@wizeworks/lens-cloud 0.0.0-stage → 0.3.0-alpha.2

package/dist/repo/alerts.d.ts

@@ -0,0 +1,52 @@
+import type { AlertMetric, AlertOp, MetricAlertStat } from "@wizeworks/lens-core";
+import type { Queryable } from "../db/db.js";
+/** Where a notice goes: a webhook, a Slack incoming webhook, or email to members of the organization. */
+export type Channel = {
+    kind: "webhook" | "slack";
+    url: string;
+} | {
+    kind: "email";
+    to: string[];
+};
+export interface AlertRule {
+    id: string;
+    projectId: string;
+    name: string;
+    /** A trace metric, or "metric" for one OpenTelemetry metric named by `metricName`. */
+    metric: AlertMetric | "metric";
+    /** For "metric" rules: the metric, what to read from it, and optionally one service. Empty otherwise. */
+    metricName: string;
+    metricStat: MetricAlertStat | "";
+    metricService: string;
+    op: AlertOp;
+    threshold: number;
+    windowMs: number;
+    env: string;
+    channels: Channel[];
+    enabled: boolean;
+    state: "ok" | "firing";
+    lastValue: number | null;
+    lastEvalMs: number | null;
+}
+export interface AlertEvent {
+    id: string;
+    ruleId: string;
+    ruleName: string;
+    kind: "fired" | "resolved" | "test";
+    value: number | null;
+    threshold: number;
+    message: string;
+    timeMs: number;
+    delivery: string;
+}
+export type RuleInput = Omit<AlertRule, "id" | "projectId" | "state" | "lastValue" | "lastEvalMs">;
+export declare function listRules(q: Queryable, projectId: string): Promise<AlertRule[]>;
+export declare function enabledRules(q: Queryable): Promise<AlertRule[]>;
+export declare function ruleById(q: Queryable, projectId: string, id: string): Promise<AlertRule | undefined>;
+export declare function createRule(q: Queryable, projectId: string, r: RuleInput, by: string, now: number): Promise<string>;
+export declare function updateRule(q: Queryable, projectId: string, id: string, r: RuleInput): Promise<void>;
+export declare function deleteRule(q: Queryable, projectId: string, id: string): Promise<boolean>;
+export declare function saveEvaluation(q: Queryable, id: string, state: AlertRule["state"], value: number | null, now: number): Promise<void>;
+export declare function addEvent(q: Queryable, rule: AlertRule, e: Omit<AlertEvent, "id" | "ruleId" | "ruleName" | "threshold">): Promise<void>;
+export declare const listEvents: (q: Queryable, projectId: string, limit: number) => Promise<AlertEvent[]>;
+//# sourceMappingURL=alerts.d.ts.map

package/dist/repo/alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/repo/alerts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAElF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,yGAAyG;AACzG,MAAM,MAAM,OAAO,GAAG;IAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEnG,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,yGAAyG;IACzG,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,eAAe,GAAG,EAAE,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,IAAI,GAAG,QAAQ,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACpC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,WAAW,GAAG,YAAY,CAAC,CAAC;AASnG,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAErF;AAED,wBAAsB,YAAY,CAAC,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAErE;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAG1G;AAED,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxH;AAED,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzG;AAED,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE9F;AAED,wBAAsB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1I;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5I;AAED,eAAO,MAAM,UAAU,MAAO,SAAS,aAAa,MAAM,SAAS,MAAM,KAAG,OAAO,CAAC,UAAU,EAAE,CAK7F,CAAC"}

package/dist/repo/alerts.js

@@ -0,0 +1,38 @@
+import { newId } from "../auth/crypto.js";
+const RULE_COLUMNS = `id, project_id AS "projectId", name, metric, metric_name AS "metricName", metric_stat AS "metricStat",
+  metric_service AS "metricService", op, threshold, window_ms AS "windowMs", env, channels, enabled, state,
+  last_value AS "lastValue", last_eval_ms AS "lastEvalMs"`;
+const toRule = (r) => ({ ...r, channels: JSON.parse(r.channels) });
+export async function listRules(q, projectId) {
+    return (await q.query(`SELECT ${RULE_COLUMNS} FROM alert_rules WHERE project_id = $1 ORDER BY name`, [projectId])).map(toRule);
+}
+export async function enabledRules(q) {
+    return (await q.query(`SELECT ${RULE_COLUMNS} FROM alert_rules WHERE enabled`)).map(toRule);
+}
+export async function ruleById(q, projectId, id) {
+    const [row] = await q.query(`SELECT ${RULE_COLUMNS} FROM alert_rules WHERE project_id = $1 AND id = $2`, [projectId, id]);
+    return row && toRule(row);
+}
+export async function createRule(q, projectId, r, by, now) {
+    const id = newId();
+    await q.query(`INSERT INTO alert_rules (id, project_id, name, metric, op, threshold, window_ms, env, channels, enabled, created_by, created_ms,
+       metric_name, metric_stat, metric_service)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)`, [id, projectId, r.name, r.metric, r.op, r.threshold, r.windowMs, r.env, JSON.stringify(r.channels), r.enabled, by, now, r.metricName, r.metricStat, r.metricService]);
+    return id;
+}
+export async function updateRule(q, projectId, id, r) {
+    await q.query(`UPDATE alert_rules SET name = $3, metric = $4, op = $5, threshold = $6, window_ms = $7, env = $8, channels = $9, enabled = $10,
+       metric_name = $11, metric_stat = $12, metric_service = $13, state = CASE WHEN $10 THEN state ELSE 'ok' END WHERE project_id = $1 AND id = $2`, [projectId, id, r.name, r.metric, r.op, r.threshold, r.windowMs, r.env, JSON.stringify(r.channels), r.enabled, r.metricName, r.metricStat, r.metricService]);
+}
+export async function deleteRule(q, projectId, id) {
+    return (await q.query("DELETE FROM alert_rules WHERE project_id = $1 AND id = $2 RETURNING id", [projectId, id])).length > 0;
+}
+export async function saveEvaluation(q, id, state, value, now) {
+    await q.query("UPDATE alert_rules SET state = $2, last_value = $3, last_eval_ms = $4 WHERE id = $1", [id, state, value, now]);
+}
+export async function addEvent(q, rule, e) {
+    await q.query(`INSERT INTO alert_events (id, rule_id, project_id, kind, value, threshold, message, time_ms, delivery) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`, [newId(), rule.id, rule.projectId, e.kind, e.value, rule.threshold, e.message, e.timeMs, e.delivery]);
+}
+export const listEvents = (q, projectId, limit) => q.query(`SELECT e.id, e.rule_id AS "ruleId", r.name AS "ruleName", e.kind, e.value, e.threshold, e.message, e.time_ms AS "timeMs", e.delivery
+     FROM alert_events e JOIN alert_rules r ON r.id = e.rule_id WHERE e.project_id = $1 ORDER BY e.time_ms DESC LIMIT $2`, [projectId, limit]);
+//# sourceMappingURL=alerts.js.map

