queries, alerts fired, top errors, the slowest
+  endpoints, and insights. Projects with no traffic get none.
+
+Team, health, and digest emails carry a one-click stop link (`List-Unsubscribe`, RFC 8058). People pick all of it on the Account
+page. `pnpm --filter @wizeworks/lens-cloud email:preview <folder>` writes every email to HTML and text.
+
+## Accounts
+
+Sign-in is [Better Auth](https://better-auth.com) (pinned to one version): email and password, passkeys, two-step codes from an
+authenticator app with backup codes, password reset and email confirm by link, sessions per device (sign out one or all),
+organizations with owner, admin, member, and viewer roles, email invites, single sign-on per organization (OIDC or SAML, after a
+DNS proof of the email domain; Team page), and account deletion. Sign-in tries are limited per
+client address across all instances. Existing accounts keep working after the upgrade; everyone signs in once more. See
+`docs/CONTRACT.md`, "Tenancy and access".
+
+Check a running cloud end to end with `node scripts/cloud-smoke.mjs <url> <setup token>` from the repo (a fresh database, no SMTP).
+
+## Stats
+
+Pages are computed from stats tables, never from a sample of traces: per-trace facts (request, trace, log, and slow span rows) and
+rollups in 10 s, 5 min, and 1 h buckets, so 30-day pages on busy projects answer in well under a second. A background job settles
+traces a few seconds after their last span (every 3 s, one instance at a time through a Postgres advisory lock); pages say
+"Preparing stats" while traces wait, for example right after an upgrade, when existing traces are backfilled newest first.
+Alerts on traces read the same tables. See `docs/CONTRACT.md`, "Stats tables".
+
+## Metrics
+
+Apps send OpenTelemetry metrics to `POST /v1/metrics` with the ingest key (JSON or protobuf; gauges, sums, histograms,
+exponential histograms, and summaries). WizeLens add-ons send theirs in their batches. The Metrics page reads
+`GET /_wizelens/api/models/metrics?project=&range=&env=&service=&metric=&group=&stat=&q=` (member or read key), computed from
+metric rollups (per series, in 10 s, 5 min, and 1 h buckets, written as points arrive), so every range reads all of its points.
+Points and rollups follow the organization's retention. Alert rules can watch
+one metric: `{ "metric": "metric", "metricName": "process.cpu.utilization", "metricStat": "avg", "metricService": "", ... }`, with
+`metricStat` one of `last`, `avg`, `max`, `p95`, `p99`, `rate`, and the threshold in the metric's own unit (seconds, bytes, or
+0 to 1 for ratios). Read keys get `list_metrics` and `get_metric` over MCP.
+
+## In code
+
+```ts
+import { createCloud } from "@wizeworks/lens-cloud";
+
+const cloud = await createCloud({
+  database: process.env.DATABASE_URL,
+  publicUrl: "https://wizelens.example.com",
+  authSecret: process.env.WIZELENS_CLOUD_AUTH_SECRET,
+  resendApiKey: process.env.WIZELENS_CLOUD_RESEND_API_KEY,
+  resendWebhookSecret: process.env.WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET,
+});
+console.log(await cloud.listen());
+```
+
+The API, roles, keys, and storage are in [CONTRACT.md](https://github.com/brandonkorous/wizelens/blob/main/docs/CONTRACT.md#cloud-v07-phase-3). MIT licensed.

package/dist/alerts/evaluate.d.ts

@@ -0,0 +1,10 @@
+import type { CloudApp } from "../app.js";
+import { type AlertRule } from "../repo/alerts.js";
+import { type Notice } from "./notify.js";
+/** Send a notice and keep it as an event. */
+export declare function notify(app: CloudApp, rule: AlertRule, state: Notice["state"], value: number | null, now: number): Promise<string>;
+/** Check one rule. It notifies only when the state changes: ok to firing, or firing to ok. */
+export declare function evaluateRule(app: CloudApp, rule: AlertRule, now: number): Promise<void>;
+/** Check every enabled rule once. One failing rule does not stop the others. */
+export declare function evaluateAll(app: CloudApp): Promise<void>;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/alerts/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAY,KAAK,SAAS,EAAgC,MAAM,mBAAmB,CAAC;AAK3F,OAAO,EAAW,KAAK,MAAM,EAAe,MAAM,aAAa,CAAC;AAsDhE,6CAA6C;AAC7C,wBAAsB,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKvI;AAED,8FAA8F;AAC9F,wBAAsB,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7F;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9D"}

