@wizeworks/lens-cloud 0.3.0-alpha.1 → 0.3.0-alpha.3

package/README.md

@@ -11,7 +11,8 @@ npx @wizeworks/lens-cloud
 POSTGRES_PASSWORD=<a long secret> docker compose -f deploy/docker-compose.cloud.yml up -d
 ```
 
-Open http://localhost:5970/_wizelens/ and create the first account. Make an ingest key on the Team page, then on each app:
+The cloud prints a one-time setup link while it has no account. Open it and create the first account. Make an ingest key on the
+Team page, then on each app:
 
 ```bash
 WIZELENS_HUB=http://localhost:5970
@@ -29,9 +30,55 @@ WIZELENS_HUB_TOKEN=wl_ik_...
 | `--signup <invite\|open>` | `WIZELENS_CLOUD_SIGNUP` | `invite` |
 | `--retention-days <n>` | `WIZELENS_CLOUD_RETENTION_DAYS` | `30` |
 | `--allow-private-webhooks` | `WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1` | off |
-
-Put it behind https. With an https public URL, the sign-in cookie is marked secure. PGlite is for trials and tests; use Postgres
-for real teams. Check a running cloud end to end with `node scripts/cloud-smoke.mjs <url>` from the repo (it needs a fresh database).
+| `--auth-secret <text>` | `WIZELENS_CLOUD_AUTH_SECRET` | required with Postgres (32+ random characters; `2:new,1:old` rotates) |
+| `--resend-api-key <key>` | `WIZELENS_CLOUD_RESEND_API_KEY` | none: mail through the [Resend](https://resend.com) API (`re_…`) |
+| `--resend-webhook-secret <s>` | `WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET` | none: the `whsec_…` secret of the Resend webhook (see below) |
+| `--smtp-url <url>` | `WIZELENS_CLOUD_SMTP_URL` | none: or mail over SMTP (`smtp://user:pass@host:587` or `smtps://…:465`) |
+| `--mail-from <address>` | `WIZELENS_CLOUD_MAIL_FROM` | `WizeLens <no-reply@<public host>>` |
+| `--mail-reply-to <address>` | `WIZELENS_CLOUD_MAIL_REPLY_TO` | none: replies go to the sender |
+| `--trust-proxy` | `WIZELENS_CLOUD_TRUST_PROXY=1` | off (client address from the last `X-Forwarded-For` entry) |
+| `--setup-token <text>` | `WIZELENS_CLOUD_SETUP_TOKEN` | random, printed at start while no account exists |
+| `--[no-]check-pwned-passwords` | `WIZELENS_CLOUD_CHECK_PWNED=1\|0` | on with Postgres, off with PGlite |
+| `--sso-origins <list>` | `WIZELENS_CLOUD_SSO_ORIGINS` | none: identity provider origins for OIDC single sign-on, comma separated (`https://acme.okta.com`) |
+
+Put it behind https, and set `--public-url` to the https address: cookies are then Secure, and passkeys and email links use it.
+Sending mail needs `--public-url`. Without `--resend-api-key` or `--smtp-url`, nobody gets email: reset and invite links are in
+the log, and email addresses are not confirmed. PGlite is for trials and tests; use Postgres for real teams.
+
+## Email
+
+Use Resend or SMTP, not both. With Resend, each email is sent with an idempotency key and tried up to 4 times on 429 and 5xx answers.
+Add a Resend webhook to `<public-url>/_wizelens/api/mail/resend` with the events `email.bounced` and `email.complained`, and set
+`--resend-webhook-secret` to its signing secret. The cloud checks the signature, then keeps a suppression list: after a hard bounce
+no mail goes to that address, and after a spam complaint only mail the person asked for (confirm, reset, change, delete) goes
+there. Confirming the address again by link clears it.
+
+What the cloud sends, beyond sign-in links and invites:
+
+- **Security notices**, always, to the person: password changed, email changed (to the old address), two-step sign-in on or off,
+  passkey added or removed, new backup codes, and a sign-in on a browser and system the account never used.
+- **Team changes**, to owners and admins: members invited, joined, left, removed, or given a new role (that member hears too), keys,
+  single sign-on, projects, share links, and settings. One email per batch, without the reader's own changes. A deleted
+  organization is told to every member.
+- **Project health**, to owners and admins: a project that sends data in most hours went quiet for 2 hours, and when it is back.
+- **Alerts**, from alert rules.
+- **Digests**, per person and project: daily, weekly (Mondays), and monthly (the 1st), at the person's hour and time zone. Weekly
+  is on by default. Each has requests, error rate, average and p95 time, SQL queries, alerts fired, top errors, the slowest
+  endpoints, and insights. Projects with no traffic get none.
+
+Team, health, and digest emails carry a one-click stop link (`List-Unsubscribe`, RFC 8058). People pick all of it on the Account
+page. `pnpm --filter @wizeworks/lens-cloud email:preview <folder>` writes every email to HTML and text.
+
+## Accounts
+
+Sign-in is [Better Auth](https://better-auth.com) (pinned to one version): email and password, passkeys, two-step codes from an
+authenticator app with backup codes, password reset and email confirm by link, sessions per device (sign out one or all),
+organizations with owner, admin, member, and viewer roles, email invites, single sign-on per organization (OIDC or SAML, after a
+DNS proof of the email domain; Team page), and account deletion. Sign-in tries are limited per
+client address across all instances. Existing accounts keep working after the upgrade; everyone signs in once more. See
+`docs/CONTRACT.md`, "Tenancy and access".
+
+Check a running cloud end to end with `node scripts/cloud-smoke.mjs <url> <setup token>` from the repo (a fresh database, no SMTP).
 
