@wizeworks/lens-cloud 0.3.0-alpha.1 → 0.3.0-alpha.3

package/dist/auth/sso.d.ts

@@ -0,0 +1,21 @@
+import type { BetterAuthPlugin } from "better-auth";
+import type { AuthDeps } from "./deps.js";
+/** The DNS record that proves a domain: `_wizelens-sso-<providerId>.<domain>` TXT `<token>`. */
+export declare const SSO_TOKEN_PREFIX = "wizelens-sso";
+interface Finder {
+    findOne<T>(a: {
+        model: string;
+        where: {
+            field: string;
+            value: string;
+        }[];
+    }): Promise<T | null>;
+}
+/** The SSO provider behind a new account, when Better Auth makes it from a single sign-on. */
+export declare function ssoProviderOf(source: unknown): string | undefined;
+/** True when an organization's provider has a proven domain and the email is at exactly that domain. */
+export declare function ssoTrusts(db: Finder, providerId: string, email: string): Promise<boolean>;
+/** Organization SSO with OIDC or SAML. Sign-in works once the domain is proven in DNS; new people join that organization as members. */
+export declare function ssoPlugin(deps: AuthDeps): BetterAuthPlugin;
+export {};
+//# sourceMappingURL=sso.d.ts.map

package/dist/auth/sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.d.ts","sourceRoot":"","sources":["../../src/auth/sso.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,gGAAgG;AAChG,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,UAAU,MAAM;IACd,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAChG;AAQD,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGjE;AAED,wGAAwG;AACxG,wBAAsB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK/F;AAED,wIAAwI;AACxI,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,CAc1D"}

package/dist/auth/sso.js

@@ -0,0 +1,35 @@
+import { sso } from "@better-auth/sso";
+import { audit } from "../repo/audit.js";
+import { ssoSchema } from "./schema-names.js";
+/** The DNS record that proves a domain: `_wizelens-sso-<providerId>.<domain>` TXT `<token>`. */
+export const SSO_TOKEN_PREFIX = "wizelens-sso";
+/** The SSO provider behind a new account, when Better Auth makes it from a single sign-on. */
+export function ssoProviderOf(source) {
+    const s = source;
+    return s?.method?.startsWith("sso-") && typeof s.sso?.providerId === "string" ? s.sso.providerId : undefined;
+}
+/** True when an organization's provider has a proven domain and the email is at exactly that domain. */
+export async function ssoTrusts(db, providerId, email) {
+    const p = await db.findOne({ model: "ssoProvider", where: [{ field: "providerId", value: providerId }] });
+    const at = email.trim().toLowerCase().split("@")[1] ?? "";
+    const domains = (p?.domain ?? "").toLowerCase().split(",").map((d) => d.trim());
+    return !!p?.organizationId && p.domainVerified === true && !!at && domains.includes(at);
+}
+/** Organization SSO with OIDC or SAML. Sign-in works once the domain is proven in DNS; new people join that organization as members. */
+export function ssoPlugin(deps) {
+    return sso({
+        schema: ssoSchema,
+        providersLimit: 20,
+        domainVerification: { enabled: true, tokenPrefix: SSO_TOKEN_PREFIX },
+        organizationProvisioning: {
+            defaultRole: "member",
+            getRole: async ({ user, provider }) => {
+                if (provider.organizationId)
+                    await audit(deps.db, provider.organizationId, `user:${user.id}`, "member.join", { via: "sso", providerId: provider.providerId }, Date.now());
+                return "member";
+            },
+        },
+        saml: { enableInResponseToValidation: true, allowIdpInitiated: false, requireTimestamps: true, clockSkew: 2 * 60_000, algorithms: { onDeprecated: "reject" } },
+    });
+}
+//# sourceMappingURL=sso.js.map