package/dist/alerts/evaluate.js

@@ -0,0 +1,81 @@
+import { alertBreached, alignNow, alertContext, alertMessage, alertPage, computePage, metricAlertMessage, metricAlertUnit, metricAlertValueOf } from "@wizeworks/lens-core";
+import { addEvent, enabledRules, saveEvaluation } from "../repo/alerts.js";
+import { loadMetricAlertData } from "../repo/metric-read.js";
+import { cloudExecutor, projectRetentionMs } from "../scale-exec.js";
+import { alertMail } from "../mail/templates.js";
+import { memberEmails } from "../repo/users.js";
+import { deliver } from "./notify.js";
+/** Names for the notice: project and the dashboard link. */
+async function noticeOf(app, rule, state, value, now) {
+    const [p] = await app.db.query("SELECT name FROM projects WHERE id = $1", [rule.projectId]);
+    const base = app.baseUrl();
+    return {
+        rule: rule.name,
+        project: p?.name ?? rule.projectId,
+        state,
+        message: await messageOf(app, rule, state, value, now),
+        value,
+        threshold: rule.threshold,
+        timeMs: now,
+        url: `${base}/_wizelens/#/alerts?project=${rule.projectId}`,
+    };
+}
+/** One OpenTelemetry metric over the rule's window (from its rollups), and a sample series for its unit. */
+async function measureMetric(app, rule, now) {
+    const at = alignNow(now);
+    const q = { projectId: rule.projectId, env: rule.env || undefined, service: rule.metricService || undefined };
+    const data = await loadMetricAlertData(app.db, q, rule.metricName, { from: at - rule.windowMs, to: at }, at);
+    const stat = rule.metricStat || "avg";
+    return { value: metricAlertValueOf(data, stat), sample: data.series[0], stat };
+}
+async function messageOf(app, rule, state, value, now) {
+    if (rule.metric !== "metric")
+        return alertMessage(rule.metric, rule.op, value, rule.threshold, state);
+    const { sample, stat } = await measureMetric(app, rule, now);
+    const unit = sample ? metricAlertUnit(sample, stat) : "";
+    return metricAlertMessage(rule.metricName, stat, rule.op, value, rule.threshold, unit, state);
+}
+/** The metric over the rule's window: from the stats tables, or from the metric's points. */
+async function measure(app, rule, now) {
+    if (rule.metric === "metric")
+        return (await measureMetric(app, rule, now)).value;
+    const retentionMs = await projectRetentionMs(app.db, rule.projectId, app.config.retentionDays);
+    return computePage(alertPage(rule.metric), alertContext(rule.windowMs, alignNow(now)), cloudExecutor(app.db, rule.projectId, retentionMs, rule.env || undefined));
+}
+/** Webhooks, Slack, and email. Email goes only to addresses that still belong to confirmed members of the organization. */
+async function outboxOf(app, projectId) {
+    const [p] = await app.db.query("SELECT org_id FROM projects WHERE id = $1", [projectId]);
+    const members = new Set(p ? await memberEmails(app.db, p.org_id, app.mailer.live) : []);
+    const email = (to, n) => {
+        const ok = to.filter((e) => members.has(e));
+        for (const addr of ok)
+            app.mailer.send(alertMail(addr, n));
+        const note = app.mailer.live ? `sent to ${ok.length}` : "mail is not set up (see the cloud log)";
+        return `email: ${note}${ok.length < to.length ? `, ${to.length - ok.length} no longer members` : ""}`;
+    };
+    return { http: app.config.fetch, allowPrivate: app.config.allowPrivateWebhooks, email };
+}
+/** Send a notice and keep it as an event. */
+export async function notify(app, rule, state, value, now) {
+    const notice = await noticeOf(app, rule, state, value, now);
+    const delivery = await deliver(rule.channels, notice, await outboxOf(app, rule.projectId));
+    await addEvent(app.db, rule, { kind: state, value, message: notice.message, timeMs: now, delivery });
+    return delivery;
+}
+/** Check one rule. It notifies only when the state changes: ok to firing, or firing to ok. */
+export async function evaluateRule(app, rule, now) {
+    const value = await measure(app, rule, now);
+    const firing = rule.metric === "metric" ? value !== null && (rule.op === ">" ? value > rule.threshold : value < rule.threshold) : alertBreached(rule.metric, rule.op, value, rule.threshold);
+    const next = firing ? "firing" : "ok";
+    await saveEvaluation(app.db, rule.id, next, value, now);
+    if (next !== rule.state)
+        await notify(app, rule, firing ? "fired" : "resolved", value, now);
+}
+/** Check every enabled rule once. One failing rule does not stop the others. */
+export async function evaluateAll(app) {
+    const now = app.config.now();
+    for (const rule of await enabledRules(app.db)) {
+        await evaluateRule(app, rule, now).catch((err) => console.error(`[wizelens-cloud] alert ${rule.id} failed:`, err));
+    }
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/alerts/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE5K,OAAO,EAAE,QAAQ,EAAkB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,OAAO,EAA4B,MAAM,aAAa,CAAC;AAEhE,4DAA4D;AAC5D,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IAC/G,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAmB,yCAAyC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,SAAS;QAClC,KAAK;QACL,OAAO,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC;QACtD,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG,IAAI,+BAA+B,IAAI,CAAC,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,aAAa,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IACtE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;IAC9G,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IAChH,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAChG,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,OAAO,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/F,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;AACpK,CAAC;AAED,2HAA2H;AAC3H,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,SAAiB;IACtD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,CAAC,EAAqB,EAAE,CAAS,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,EAAE;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,wCAAwC,CAAC;QACjG,OAAO,UAAU,IAAI,GAAG,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxG,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC;AAC1F,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IACpH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3F,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7L,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAa;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC"}