 ## Stats
 
@@ -57,7 +104,13 @@ one metric: `{ "metric": "metric", "metricName": "process.cpu.utilization", "met
 ```ts
 import { createCloud } from "@wizeworks/lens-cloud";
 
-const cloud = await createCloud({ database: process.env.DATABASE_URL, publicUrl: "https://wizelens.example.com" });
+const cloud = await createCloud({
+  database: process.env.DATABASE_URL,
+  publicUrl: "https://wizelens.example.com",
+  authSecret: process.env.WIZELENS_CLOUD_AUTH_SECRET,
+  resendApiKey: process.env.WIZELENS_CLOUD_RESEND_API_KEY,
+  resendWebhookSecret: process.env.WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET,
+});
 console.log(await cloud.listen());
 ```
 

package/dist/alerts/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAY,KAAK,SAAS,EAAgC,MAAM,mBAAmB,CAAC;AAG3F,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAyCnD,6CAA6C;AAC7C,wBAAsB,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKvI;AAED,8FAA8F;AAC9F,wBAAsB,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7F;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9D"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAY,KAAK,SAAS,EAAgC,MAAM,mBAAmB,CAAC;AAI3F,OAAO,EAAW,KAAK,MAAM,EAAe,MAAM,aAAa,CAAC;AAsDhE,6CAA6C;AAC7C,wBAAsB,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKvI;AAED,8FAA8F;AAC9F,wBAAsB,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7F;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9D"}

package/dist/alerts/evaluate.js

@@ -1,12 +1,13 @@
 import { alertBreached, alignNow, alertContext, alertMessage, alertPage, computePage, metricAlertMessage, metricAlertUnit, metricAlertValueOf } from "@wizeworks/lens-core";
 import { addEvent, enabledRules, saveEvaluation } from "../repo/alerts.js";
-import { loadMetricAlertData } from "../repo/metric-read.js";
-import { cloudExecutor, projectRetentionMs } from "../scale-exec.js";
+import { projectRetentionMs } from "../scale-exec.js";
+import { alertMail } from "../mail/templates.js";
+import { memberEmails } from "../repo/users.js";
 import { deliver } from "./notify.js";
 /** Names for the notice: project and the dashboard link. */
 async function noticeOf(app, rule, state, value, now) {
     const [p] = await app.db.query("SELECT name FROM projects WHERE id = $1", [rule.projectId]);
-    const base = app.config.publicUrl ?? `http://localhost:${app.config.port}`;
+    const base = app.baseUrl();
     return {
         rule: rule.name,
         project: p?.name ?? rule.projectId,
@@ -22,7 +23,7 @@ async function noticeOf(app, rule, state, value, now) {
 async function measureMetric(app, rule, now) {
     const at = alignNow(now);
     const q = { projectId: rule.projectId, env: rule.env || undefined, service: rule.metricService || undefined };
-    const data = await loadMetricAlertData(app.db, q, rule.metricName, { from: at - rule.windowMs, to: at }, at);
+    const data = await app.telemetry.metricAlertData(q, rule.metricName, { from: at - rule.windowMs, to: at }, at);
     const stat = rule.metricStat || "avg";
     return { value: metricAlertValueOf(data, stat), sample: data.series[0], stat };
 }
@@ -38,12 +39,25 @@ async function measure(app, rule, now) {
     if (rule.metric === "metric")
         return (await measureMetric(app, rule, now)).value;
     const retentionMs = await projectRetentionMs(app.db, rule.projectId, app.config.retentionDays);
-    return computePage(alertPage(rule.metric), alertContext(rule.windowMs, alignNow(now)), cloudExecutor(app.db, rule.projectId, retentionMs, rule.env || undefined));
+    return computePage(alertPage(rule.metric), alertContext(rule.windowMs, alignNow(now)), app.telemetry.executor(rule.projectId, retentionMs, rule.env || undefined));
+}
+/** Webhooks, Slack, and email. Email goes only to addresses that still belong to confirmed members of the organization. */
+async function outboxOf(app, projectId) {
+    const [p] = await app.db.query("SELECT org_id FROM projects WHERE id = $1", [projectId]);
+    const members = new Set(p ? await memberEmails(app.db, p.org_id, app.mailer.live) : []);
+    const email = (to, n) => {
+        const ok = to.filter((e) => members.has(e));
+        for (const addr of ok)
+            app.mailer.send(alertMail(addr, n));
+        const note = app.mailer.live ? `sent to ${ok.length}` : "mail is not set up (see the cloud log)";
+        return `email: ${note}${ok.length < to.length ? `, ${to.length - ok.length} no longer members` : ""}`;
+    };
+    return { http: app.config.fetch, allowPrivate: app.config.allowPrivateWebhooks, email };
 }
 /** Send a notice and keep it as an event. */
 export async function notify(app, rule, state, value, now) {
     const notice = await noticeOf(app, rule, state, value, now);
-    const delivery = await deliver(rule.channels, notice, app.config.fetch, app.config.allowPrivateWebhooks);
+    const delivery = await deliver(rule.channels, notice, await outboxOf(app, rule.projectId));
     await addEvent(app.db, rule, { kind: state, value, message: notice.message, timeMs: now, delivery });
     return delivery;
 }