package/dist/auth/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../src/auth/sso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAY/C,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,MAAM,CAAC,GAAG,MAAyE,CAAC;IACpF,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/G,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAU,EAAE,UAAkB,EAAE,KAAa;IAC3E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACvH,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,wIAAwI;AACxI,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,OAAO,GAAG,CAAC;QACT,MAAM,EAAE,SAAS;QACjB,cAAc,EAAE,EAAE;QAClB,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE;QACpE,wBAAwB,EAAE;YACxB,WAAW,EAAE,QAAQ;YACrB,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACpC,IAAI,QAAQ,CAAC,cAAc;oBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,cAAc,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC1K,OAAO,QAAQ,CAAC;YAClB,CAAC;SACF;QACD,IAAI,EAAE,EAAE,4BAA4B,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE;KAC/J,CAAgC,CAAC;AACpC,CAAC"}

package/dist/auth/wire.d.ts

@@ -0,0 +1,16 @@
+import type { CloudConfig } from "../config.js";
+import type { Db } from "../db/db.js";
+import type { Mailer } from "../mail/mailer.js";
+import { type WizeAuth } from "./auth.js";
+import { type AuthSecret } from "./secret.js";
+export interface AuthWiring {
+    /** Build Better Auth for the address the cloud listens on. */
+    start(listenUrl: string): WizeAuth;
+    /** The first account's link while no account exists, else null. */
+    setupLink(): string | null;
+    /** The auth secrets, newest first. Unsubscribe links are signed with them too. */
+    secrets: AuthSecret[];
+}
+/** Secrets, the setup gate, and the rest Better Auth needs; Better Auth itself starts once the address is known. */
+export declare function wireAuth(db: Db, config: CloudConfig, mailer: Mailer): Promise<AuthWiring>;
+//# sourceMappingURL=wire.d.ts.map

package/dist/auth/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/auth/wire.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,aAAa,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IACnC,mEAAmE;IACnE,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,kFAAkF;IAClF,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAgBD,oHAAoH;AACpH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2B/F"}

package/dist/auth/wire.js

@@ -0,0 +1,47 @@
+import { randomBytes } from "node:crypto";
+import { userCount } from "../repo/users.js";
+import { createAuth } from "./auth.js";
+import { clearAuthEnv, resolveSecrets } from "./secret.js";
+/** The one-time setup token: from the config, or new. Gone once the first account exists. */
+async function setupGate(db, configured) {
+    let open = (await userCount(db)) === 0;
+    const token = configured ?? randomBytes(24).toString("base64url");
+    return { token: () => (open ? token : null), done: () => void (open = false) };
+}
+/** The public origin, plus 127.0.0.1 next to localhost (or the reverse) when the cloud runs on its default local address. */
+function originsOf(publicUrl, local) {
+    const origin = new URL(publicUrl).origin;
+    if (!local)
+        return [origin];
+    return [origin, origin.includes("//localhost") ? origin.replace("//localhost", "//127.0.0.1") : origin.replace("//127.0.0.1", "//localhost")];
+}
+/** Secrets, the setup gate, and the rest Better Auth needs; Better Auth itself starts once the address is known. */
+export async function wireAuth(db, config, mailer) {
+    clearAuthEnv();
+    const [secrets, setup] = await Promise.all([resolveSecrets(db, config.authSecret), setupGate(db, config.setupToken)]);
+    let base = config.publicUrl;
+    return {
+        secrets,
+        start: (listenUrl) => {
+            base = config.publicUrl ?? listenUrl.replace("//127.0.0.1", "//localhost");
+            const deps = {
+                db,
+                publicUrl: new URL(base).origin,
+                trustedOrigins: originsOf(base, !config.publicUrl),
+                ssoOrigins: config.ssoOrigins,
+                secrets,
+                signup: config.signup,
+                mailer,
+                setup,
+                checkPwned: config.checkPwnedPasswords ?? db.kind === "postgres",
+                retentionDays: config.retentionDays,
+            };
+            return createAuth(deps);
+        },
+        setupLink: () => {
+            const token = setup.token();
+            return token && base ? `${base}/_wizelens/#/setup?token=${token}` : null;
+        },
+    };
+}
+//# sourceMappingURL=wire.js.map