package/dist/repo/alerts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.js","sourceRoot":"","sources":["../../src/repo/alerts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAyC1C,MAAM,YAAY,GAAG;;0DAEqC,CAAC;AAG3D,MAAM,MAAM,GAAG,CAAC,CAAU,EAAa,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAc,EAAE,CAAC,CAAC;AAEpG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,SAAiB;IAC7D,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAU,UAAU,YAAY,uDAAuD,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1I,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAY;IAC7C,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAU,UAAU,YAAY,iCAAiC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACvG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAY,EAAE,SAAiB,EAAE,EAAU;IACxE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAU,UAAU,YAAY,qDAAqD,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACnI,OAAO,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,SAAiB,EAAE,CAAY,EAAE,EAAU,EAAE,GAAW;IACrG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,CAAC,KAAK,CACX;;+EAE2E,EAC3E,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,aAAa,CAAC,CACrK,CAAC;IACF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,SAAiB,EAAE,EAAU,EAAE,CAAY;IACxF,MAAM,CAAC,CAAC,KAAK,CACX;oJACgJ,EAChJ,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,aAAa,CAAC,CAC5J,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,SAAiB,EAAE,EAAU;IAC1E,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,wEAAwE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAY,EAAE,EAAU,EAAE,KAAyB,EAAE,KAAoB,EAAE,GAAW;IACzH,MAAM,CAAC,CAAC,KAAK,CAAC,qFAAqF,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAChI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAY,EAAE,IAAe,EAAE,CAA+D;IAC3H,MAAM,CAAC,CAAC,KAAK,CACX,oJAAoJ,EACpJ,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAY,EAAE,SAAiB,EAAE,KAAa,EAAyB,EAAE,CAClG,CAAC,CAAC,KAAK,CACL;yHACqH,EACrH,CAAC,SAAS,EAAE,KAAK,CAAC,CACnB,CAAC"}

package/dist/repo/audit.d.ts

@@ -0,0 +1,11 @@
+import type { Queryable } from "../db/db.js";
+export interface AuditEntry {
+    actor: string;
+    action: string;
+    detail: Record<string, unknown>;
+    timeMs: number;
+}
+/** Keep one line of who did what. Every MCP call and every change to members, keys, and projects writes one. */
+export declare function audit(q: Queryable, orgId: string, actor: string, action: string, detail: Record<string, unknown>, now: number): Promise<void>;
+export declare function listAudit(q: Queryable, orgId: string, limit: number, before?: number): Promise<AuditEntry[]>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/repo/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/repo/audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gHAAgH;AAChH,wBAAsB,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASnJ;AAED,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAMlH"}

package/dist/repo/audit.js

@@ -0,0 +1,17 @@
+import { newId } from "../auth/crypto.js";
+/** Keep one line of who did what. Every MCP call and every change to members, keys, and projects writes one. */
+export async function audit(q, orgId, actor, action, detail, now) {
+    await q.query("INSERT INTO audit (id, org_id, actor, action, detail, time_ms) VALUES ($1, $2, $3, $4, $5, $6)", [
+        newId(),
+        orgId,
+        actor,
+        action,
+        JSON.stringify(detail),
+        now,
+    ]);
+}
+export async function listAudit(q, orgId, limit, before) {
+    const rows = await q.query(`SELECT actor, action, detail, time_ms FROM audit WHERE org_id = $1 AND time_ms < $2 ORDER BY time_ms DESC LIMIT $3`, [orgId, before ?? Number.MAX_SAFE_INTEGER, limit]);
+    return rows.map((r) => ({ actor: r.actor, action: r.action, detail: JSON.parse(r.detail), timeMs: r.time_ms }));
+}
+//# sourceMappingURL=audit.js.map

package/dist/repo/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/repo/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAU1C,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,CAAY,EAAE,KAAa,EAAE,KAAa,EAAE,MAAc,EAAE,MAA+B,EAAE,GAAW;IAClI,MAAM,CAAC,CAAC,KAAK,CAAC,gGAAgG,EAAE;QAC9G,KAAK,EAAE;QACP,KAAK;QACL,KAAK;QACL,MAAM;QACN,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACtB,GAAG;KACJ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,KAAa,EAAE,KAAa,EAAE,MAAe;IACzF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,CACxB,oHAAoH,EACpH,CAAC,KAAK,EAAE,MAAM,IAAI,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAClD,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAA4B,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAC7I,CAAC"}

package/dist/repo/auth-prune.d.ts

@@ -0,0 +1,4 @@
+import type { Queryable } from "../db/db.js";
+/** Remove expired sessions and links, and sign-in counters older than a day. Better Auth ignores them already; this keeps the tables small. */
+export declare function pruneAuthRows(q: Queryable): Promise<void>;
+//# sourceMappingURL=auth-prune.d.ts.map

package/dist/repo/auth-prune.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-prune.d.ts","sourceRoot":"","sources":["../../src/repo/auth-prune.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,+IAA+I;AAC/I,wBAAsB,aAAa,CAAC,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/D"}