package/dist/alerts/notify.d.ts

@@ -0,0 +1,28 @@
+import type { Channel } from "../repo/alerts.js";
+export interface Notice {
+    rule: string;
+    project: string;
+    state: "fired" | "resolved" | "test";
+    message: string;
+    value: number | null;
+    threshold: number;
+    timeMs: number;
+    /** Link to the project in the dashboard. */
+    url: string;
+}
+/** How notices leave: HTTP for webhooks and Slack, and a mail function that sends to the members still allowed and says what it did. */
+export interface Outbox {
+    http: typeof fetch;
+    allowPrivate: boolean;
+    email: (to: readonly string[], n: Notice) => string;
+}
+/** A webhook may not point into the service's own network (cloud metadata, databases). Self-hosts can allow it. */
+export declare function checkTarget(url: string, allowPrivate: boolean): Promise<string | null>;
+/** The notice in words, for Slack and email. */
+export declare function noticeLines(n: Notice): {
+    subject: string;
+    lines: string[];
+};
+/** Send to every channel. Returns one line per channel, for the delivery note of the event. */
+export declare function deliver(channels: readonly Channel[], n: Notice, out: Outbox): Promise<string>;
+//# sourceMappingURL=notify.d.ts.map

package/dist/alerts/notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/alerts/notify.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;CACb;AAID,wIAAwI;AACxI,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,OAAO,KAAK,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;CACrD;AAKD,mHAAmH;AACnH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY5F;AAED,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAG3E;AAoBD,+FAA+F;AAC/F,wBAAsB,OAAO,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGnG"}