package/dist/alerts/evaluate.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE5K,OAAO,EAAE,QAAQ,EAAkB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAe,MAAM,aAAa,CAAC;AAEnD,4DAA4D;AAC5D,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IAC/G,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAmB,yCAAyC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,oBAAoB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3E,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,SAAS;QAClC,KAAK;QACL,OAAO,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC;QACtD,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG,IAAI,+BAA+B,IAAI,CAAC,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,aAAa,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IACtE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;IAC9G,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IAChH,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAChG,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,OAAO,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/F,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;AACpK,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IACpH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACzG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7L,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAa;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC"}
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE5K,OAAO,EAAE,QAAQ,EAAkB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,OAAO,EAA4B,MAAM,aAAa,CAAC;AAEhE,4DAA4D;AAC5D,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IAC/G,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAmB,yCAAyC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,SAAS;QAClC,KAAK;QACL,OAAO,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC;QACtD,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG,IAAI,+BAA+B,IAAI,CAAC,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,aAAa,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IACtE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;IAC9G,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IAChH,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAChG,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,OAAO,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/F,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;AACrK,CAAC;AAED,2HAA2H;AAC3H,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,SAAiB;IACtD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,CAAC,EAAqB,EAAE,CAAS,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,EAAE;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,wCAAwC,CAAC;QACjG,OAAO,UAAU,IAAI,GAAG,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxG,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC;AAC1F,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IACpH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3F,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7L,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAa;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC"}

package/dist/alerts/notify.d.ts

@@ -10,8 +10,19 @@ export interface Notice {
     /** Link to the project in the dashboard. */
     url: string;
 }
+/** How notices leave: HTTP for webhooks and Slack, and a mail function that sends to the members still allowed and says what it did. */
+export interface Outbox {
+    http: typeof fetch;
+    allowPrivate: boolean;
+    email: (to: readonly string[], n: Notice) => string;
+}
 /** A webhook may not point into the service's own network (cloud metadata, databases). Self-hosts can allow it. */
 export declare function checkTarget(url: string, allowPrivate: boolean): Promise<string | null>;
-/** Send to every channel. Returns one line per channel, for the event's delivery note. */
-export declare function deliver(channels: readonly Channel[], n: Notice, http: typeof fetch, allowPrivate: boolean): Promise<string>;
+/** The notice in words, for Slack and email. */
+export declare function noticeLines(n: Notice): {
+    subject: string;
+    lines: string[];
+};
+/** Send to every channel. Returns one line per channel, for the delivery note of the event. */
+export declare function deliver(channels: readonly Channel[], n: Notice, out: Outbox): Promise<string>;
 //# sourceMappingURL=notify.d.ts.map

package/dist/alerts/notify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/alerts/notify.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;CACb;AAKD,mHAAmH;AACnH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY5F;AASD,0FAA0F;AAC1F,wBAAsB,OAAO,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAcjI"}
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/alerts/notify.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;CACb;AAID,wIAAwI;AACxI,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,OAAO,KAAK,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;CACrD;AAKD,mHAAmH;AACnH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY5F;AAED,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAG3E;AAoBD,+FAA+F;AAC/F,wBAAsB,OAAO,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGnG"}