package/dist/auth/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../src/auth/wire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAmB,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAW5E,6FAA6F;AAC7F,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,UAA8B;IAC7D,IAAI,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,6HAA6H;AAC7H,SAAS,SAAS,CAAC,SAAiB,EAAE,KAAc;IAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAChJ,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,MAAmB,EAAE,MAAc;IACxE,YAAY,EAAE,CAAC;IACf,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,OAAO;QACL,OAAO;QACP,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE;YACnB,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAC3E,MAAM,IAAI,GAAa;gBACrB,EAAE;gBACF,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM;gBAC/B,cAAc,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;gBAClD,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO;gBACP,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM;gBACN,KAAK;gBACL,UAAU,EAAE,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU;gBAChE,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CAAC;YACF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,4BAA4B,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/changes.d.ts

@@ -0,0 +1,15 @@
+type Listener = () => void;
+/** Who listens to which project, and the last time each project was announced. */
+export declare class Changes {
+    #private;
+    /** Call `fn` when the project gets new data. Returns the function that stops it. */
+    subscribe(projectId: string, fn: Listener): () => void;
+    /** Call `fn` for every announced project (caches that drop the project's entries). */
+    onAny(fn: (projectId: string) => void): void;
+    /** The project has new data. Close calls merge into one, sent `GAP_MS` after the last. */
+    emit(projectId: string, now?: number): void;
+    /** How many dashboards listen to a project. */
+    count(projectId: string): number;
+}
+export {};
+//# sourceMappingURL=changes.d.ts.map

package/dist/changes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes.d.ts","sourceRoot":"","sources":["../src/changes.ts"],"names":[],"mappings":"AAIA,KAAK,QAAQ,GAAG,MAAM,IAAI,CAAC;AAE3B,kFAAkF;AAClF,qBAAa,OAAO;;IAMlB,oFAAoF;IACpF,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,MAAM,IAAI,CAOrD;IAED,sFAAsF;IACtF,KAAK,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAE3C;IAED,0FAA0F;IAC1F,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI,CAM9C;IAED,+CAA+C;IAC/C,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/B;CAOF"}

package/dist/changes.js

@@ -0,0 +1,45 @@
+// New data per project, for open dashboards: settling announces each project it wrote, at most every `GAP_MS`.
+const GAP_MS = 2_000;
+/** Who listens to which project, and the last time each project was announced. */
+export class Changes {
+    #listeners = new Map();
+    #last = new Map();
+    #pending = new Set();
+    #any = [];
+    /** Call `fn` when the project gets new data. Returns the function that stops it. */
+    subscribe(projectId, fn) {
+        const set = this.#listeners.get(projectId) ?? new Set();
+        this.#listeners.set(projectId, set.add(fn));
+        return () => {
+            set.delete(fn);
+            if (!set.size)
+                this.#listeners.delete(projectId);
+        };
+    }
+    /** Call `fn` for every announced project (caches that drop the project's entries). */
+    onAny(fn) {
+        this.#any.push(fn);
+    }
+    /** The project has new data. Close calls merge into one, sent `GAP_MS` after the last. */
+    emit(projectId, now = Date.now()) {
+        const wait = (this.#last.get(projectId) ?? 0) + GAP_MS - now;
+        if (wait <= 0)
+            return this.#send(projectId, now);
+        if (this.#pending.has(projectId))
+            return;
+        this.#pending.add(projectId);
+        setTimeout(() => (this.#pending.delete(projectId), this.#send(projectId, Date.now())), wait).unref();
+    }
+    /** How many dashboards listen to a project. */
+    count(projectId) {
+        return this.#listeners.get(projectId)?.size ?? 0;
+    }
+    #send(projectId, now) {
+        this.#last.set(projectId, now);
+        for (const fn of this.#any)
+            fn(projectId);
+        for (const fn of this.#listeners.get(projectId) ?? [])
+            fn();
+    }
+}
+//# sourceMappingURL=changes.js.map