package/dist/repo/auth-prune.js

@@ -0,0 +1,8 @@
+/** Remove expired sessions and links, and sign-in counters older than a day. Better Auth ignores them already; this keeps the tables small. */
+export async function pruneAuthRows(q) {
+    await q.query("DELETE FROM sessions WHERE expires_at < now()");
+    await q.query("DELETE FROM verifications WHERE expires_at < now()");
+    await q.query("DELETE FROM rate_limits WHERE last_request < $1", [Date.now() - 86_400_000]);
+    await q.query("DELETE FROM invites WHERE status <> 'pending' AND created_at < now() - interval '90 days'");
+}
+//# sourceMappingURL=auth-prune.js.map

package/dist/repo/auth-prune.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-prune.js","sourceRoot":"","sources":["../../src/repo/auth-prune.ts"],"names":[],"mappings":"AAEA,+IAA+I;AAC/I,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAY;IAC9C,MAAM,CAAC,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,MAAM,CAAC,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACpE,MAAM,CAAC,CAAC,KAAK,CAAC,iDAAiD,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,CAAC,KAAK,CAAC,2FAA2F,CAAC,CAAC;AAC7G,CAAC"}

package/dist/repo/mail-prefs.d.ts

@@ -0,0 +1,35 @@
+import type { Queryable } from "../db/db.js";
+export type DigestPeriod = "daily" | "weekly" | "monthly";
+export declare const DIGEST_PERIODS: readonly DigestPeriod[];
+/** A project with no saved choice gets the weekly digest only. */
+export declare const DEFAULT_DIGEST: Record<DigestPeriod, boolean>;
+export interface MailPrefs {
+    team: boolean;
+    health: boolean;
+    /** Off stops every digest, for projects made later too. */
+    digests: boolean;
+    timeZone: string;
+    /** Local hour digests go out, 0 to 23. */
+    digestHour: number;
+}
+export declare const DEFAULT_PREFS: MailPrefs;
+/** What a stop link turns off: team or health notices, one digest of one project, or every digest. */
+export type StopScope = "team" | "health" | "digests" | {
+    projectId: string;
+    period: DigestPeriod;
+};
+export declare function prefsOf(q: Queryable, userId: string): Promise<MailPrefs>;
+export declare function savePrefs(q: Queryable, userId: string, patch: Partial<MailPrefs>): Promise<MailPrefs>;
+/** Saved digest choices by project. Projects not in the map use DEFAULT_DIGEST. */
+export declare function digestPrefsOf(q: Queryable, userId: string): Promise<Map<string, Record<DigestPeriod, boolean>>>;
+export declare function saveDigestPref(q: Queryable, userId: string, projectId: string, patch: Partial<Record<DigestPeriod, boolean>>): Promise<void>;
+/** Turn off what a stop link names. */
+export declare function applyStop(q: Queryable, userId: string, scope: StopScope): Promise<void>;
+export interface Recipient {
+    id: string;
+    email: string;
+    name: string;
+}
+/** Owners and admins of an organization who keep this kind of notice on. With real mail, only confirmed addresses. */
+export declare const managersOf: (q: Queryable, orgId: string, pref: "team" | "health", confirmedOnly: boolean) => Promise<Recipient[]>;
+//# sourceMappingURL=mail-prefs.d.ts.map

package/dist/repo/mail-prefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-prefs.d.ts","sourceRoot":"","sources":["../../src/repo/mail-prefs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC1D,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAAmC,CAAC;AACtF,kEAAkE;AAClE,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,CAAkD,CAAC;AAE5G,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,aAAa,EAAE,SAAuF,CAAC;AAEpH,sGAAsG;AACtG,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAIpG,wBAAsB,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG9E;AAED,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAQ3G;AAED,mFAAmF;AACnF,wBAAsB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAGrH;AAED,wBAAsB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlJ;AAED,uCAAuC;AACvC,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7F;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,sHAAsH;AACtH,eAAO,MAAM,UAAU,MAAa,SAAS,SAAS,MAAM,QAAQ,MAAM,GAAG,QAAQ,iBAAiB,OAAO,KAAG,OAAO,CAAC,SAAS,EAAE,CAKhI,CAAC"}

package/dist/repo/mail-prefs.js

@@ -0,0 +1,34 @@
+export const DIGEST_PERIODS = ["daily", "weekly", "monthly"];
+/** A project with no saved choice gets the weekly digest only. */
+export const DEFAULT_DIGEST = { daily: false, weekly: true, monthly: false };
+export const DEFAULT_PREFS = { team: true, health: true, digests: true, timeZone: "UTC", digestHour: 8 };
+export async function prefsOf(q, userId) {
+    const [r] = await q.query("SELECT team, health, digests, time_zone, digest_hour FROM mail_prefs WHERE user_id = $1", [userId]);
+    return r ? { team: r.team, health: r.health, digests: r.digests, timeZone: r.time_zone, digestHour: r.digest_hour } : { ...DEFAULT_PREFS };
+}
+export async function savePrefs(q, userId, patch) {
+    const p = { ...(await prefsOf(q, userId)), ...patch };
+    await q.query(`INSERT INTO mail_prefs (user_id, team, health, digests, time_zone, digest_hour) VALUES ($1, $2, $3, $4, $5, $6)
+     ON CONFLICT (user_id) DO UPDATE SET team = $2, health = $3, digests = $4, time_zone = $5, digest_hour = $6`, [userId, p.team, p.health, p.digests, p.timeZone, p.digestHour]);
+    return p;
+}
+/** Saved digest choices by project. Projects not in the map use DEFAULT_DIGEST. */
+export async function digestPrefsOf(q, userId) {
+    const rows = await q.query("SELECT project_id, daily, weekly, monthly FROM digest_prefs WHERE user_id = $1", [userId]);
+    return new Map(rows.map((r) => [r.project_id, { daily: r.daily, weekly: r.weekly, monthly: r.monthly }]));
+}
+export async function saveDigestPref(q, userId, projectId, patch) {
+    const p = { ...((await digestPrefsOf(q, userId)).get(projectId) ?? DEFAULT_DIGEST), ...patch };
+    await q.query(`INSERT INTO digest_prefs (user_id, project_id, daily, weekly, monthly) VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT (user_id, project_id) DO UPDATE SET daily = $3, weekly = $4, monthly = $5`, [userId, projectId, p.daily, p.weekly, p.monthly]);
+}
+/** Turn off what a stop link names. */
+export async function applyStop(q, userId, scope) {
+    if (typeof scope === "object")
+        return saveDigestPref(q, userId, scope.projectId, { [scope.period]: false });
+    await savePrefs(q, userId, { [scope]: false });
+}
+/** Owners and admins of an organization who keep this kind of notice on. With real mail, only confirmed addresses. */
+export const managersOf = async (q, orgId, pref, confirmedOnly) => q.query(`SELECT u.id, u.email, u.name FROM members m JOIN users u ON u.id = m.user_id LEFT JOIN mail_prefs p ON p.user_id = u.id
+     WHERE m.org_id = $1 AND m.role IN ('owner', 'admin') AND COALESCE(p.${pref}, TRUE) AND (u.email_verified OR NOT $2) ORDER BY u.email`, [orgId, confirmedOnly]);
+//# sourceMappingURL=mail-prefs.js.map