package/dist/alerts/notify.js

@@ -20,27 +20,33 @@ export async function checkTarget(url, allowPrivate) {
         return "The host name does not resolve.";
     return addresses.some(isPrivate) ? "Webhooks cannot point at private or local addresses." : null;
 }
+/** The notice in words, for Slack and email. */
+export function noticeLines(n) {
+    const verb = n.state === "fired" ? "Alert" : n.state === "resolved" ? "Resolved" : "Test";
+    return { subject: `${verb}: ${n.rule} (${n.project})`, lines: [`${verb}: ${n.rule} in ${n.project}.`, n.message] };
+}
 function bodyOf(channel, n) {
     if (channel.kind === "webhook")
         return n;
     const icon = n.state === "fired" ? ":rotating_light:" : n.state === "resolved" ? ":white_check_mark:" : ":bell:";
-    const verb = n.state === "fired" ? "Alert" : n.state === "resolved" ? "Resolved" : "Test";
-    return { text: `${icon} *${verb}: ${n.rule}* (${n.project})\n${n.message}\n<${n.url}|Open WizeLens>` };
+    const { subject } = noticeLines(n);
+    return { text: `${icon} *${subject}*\n${n.message}\n<${n.url}|Open WizeLens>` };
+}
+async function post(c, n, out) {
+    const problem = await checkTarget(c.url, out.allowPrivate);
+    if (problem)
+        return `${c.kind}: ${problem}`;
+    try {
+        const res = await out.http(c.url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(bodyOf(c, n)), signal: AbortSignal.timeout(5000), redirect: "error" });
+        return `${c.kind}: ${res.ok ? "sent" : `HTTP ${res.status}`}`;
+    }
+    catch (err) {
+        return `${c.kind}: ${err instanceof Error ? err.message : "failed"}`;
+    }
 }
-/** Send to every channel. Returns one line per channel, for the event's delivery note. */
-export async function deliver(channels, n, http, allowPrivate) {
-    const results = await Promise.all(channels.map(async (c) => {
-        const problem = await checkTarget(c.url, allowPrivate);
-        if (problem)
-            return `${c.kind}: ${problem}`;
-        try {
-            const res = await http(c.url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(bodyOf(c, n)), signal: AbortSignal.timeout(5000), redirect: "error" });
-            return `${c.kind}: ${res.ok ? "sent" : `HTTP ${res.status}`}`;
-        }
-        catch (err) {
-            return `${c.kind}: ${err instanceof Error ? err.message : "failed"}`;
-        }
-    }));
+/** Send to every channel. Returns one line per channel, for the delivery note of the event. */
+export async function deliver(channels, n, out) {
+    const results = await Promise.all(channels.map(async (c) => (c.kind === "email" ? out.email(c.to, n) : post(c, n, out))));
     return results.join("; ") || "no channels";
 }
 //# sourceMappingURL=notify.js.map

package/dist/alerts/notify.js.map

@@ -1 +1 @@
-{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/alerts/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAehC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,EAAE,0CAA0C,CAAC,CAAC;AACvJ,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,wDAAwD,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE3K,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,YAAqB;IAClE,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACxG,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACrE,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC,IAAI,CAAC;AACnG,CAAC;AAED,SAAS,MAAM,CAAC,OAAgB,EAAE,CAAS;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjH,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,GAAG,iBAAiB,EAAE,CAAC;AACzG,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,QAA4B,EAAE,CAAS,EAAE,IAAkB,EAAE,YAAqB;IAC9G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,OAAO;YAAE,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7L,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/alerts/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAwBhC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,EAAE,0CAA0C,CAAC,CAAC;AACvJ,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,wDAAwD,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE3K,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,YAAqB;IAClE,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACxG,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACrE,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC,IAAI,CAAC;AACnG,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACrH,CAAC;AAED,SAAS,MAAM,CAAC,OAAoB,EAAE,CAAS;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjH,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,KAAK,OAAO,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,GAAG,iBAAiB,EAAE,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,CAAc,EAAE,CAAS,EAAE,GAAW;IACxD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,OAAO;QAAE,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvE,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,QAA4B,EAAE,CAAS,EAAE,GAAW;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1H,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;AAC7C,CAAC"}

package/dist/app.d.ts

@@ -1,15 +1,29 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import type { WizeAuth } from "./auth/auth.js";
+import type { AuthSecret } from "./auth/secret.js";
+import type { Changes } from "./changes.js";
 import type { CloudConfig } from "./config.js";
 import type { Db } from "./db/db.js";
 import type { RouteCtx } from "./http/router.js";
+import type { Mailer } from "./mail/mailer.js";
+import type { TelemetryStore } from "./telemetry/store.js";
 /** Everything a request handler needs. */
 export interface CloudApp {
     db: Db;
+    /** Spans, logs, metrics, and stats: Postgres in small mode, ClickHouse in scale mode. */
+    telemetry: TelemetryStore;
     config: CloudConfig;
     version: string;
     startedMs: number;
-    /** The address for links: the public URL, or the one this request came in on. */
-    baseUrl(req: IncomingMessage): string;
+    mailer: Mailer;
+    /** The auth secrets, newest first, for signed mail links. */
+    secrets: readonly AuthSecret[];
+    /** Better Auth. Ready once the cloud listens (its address goes into links and cookie checks). */
+    readonly auth: WizeAuth;
+    /** New data per project, for open dashboards. */
+    changes: Changes;
+    /** The address for links: the public URL, or the address the cloud listens on. */
+    baseUrl(req?: IncomingMessage): string;
 }
 export interface Ctx extends RouteCtx {
     app: CloudApp;

