@wizeworks/lens-cloud 0.0.0-stage → 0.3.0-alpha.2

package/dist/auth/signup.js

@@ -0,0 +1,61 @@
+import { timingSafeEqual } from "node:crypto";
+import { getCurrentAdapter } from "better-auth";
+import { ssoProviderOf, ssoTrusts } from "./sso.js";
+export const SETUP_HEADER = "x-wizelens-setup-token";
+export const INVITE_HEADER = "x-wizelens-invite";
+const same = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+/** An open invite for this email (read through Better Auth's adapter, inside its transaction); without real mail, its id too. */
+async function invitedNow(deps, ctx, email) {
+    const db = await getCurrentAdapter(ctx.context.adapter);
+    const rows = await db.findMany({ model: "invitation", where: [{ field: "email", value: email.toLowerCase() }, { field: "status", value: "pending" }] });
+    const open = rows.filter((r) => new Date(r.expiresAt).getTime() > Date.now());
+    if (deps.mailer.live)
+        return open.length > 0;
+    const id = ctx.headers?.get(INVITE_HEADER) ?? "";
+    return open.some((r) => same(r.id, id));
+}
+/** Who may make an account: by SSO, only from a proven domain; the first needs the setup token; then the invited, or anyone with open sign-up. */
+export function signupGate(deps) {
+    return async ({ user, source }, ctx) => {
+        if (source.action !== "create-user")
+            return;
+        const db = await getCurrentAdapter(ctx.context.adapter);
+        const viaSso = ssoProviderOf(source);
+        if (viaSso)
+            return (await ssoTrusts(db, viaSso, String(user.email ?? ""))) ? undefined : { error: "sso_domain", errorDescription: "Single sign-on works only for emails at the provider's verified domain." };
+        if ((await db.count({ model: "user" })) === 0) {
+            const want = deps.setup.token();
+            if (want && same(ctx.headers?.get(SETUP_HEADER) ?? "", want))
+                return;
+            return { error: "setup_token", errorDescription: "The first account needs the setup link printed when the cloud started." };
+        }
+        if (deps.signup === "open" || (await invitedNow(deps, ctx, String(user.email ?? ""))))
+            return;
+        return { error: "signup_closed", errorDescription: "Sign-up needs an invite. Ask your team for one." };
+    };
+}
+/** A new account from single sign-on: the provider's organization takes it in. */
+const bySso = (ctx) => String(ctx?.path ?? "").startsWith("/sso/");
+/** The provider proved the domain and the gate checked the email, so an SSO account starts confirmed. */
+export async function confirmSsoEmail(user, ctx) {
+    const providerId = ctx?.params?.providerId;
+    if (!bySso(ctx) || typeof providerId !== "string")
+        return undefined;
+    const db = await getCurrentAdapter(ctx.context.adapter);
+    return (await ssoTrusts(db, providerId, user.email)) ? { data: { ...user, emailVerified: true } } : undefined;
+}
+/** Runs after the new user is saved: the first account and open sign-ups get their own organization and project. */
+export function afterSignup(deps, createOrg) {
+    return async (user, ctx) => {
+        if (!ctx || bySso(ctx))
+            return;
+        const [count] = await deps.db.query("SELECT count(*)::int AS n FROM users");
+        const [pending] = await deps.db.query("SELECT EXISTS (SELECT 1 FROM invites WHERE email = $1 AND status = 'pending' AND expires_at > now()) AS invited", [user.email.toLowerCase()]);
+        const first = count?.n === 1;
+        if (first)
+            deps.setup.done();
+        if (first || (deps.signup === "open" && !pending?.invited))
+            await createOrg(user.id, `${user.name.trim()}'s team`);
+    };
+}
+//# sourceMappingURL=signup.js.map

package/dist/auth/signup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../src/auth/signup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAA0B,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAMpD,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAOhH,iIAAiI;AACjI,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,GAAQ,EAAE,KAAa;IAC/D,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACnK,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,kJAAkJ;AAClJ,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,OAAO,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO;QAC5C,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,yEAAyE,EAAE,CAAC;QAC9M,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC;gBAAE,OAAO;YACrE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,wEAAwE,EAAE,CAAC;QAC9H,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO;QAC9F,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,iDAAiD,EAAE,CAAC;IACzG,CAAC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,KAAK,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAE,GAAiC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAE3G,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAuD,IAAO,EAAE,GAAY;IAC/G,MAAM,UAAU,GAAI,GAAoD,EAAE,MAAM,EAAE,UAAU,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAE,GAAyE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/H,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChH,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,SAA6D;IACvG,OAAO,KAAK,EAAE,IAAiD,EAAE,GAAY,EAAiB,EAAE;QAC9F,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAgB,sCAAsC,CAAC,CAAC;QAC3F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACnC,iHAAiH,EACjH,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAC3B,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/sso.d.ts