package/dist/repo/mail-prefs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-prefs.js","sourceRoot":"","sources":["../../src/repo/mail-prefs.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,cAAc,GAA4B,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AACtF,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAkC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAY5G,MAAM,CAAC,MAAM,aAAa,GAAc,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAOpH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,CAAY,EAAE,MAAc;IACxD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAU,yFAAyF,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACxI,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,CAAC;AAC7I,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,MAAc,EAAE,KAAyB;IACrF,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;IACtD,MAAM,CAAC,CAAC,KAAK,CACX;gHAC4G,EAC5G,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAChE,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAY,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,CAAyD,gFAAgF,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/K,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAY,EAAE,MAAc,EAAE,SAAiB,EAAE,KAA6C;IACjI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;IAC/F,MAAM,CAAC,CAAC,KAAK,CACX;2FACuF,EACvF,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,MAAc,EAAE,KAAgB;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACjD,CAAC;AAQD,sHAAsH;AACtH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,CAAY,EAAE,KAAa,EAAE,IAAuB,EAAE,aAAsB,EAAwB,EAAE,CACrI,CAAC,CAAC,KAAK,CACL;2EACuE,IAAI,2DAA2D,EACtI,CAAC,KAAK,EAAE,aAAa,CAAC,CACvB,CAAC"}

package/dist/repo/metric-read.d.ts

@@ -0,0 +1,12 @@
+import { type MetricAlertData, type MetricData, type TimeRange, type TimeWindow } from "@wizeworks/lens-core";
+import type { Queryable } from "../db/db.js";
+export interface MetricQuery {
+    projectId: string;
+    env?: string;
+    service?: string;
+}
+/** The metrics page data for one project, from the metric rollup tiers. `now` is rounded down to 10 s. */
+export declare function loadMetricData(q: Queryable, m: MetricQuery, range: TimeRange, params: Readonly<Record<string, string>>, now: number): Promise<MetricData>;
+/** One metric over an alert rule's window, from the metric rollup tiers. */
+export declare function loadMetricAlertData(q: Queryable, m: MetricQuery, name: string, w: TimeWindow, now: number): Promise<MetricAlertData>;
+//# sourceMappingURL=metric-read.d.ts.map

package/dist/repo/metric-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metric-read.d.ts","sourceRoot":"","sources":["../../src/repo/metric-read.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAKf,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,0GAA0G;AAC1G,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAEzJ;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEpI"}

package/dist/repo/metric-read.js

@@ -0,0 +1,11 @@
+import { alignNow, metricAlertSteps, metricPageSteps, runMetricAsync, } from "@wizeworks/lens-core";
+const run = (q) => (s) => q.query(s.sql, s.args);
+/** The metrics page data for one project, from the metric rollup tiers. `now` is rounded down to 10 s. */
+export function loadMetricData(q, m, range, params, now) {
+    return runMetricAsync(metricPageSteps("pg", { project: m.projectId, env: m.env }, range, alignNow(now), params), run(q));
+}
+/** One metric over an alert rule's window, from the metric rollup tiers. */
+export function loadMetricAlertData(q, m, name, w, now) {
+    return runMetricAsync(metricAlertSteps("pg", { project: m.projectId, env: m.env, service: m.service }, name, w, now), run(q));
+}
+//# sourceMappingURL=metric-read.js.map

package/dist/repo/metric-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metric-read.js","sourceRoot":"","sources":["../../src/repo/metric-read.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EAER,gBAAgB,EAEhB,eAAe,EAGf,cAAc,GAGf,MAAM,sBAAsB,CAAC;AAS9B,MAAM,GAAG,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAA0B,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAwB,CAAC;AAEvH,0GAA0G;AAC1G,MAAM,UAAU,cAAc,CAAC,CAAY,EAAE,CAAc,EAAE,KAAgB,EAAE,MAAwC,EAAE,GAAW;IAClI,OAAO,cAAc,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,CAAY,EAAE,CAAc,EAAE,IAAY,EAAE,CAAa,EAAE,GAAW;IACxG,OAAO,cAAc,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChI,CAAC"}

package/dist/repo/metric-write.d.ts

@@ -0,0 +1,9 @@
+import { type MetricPoint } from "@wizeworks/lens-core";
+import type { Queryable } from "../db/db.js";
+/** The metric rollup tables, for clearing a project. */
+export declare const METRIC_TABLES: string[];
+/** Add one batch's points to the metric tiers and series state. Series rows are locked first, in key order. */
+export declare function writeMetricRollups(q: Queryable, projectId: string, env: string, points: readonly MetricPoint[], now: number): Promise<void>;
+/** Drop tier buckets past their keep (10 s and 5 min tiers) or the organization's retention (1 h tier and series state). */
+export declare function pruneMetricRollups(q: Queryable, now: number): Promise<void>;
+//# sourceMappingURL=metric-write.d.ts.map