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,0CAA0C;AAC1C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,GAAI,SAAQ,QAAQ;IACnC,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,0CAA0C;AAC1C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,EAAE,CAAC;IACP,yFAAyF;IACzF,SAAS,EAAE,cAAc,CAAC;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,OAAO,CAAC,GAAG,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,GAAI,SAAQ,QAAQ;IACnC,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC"}

package/dist/auth/auth.d.ts

@@ -0,0 +1,51 @@
+import { type BetterAuthOptions } from "better-auth";
+import type { AuthDeps } from "./deps.js";
+/** The parts of Better Auth the cloud calls itself; the dashboard reaches the rest through `api/auth/*`. */
+export interface WizeAuth {
+    handler: (request: Request) => Promise<Response>;
+    options: BetterAuthOptions;
+    api: {
+        getSession(a: {
+            headers: Headers;
+        }): Promise<{
+            user: SessionUser;
+            session: {
+                id: string;
+            };
+        } | null>;
+        verifyPassword(a: {
+            body: {
+                password: string;
+            };
+            headers: Headers;
+        }): Promise<unknown>;
+        createOrganization(a: {
+            body: {
+                name: string;
+                slug: string;
+                userId: string;
+            };
+        }): Promise<{
+            id: string;
+            name: string;
+            slug: string;
+        } | null>;
+    };
+}
+interface SessionUser {
+    id: string;
+    email: string;
+    name: string;
+    emailVerified: boolean;
+    twoFactorEnabled?: boolean | null;
+}
+/** Better Auth for the cloud: accounts, sessions, 2FA, passkeys, SSO, organizations, members, and invites (docs/CONTRACT.md, "Tenancy and access"). */
+export declare function createAuth(deps: AuthDeps): WizeAuth;
+/** A new organization with `userId` as owner, the cloud's default retention, a first project, and an audit line. */
+export declare function createOrgFor(auth: WizeAuth, deps: Pick<AuthDeps, "db" | "retentionDays">, userId: string, name: string): Promise<{
+    id: string;
+    name: string;
+    slug: string;
+}>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AA4C1C,4GAA4G;AAC5G,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,GAAG,EAAE;QACH,UAAU,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE,WAAW,CAAC;YAAC,OAAO,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACpG,cAAc,CAAC,CAAC,EAAE;YAAE,IAAI,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtF,kBAAkB,CAAC,CAAC,EAAE;YAAE,IAAI,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;KAC7I,CAAC;CACH;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAED,uJAAuJ;AACvJ,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAGnD;AAED,oHAAoH;AACpH,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAWlL"}