@@ -0,0 +1,21 @@
+import type { BetterAuthPlugin } from "better-auth";
+import type { AuthDeps } from "./deps.js";
+/** The DNS record that proves a domain: `_wizelens-sso-<providerId>.<domain>` TXT `<token>`. */
+export declare const SSO_TOKEN_PREFIX = "wizelens-sso";
+interface Finder {
+    findOne<T>(a: {
+        model: string;
+        where: {
+            field: string;
+            value: string;
+        }[];
+    }): Promise<T | null>;
+}
+/** The SSO provider behind a new account, when Better Auth makes it from a single sign-on. */
+export declare function ssoProviderOf(source: unknown): string | undefined;
+/** True when an organization's provider has a proven domain and the email is at exactly that domain. */
+export declare function ssoTrusts(db: Finder, providerId: string, email: string): Promise<boolean>;
+/** Organization SSO with OIDC or SAML. Sign-in works once the domain is proven in DNS; new people join that organization as members. */
+export declare function ssoPlugin(deps: AuthDeps): BetterAuthPlugin;
+export {};
+//# sourceMappingURL=sso.d.ts.map

package/dist/auth/sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.d.ts","sourceRoot":"","sources":["../../src/auth/sso.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,gGAAgG;AAChG,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,UAAU,MAAM;IACd,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAChG;AAQD,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGjE;AAED,wGAAwG;AACxG,wBAAsB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK/F;AAED,wIAAwI;AACxI,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,CAc1D"}

package/dist/auth/sso.js

@@ -0,0 +1,35 @@
+import { sso } from "@better-auth/sso";
+import { audit } from "../repo/audit.js";
+import { ssoSchema } from "./schema-names.js";
+/** The DNS record that proves a domain: `_wizelens-sso-<providerId>.<domain>` TXT `<token>`. */
+export const SSO_TOKEN_PREFIX = "wizelens-sso";
+/** The SSO provider behind a new account, when Better Auth makes it from a single sign-on. */
+export function ssoProviderOf(source) {
+    const s = source;
+    return s?.method?.startsWith("sso-") && typeof s.sso?.providerId === "string" ? s.sso.providerId : undefined;
+}
+/** True when an organization's provider has a proven domain and the email is at exactly that domain. */
+export async function ssoTrusts(db, providerId, email) {
+    const p = await db.findOne({ model: "ssoProvider", where: [{ field: "providerId", value: providerId }] });
+    const at = email.trim().toLowerCase().split("@")[1] ?? "";
+    const domains = (p?.domain ?? "").toLowerCase().split(",").map((d) => d.trim());
+    return !!p?.organizationId && p.domainVerified === true && !!at && domains.includes(at);
+}
+/** Organization SSO with OIDC or SAML. Sign-in works once the domain is proven in DNS; new people join that organization as members. */
+export function ssoPlugin(deps) {
+    return sso({
+        schema: ssoSchema,
+        providersLimit: 20,
+        domainVerification: { enabled: true, tokenPrefix: SSO_TOKEN_PREFIX },
+        organizationProvisioning: {
+            defaultRole: "member",
+            getRole: async ({ user, provider }) => {
+                if (provider.organizationId)
+                    await audit(deps.db, provider.organizationId, `user:${user.id}`, "member.join", { via: "sso", providerId: provider.providerId }, Date.now());
+                return "member";
+            },
+        },
+        saml: { enableInResponseToValidation: true, allowIdpInitiated: false, requireTimestamps: true, clockSkew: 2 * 60_000, algorithms: { onDeprecated: "reject" } },
+    });
+}
+//# sourceMappingURL=sso.js.map

package/dist/auth/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../src/auth/sso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAY/C,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,MAAM,CAAC,GAAG,MAAyE,CAAC;IACpF,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/G,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAU,EAAE,UAAkB,EAAE,KAAa;IAC3E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACvH,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,wIAAwI;AACxI,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,OAAO,GAAG,CAAC;QACT,MAAM,EAAE,SAAS;QACjB,cAAc,EAAE,EAAE;QAClB,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE;QACpE,wBAAwB,EAAE;YACxB,WAAW,EAAE,QAAQ;YACrB,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACpC,IAAI,QAAQ,CAAC,cAAc;oBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,cAAc,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC1K,OAAO,QAAQ,CAAC;YAClB,CAAC;SACF;QACD,IAAI,EAAE,EAAE,4BAA4B,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE;KAC/J,CAAgC,CAAC;AACpC,CAAC"}

package/dist/auth/wire.d.ts

@@ -0,0 +1,16 @@
+import type { CloudConfig } from "../config.js";
+import type { Db } from "../db/db.js";
+import type { Mailer } from "../mail/mailer.js";
+import { type WizeAuth } from "./auth.js";
+import { type AuthSecret } from "./secret.js";
+export interface AuthWiring {
+    /** Build Better Auth for the address the cloud listens on. */
+    start(listenUrl: string): WizeAuth;
+    /** The first account's link while no account exists, else null. */
+    setupLink(): string | null;
+    /** The auth secrets, newest first. Unsubscribe links are signed with them too. */
+    secrets: AuthSecret[];
+}
+/** Secrets, the setup gate, and the rest Better Auth needs; Better Auth itself starts once the address is known. */
+export declare function wireAuth(db: Db, config: CloudConfig, mailer: Mailer): Promise<AuthWiring>;
+//# sourceMappingURL=wire.d.ts.map