package/dist/repo/metric-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metric-write.d.ts","sourceRoot":"","sources":["../../src/repo/metric-write.ts"],"names":[],"mappings":"AACA,OAAO,EAQL,KAAK,WAAW,EAYjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C,wDAAwD;AACxD,eAAO,MAAM,aAAa,UAA6D,CAAC;AAsBxF,+GAA+G;AAC/G,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcjJ;AAED,4HAA4H;AAC5H,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjF"}

package/dist/repo/metric-write.js

@@ -0,0 +1,53 @@
+import { createHash } from "node:crypto";
+import { groupMetricSeries, mergeStoredHists, metricBatchWrites, metricHistOfColumns, metricHistStateSql, metricPlaceholderValues, metricSeriesInsertSql, metricSeriesUpsertSql, metricSeriesValues, metricStateOfColumns, tierCutoff, metricStateSql, metricTierUpsertSql, metricTierValues, seriesKeyOf, TIERS, } from "@wizeworks/lens-core";
+// Metric rollups at ingest (docs/CONTRACT.md, "Cloud storage"): written with the raw points, in the same transaction.
+const CHUNK = 200;
+const sha1 = (text) => createHash("sha1").update(text).digest("hex");
+/** The metric rollup tables, for clearing a project. */
+export const METRIC_TABLES = ["metric_series", ...TIERS.map((t) => `metric_${t.name}`)];
+/** Multi-row statements, `CHUNK` rows each; `sqlOf(n)` gives the text for n rows. */
+async function insertRows(q, sqlOf, rows) {
+    for (let i = 0; i < rows.length; i += CHUNK) {
+        const part = rows.slice(i, i + CHUNK);
+        await q.query(sqlOf(part.length), part.flat());
+    }
+}
+/** The stored histograms of the tier buckets this batch adds counts to, locked until the transaction ends. */
+async function storedHists(q, projectId, env, tiers) {
+    const stored = new Map();
+    for (const tier of TIERS) {
+        const mine = tiers.filter((t) => t.tier === tier && t.row.hist);
+        if (mine.length === 0)
+            continue;
+        const s = metricHistStateSql("pg", tier, projectId, env, [...new Set(mine.map((t) => t.key))], [...new Set(mine.map((t) => t.bucket))]);
+        for (const r of await q.query(s.sql, s.args))
+            stored.set(`${tier.name} ${r.series_key} ${Number(r.bucket_ms)}`, metricHistOfColumns(r));
+    }
+    return (t) => stored.get(`${t.tier.name} ${t.key} ${t.bucket}`) ?? null;
+}
+/** Add one batch's points to the metric tiers and series state. Series rows are locked first, in key order. */
+export async function writeMetricRollups(q, projectId, env, points, now) {
+    if (points.length === 0)
+        return;
+    const groups = groupMetricSeries(points, (p) => sha1(seriesKeyOf(p)));
+    const keys = [...groups.keys()];
+    await insertRows(q, (n) => metricSeriesInsertSql("pg", n), keys.map((k) => metricPlaceholderValues(projectId, env, k, groups.get(k).at(-1))));
+    const st = metricStateSql("pg", projectId, env, keys);
+    const states = new Map((await q.query(st.sql, st.args)).map((r) => [String(r.series_key), metricStateOfColumns(r)]));
+    const { series, tiers } = metricBatchWrites(groups, states, now);
+    mergeStoredHists(tiers, await storedHists(q, projectId, env, tiers));
+    for (const tier of TIERS) {
+        const rows = tiers.filter((t) => t.tier === tier).map((t) => metricTierValues("pg", projectId, env, t));
+        await insertRows(q, (n) => metricTierUpsertSql("pg", tier, n), rows);
+    }
+    await insertRows(q, (n) => metricSeriesUpsertSql("pg", n), series.map((s) => metricSeriesValues("pg", projectId, env, s)));
+}
+/** Drop tier buckets past their keep (10 s and 5 min tiers) or the organization's retention (1 h tier and series state). */
+export async function pruneMetricRollups(q, now) {
+    for (const t of TIERS.filter((x) => x.keepMs !== null))
+        await q.query(`DELETE FROM metric_${t.name} WHERE bucket_ms <= $1`, [tierCutoff(t, now, t.keepMs)]);
+    const scope = "USING projects p, orgs o WHERE p.id = m.project_id AND o.id = p.org_id";
+    await q.query(`DELETE FROM metric_1h m ${scope} AND m.bucket_ms <= $1 - o.retention_days * 86400000.0`, [now - 3_600_000]);
+    await q.query(`DELETE FROM metric_series m ${scope} AND m.last_ms < $1 - o.retention_days * 86400000.0`, [now]);
+}
+//# sourceMappingURL=metric-write.js.map

package/dist/repo/metric-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metric-write.js","sourceRoot":"","sources":["../../src/repo/metric-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,iBAAiB,EAEjB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EAEvB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,cAAc,EAEd,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,KAAK,GACN,MAAM,sBAAsB,CAAC;AAG9B,sHAAsH;AACtH,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE7E,wDAAwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,eAAe,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAExF,qFAAqF;AACrF,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,KAA4B,EAAE,IAAiB;IACrF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,8GAA8G;AAC9G,KAAK,UAAU,WAAW,CAAC,CAAY,EAAE,SAAiB,EAAE,GAAW,EAAE,KAAiC;IACxG,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxI,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1I,CAAC;IACD,OAAO,CAAC,CAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,CAAC;AAC3F,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAY,EAAE,SAAiB,EAAE,GAAW,EAAE,MAA8B,EAAE,GAAW;IAChI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IAChJ,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACjE,gBAAgB,CAAC,KAAK,EAAE,MAAM,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED,4HAA4H;AAC5H,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAY,EAAE,GAAW;IAChE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;QAAE,MAAM,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,IAAI,wBAAwB,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC;IAC7J,MAAM,KAAK,GAAG,wEAAwE,CAAC;IACvF,MAAM,CAAC,CAAC,KAAK,CAAC,2BAA2B,KAAK,wDAAwD,EAAE,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3H,MAAM,CAAC,CAAC,KAAK,CAAC,+BAA+B,KAAK,qDAAqD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAClH,CAAC"}