package/dist/auth/auth.js

@@ -0,0 +1,63 @@
+import { betterAuth } from "better-auth";
+import { audit } from "../repo/audit.js";
+import { freeSlug } from "../repo/orgs.js";
+import { createProject } from "../repo/projects.js";
+import { beforeDeleteUser } from "./delete-user.js";
+import { authHooks } from "./hooks.js";
+import { advancedOptions, AUTH_BASE_PATH, passwordAuth, rateLimitOptions, sessionOptions, userOptions } from "./options.js";
+import { authPlugins } from "./plugins.js";
+import { securityDbHooks } from "./security-notices.js";
+import { afterSignup, confirmSsoEmail } from "./signup.js";
+const ALWAYS_OFF = ["/sign-in/social", "/link-social", "/get-access-token", "/refresh-token", "/account-info", "/delete-user/callback", "/update-session"];
+/** Invite ids are link secrets: no route lists them (managers see them on our Team page), nor, without real mail, by "their" email. */
+const disabledPaths = (deps) => [
+    ...ALWAYS_OFF,
+    "/organization/list-invitations",
+    "/organization/get-full-organization",
+    ...(deps.mailer.live ? [] : ["/organization/list-user-invitations"]),
+];
+/** Sign-up (first organization, SSO email) and security notices (new device, two-step sign-in, changed email). */
+function databaseHooksOf(deps, createOrg) {
+    const notices = securityDbHooks(deps);
+    return { session: notices.session, user: { create: { before: confirmSsoEmail, after: afterSignup(deps, createOrg) }, update: notices.user?.update } };
+}
+function build(deps, createOrg) {
+    return betterAuth({
+        appName: "WizeLens",
+        baseURL: deps.publicUrl,
+        basePath: AUTH_BASE_PATH,
+        secrets: deps.secrets,
+        trustedOrigins: [...deps.trustedOrigins, ...deps.ssoOrigins],
+        telemetry: { enabled: false },
+        disabledPaths: disabledPaths(deps),
+        database: deps.db.authDatabase,
+        user: userOptions(deps, beforeDeleteUser(deps.db)),
+        ...passwordAuth(deps),
+        ...sessionOptions(),
+        rateLimit: rateLimitOptions(),
+        advanced: advancedOptions(deps),
+        databaseHooks: databaseHooksOf(deps, createOrg),
+        hooks: authHooks(deps),
+        plugins: authPlugins(deps),
+    });
+}
+/** Better Auth for the cloud: accounts, sessions, 2FA, passkeys, SSO, organizations, members, and invites (docs/CONTRACT.md, "Tenancy and access"). */
+export function createAuth(deps) {
+    const auth = build(deps, (userId, name) => createOrgFor(auth, deps, userId, name));
+    return auth;
+}
+/** A new organization with `userId` as owner, the cloud's default retention, a first project, and an audit line. */
+export async function createOrgFor(auth, deps, userId, name) {
+    const clean = name.trim().slice(0, 100) || "My organization";
+    const org = await auth.api.createOrganization({ body: { name: clean, slug: await freeSlug(deps.db, clean), userId } });
+    if (!org)
+        throw new Error("Could not create the organization.");
+    const now = Date.now();
+    await deps.db.tx(async (q) => {
+        await q.query("UPDATE orgs SET retention_days = $1 WHERE id = $2", [deps.retentionDays, org.id]);
+        await createProject(q, org.id, "My app", now);
+        await audit(q, org.id, `user:${userId}`, "org.create", { name: clean }, now);
+    });
+    return { id: org.id, name: org.name, slug: org.slug };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5H,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;AAE3J,uIAAuI;AACvI,MAAM,aAAa,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC;IACxC,GAAG,UAAU;IACb,gCAAgC;IAChC,qCAAqC;IACrC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC;CACrE,CAAC;AAEF,kHAAkH;AAClH,SAAS,eAAe,CAAC,IAAc,EAAE,SAAoE;IAC3G,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;AACxJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAc,EAAE,SAAoE;IACjG,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5D,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY;QAC9B,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,GAAG,YAAY,CAAC,IAAI,CAAC;QACrB,GAAG,cAAc,EAAE;QACnB,SAAS,EAAE,gBAAgB,EAAE;QAC7B,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC;QAC/B,aAAa,EAAE,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;QAC/C,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC;AAqBD,uJAAuJ;AACvJ,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAwB,CAAC;IAC1G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,IAA4C,EAAE,MAAc,EAAE,IAAY;IAC3H,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,iBAAiB,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACvH,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,CAAC,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,MAAM,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC"}

package/dist/auth/bridge.d.ts

@@ -0,0 +1,7 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { WizeAuth } from "./auth.js";
+/** The caller's address: the socket, or (behind a proxy we run) the last address that proxy added to X-Forwarded-For. */
+export declare function clientIp(req: IncomingMessage, trustProxy: boolean): string;
+/** Better Auth below `/_wizelens/api/auth/`: our dashboard header on changes, a body limit, and our own client-address header. */
+export declare function authHandler(auth: WizeAuth, trustProxy: boolean): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+//# sourceMappingURL=bridge.d.ts.map

package/dist/auth/bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/auth/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAU1C,yHAAyH;AACzH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,CAI1E;AAOD,kIAAkI;AAClI,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,SAE1C,eAAe,OAAO,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC,CAaxE"}