package/dist/auth/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/auth/wire.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,aAAa,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IACnC,mEAAmE;IACnE,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,kFAAkF;IAClF,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAgBD,oHAAoH;AACpH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2B/F"}

package/dist/auth/wire.js

@@ -0,0 +1,47 @@
+import { randomBytes } from "node:crypto";
+import { userCount } from "../repo/users.js";
+import { createAuth } from "./auth.js";
+import { clearAuthEnv, resolveSecrets } from "./secret.js";
+/** The one-time setup token: from the config, or new. Gone once the first account exists. */
+async function setupGate(db, configured) {
+    let open = (await userCount(db)) === 0;
+    const token = configured ?? randomBytes(24).toString("base64url");
+    return { token: () => (open ? token : null), done: () => void (open = false) };
+}
+/** The public origin, plus 127.0.0.1 next to localhost (or the reverse) when the cloud runs on its default local address. */
+function originsOf(publicUrl, local) {
+    const origin = new URL(publicUrl).origin;
+    if (!local)
+        return [origin];
+    return [origin, origin.includes("//localhost") ? origin.replace("//localhost", "//127.0.0.1") : origin.replace("//127.0.0.1", "//localhost")];
+}
+/** Secrets, the setup gate, and the rest Better Auth needs; Better Auth itself starts once the address is known. */
+export async function wireAuth(db, config, mailer) {
+    clearAuthEnv();
+    const [secrets, setup] = await Promise.all([resolveSecrets(db, config.authSecret), setupGate(db, config.setupToken)]);
+    let base = config.publicUrl;
+    return {
+        secrets,
+        start: (listenUrl) => {
+            base = config.publicUrl ?? listenUrl.replace("//127.0.0.1", "//localhost");
+            const deps = {
+                db,
+                publicUrl: new URL(base).origin,
+                trustedOrigins: originsOf(base, !config.publicUrl),
+                ssoOrigins: config.ssoOrigins,
+                secrets,
+                signup: config.signup,
+                mailer,
+                setup,
+                checkPwned: config.checkPwnedPasswords ?? db.kind === "postgres",
+                retentionDays: config.retentionDays,
+            };
+            return createAuth(deps);
+        },
+        setupLink: () => {
+            const token = setup.token();
+            return token && base ? `${base}/_wizelens/#/setup?token=${token}` : null;
+        },
+    };
+}
+//# sourceMappingURL=wire.js.map

package/dist/auth/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../src/auth/wire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAmB,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAW5E,6FAA6F;AAC7F,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,UAA8B;IAC7D,IAAI,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,6HAA6H;AAC7H,SAAS,SAAS,CAAC,SAAiB,EAAE,KAAc;IAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAChJ,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,MAAmB,EAAE,MAAc;IACxE,YAAY,EAAE,CAAC;IACf,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,OAAO;QACL,OAAO;QACP,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE;YACnB,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAC3E,MAAM,IAAI,GAAa;gBACrB,EAAE;gBACF,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM;gBAC/B,cAAc,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;gBAClD,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO;gBACP,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM;gBACN,KAAK;gBACL,UAAU,EAAE,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU;gBAChE,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CAAC;YACF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,4BAA4B,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli-args.d.ts