package/dist/alerts/notify.js

@@ -0,0 +1,52 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+const PRIVATE_V4 = [/^10\./, /^127\./, /^169\.254\./, /^172\.(1[6-9]|2\d|3[01])\./, /^192\.168\./, /^0\./, /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./];
+const isPrivate = (ip) => (isIP(ip) === 6 ? /^(::1|fc|fd|fe80|::ffff:(10|127|169\.254|192\.168)\.)/i.test(ip) || ip === "::" : PRIVATE_V4.some((r) => r.test(ip)));
+/** A webhook may not point into the service's own network (cloud metadata, databases). Self-hosts can allow it. */
+export async function checkTarget(url, allowPrivate) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return "Not a valid URL.";
+    }
+    if (u.protocol !== "https:" && !(allowPrivate && u.protocol === "http:"))
+        return "Use an https:// URL.";
+    if (allowPrivate)
+        return null;
+    const addresses = isIP(u.hostname) ? [u.hostname] : (await lookup(u.hostname, { all: true }).catch(() => [])).map((a) => a.address);
+    if (addresses.length === 0)
+        return "The host name does not resolve.";
+    return addresses.some(isPrivate) ? "Webhooks cannot point at private or local addresses." : null;
+}
+/** The notice in words, for Slack and email. */
+export function noticeLines(n) {
+    const verb = n.state === "fired" ? "Alert" : n.state === "resolved" ? "Resolved" : "Test";
+    return { subject: `${verb}: ${n.rule} (${n.project})`, lines: [`${verb}: ${n.rule} in ${n.project}.`, n.message] };
+}
+function bodyOf(channel, n) {
+    if (channel.kind === "webhook")
+        return n;
+    const icon = n.state === "fired" ? ":rotating_light:" : n.state === "resolved" ? ":white_check_mark:" : ":bell:";
+    const { subject } = noticeLines(n);
+    return { text: `${icon} *${subject}*\n${n.message}\n<${n.url}|Open WizeLens>` };
+}
+async function post(c, n, out) {
+    const problem = await checkTarget(c.url, out.allowPrivate);
+    if (problem)
+        return `${c.kind}: ${problem}`;
+    try {
+        const res = await out.http(c.url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(bodyOf(c, n)), signal: AbortSignal.timeout(5000), redirect: "error" });
+        return `${c.kind}: ${res.ok ? "sent" : `HTTP ${res.status}`}`;
+    }
+    catch (err) {
+        return `${c.kind}: ${err instanceof Error ? err.message : "failed"}`;
+    }
+}
+/** Send to every channel. Returns one line per channel, for the delivery note of the event. */
+export async function deliver(channels, n, out) {
+    const results = await Promise.all(channels.map(async (c) => (c.kind === "email" ? out.email(c.to, n) : post(c, n, out))));
+    return results.join("; ") || "no channels";
+}
+//# sourceMappingURL=notify.js.map

package/dist/alerts/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/alerts/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAwBhC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,EAAE,0CAA0C,CAAC,CAAC;AACvJ,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,wDAAwD,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE3K,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,YAAqB;IAClE,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACxG,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACrE,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC,IAAI,CAAC;AACnG,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACrH,CAAC;AAED,SAAS,MAAM,CAAC,OAAoB,EAAE,CAAS;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjH,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,KAAK,OAAO,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,GAAG,iBAAiB,EAAE,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,CAAc,EAAE,CAAS,EAAE,GAAW;IACxD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,OAAO;QAAE,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvE,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,QAA4B,EAAE,CAAS,EAAE,GAAW;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1H,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;AAC7C,CAAC"}

package/dist/app.d.ts

@@ -0,0 +1,26 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { WizeAuth } from "./auth/auth.js";
+import type { AuthSecret } from "./auth/secret.js";
+import type { CloudConfig } from "./config.js";
+import type { Db } from "./db/db.js";
+import type { RouteCtx } from "./http/router.js";
+import type { Mailer } from "./mail/mailer.js";
+/** Everything a request handler needs. */
+export interface CloudApp {
+    db: Db;
+    config: CloudConfig;
+    version: string;
+    startedMs: number;
+    mailer: Mailer;
+    /** The auth secrets, newest first, for signed mail links. */
+    secrets: readonly AuthSecret[];
+    /** Better Auth. Ready once the cloud listens (its address goes into links and cookie checks). */
+    readonly auth: WizeAuth;
+    /** The address for links: the public URL, or the address the cloud listens on. */
+    baseUrl(req?: IncomingMessage): string;
+}
+export interface Ctx extends RouteCtx {
+    app: CloudApp;
+}
+export type { IncomingMessage, ServerResponse };
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,0CAA0C;AAC1C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,kFAAkF;IAClF,OAAO,CAAC,GAAG,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,GAAI,SAAQ,QAAQ;IACnC,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC"}