package/dist/auth/bridge.js

@@ -0,0 +1,39 @@
+import { toNodeHandler } from "better-auth/node";
+import { AUTH_BASE_PATH, CLIENT_IP_HEADER } from "./options.js";
+const SAFE = new Set(["GET", "HEAD", "OPTIONS"]);
+/** Paths an outside party posts to (sign-in providers), which cannot send the dashboard header. None are on yet; SSO adds them. */
+const EXTERNAL = [/^\/callback\/[^/]+$/, /^\/sso\/callback(\/[^/]+)?$/, /^\/sso\/saml2\/sp\/(acs|slo)\/[^/]+$/];
+const IP_HEADERS = ["x-forwarded-for", "x-real-ip", "cf-connecting-ip", "true-client-ip", "forwarded", CLIENT_IP_HEADER];
+const MAX_BODY = 64 * 1024;
+const MAX_EXTERNAL_BODY = 1024 * 1024;
+/** The caller's address: the socket, or (behind a proxy we run) the last address that proxy added to X-Forwarded-For. */
+export function clientIp(req, trustProxy) {
+    const forwarded = String(req.headers["x-forwarded-for"] ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+    const ip = trustProxy && forwarded.length ? forwarded[forwarded.length - 1] : (req.socket.remoteAddress ?? "");
+    return ip.replace(/^::ffff:/, "");
+}
+function deny(res, status, message) {
+    res.writeHead(status, { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" });
+    res.end(JSON.stringify({ error: message, message }));
+}
+/** Better Auth below `/_wizelens/api/auth/`: our dashboard header on changes, a body limit, and our own client-address header. */
+export function authHandler(auth, trustProxy) {
+    const handler = toNodeHandler(auth);
+    return async (req, res) => {
+        const path = new URL(req.url ?? "/", "http://cloud.local").pathname.slice(AUTH_BASE_PATH.length);
+        const external = EXTERNAL.some((r) => r.test(path));
+        if (!SAFE.has(req.method ?? "GET")) {
+            if (!external && req.headers["x-wizelens-client"] !== "dashboard")
+                return deny(res, 403, "Missing the X-WizeLens-Client header.");
+            const length = Number(req.headers["content-length"] ?? 0);
+            if (req.headers["transfer-encoding"] || length > (external ? MAX_EXTERNAL_BODY : MAX_BODY))
+                return deny(res, 413, "The body is too large.");
+        }
+        const ip = clientIp(req, trustProxy);
+        for (const h of IP_HEADERS)
+            delete req.headers[h];
+        req.headers[CLIENT_IP_HEADER] = ip;
+        await handler(req, res);
+    };
+}
+//# sourceMappingURL=bridge.js.map

package/dist/auth/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/auth/bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACjD,mIAAmI;AACnI,MAAM,QAAQ,GAAa,CAAC,qBAAqB,EAAE,6BAA6B,EAAE,sCAAsC,CAAC,CAAC;AAC1H,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AACzH,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC,yHAAyH;AACzH,MAAM,UAAU,QAAQ,CAAC,GAAoB,EAAE,UAAmB;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/G,MAAM,EAAE,GAAG,UAAU,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAChH,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe;IAChE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1G,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,kIAAkI;AAClI,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,UAAmB;IAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACxE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;YAClI,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/crypto.d.ts

@@ -1,10 +1,5 @@
-/** "scrypt$<salt>$<hash>", both base64url. */
-export declare function hashPassword(password: string): Promise<string>;
-export declare function checkPassword(password: string, stored: string): Promise<boolean>;
 /** Kinds of secret tokens. The prefix tells a person what a token is for. */
 export declare const TOKEN_PREFIX: {
-    readonly session: "wl_s_";
-    readonly invite: "wl_inv_";
     readonly ingest: "wl_ik_";
     readonly read: "wl_rk_";
     readonly share: "wl_sh_";

package/dist/auth/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAOA,8CAA8C;AAC9C,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpE;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMtF;AAED,6EAA6E;AAC7E,eAAO,MAAM,YAAY;aAAK,OAAO,EAAE,OAAO;aAAE,MAAM,EAAE,SAAS;aAAE,MAAM,EAAE,QAAQ;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,QAAQ;CAAW,CAAC;AAChI,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC;AAElD,mDAAmD;AACnD,eAAO,MAAM,QAAQ,SAAU,SAAS,KAAG,MAAyE,CAAC;AAErH,eAAO,MAAM,SAAS,UAAW,MAAM,KAAG,MAA0D,CAAC;AAErG,eAAO,MAAM,KAAK,QAAO,MAAsB,CAAC;AAEhD,iFAAiF;AACjF,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAMX,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAIA,6EAA6E;AAC7E,eAAO,MAAM,YAAY;aAAK,MAAM,EAAE,QAAQ;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,QAAQ;CAAW,CAAC;AAC3F,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC;AAElD,mDAAmD;AACnD,eAAO,MAAM,QAAQ,SAAU,SAAS,KAAG,MAAyE,CAAC;AAErH,eAAO,MAAM,SAAS,UAAW,MAAM,KAAG,MAA0D,CAAC;AAErG,eAAO,MAAM,KAAK,QAAO,MAAsB,CAAC;AAEhD,iFAAiF;AACjF,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAMX,CAAC"}