@@ -0,0 +1,5 @@
+import type { CloudOptions } from "./config.js";
+export declare const USAGE = "wizelens-cloud: the WizeLens service for many teams.\n\nUsage: wizelens-cloud [options]\n\n  --database <url>          postgres://..., pglite:<folder>, or memory.\n                            Default pglite:./.wizelens-cloud.          (DATABASE_URL)\n  --port <n>                Default 5970.                               (PORT)\n  --host <addr>             Default 0.0.0.0.                            (WIZELENS_CLOUD_HOST)\n  --public-url <url>        The address people use, for links.          (WIZELENS_CLOUD_PUBLIC_URL)\n  --signup <invite|open>    Who can make an account. Default invite.    (WIZELENS_CLOUD_SIGNUP)\n  --retention-days <n>      Default for new organizations. Default 30.  (WIZELENS_CLOUD_RETENTION_DAYS)\n  --allow-private-webhooks  Let alert webhooks reach private addresses. (WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1)\n  --auth-secret <text>      Signs sessions, encrypts 2FA secrets. 32+   (WIZELENS_CLOUD_AUTH_SECRET)\n                            characters; \"2:new,1:old\" rotates.\n                            Required with Postgres.\n  --resend-api-key <key>    Outgoing mail through Resend (re_...).      (WIZELENS_CLOUD_RESEND_API_KEY)\n                            Needs --public-url.\n  --resend-webhook-secret <s>  The Resend webhook's whsec_ secret:     (WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET)\n                            bounces and complaints stop later mail.\n                            Webhook URL: <public-url>/_wizelens/api/mail/resend\n  --smtp-url <url>          Or mail over SMTP: smtp://user:pass@host:587 (WIZELENS_CLOUD_SMTP_URL)\n                            or smtps://...:465. Needs --public-url.\n  --mail-from <address>     Sender, e.g. \"WizeLens <a@b.com>\".          (WIZELENS_CLOUD_MAIL_FROM)\n  --trust-proxy             Read the client address from the last       (WIZELENS_CLOUD_TRUST_PROXY=1)\n                            X-Forwarded-For entry (your own proxy only).\n  --setup-token <text>      The first account's token. Default: random, (WIZELENS_CLOUD_SETUP_TOKEN)\n                            printed at start while no account exists.\n  --check-pwned-passwords   Refuse breached passwords. Default on with  (WIZELENS_CLOUD_CHECK_PWNED=1|0)\n  --no-check-pwned-passwords Postgres, off with PGlite.\n  --sso-origins <list>      Identity provider origins for OIDC single   (WIZELENS_CLOUD_SSO_ORIGINS)\n                            sign-on, comma separated, for example\n                            https://acme.okta.com. SAML needs none.\n  --help                    Show this help.\n";
+/** Options from the command line, then from the environment. */
+export declare function optionsFromArgs(argv: string[], env: NodeJS.ProcessEnv): CloudOptions | "help";
+//# sourceMappingURL=cli-args.d.ts.map

package/dist/cli-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAE5D,eAAO,MAAM,KAAK,y/EAiCjB,CAAC;AAgCF,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,YAAY,GAAG,MAAM,CAqB7F"}

package/dist/cli-args.js

@@ -0,0 +1,86 @@
+import { parseArgs } from "node:util";
+export const USAGE = `wizelens-cloud: the WizeLens service for many teams.
+
+Usage: wizelens-cloud [options]
+
+  --database <url>          postgres://..., pglite:<folder>, or memory.
+                            Default pglite:./.wizelens-cloud.          (DATABASE_URL)
+  --port <n>                Default 5970.                               (PORT)
+  --host <addr>             Default 0.0.0.0.                            (WIZELENS_CLOUD_HOST)
+  --public-url <url>        The address people use, for links.          (WIZELENS_CLOUD_PUBLIC_URL)
+  --signup <invite|open>    Who can make an account. Default invite.    (WIZELENS_CLOUD_SIGNUP)
+  --retention-days <n>      Default for new organizations. Default 30.  (WIZELENS_CLOUD_RETENTION_DAYS)
+  --allow-private-webhooks  Let alert webhooks reach private addresses. (WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1)
+  --auth-secret <text>      Signs sessions, encrypts 2FA secrets. 32+   (WIZELENS_CLOUD_AUTH_SECRET)
+                            characters; "2:new,1:old" rotates.
+                            Required with Postgres.