package/dist/changes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes.js","sourceRoot":"","sources":["../src/changes.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAE/G,MAAM,MAAM,GAAG,KAAK,CAAC;AAIrB,kFAAkF;AAClF,MAAM,OAAO,OAAO;IACT,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,IAAI,GAAoC,EAAE,CAAC;IAEpD,oFAAoF;IACpF,SAAS,CAAC,SAAiB,EAAE,EAAY;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,OAAO,GAAG,EAAE;YACV,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC;IACJ,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,EAA+B;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,0FAA0F;IAC1F,IAAI,CAAC,SAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACtC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC;QAC7D,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACvG,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,SAAiB;QACrB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAiB,EAAE,GAAW;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI;YAAE,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;YAAE,EAAE,EAAE,CAAC;IAC9D,CAAC;CACF"}

package/dist/cli-args.d.ts

@@ -1,5 +1,5 @@
 import type { CloudOptions } from "./config.js";
-export declare const USAGE = "wizelens-cloud: the WizeLens service for many teams.\n\nUsage: wizelens-cloud [options]\n\n  --database <url>          postgres://..., pglite:<folder>, or memory.\n                            Default pglite:./.wizelens-cloud.          (DATABASE_URL)\n  --port <n>                Default 5970.                               (PORT)\n  --host <addr>             Default 0.0.0.0.                            (WIZELENS_CLOUD_HOST)\n  --public-url <url>        The address people use, for links.          (WIZELENS_CLOUD_PUBLIC_URL)\n  --signup <invite|open>    Who can make an account. Default invite.    (WIZELENS_CLOUD_SIGNUP)\n  --retention-days <n>      Default for new organizations. Default 30.  (WIZELENS_CLOUD_RETENTION_DAYS)\n  --allow-private-webhooks  Let alert webhooks reach private addresses. (WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1)\n  --help                    Show this help.\n";
+export declare const USAGE = "wizelens-cloud: the WizeLens service for many teams.\n\nUsage: wizelens-cloud [options]\n\n  --database <url>          postgres://..., pglite:<folder>, or memory.\n                            Default pglite:./.wizelens-cloud.          (DATABASE_URL)\n  --clickhouse <url>        Scale mode: telemetry in ClickHouse,        (WIZELENS_CLOUD_CLICKHOUSE_URL)\n                            http://user:pass@host:8123/database.\n  --port <n>                Default 5970.                               (PORT)\n  --host <addr>             Default 0.0.0.0.                            (WIZELENS_CLOUD_HOST)\n  --public-url <url>        The address people use, for links.          (WIZELENS_CLOUD_PUBLIC_URL)\n  --signup <invite|open>    Who can make an account. Default invite.    (WIZELENS_CLOUD_SIGNUP)\n  --retention-days <n>      Default for new organizations. Default 30.  (WIZELENS_CLOUD_RETENTION_DAYS)\n  --ingest-per-minute <n>   Ingest calls per key per minute. Default    (WIZELENS_CLOUD_INGEST_PER_MINUTE)\n                            1200.\n  --allow-private-webhooks  Let alert webhooks reach private addresses. (WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1)\n  --auth-secret <text>      Signs sessions, encrypts 2FA secrets. 32+   (WIZELENS_CLOUD_AUTH_SECRET)\n                            characters; \"2:new,1:old\" rotates.\n                            Required with Postgres.\n  --resend-api-key <key>    Outgoing mail through Resend (re_...).      (WIZELENS_CLOUD_RESEND_API_KEY)\n                            Needs --public-url.\n  --resend-webhook-secret <s>  The Resend webhook's whsec_ secret:     (WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET)\n                            bounces and complaints stop later mail.\n                            Webhook URL: <public-url>/_wizelens/api/mail/resend\n  --smtp-url <url>          Or mail over SMTP: smtp://user:pass@host:587 (WIZELENS_CLOUD_SMTP_URL)\n                            or smtps://...:465. Needs --public-url.\n  --mail-from <address>     Sender, e.g. \"WizeLens <a@b.com>\".          (WIZELENS_CLOUD_MAIL_FROM)\n  --mail-reply-to <address> Where replies go, e.g. \"hello@b.com\".       (WIZELENS_CLOUD_MAIL_REPLY_TO)\n  --trust-proxy             Read the client address from the last       (WIZELENS_CLOUD_TRUST_PROXY=1)\n                            X-Forwarded-For entry (your own proxy only).\n  --setup-token <text>      The first account's token. Default: random, (WIZELENS_CLOUD_SETUP_TOKEN)\n                            printed at start while no account exists.\n  --check-pwned-passwords   Refuse breached passwords. Default on with  (WIZELENS_CLOUD_CHECK_PWNED=1|0)\n  --no-check-pwned-passwords Postgres, off with PGlite.\n  --sso-origins <list>      Identity provider origins for OIDC single   (WIZELENS_CLOUD_SSO_ORIGINS)\n                            sign-on, comma separated, for example\n                            https://acme.okta.com. SAML needs none.\n  --help                    Show this help.\n";
 /** Options from the command line, then from the environment. */
 export declare function optionsFromArgs(argv: string[], env: NodeJS.ProcessEnv): CloudOptions | "help";
 //# sourceMappingURL=cli-args.d.ts.map