package/dist/app.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":""}

package/dist/auth/auth.d.ts

@@ -0,0 +1,51 @@
+import { type BetterAuthOptions } from "better-auth";
+import type { AuthDeps } from "./deps.js";
+/** The parts of Better Auth the cloud calls itself; the dashboard reaches the rest through `api/auth/*`. */
+export interface WizeAuth {
+    handler: (request: Request) => Promise<Response>;
+    options: BetterAuthOptions;
+    api: {
+        getSession(a: {
+            headers: Headers;
+        }): Promise<{
+            user: SessionUser;
+            session: {
+                id: string;
+            };
+        } | null>;
+        verifyPassword(a: {
+            body: {
+                password: string;
+            };
+            headers: Headers;
+        }): Promise<unknown>;
+        createOrganization(a: {
+            body: {
+                name: string;
+                slug: string;
+                userId: string;
+            };
+        }): Promise<{
+            id: string;
+            name: string;
+            slug: string;
+        } | null>;
+    };
+}
+interface SessionUser {
+    id: string;
+    email: string;
+    name: string;
+    emailVerified: boolean;
+    twoFactorEnabled?: boolean | null;
+}
+/** Better Auth for the cloud: accounts, sessions, 2FA, passkeys, SSO, organizations, members, and invites (docs/CONTRACT.md, "Tenancy and access"). */
+export declare function createAuth(deps: AuthDeps): WizeAuth;
+/** A new organization with `userId` as owner, the cloud's default retention, a first project, and an audit line. */
+export declare function createOrgFor(auth: WizeAuth, deps: Pick<AuthDeps, "db" | "retentionDays">, userId: string, name: string): Promise<{
+    id: string;
+    name: string;
+    slug: string;
+}>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AA4C1C,4GAA4G;AAC5G,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,GAAG,EAAE;QACH,UAAU,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE,WAAW,CAAC;YAAC,OAAO,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACpG,cAAc,CAAC,CAAC,EAAE;YAAE,IAAI,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtF,kBAAkB,CAAC,CAAC,EAAE;YAAE,IAAI,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;KAC7I,CAAC;CACH;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAED,uJAAuJ;AACvJ,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAGnD;AAED,oHAAoH;AACpH,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAWlL"}

package/dist/auth/auth.js

@@ -0,0 +1,63 @@
+import { betterAuth } from "better-auth";
+import { audit } from "../repo/audit.js";
+import { freeSlug } from "../repo/orgs.js";
+import { createProject } from "../repo/projects.js";
+import { beforeDeleteUser } from "./delete-user.js";
+import { authHooks } from "./hooks.js";
+import { advancedOptions, AUTH_BASE_PATH, passwordAuth, rateLimitOptions, sessionOptions, userOptions } from "./options.js";
+import { authPlugins } from "./plugins.js";
+import { securityDbHooks } from "./security-notices.js";
+import { afterSignup, confirmSsoEmail } from "./signup.js";
+const ALWAYS_OFF = ["/sign-in/social", "/link-social", "/get-access-token", "/refresh-token", "/account-info", "/delete-user/callback", "/update-session"];
+/** Invite ids are link secrets: no route lists them (managers see them on our Team page), nor, without real mail, by "their" email. */
+const disabledPaths = (deps) => [
+    ...ALWAYS_OFF,
+    "/organization/list-invitations",
+    "/organization/get-full-organization",
+    ...(deps.mailer.live ? [] : ["/organization/list-user-invitations"]),
+];
+/** Sign-up (first organization, SSO email) and security notices (new device, two-step sign-in, changed email). */
+function databaseHooksOf(deps, createOrg) {
+    const notices = securityDbHooks(deps);
+    return { session: notices.session, user: { create: { before: confirmSsoEmail, after: afterSignup(deps, createOrg) }, update: notices.user?.update } };
+}
+function build(deps, createOrg) {
+    return betterAuth({
+        appName: "WizeLens",
+        baseURL: deps.publicUrl,
+        basePath: AUTH_BASE_PATH,
+        secrets: deps.secrets,
+        trustedOrigins: [...deps.trustedOrigins, ...deps.ssoOrigins],
+        telemetry: { enabled: false },
+        disabledPaths: disabledPaths(deps),
+        database: deps.db.authDatabase,
+        user: userOptions(deps, beforeDeleteUser(deps.db)),
+        ...passwordAuth(deps),
+        ...sessionOptions(),
+        rateLimit: rateLimitOptions(),
+        advanced: advancedOptions(deps),
+        databaseHooks: databaseHooksOf(deps, createOrg),
+        hooks: authHooks(deps),
+        plugins: authPlugins(deps),
+    });
+}
+/** Better Auth for the cloud: accounts, sessions, 2FA, passkeys, SSO, organizations, members, and invites (docs/CONTRACT.md, "Tenancy and access"). */
+export function createAuth(deps) {
+    const auth = build(deps, (userId, name) => createOrgFor(auth, deps, userId, name));
+    return auth;
+}
+/** A new organization with `userId` as owner, the cloud's default retention, a first project, and an audit line. */
+export async function createOrgFor(auth, deps, userId, name) {
+    const clean = name.trim().slice(0, 100) || "My organization";
+    const org = await auth.api.createOrganization({ body: { name: clean, slug: await freeSlug(deps.db, clean), userId } });
+    if (!org)
+        throw new Error("Could not create the organization.");
+    const now = Date.now();
+    await deps.db.tx(async (q) => {
+        await q.query("UPDATE orgs SET retention_days = $1 WHERE id = $2", [deps.retentionDays, org.id]);
+        await createProject(q, org.id, "My app", now);
+        await audit(q, org.id, `user:${userId}`, "org.create", { name: clean }, now);
+    });
+    return { id: org.id, name: org.name, slug: org.slug };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5H,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;AAE3J,uIAAuI;AACvI,MAAM,aAAa,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC;IACxC,GAAG,UAAU;IACb,gCAAgC;IAChC,qCAAqC;IACrC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC;CACrE,CAAC;AAEF,kHAAkH;AAClH,SAAS,eAAe,CAAC,IAAc,EAAE,SAAoE;IAC3G,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;AACxJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAc,EAAE,SAAoE;IACjG,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5D,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY;QAC9B,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,GAAG,YAAY,CAAC,IAAI,CAAC;QACrB,GAAG,cAAc,EAAE;QACnB,SAAS,EAAE,gBAAgB,EAAE;QAC7B,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC;QAC/B,aAAa,EAAE,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;QAC/C,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC;AAqBD,uJAAuJ;AACvJ,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAwB,CAAC;IAC1G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,IAA4C,EAAE,MAAc,EAAE,IAAY;IAC3H,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,iBAAiB,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACvH,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,CAAC,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,MAAM,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC"}