+  --resend-api-key <key>    Outgoing mail through Resend (re_...).      (WIZELENS_CLOUD_RESEND_API_KEY)
+                            Needs --public-url.
+  --resend-webhook-secret <s>  The Resend webhook's whsec_ secret:     (WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET)
+                            bounces and complaints stop later mail.
+                            Webhook URL: <public-url>/_wizelens/api/mail/resend
+  --smtp-url <url>          Or mail over SMTP: smtp://user:pass@host:587 (WIZELENS_CLOUD_SMTP_URL)
+                            or smtps://...:465. Needs --public-url.
+  --mail-from <address>     Sender, e.g. "WizeLens <a@b.com>".          (WIZELENS_CLOUD_MAIL_FROM)
+  --trust-proxy             Read the client address from the last       (WIZELENS_CLOUD_TRUST_PROXY=1)
+                            X-Forwarded-For entry (your own proxy only).
+  --setup-token <text>      The first account's token. Default: random, (WIZELENS_CLOUD_SETUP_TOKEN)
+                            printed at start while no account exists.
+  --check-pwned-passwords   Refuse breached passwords. Default on with  (WIZELENS_CLOUD_CHECK_PWNED=1|0)
+  --no-check-pwned-passwords Postgres, off with PGlite.
+  --sso-origins <list>      Identity provider origins for OIDC single   (WIZELENS_CLOUD_SSO_ORIGINS)
+                            sign-on, comma separated, for example
+                            https://acme.okta.com. SAML needs none.
+  --help                    Show this help.
+`;
+const int = (v) => (v && /^\d+$/.test(v) ? Number(v) : undefined);
+const signupOf = (v) => (v === "open" || v === "invite" ? v : undefined);
+const text = (...v) => v.find((x) => x !== undefined && x !== "");
+const list = (v) => v?.split(",").map((s) => s.trim()).filter(Boolean);
+const flag = (v) => (v === "1" || v === "true" ? true : v === "0" || v === "false" ? false : undefined);
+const OPTIONS = {
+    database: { type: "string" },
+    port: { type: "string" },
+    host: { type: "string" },
+    "public-url": { type: "string" },
+    signup: { type: "string" },
+    "retention-days": { type: "string" },
+    "allow-private-webhooks": { type: "boolean" },
+    "auth-secret": { type: "string" },
+    "smtp-url": { type: "string" },
+    "resend-api-key": { type: "string" },
+    "resend-webhook-secret": { type: "string" },
+    "mail-from": { type: "string" },
+    "trust-proxy": { type: "boolean" },
+    "setup-token": { type: "string" },
+    "check-pwned-passwords": { type: "boolean" },
+    "no-check-pwned-passwords": { type: "boolean" },
+    "sso-origins": { type: "string" },
+    help: { type: "boolean", short: "h" },
+};
+const pwnedOf = (a, env) => a["no-check-pwned-passwords"] ? false : (a["check-pwned-passwords"] ?? flag(env.WIZELENS_CLOUD_CHECK_PWNED));
+/** Options from the command line, then from the environment. */
+export function optionsFromArgs(argv, env) {
+    const { values: a } = parseArgs({ args: argv, options: OPTIONS });
+    if (a.help)
+        return "help";
+    return {
+        database: a.database ?? env.DATABASE_URL,
+        port: int(a.port ?? env.PORT),
+        host: a.host ?? env.WIZELENS_CLOUD_HOST,
+        publicUrl: text(a["public-url"], env.WIZELENS_CLOUD_PUBLIC_URL),
+        signup: signupOf(a.signup ?? env.WIZELENS_CLOUD_SIGNUP),
+        retentionDays: int(a["retention-days"] ?? env.WIZELENS_CLOUD_RETENTION_DAYS),
+        allowPrivateWebhooks: a["allow-private-webhooks"] ?? env.WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS === "1",
+        authSecret: text(a["auth-secret"], env.WIZELENS_CLOUD_AUTH_SECRET),
+        smtpUrl: text(a["smtp-url"], env.WIZELENS_CLOUD_SMTP_URL),
+        resendApiKey: text(a["resend-api-key"], env.WIZELENS_CLOUD_RESEND_API_KEY),
+        resendWebhookSecret: text(a["resend-webhook-secret"], env.WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET),
+        mailFrom: text(a["mail-from"], env.WIZELENS_CLOUD_MAIL_FROM),
+        trustProxy: a["trust-proxy"] ?? env.WIZELENS_CLOUD_TRUST_PROXY === "1",
+        setupToken: text(a["setup-token"], env.WIZELENS_CLOUD_SETUP_TOKEN),
+        checkPwnedPasswords: pwnedOf(a, env),
+        ssoOrigins: list(text(a["sso-origins"], env.WIZELENS_CLOUD_SSO_ORIGINS)),
+    };
+}
+//# sourceMappingURL=cli-args.js.map