package/dist/cli-args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAE5D,eAAO,MAAM,KAAK,83BAajB,CAAC;AAKF,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,YAAY,GAAG,MAAM,CAwB7F"}
+{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAE5D,eAAO,MAAM,KAAK,65FAsCjB,CAAC;AAmCF,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,YAAY,GAAG,MAAM,CAwB7F"}

package/dist/cli-args.js

@@ -5,41 +5,93 @@ Usage: wizelens-cloud [options]
 
   --database <url>          postgres://..., pglite:<folder>, or memory.
                             Default pglite:./.wizelens-cloud.          (DATABASE_URL)
+  --clickhouse <url>        Scale mode: telemetry in ClickHouse,        (WIZELENS_CLOUD_CLICKHOUSE_URL)
+                            http://user:pass@host:8123/database.
   --port <n>                Default 5970.                               (PORT)
   --host <addr>             Default 0.0.0.0.                            (WIZELENS_CLOUD_HOST)
   --public-url <url>        The address people use, for links.          (WIZELENS_CLOUD_PUBLIC_URL)
   --signup <invite|open>    Who can make an account. Default invite.    (WIZELENS_CLOUD_SIGNUP)
   --retention-days <n>      Default for new organizations. Default 30.  (WIZELENS_CLOUD_RETENTION_DAYS)
+  --ingest-per-minute <n>   Ingest calls per key per minute. Default    (WIZELENS_CLOUD_INGEST_PER_MINUTE)
+                            1200.
   --allow-private-webhooks  Let alert webhooks reach private addresses. (WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1)
+  --auth-secret <text>      Signs sessions, encrypts 2FA secrets. 32+   (WIZELENS_CLOUD_AUTH_SECRET)
+                            characters; "2:new,1:old" rotates.
+                            Required with Postgres.
+  --resend-api-key <key>    Outgoing mail through Resend (re_...).      (WIZELENS_CLOUD_RESEND_API_KEY)
+                            Needs --public-url.
+  --resend-webhook-secret <s>  The Resend webhook's whsec_ secret:     (WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET)
+                            bounces and complaints stop later mail.
+                            Webhook URL: <public-url>/_wizelens/api/mail/resend
+  --smtp-url <url>          Or mail over SMTP: smtp://user:pass@host:587 (WIZELENS_CLOUD_SMTP_URL)
+                            or smtps://...:465. Needs --public-url.
+  --mail-from <address>     Sender, e.g. "WizeLens <a@b.com>".          (WIZELENS_CLOUD_MAIL_FROM)
+  --mail-reply-to <address> Where replies go, e.g. "hello@b.com".       (WIZELENS_CLOUD_MAIL_REPLY_TO)
+  --trust-proxy             Read the client address from the last       (WIZELENS_CLOUD_TRUST_PROXY=1)
+                            X-Forwarded-For entry (your own proxy only).
+  --setup-token <text>      The first account's token. Default: random, (WIZELENS_CLOUD_SETUP_TOKEN)
+                            printed at start while no account exists.
+  --check-pwned-passwords   Refuse breached passwords. Default on with  (WIZELENS_CLOUD_CHECK_PWNED=1|0)
+  --no-check-pwned-passwords Postgres, off with PGlite.
+  --sso-origins <list>      Identity provider origins for OIDC single   (WIZELENS_CLOUD_SSO_ORIGINS)
+                            sign-on, comma separated, for example
+                            https://acme.okta.com. SAML needs none.
   --help                    Show this help.
 `;
 const int = (v) => (v && /^\d+$/.test(v) ? Number(v) : undefined);
 const signupOf = (v) => (v === "open" || v === "invite" ? v : undefined);
+const text = (...v) => v.find((x) => x !== undefined && x !== "");