package/dist/repo/orgs.d.ts

@@ -0,0 +1,37 @@
+import type { Role } from "../auth/roles.js";
+import type { Queryable } from "../db/db.js";
+export interface Org {
+    id: string;
+    name: string;
+    slug: string;
+    retentionDays: number;
+}
+export interface Membership extends Org {
+    role: Role;
+}
+export interface Member {
+    /** The membership id Better Auth uses to change a role. */
+    memberId: string;
+    userId: string;
+    email: string;
+    name: string;
+    role: Role;
+    sinceMs: number;
+}
+export interface PendingInvite {
+    id: string;
+    email: string;
+    role: Role;
+    expiresMs: number;
+}
+/** A slug no organization has yet, from the name. */
+export declare function freeSlug(q: Queryable, name: string): Promise<string>;
+export declare const orgsOfUser: (q: Queryable, userId: string) => Promise<Membership[]>;
+export declare function membership(q: Queryable, userId: string, orgId: string): Promise<Membership | undefined>;
+export declare function setRetention(q: Queryable, orgId: string, retentionDays: number): Promise<void>;
+export declare const listMembers: (q: Queryable, orgId: string) => Promise<Member[]>;
+/** Open invites. Their ids are the secret part of the link, so only managers see them. */
+export declare const pendingInvites: (q: Queryable, orgId: string) => Promise<PendingInvite[]>;
+/** Delete an organization: every project's data first, then the row (members, invites, projects, keys, alerts, and shares go with it). */
+export declare function deleteOrgEverything(q: Queryable, orgId: string): Promise<void>;
+//# sourceMappingURL=orgs.d.ts.map

package/dist/repo/orgs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/repo/orgs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAW,SAAQ,GAAG;IACrC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,MAAM;IACrB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,qDAAqD;AACrD,wBAAsB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1E;AAED,eAAO,MAAM,UAAU,MAAO,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,UAAU,EAAE,CACqE,CAAC;AAEpJ,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAG7G;AAED,wBAAsB,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpG;AAED,eAAO,MAAM,WAAW,MAAO,SAAS,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAKvE,CAAC;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,cAAc,MAAO,SAAS,SAAS,MAAM,KAAG,OAAO,CAAC,aAAa,EAAE,CAIjF,CAAC;AAEJ,0IAA0I;AAC1I,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIpF"}

package/dist/repo/orgs.js

@@ -0,0 +1,33 @@
+import { slugOf } from "../auth/crypto.js";
+import { deleteProjectData } from "./projects.js";
+const ORG_COLUMNS = `o.id, o.name, o.slug, o.retention_days AS "retentionDays"`;
+const ms = (column) => `(extract(epoch FROM ${column}) * 1000)::double precision`;
+/** A slug no organization has yet, from the name. */
+export async function freeSlug(q, name) {
+    const base = slugOf(name);
+    const taken = new Set((await q.query("SELECT slug FROM orgs WHERE slug LIKE $1", [`${base}%`])).map((r) => r.slug));
+    let slug = base;
+    for (let i = 2; taken.has(slug); i++)
+        slug = `${base}-${i}`;
+    return slug;
+}
+export const orgsOfUser = (q, userId) => q.query(`SELECT ${ORG_COLUMNS}, m.role FROM members m JOIN orgs o ON o.id = m.org_id WHERE m.user_id = $1 ORDER BY o.name`, [userId]);
+export async function membership(q, userId, orgId) {
+    const [row] = await q.query(`SELECT ${ORG_COLUMNS}, m.role FROM members m JOIN orgs o ON o.id = m.org_id WHERE m.user_id = $1 AND m.org_id = $2`, [userId, orgId]);
+    return row;
+}
+export async function setRetention(q, orgId, retentionDays) {
+    await q.query("UPDATE orgs SET retention_days = $1 WHERE id = $2", [retentionDays, orgId]);
+}
+export const listMembers = (q, orgId) => q.query(`SELECT m.id AS "memberId", u.id AS "userId", u.email, u.name, m.role, ${ms("m.created_at")} AS "sinceMs" FROM members m JOIN users u ON u.id = m.user_id
+     WHERE m.org_id = $1 ORDER BY u.name`, [orgId]);
+/** Open invites. Their ids are the secret part of the link, so only managers see them. */
+export const pendingInvites = (q, orgId) => q.query(`SELECT id, email, role, ${ms("expires_at")} AS "expiresMs" FROM invites WHERE org_id = $1 AND status = 'pending' AND expires_at > now() ORDER BY created_at DESC`, [orgId]);
+/** Delete an organization: every project's data first, then the row (members, invites, projects, keys, alerts, and shares go with it). */
+export async function deleteOrgEverything(q, orgId) {
+    for (const { id } of await q.query("SELECT id FROM projects WHERE org_id = $1", [orgId]))
+        await deleteProjectData(q, id);
+    await q.query("DELETE FROM audit WHERE org_id = $1", [orgId]);
+    await q.query("DELETE FROM orgs WHERE id = $1", [orgId]);
+}
+//# sourceMappingURL=orgs.js.map