package/dist/cli-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCpB,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACtF,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAA0B,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAyB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1F,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC3F,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE5H,MAAM,OAAO,GAAG;IACd,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3C,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,uBAAuB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5C,0BAA0B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;CAC7B,CAAC;AAEX,MAAM,OAAO,GAAG,CAAC,CAA8E,EAAE,GAAsB,EAAE,EAAE,CACzH,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAE/G,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,GAAsB;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY;QACxC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,mBAAmB;QACvC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,yBAAyB,CAAC;QAC/D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,qBAAqB,CAAC;QACvD,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,6BAA6B,CAAC;QAC5E,oBAAoB,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC,qCAAqC,KAAK,GAAG;QACtG,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC;QAClE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,uBAAuB,CAAC;QACzD,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,6BAA6B,CAAC;QAC1E,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,GAAG,CAAC,oCAAoC,CAAC;QAC/F,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,wBAAwB,CAAC;QAC5D,UAAU,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,KAAK,GAAG;QACtE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC;QAClE,mBAAmB,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC;QACpC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import { optionsFromArgs, USAGE } from "./cli-args.js";
+import { CLOUD_VERSION, createCloud } from "./server.js";
+function notes(cloud) {
+    const { app } = cloud;
+    const out = [];
+    if (app.db.kind === "pglite")
+        out.push("  Note: PGlite is for trials and tests. Use Postgres for real teams.");
+    if (!app.mailer.live)
+        out.push("  Note: no --resend-api-key or --smtp-url, so emails are written to this log and email addresses are not confirmed.");
+    if (app.mailer.via === "resend" && !app.config.resendWebhookSecret)
+        out.push("  Note: no --resend-webhook-secret, so bounced addresses keep getting mail.");
+    if (app.db.kind === "postgres" && !app.config.publicUrl?.startsWith("https://"))
+        out.push("  Note: set --public-url to an https:// address, so sign-in cookies are Secure.");
+    const setup = cloud.setupLink();
+    if (setup)
+        out.push("", "  No account yet. Open this link to make the first one (it works once):", `  ${setup}`);
+    return out;
+}
+async function main() {
+    const options = optionsFromArgs(process.argv.slice(2), process.env);
+    if (options === "help")
+        return void process.stdout.write(USAGE);
+    const cloud = await createCloud(options);
+    const url = await cloud.listen();
+    const db = cloud.app.db.kind === "postgres" ? "Postgres" : `PGlite (${cloud.app.config.database})`;
+    console.info([
+        `WizeLens Cloud ${CLOUD_VERSION}`,
+        `  Dashboard   ${url}/_wizelens/`,
+        `  Add-ons     WIZELENS_HUB=${url}  WIZELENS_HUB_TOKEN=<ingest key>`,
+        `  OTLP/HTTP   OTEL_EXPORTER_OTLP_ENDPOINT=${url}  (header Authorization=Bearer <ingest key>)`,
+        `  Database    ${db}`,
+        `  Mail        ${{ resend: "Resend", smtp: "SMTP", test: "test sender", log: "log only" }[cloud.app.mailer.via]}`,
+        ...notes(cloud),
+    ].join("\n"));
+    const stop = () => void cloud.close().then(() => process.exit(0));
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+}
+main().catch((err) => {
+    console.error(`[wizelens-cloud] ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAc,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAErE,SAAS,KAAK,CAAC,KAAY;IACzB,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IAC/G,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,qHAAqH,CAAC,CAAC;IACtJ,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB;QAAE,GAAG,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAC5J,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC7K,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,yEAAyE,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC;IACjH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC;IACnG,OAAO,CAAC,IAAI,CACV;QACE,kBAAkB,aAAa,EAAE;QACjC,iBAAiB,GAAG,aAAa;QACjC,8BAA8B,GAAG,mCAAmC;QACpE,6CAA6C,GAAG,8CAA8C;QAC9F,iBAAiB,EAAE,EAAE;QACrB,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QACjH,GAAG,KAAK,CAAC,KAAK,CAAC;KAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,55 @@
+import type { Mail } from "./mail/mailer.js";
+export type SignupMode = "open" | "invite";
+export interface CloudOptions {
+    /** "postgres://...", "pglite:<folder>", or "memory". Default "pglite:./.wizelens-cloud". */
+    database?: string;
+    /** Default 5970. 0 picks a free port. */
+    port?: number;
+    /** Default "0.0.0.0". */
+    host?: string;
+    /** The address people use, for links in invites and shares. Default http://localhost:<port>. */
+    publicUrl?: string;
+    /** "invite": only the first account and invited people can sign up. "open": anyone can. Default "invite". */
+    signup?: SignupMode;
+    /** Default retention for new organizations, in days. Default 30. */
+    retentionDays?: number;
+    /** Ingest calls per key per minute. Default 1200. */
+    ingestPerMinute?: number;
+    /** How often alert rules run, in ms. Default 60000. */
+    alertIntervalMs?: number;
+    /** Let alert webhooks call private and local addresses, and plain http. For self-hosting on a private network. Default false. */
+    allowPrivateWebhooks?: boolean;
+    /** Outgoing mail: "smtp://user:pass@host:587" (STARTTLS) or "smtps://user:pass@host:465". Without it, mail is written to the log. */
+    smtpUrl?: string;
+    /** Outgoing mail through the Resend API (a `re_` key). Used in place of `smtpUrl`. */
+    resendApiKey?: string;
+    /** The `whsec_` signing secret of the Resend webhook, so bounces and spam complaints reach the suppression list. */
+    resendWebhookSecret?: string;
+    /** The sender of every email, for example "WizeLens <alerts@example.com>". */
+    mailFrom?: string;
+    /** Take the client address from X-Forwarded-For (behind a proxy you run). Default false. */
+    trustProxy?: boolean;
+    /** Signs sessions and encrypts 2FA secrets: 32+ random characters, or "2:new,1:old" to rotate. Required with Postgres. */
+    authSecret?: string;
+    /** The one-time token the first account needs. Default: a new random one, printed at start while no account exists. */
+    setupToken?: string;
+    /** Refuse passwords found in known breaches (sends a 5-character hash prefix to api.pwnedpasswords.com). Default: on with Postgres. */
+    checkPwnedPasswords?: boolean;
+    /** Identity provider origins for OIDC single sign-on, for example https://acme.okta.com. The cloud fetches OIDC settings only from these. */
+    ssoOrigins?: string[];
+    redactKeys?: string[];
+    uiDir?: string;
+    /** For tests: the clock, the HTTP client alerts use, and a mail sender in place of SMTP. */
+    now?: () => number;
+    fetch?: typeof fetch;
+    sendMail?: (mail: Mail) => Promise<void>;
+    /** For tests: false keeps background jobs off, so a test runs them itself. Default true. */
+    jobs?: boolean;
+}
+type Optional = "uiDir" | "publicUrl" | "smtpUrl" | "resendApiKey" | "resendWebhookSecret" | "sendMail" | "authSecret" | "setupToken" | "checkPwnedPasswords";
+export type CloudConfig = Required<Omit<CloudOptions, Optional>> & Pick<CloudOptions, Optional> & {
+    secureCookies: boolean;
+};
+export declare function resolveConfig(o?: CloudOptions): CloudConfig;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iIAAiI;IACjI,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qIAAqI;IACrI,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oHAAoH;IACpH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0HAA0H;IAC1H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uHAAuH;IACvH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uIAAuI;IACvI,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,6IAA6I;IAC7I,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,KAAK,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,GAAG,qBAAqB,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,qBAAqB,CAAC;AAC9J,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAqB7H,wBAAgB,aAAa,CAAC,CAAC,GAAE,YAAiB,GAAG,WAAW,CA6B/D"}