+const list = (v) => v?.split(",").map((s) => s.trim()).filter(Boolean);
+const flag = (v) => (v === "1" || v === "true" ? true : v === "0" || v === "false" ? false : undefined);
+const OPTIONS = {
+    database: { type: "string" },
+    clickhouse: { type: "string" },
+    port: { type: "string" },
+    host: { type: "string" },
+    "public-url": { type: "string" },
+    signup: { type: "string" },
+    "retention-days": { type: "string" },
+    "ingest-per-minute": { type: "string" },
+    "allow-private-webhooks": { type: "boolean" },
+    "auth-secret": { type: "string" },
+    "smtp-url": { type: "string" },
+    "resend-api-key": { type: "string" },
+    "resend-webhook-secret": { type: "string" },
+    "mail-from": { type: "string" },
+    "mail-reply-to": { type: "string" },
+    "trust-proxy": { type: "boolean" },
+    "setup-token": { type: "string" },
+    "check-pwned-passwords": { type: "boolean" },
+    "no-check-pwned-passwords": { type: "boolean" },
+    "sso-origins": { type: "string" },
+    help: { type: "boolean", short: "h" },
+};
+const pwnedOf = (a, env) => a["no-check-pwned-passwords"] ? false : (a["check-pwned-passwords"] ?? flag(env.WIZELENS_CLOUD_CHECK_PWNED));
 /** Options from the command line, then from the environment. */
 export function optionsFromArgs(argv, env) {
-    const { values: a } = parseArgs({
-        args: argv,
-        options: {
-            database: { type: "string" },
-            port: { type: "string" },
-            host: { type: "string" },
-            "public-url": { type: "string" },
-            signup: { type: "string" },
-            "retention-days": { type: "string" },
-            "allow-private-webhooks": { type: "boolean" },
-            help: { type: "boolean", short: "h" },
-        },
-    });
+    const { values: a } = parseArgs({ args: argv, options: OPTIONS });
     if (a.help)
         return "help";
     return {
         database: a.database ?? env.DATABASE_URL,
+        clickhouseUrl: text(a.clickhouse, env.WIZELENS_CLOUD_CLICKHOUSE_URL),
         port: int(a.port ?? env.PORT),
         host: a.host ?? env.WIZELENS_CLOUD_HOST,
-        publicUrl: a["public-url"] ?? env.WIZELENS_CLOUD_PUBLIC_URL,
+        publicUrl: text(a["public-url"], env.WIZELENS_CLOUD_PUBLIC_URL),
         signup: signupOf(a.signup ?? env.WIZELENS_CLOUD_SIGNUP),
         retentionDays: int(a["retention-days"] ?? env.WIZELENS_CLOUD_RETENTION_DAYS),
+        ingestPerMinute: int(a["ingest-per-minute"] ?? env.WIZELENS_CLOUD_INGEST_PER_MINUTE),
         allowPrivateWebhooks: a["allow-private-webhooks"] ?? env.WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS === "1",
+        authSecret: text(a["auth-secret"], env.WIZELENS_CLOUD_AUTH_SECRET),
+        smtpUrl: text(a["smtp-url"], env.WIZELENS_CLOUD_SMTP_URL),
+        resendApiKey: text(a["resend-api-key"], env.WIZELENS_CLOUD_RESEND_API_KEY),
+        resendWebhookSecret: text(a["resend-webhook-secret"], env.WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET),
+        mailFrom: text(a["mail-from"], env.WIZELENS_CLOUD_MAIL_FROM),
+        mailReplyTo: text(a["mail-reply-to"], env.WIZELENS_CLOUD_MAIL_REPLY_TO),
+        trustProxy: a["trust-proxy"] ?? env.WIZELENS_CLOUD_TRUST_PROXY === "1",
+        setupToken: text(a["setup-token"], env.WIZELENS_CLOUD_SETUP_TOKEN),
+        checkPwnedPasswords: pwnedOf(a, env),
+        ssoOrigins: list(text(a["sso-origins"], env.WIZELENS_CLOUD_SSO_ORIGINS)),
     };
 }
 //# sourceMappingURL=cli-args.js.map