package/dist/repo/orgs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/repo/orgs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAG3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAgClD,MAAM,WAAW,GAAG,2DAA2D,CAAC;AAChF,MAAM,EAAE,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,uBAAuB,MAAM,6BAA6B,CAAC;AAE1F,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAY,EAAE,IAAY;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAmB,0CAA0C,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtI,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAY,EAAE,MAAc,EAAyB,EAAE,CAChF,CAAC,CAAC,KAAK,CAAa,UAAU,WAAW,6FAA6F,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpJ,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,MAAc,EAAE,KAAa;IAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAa,UAAU,WAAW,+FAA+F,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/K,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAY,EAAE,KAAa,EAAE,aAAqB;IACnF,MAAM,CAAC,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAY,EAAE,KAAa,EAAqB,EAAE,CAC5E,CAAC,CAAC,KAAK,CACL,yEAAyE,EAAE,CAAC,cAAc,CAAC;yCACtD,EACrC,CAAC,KAAK,CAAC,CACR,CAAC;AAEJ,0FAA0F;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAY,EAAE,KAAa,EAA4B,EAAE,CACtF,CAAC,CAAC,KAAK,CACL,2BAA2B,EAAE,CAAC,YAAY,CAAC,uHAAuH,EAClK,CAAC,KAAK,CAAC,CACR,CAAC;AAEJ,0IAA0I;AAC1I,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,CAAY,EAAE,KAAa;IACnE,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,CAAC,KAAK,CAAiB,2CAA2C,EAAE,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,iBAAiB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzI,MAAM,CAAC,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,CAAC,KAAK,CAAC,gCAAgC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/repo/projects.d.ts

@@ -0,0 +1,37 @@
+import type { Queryable } from "../db/db.js";
+export interface Project {
+    id: string;
+    orgId: string;
+    name: string;
+    slug: string;
+}
+export declare function createProject(q: Queryable, orgId: string, name: string, now: number): Promise<Project>;
+export declare const listProjects: (q: Queryable, orgId: string) => Promise<Project[]>;
+export declare function projectInOrg(q: Queryable, orgId: string, projectId: string): Promise<Project | undefined>;
+/** Delete a project and all of its data. */
+export declare function deleteProject(q: Queryable, projectId: string): Promise<void>;
+/** Delete every trace, span, log, service, metric, and stat of a project. The project and its settings stay. */
+export declare function deleteProjectData(q: Queryable, projectId: string): Promise<void>;
+export type KeyKind = "ingest" | "read";
+export interface ApiKey {
+    id: string;
+    kind: KeyKind;
+    name: string;
+    prefix: string;
+    /** Ingest keys: exactly one project. Read keys: the projects they may read. */
+    projectIds: string[];
+    createdMs: number;
+    lastUsedMs: number | null;
+}
+/** A new key. Returns the secret once; only its hash is kept. */
+export declare function createKey(q: Queryable, orgId: string, kind: KeyKind, name: string, projectIds: string[], by: string, now: number): Promise<{
+    id: string;
+    token: string;
+}>;
+export declare function listKeys(q: Queryable, orgId: string): Promise<ApiKey[]>;
+export declare function revokeKey(q: Queryable, orgId: string, keyId: string, now: number): Promise<boolean>;
+/** The key for a secret, when it is valid. Marks it used (at most once a minute). */
+export declare function keyByToken(q: Queryable, token: string, now: number): Promise<(ApiKey & {
+    orgId: string;
+}) | undefined>;
+//# sourceMappingURL=projects.d.ts.map

package/dist/repo/projects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/repo/projects.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAsB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5G;AAED,eAAO,MAAM,YAAY,MAAO,SAAS,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,EAAE,CACkB,CAAC;AAE/F,wBAAsB,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAG/G;AAED,4CAA4C;AAC5C,wBAAsB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlF;AAED,gHAAgH;AAChH,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;AAED,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAUD,iEAAiE;AACjE,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;GAQtI;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAG7E;AAED,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGzG;AAED,qFAAqF;AACrF,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,CAAC,CAK5H"}

package/dist/repo/projects.js

@@ -0,0 +1,57 @@
+import { hashToken, newId, newToken, slugOf } from "../auth/crypto.js";
+import { METRIC_TABLES } from "./metric-write.js";
+import { STATS_TABLES } from "../settle.js";
+const COLUMNS = `id, org_id AS "orgId", name, slug`;
+export async function createProject(q, orgId, name, now) {
+    const base = slugOf(name);
+    const taken = new Set((await q.query("SELECT slug FROM projects WHERE org_id = $1", [orgId])).map((r) => r.slug));
+    let slug = base;
+    for (let i = 2; taken.has(slug); i++)
+        slug = `${base}-${i}`;
+    const p = { id: newId(), orgId, name: name.trim().slice(0, 100) || slug, slug };
+    await q.query("INSERT INTO projects (id, org_id, name, slug, created_ms) VALUES ($1, $2, $3, $4, $5)", [p.id, orgId, p.name, slug, now]);
+    return p;
+}
+export const listProjects = (q, orgId) => q.query(`SELECT ${COLUMNS} FROM projects WHERE org_id = $1 ORDER BY name`, [orgId]);
+export async function projectInOrg(q, orgId, projectId) {
+    const [row] = await q.query(`SELECT ${COLUMNS} FROM projects WHERE org_id = $1 AND id = $2`, [orgId, projectId]);
+    return row;
+}
+/** Delete a project and all of its data. */
+export async function deleteProject(q, projectId) {
+    await deleteProjectData(q, projectId);
+    await q.query("DELETE FROM api_keys WHERE project_ids = $1", [JSON.stringify([projectId])]);
+    await q.query("DELETE FROM projects WHERE id = $1", [projectId]);
+}
+/** Delete every trace, span, log, service, metric, and stat of a project. The project and its settings stay. */
+export async function deleteProjectData(q, projectId) {
+    for (const table of ["spans", "logs", "traces", "services", "metric_points", ...METRIC_TABLES, ...STATS_TABLES])
+        await q.query(`DELETE FROM ${table} WHERE project_id = $1`, [projectId]);
+}
+const KEY_COLUMNS = `id, org_id, kind, name, prefix, project_ids, created_ms AS "createdMs", last_used_ms AS "lastUsedMs"`;
+const toKey = ({ project_ids, org_id: _org, ...k }) => ({ ...k, projectIds: JSON.parse(project_ids) });
+/** A new key. Returns the secret once; only its hash is kept. */
+export async function createKey(q, orgId, kind, name, projectIds, by, now) {
+    const token = newToken(kind);
+    const id = newId();
+    await q.query(`INSERT INTO api_keys (id, org_id, kind, project_ids, name, prefix, token_hash, created_by, created_ms) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`, [id, orgId, kind, JSON.stringify(projectIds), name.trim().slice(0, 100) || kind, token.slice(0, 12), hashToken(token), by, now]);
+    return { id, token };
+}
+export async function listKeys(q, orgId) {
+    const rows = await q.query(`SELECT ${KEY_COLUMNS} FROM api_keys WHERE org_id = $1 AND revoked_ms IS NULL ORDER BY created_ms DESC`, [orgId]);
+    return rows.map(toKey);
+}
+export async function revokeKey(q, orgId, keyId, now) {
+    const rows = await q.query("UPDATE api_keys SET revoked_ms = $1 WHERE org_id = $2 AND id = $3 AND revoked_ms IS NULL RETURNING id", [now, orgId, keyId]);
+    return rows.length > 0;
+}
+/** The key for a secret, when it is valid. Marks it used (at most once a minute). */
+export async function keyByToken(q, token, now) {
+    const [row] = await q.query(`SELECT ${KEY_COLUMNS} FROM api_keys WHERE token_hash = $1 AND revoked_ms IS NULL`, [hashToken(token)]);
+    if (!row)
+        return undefined;
+    if (!row.lastUsedMs || now - row.lastUsedMs > 60_000)
+        await q.query("UPDATE api_keys SET last_used_ms = $1 WHERE id = $2", [now, row.id]);
+    return { ...toKey(row), orgId: row.org_id };
+}
+//# sourceMappingURL=projects.js.map