package/dist/auth/bridge.d.ts

@@ -0,0 +1,7 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { WizeAuth } from "./auth.js";
+/** The caller's address: the socket, or (behind a proxy we run) the last address that proxy added to X-Forwarded-For. */
+export declare function clientIp(req: IncomingMessage, trustProxy: boolean): string;
+/** Better Auth below `/_wizelens/api/auth/`: our dashboard header on changes, a body limit, and our own client-address header. */
+export declare function authHandler(auth: WizeAuth, trustProxy: boolean): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+//# sourceMappingURL=bridge.d.ts.map

package/dist/auth/bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/auth/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAU1C,yHAAyH;AACzH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,CAI1E;AAOD,kIAAkI;AAClI,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,SAE1C,eAAe,OAAO,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC,CAaxE"}

package/dist/auth/bridge.js

@@ -0,0 +1,39 @@
+import { toNodeHandler } from "better-auth/node";
+import { AUTH_BASE_PATH, CLIENT_IP_HEADER } from "./options.js";
+const SAFE = new Set(["GET", "HEAD", "OPTIONS"]);
+/** Paths an outside party posts to (sign-in providers), which cannot send the dashboard header. None are on yet; SSO adds them. */
+const EXTERNAL = [/^\/callback\/[^/]+$/, /^\/sso\/callback(\/[^/]+)?$/, /^\/sso\/saml2\/sp\/(acs|slo)\/[^/]+$/];
+const IP_HEADERS = ["x-forwarded-for", "x-real-ip", "cf-connecting-ip", "true-client-ip", "forwarded", CLIENT_IP_HEADER];
+const MAX_BODY = 64 * 1024;
+const MAX_EXTERNAL_BODY = 1024 * 1024;
+/** The caller's address: the socket, or (behind a proxy we run) the last address that proxy added to X-Forwarded-For. */
+export function clientIp(req, trustProxy) {
+    const forwarded = String(req.headers["x-forwarded-for"] ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+    const ip = trustProxy && forwarded.length ? forwarded[forwarded.length - 1] : (req.socket.remoteAddress ?? "");
+    return ip.replace(/^::ffff:/, "");
+}
+function deny(res, status, message) {
+    res.writeHead(status, { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" });
+    res.end(JSON.stringify({ error: message, message }));
+}
+/** Better Auth below `/_wizelens/api/auth/`: our dashboard header on changes, a body limit, and our own client-address header. */
+export function authHandler(auth, trustProxy) {
+    const handler = toNodeHandler(auth);
+    return async (req, res) => {
+        const path = new URL(req.url ?? "/", "http://cloud.local").pathname.slice(AUTH_BASE_PATH.length);
+        const external = EXTERNAL.some((r) => r.test(path));
+        if (!SAFE.has(req.method ?? "GET")) {
+            if (!external && req.headers["x-wizelens-client"] !== "dashboard")
+                return deny(res, 403, "Missing the X-WizeLens-Client header.");
+            const length = Number(req.headers["content-length"] ?? 0);
+            if (req.headers["transfer-encoding"] || length > (external ? MAX_EXTERNAL_BODY : MAX_BODY))
+                return deny(res, 413, "The body is too large.");
+        }
+        const ip = clientIp(req, trustProxy);
+        for (const h of IP_HEADERS)
+            delete req.headers[h];
+        req.headers[CLIENT_IP_HEADER] = ip;
+        await handler(req, res);
+    };
+}
+//# sourceMappingURL=bridge.js.map