package/dist/cli-args.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAapB,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACtF,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAA0B,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAErH,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,GAAsB;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC;QAC9B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACtC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY;QACxC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,mBAAmB;QACvC,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,yBAAyB;QAC3D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,qBAAqB,CAAC;QACvD,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,6BAA6B,CAAC;QAC5E,oBAAoB,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC,qCAAqC,KAAK,GAAG;KACvG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCpB,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACtF,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAA0B,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAyB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1F,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC3F,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE5H,MAAM,OAAO,GAAG;IACd,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3C,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,uBAAuB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5C,0BAA0B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;CAC7B,CAAC;AAEX,MAAM,OAAO,GAAG,CAAC,CAA8E,EAAE,GAAsB,EAAE,EAAE,CACzH,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAE/G,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,GAAsB;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY;QACxC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,6BAA6B,CAAC;QACpE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,mBAAmB;QACvC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,yBAAyB,CAAC;QAC/D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,qBAAqB,CAAC;QACvD,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,6BAA6B,CAAC;QAC5E,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,gCAAgC,CAAC;QACpF,oBAAoB,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC,qCAAqC,KAAK,GAAG;QACtG,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC;QAClE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,uBAAuB,CAAC;QACzD,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,6BAA6B,CAAC;QAC1E,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,GAAG,CAAC,oCAAoC,CAAC;QAC/F,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,wBAAwB,CAAC;QAC5D,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,4BAA4B,CAAC;QACvE,UAAU,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,KAAK,GAAG;QACtE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC;QAClE,mBAAmB,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC;QACpC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/cli.js