package/dist/config.js

@@ -0,0 +1,55 @@
+import { DEFAULT_REDACT_KEYS } from "@wizeworks/lens-core";
+/** Mail links must use the public address: a link built from the request's Host header could point anywhere. */
+function checkMail(o) {
+    if ((o.smtpUrl || o.resendApiKey) && !o.publicUrl)
+        throw new Error("Sending mail needs --public-url, so links in emails point at this cloud.");
+    if (o.smtpUrl && o.resendApiKey)
+        throw new Error("Pick one mail service: --resend-api-key or --smtp-url, not both.");
+    if (o.smtpUrl && !/^smtps?:\/\//.test(o.smtpUrl))
+        throw new Error("--smtp-url must start with smtp:// or smtps://.");
+    if (o.resendApiKey && !o.resendApiKey.startsWith("re_"))
+        throw new Error("--resend-api-key must be a Resend API key (it starts with re_).");
+    if (o.resendWebhookSecret && !o.resendWebhookSecret.startsWith("whsec_"))
+        throw new Error("--resend-webhook-secret must start with whsec_.");
+}
+/** Each SSO origin as a bare origin: https, or http on this machine only. */
+function ssoOriginsOf(list) {
+    return list.map((raw) => {
+        const url = URL.canParse(raw) ? new URL(raw) : null;
+        const local = url?.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+        if (!url || (url.protocol !== "https:" && !local) || raw.includes("*"))
+            throw new Error(`--sso-origins: "${raw}" must be an https:// origin, like https://acme.okta.com.`);
+        return url.origin;
+    });
+}
+export function resolveConfig(o = {}) {
+    checkMail(o);
+    return {
+        database: o.database ?? "pglite:./.wizelens-cloud",
+        port: o.port ?? 5970,
+        host: o.host ?? "0.0.0.0",
+        publicUrl: o.publicUrl?.replace(/\/+$/, ""),
+        signup: o.signup ?? "invite",
+        retentionDays: o.retentionDays ?? 30,
+        ingestPerMinute: o.ingestPerMinute ?? 1200,
+        alertIntervalMs: o.alertIntervalMs ?? 60_000,
+        allowPrivateWebhooks: o.allowPrivateWebhooks ?? false,
+        smtpUrl: o.smtpUrl,
+        resendApiKey: o.resendApiKey,
+        resendWebhookSecret: o.resendWebhookSecret,
+        mailFrom: o.mailFrom ?? `WizeLens <no-reply@${o.publicUrl ? new URL(o.publicUrl).hostname : "localhost"}>`,
+        trustProxy: o.trustProxy ?? false,
+        sendMail: o.sendMail,
+        jobs: o.jobs ?? true,
+        authSecret: o.authSecret,
+        setupToken: o.setupToken,
+        checkPwnedPasswords: o.checkPwnedPasswords,
+        ssoOrigins: ssoOriginsOf(o.ssoOrigins ?? []),
+        redactKeys: o.redactKeys ?? [...DEFAULT_REDACT_KEYS],
+        uiDir: o.uiDir,
+        now: o.now ?? Date.now,
+        fetch: o.fetch ?? fetch,
+        secureCookies: !!o.publicUrl?.startsWith("https://"),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAuD3D,gHAAgH;AAChH,SAAS,SAAS,CAAC,CAAe;IAChC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC/I,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC5I,IAAI,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AAC/I,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAAuB;IAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,KAAK,GAAG,GAAG,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,2DAA2D,CAAC,CAAC;QAC3K,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAC,GAAiB,EAAE;IAChD,SAAS,CAAC,CAAC,CAAC,CAAC;IACb,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,0BAA0B;QAClD,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;QACzB,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;QAC5B,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,EAAE;QACpC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;QAC1C,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,MAAM;QAC5C,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,IAAI,KAAK;QACrD,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,sBAAsB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG;QAC1G,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,KAAK;QACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,mBAAmB,CAAC;QACpD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK;QACvB,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/db/db.d.ts