package/dist/auth/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/auth/bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACjD,mIAAmI;AACnI,MAAM,QAAQ,GAAa,CAAC,qBAAqB,EAAE,6BAA6B,EAAE,sCAAsC,CAAC,CAAC;AAC1H,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AACzH,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC,yHAAyH;AACzH,MAAM,UAAU,QAAQ,CAAC,GAAoB,EAAE,UAAmB;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/G,MAAM,EAAE,GAAG,UAAU,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAChH,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe;IAChE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1G,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,kIAAkI;AAClI,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,UAAmB;IAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACxE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;YAClI,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/crypto.d.ts

@@ -0,0 +1,14 @@
+/** Kinds of secret tokens. The prefix tells a person what a token is for. */
+export declare const TOKEN_PREFIX: {
+    readonly ingest: "wl_ik_";
+    readonly read: "wl_rk_";
+    readonly share: "wl_sh_";
+};
+export type TokenKind = keyof typeof TOKEN_PREFIX;
+/** A new random token. Only its hash is stored. */
+export declare const newToken: (kind: TokenKind) => string;
+export declare const hashToken: (token: string) => string;
+export declare const newId: () => string;
+/** A URL-safe short name from free text, for example "My Shop!" -> "my-shop". */
+export declare const slugOf: (text: string) => string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/auth/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAIA,6EAA6E;AAC7E,eAAO,MAAM,YAAY;aAAK,MAAM,EAAE,QAAQ;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,QAAQ;CAAW,CAAC;AAC3F,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC;AAElD,mDAAmD;AACnD,eAAO,MAAM,QAAQ,SAAU,SAAS,KAAG,MAAyE,CAAC;AAErH,eAAO,MAAM,SAAS,UAAW,MAAM,KAAG,MAA0D,CAAC;AAErG,eAAO,MAAM,KAAK,QAAO,MAAsB,CAAC;AAEhD,iFAAiF;AACjF,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAMX,CAAC"}

package/dist/auth/crypto.js

@@ -0,0 +1,16 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+// Our own secrets: data-plane keys and share links. Passwords, sessions, and invites are Better Auth's.
+/** Kinds of secret tokens. The prefix tells a person what a token is for. */
+export const TOKEN_PREFIX = { ingest: "wl_ik_", read: "wl_rk_", share: "wl_sh_" };
+/** A new random token. Only its hash is stored. */
+export const newToken = (kind) => `${TOKEN_PREFIX[kind]}${randomBytes(24).toString("base64url")}`;
+export const hashToken = (token) => createHash("sha256").update(token).digest("hex");
+export const newId = () => randomUUID();
+/** A URL-safe short name from free text, for example "My Shop!" -> "my-shop". */
+export const slugOf = (text) => text
+    .toLowerCase()
+    .normalize("NFKD")
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 40) || "item";
+//# sourceMappingURL=crypto.js.map

package/dist/auth/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,wGAAwG;AAExG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAW,CAAC;AAG3F,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAe,EAAU,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAErH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,UAAU,EAAE,CAAC;AAEhD,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI;KACD,WAAW,EAAE;KACb,SAAS,CAAC,MAAM,CAAC;KACjB,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;KAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;KACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC"}