package/dist/repo/projects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/repo/projects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAS5C,MAAM,OAAO,GAAG,mCAAmC,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAY,EAAE,KAAa,EAAE,IAAY,EAAE,GAAW;IACxF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAmB,6CAA6C,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpI,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;IAC5D,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;IAChF,MAAM,CAAC,CAAC,KAAK,CAAC,uFAAuF,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACzI,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAY,EAAE,KAAa,EAAsB,EAAE,CAC9E,CAAC,CAAC,KAAK,CAAU,UAAU,OAAO,gDAAgD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AAE/F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAY,EAAE,KAAa,EAAE,SAAiB;IAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAU,UAAU,OAAO,8CAA8C,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1H,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAY,EAAE,SAAiB;IACjE,MAAM,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,CAAC,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,CAAC,KAAK,CAAC,oCAAoC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,CAAY,EAAE,SAAiB;IACrE,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QAAE,MAAM,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,wBAAwB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5L,CAAC;AAoBD,MAAM,WAAW,GAAG,sGAAsG,CAAC;AAC3H,MAAM,KAAK,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,EAAE,CAAC,CAAC;AAEnI,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,KAAa,EAAE,IAAa,EAAE,IAAY,EAAE,UAAoB,EAAE,EAAU,EAAE,GAAW;IACrI,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,CAAC,KAAK,CACX,oJAAoJ,EACpJ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAChI,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAY,EAAE,KAAa;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,CAAS,UAAU,WAAW,kFAAkF,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACrJ,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,KAAa,EAAE,KAAa,EAAE,GAAW;IACrF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,uGAAuG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACzJ,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,KAAa,EAAE,GAAW;IACvE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAS,UAAU,WAAW,6DAA6D,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5I,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,GAAG,MAAM;QAAE,MAAM,CAAC,CAAC,KAAK,CAAC,qDAAqD,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1I,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC9C,CAAC"}

package/dist/repo/suppressions.d.ts

@@ -0,0 +1,8 @@
+import type { Queryable } from "../db/db.js";
+export type SuppressReason = "bounce" | "complaint";
+/** Skip this address from now on. A bounce wins over a complaint, since nothing can reach the address. */
+export declare function suppress(q: Queryable, email: string, reason: SuppressReason, detail: string, now: number): Promise<void>;
+export declare function suppressionOf(q: Queryable, email: string): Promise<SuppressReason | null>;
+/** The person proved the address works (they opened a link sent to it), so mail may go there again. */
+export declare function unsuppress(q: Queryable, email: string): Promise<void>;
+//# sourceMappingURL=suppressions.d.ts.map

package/dist/repo/suppressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/repo/suppressions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,WAAW,CAAC;AAIpD,0GAA0G;AAC1G,wBAAsB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9H;AAED,wBAAsB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAG/F;AAED,uGAAuG;AACvG,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E"}

package/dist/repo/suppressions.js

@@ -0,0 +1,16 @@
+const norm = (email) => email.trim().toLowerCase();
+/** Skip this address from now on. A bounce wins over a complaint, since nothing can reach the address. */
+export async function suppress(q, email, reason, detail, now) {
+    await q.query(`INSERT INTO mail_suppressions (email, reason, detail, created_ms) VALUES ($1, $2, $3, $4)
+     ON CONFLICT (email) DO UPDATE SET reason = CASE WHEN mail_suppressions.reason = 'bounce' THEN 'bounce' ELSE EXCLUDED.reason END,
+       detail = EXCLUDED.detail, created_ms = EXCLUDED.created_ms`, [norm(email), reason, detail.slice(0, 500), now]);
+}
+export async function suppressionOf(q, email) {
+    const rows = await q.query("SELECT reason FROM mail_suppressions WHERE email = $1", [norm(email)]);
+    return rows[0]?.reason ?? null;
+}
+/** The person proved the address works (they opened a link sent to it), so mail may go there again. */
+export async function unsuppress(q, email) {
+    await q.query("DELETE FROM mail_suppressions WHERE email = $1", [norm(email)]);
+}
+//# sourceMappingURL=suppressions.js.map