@@ -0,0 +1,22 @@
+import type { BetterAuthOptions } from "better-auth";
+/** Something that runs SQL: the database, or one transaction. Postgres syntax, `$1` parameters. */
+export interface Queryable {
+    query<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]>;
+}
+export interface Db extends Queryable {
+    /** Run `fn` in one transaction. It rolls back when `fn` throws. */
+    tx<T>(fn: (q: Queryable) => Promise<T>): Promise<T>;
+    /** Run several statements without parameters (migrations, before anything else uses the database). */
+    exec(sql: string): Promise<void>;
+    close(): Promise<void>;
+    readonly kind: "postgres" | "pglite";
+    /** The same database, for Better Auth. */
+    readonly authDatabase: NonNullable<BetterAuthOptions["database"]>;
+}
+/** A managed Postgres, from a `postgres://` URL. */
+export declare function openPostgres(url: string): Promise<Db>;
+/** PGlite (a folder, or memory), for tests and trials. All queries share one Kysely queue with Better Auth: PGlite has one connection. */
+export declare function openPglite(dir?: string): Promise<Db>;
+/** "postgres://..." opens Postgres; "pglite:<folder>" or "memory" opens PGlite. */
+export declare function openDb(url: string): Promise<Db>;
+//# sourceMappingURL=db.d.ts.map

package/dist/db/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIrD,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,EAAG,SAAQ,SAAS;IACnC,mEAAmE;IACnE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,sGAAsG;IACtG,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;CACnE;AAMD,oDAAoD;AACpD,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAyB3D;AAED,0IAA0I;AAC1I,wBAAsB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAmB1D;AAED,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAK/C"}

package/dist/db/db.js

@@ -0,0 +1,64 @@
+const wrap = (client) => ({
+    query: async (sql, params = []) => (await client.query(sql, params)).rows,
+});
+/** A managed Postgres, from a `postgres://` URL. */
+export async function openPostgres(url) {
+    const { default: pg } = await import("pg");
+    // Times are stored as double precision, so no bigint parsing is needed.
+    const pool = new pg.Pool({ connectionString: url, max: 10 });
+    return {
+        kind: "postgres",
+        authDatabase: pool,
+        ...wrap(pool),
+        async tx(fn) {
+            const client = await pool.connect();
+            try {
+                await client.query("BEGIN");
+                const out = await fn(wrap(client));
+                await client.query("COMMIT");
+                return out;
+            }
+            catch (err) {
+                await client.query("ROLLBACK");
+                throw err;
+            }
+            finally {
+                client.release();
+            }
+        },
+        exec: async (sql) => void (await pool.query(sql)),
+        close: () => pool.end(),
+    };
+}
+/** PGlite (a folder, or memory), for tests and trials. All queries share one Kysely queue with Better Auth: PGlite has one connection. */
+export async function openPglite(dir) {
+    const [{ PGlite }, { Kysely, CompiledQuery }, { PGliteDialect }] = await Promise.all([
+        import("@electric-sql/pglite"),
+        import("kysely"),
+        import("kysely-pglite-dialect"),
+    ]);
+    const lite = await PGlite.create(dir);
+    const kysely = new Kysely({ dialect: new PGliteDialect(lite) });
+    const run = (k) => ({
+        query: async (sql, params = []) => (await k.executeQuery(CompiledQuery.raw(sql, params))).rows,
+    });
+    return {
+        kind: "pglite",
+        authDatabase: { db: kysely, type: "postgres", transaction: true },
+        ...run(kysely),
+        tx: (fn) => kysely.transaction().execute((t) => fn(run(t))),
+        exec: async (sql) => void (await lite.exec(sql)),
+        close: () => kysely.destroy(),
+    };
+}
+/** "postgres://..." opens Postgres; "pglite:<folder>" or "memory" opens PGlite. */
+export function openDb(url) {
+    if (/^postgres(ql)?:\/\//i.test(url))
+        return openPostgres(url);
+    if (url === "memory")
+        return openPglite();
+    if (url.startsWith("pglite:"))
+        return openPglite(url.slice("pglite:".length));
+    throw new Error(`Unknown database URL "${url}". Use postgres://..., pglite:<folder>, or memory.`);
+}
+//# sourceMappingURL=db.js.map

package/dist/db/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAoBA,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAa,EAAE,CAAC,CAAC;IACtD,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,MAAM,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAW;CACvG,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,IAAI;QAClB,GAAG,IAAI,CAAC,IAAI,CAAC;QACb,KAAK,CAAC,EAAE,CAAI,EAAgC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,0IAA0I;AAC1I,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY;IAC3C,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnF,MAAM,CAAC,sBAAsB,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC;QAChB,MAAM,CAAC,uBAAuB,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAoB,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,CAAC,CAAyC,EAAa,EAAE,CAAC,CAAC;QACrE,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,MAAM,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAI,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;KACxH,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE;QACjE,GAAG,GAAG,CAAC,MAAM,CAAC;QACd,EAAE,EAAE,CAAI,EAAgC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oDAAoD,CAAC,CAAC;AACpG,CAAC"}