package/dist/auth/crypto.js

@@ -1,24 +1,7 @@
-import { createHash, randomBytes, randomUUID, scrypt, timingSafeEqual } from "node:crypto";
-import { promisify } from "node:util";
-const scryptAsync = promisify(scrypt);
-const SCRYPT = { N: 16384, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
-const KEY_LENGTH = 32;
-/** "scrypt$<salt>$<hash>", both base64url. */
-export async function hashPassword(password) {
-    const salt = randomBytes(16);
-    const key = await scryptAsync(password, salt, KEY_LENGTH, SCRYPT);
-    return `scrypt$${salt.toString("base64url")}$${key.toString("base64url")}`;
-}
-export async function checkPassword(password, stored) {
-    const [kind, salt, hash] = stored.split("$");
-    if (kind !== "scrypt" || !salt || !hash)
-        return false;
-    const expected = Buffer.from(hash, "base64url");
-    const key = await scryptAsync(password, Buffer.from(salt, "base64url"), expected.length, SCRYPT);
-    return key.length === expected.length && timingSafeEqual(key, expected);
-}
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+// Our own secrets: data-plane keys and share links. Passwords, sessions, and invites are Better Auth's.
 /** Kinds of secret tokens. The prefix tells a person what a token is for. */
-export const TOKEN_PREFIX = { session: "wl_s_", invite: "wl_inv_", ingest: "wl_ik_", read: "wl_rk_", share: "wl_sh_" };
+export const TOKEN_PREFIX = { ingest: "wl_ik_", read: "wl_rk_", share: "wl_sh_" };
 /** A new random token. Only its hash is stored. */
 export const newToken = (kind) => `${TOKEN_PREFIX[kind]}${randomBytes(24).toString("base64url")}`;
 export const hashToken = (token) => createHash("sha256").update(token).digest("hex");

package/dist/auth/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAyF,CAAC;AAC9H,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAClE,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAClE,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAc;IAClE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAW,CAAC;AAGhI,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAe,EAAU,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAErH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,UAAU,EAAE,CAAC;AAEhD,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI;KACD,WAAW,EAAE;KACb,SAAS,CAAC,MAAM,CAAC;KACjB,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;KAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;KACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,wGAAwG;AAExG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAW,CAAC;AAG3F,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAe,EAAU,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAErH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,UAAU,EAAE,CAAC;AAEhD,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI;KACD,WAAW,EAAE;KACb,SAAS,CAAC,MAAM,CAAC;KACjB,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;KAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;KACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC"}

package/dist/auth/delete-user.d.ts

@@ -0,0 +1,16 @@
+import type { Db, Queryable } from "../db/db.js";
+export interface OwnedOrg {
+    id: string;
+    name: string;
+    owners: number;
+    members: number;
+}
+/** Organizations the person owns, with how many owners and members each has. */
+export declare const ownedOrgs: (q: Queryable, userId: string) => Promise<OwnedOrg[]>;
+/** Organizations that would be left without an owner: they block deleting the account. */
+export declare const blockingOrgs: (orgs: readonly OwnedOrg[]) => OwnedOrg[];
+/** Before an account goes: refuse while it is the last owner of a team; delete the organizations it is alone in, with their data. */
+export declare function beforeDeleteUser(db: Db): (user: {
+    id: string;
+}) => Promise<void>;
+//# sourceMappingURL=delete-user.d.ts.map

package/dist/auth/delete-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-user.d.ts","sourceRoot":"","sources":["../../src/auth/delete-user.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,gFAAgF;AAChF,eAAO,MAAM,SAAS,MAAO,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,QAAQ,EAAE,CAOxE,CAAC;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,YAAY,SAAU,SAAS,QAAQ,EAAE,eAAwD,CAAC;AAE/G,qIAAqI;AACrI,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE,UACjB;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,IAAI,CAAC,CAMnD"}

package/dist/auth/delete-user.js

@@ -0,0 +1,21 @@
+import { APIError } from "better-auth/api";
+import { deleteOrgEverything } from "../repo/orgs.js";
+/** Organizations the person owns, with how many owners and members each has. */
+export const ownedOrgs = (q, userId) => q.query(`SELECT o.id, o.name,
+       (SELECT count(*)::int FROM members x WHERE x.org_id = o.id AND x.role = 'owner') AS owners,
+       (SELECT count(*)::int FROM members x WHERE x.org_id = o.id) AS members
+     FROM members m JOIN orgs o ON o.id = m.org_id WHERE m.user_id = $1 AND m.role = 'owner' ORDER BY o.name`, [userId]);
+/** Organizations that would be left without an owner: they block deleting the account. */
+export const blockingOrgs = (orgs) => orgs.filter((o) => o.owners === 1 && o.members > 1);
+/** Before an account goes: refuse while it is the last owner of a team; delete the organizations it is alone in, with their data. */
+export function beforeDeleteUser(db) {
+    return async (user) => {
+        const orgs = await ownedOrgs(db, user.id);
+        const blocked = blockingOrgs(orgs);
+        if (blocked.length)
+            throw new APIError("BAD_REQUEST", { message: `Make someone else an owner of ${blocked.map((o) => o.name).join(", ")} first, or delete it.` });
+        for (const o of orgs.filter((x) => x.members === 1))
+            await db.tx((q) => deleteOrgEverything(q, o.id));
+    };
+}
+//# sourceMappingURL=delete-user.js.map