@@ -1,7 +1,26 @@
 #!/usr/bin/env node
 import { optionsFromArgs, USAGE } from "./cli-args.js";
 import { CLOUD_VERSION, createCloud } from "./server.js";
+import { copyMain } from "./copy-cli.js";
+function notes(cloud) {
+    const { app } = cloud;
+    const out = [];
+    if (app.db.kind === "pglite")
+        out.push("  Note: PGlite is for trials and tests. Use Postgres for real teams.");
+    if (!app.mailer.live)
+        out.push("  Note: no --resend-api-key or --smtp-url, so emails are written to this log and email addresses are not confirmed.");
+    if (app.mailer.via === "resend" && !app.config.resendWebhookSecret)
+        out.push("  Note: no --resend-webhook-secret, so bounced addresses keep getting mail.");
+    if (app.db.kind === "postgres" && !app.config.publicUrl?.startsWith("https://"))
+        out.push("  Note: set --public-url to an https:// address, so sign-in cookies are Secure.");
+    const setup = cloud.setupLink();
+    if (setup)
+        out.push("", "  No account yet. Open this link to make the first one (it works once):", `  ${setup}`);
+    return out;
+}
 async function main() {
+    if (process.argv[2] === "copy-telemetry")
+        return copyMain(process.argv.slice(3));
     const options = optionsFromArgs(process.argv.slice(2), process.env);
     if (options === "help")
         return void process.stdout.write(USAGE);
@@ -14,9 +33,10 @@ async function main() {
         `  Add-ons     WIZELENS_HUB=${url}  WIZELENS_HUB_TOKEN=<ingest key>`,
         `  OTLP/HTTP   OTEL_EXPORTER_OTLP_ENDPOINT=${url}  (header Authorization=Bearer <ingest key>)`,
         `  Database    ${db}`,
+        `  Telemetry   ${cloud.app.telemetry.kind === "clickhouse" ? "ClickHouse" : "the database above"}`,
+        `  Mail        ${{ resend: "Resend", smtp: "SMTP", test: "test sender", log: "log only" }[cloud.app.mailer.via]}`,
+        ...notes(cloud),
     ].join("\n"));
-    if (cloud.app.db.kind === "pglite")
-        console.info("  Note: PGlite is for trials and tests. Use Postgres for real teams.");
     const stop = () => void cloud.close().then(() => process.exit(0));
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEzD,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC;IACnG,OAAO,CAAC,IAAI,CACV;QACE,kBAAkB,aAAa,EAAE;QACjC,iBAAiB,GAAG,aAAa;QACjC,8BAA8B,GAAG,mCAAmC;QACpE,6CAA6C,GAAG,8CAA8C;QAC9F,iBAAiB,EAAE,EAAE;KACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACzH,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAc,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,SAAS,KAAK,CAAC,KAAY;IACzB,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IAC/G,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,qHAAqH,CAAC,CAAC;IACtJ,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB;QAAE,GAAG,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAC5J,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC7K,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,yEAAyE,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC;IACjH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC;IACnG,OAAO,CAAC,IAAI,CACV;QACE,kBAAkB,aAAa,EAAE;QACjC,iBAAiB,GAAG,aAAa;QACjC,8BAA8B,GAAG,mCAAmC;QACpE,6CAA6C,GAAG,8CAA8C;QAC9F,iBAAiB,EAAE,EAAE;QACrB,iBAAiB,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,EAAE;QAClG,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QACjH,GAAG,KAAK,CAAC,KAAK,CAAC;KAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/config.d.ts

@@ -1,7 +1,10 @@
+import type { Mail } from "./mail/mailer.js";
 export type SignupMode = "open" | "invite";
 export interface CloudOptions {
     /** "postgres://...", "pglite:<folder>", or "memory". Default "pglite:./.wizelens-cloud". */
     database?: string;
+    /** Scale mode: telemetry in ClickHouse, `http(s)://user:password@host:8123/database`. Accounts stay in `database`. */
+    clickhouseUrl?: string;
     /** Default 5970. 0 picks a free port. */
     port?: number;
     /** Default "0.0.0.0". */
@@ -18,16 +21,39 @@ export interface CloudOptions {
     alertIntervalMs?: number;
     /** Let alert webhooks call private and local addresses, and plain http. For self-hosting on a private network. Default false. */
     allowPrivateWebhooks?: boolean;
+    /** Outgoing mail: "smtp://user:pass@host:587" (STARTTLS) or "smtps://user:pass@host:465". Without it, mail is written to the log. */
+    smtpUrl?: string;
+    /** Outgoing mail through the Resend API (a `re_` key). Used in place of `smtpUrl`. */
+    resendApiKey?: string;
+    /** The `whsec_` signing secret of the Resend webhook, so bounces and spam complaints reach the suppression list. */
+    resendWebhookSecret?: string;
+    /** The sender of every email, for example "WizeLens <alerts@example.com>". */
+    mailFrom?: string;
+    /** Where replies go, for example "hello@example.com", when the sender has no inbox. Default: none (replies go to the sender). */
+    mailReplyTo?: string;
+    /** Take the client address from X-Forwarded-For (behind a proxy you run). Default false. */
+    trustProxy?: boolean;
+    /** Signs sessions and encrypts 2FA secrets: 32+ random characters, or "2:new,1:old" to rotate. Required with Postgres. */
+    authSecret?: string;
+    /** The one-time token the first account needs. Default: a new random one, printed at start while no account exists. */
+    setupToken?: string;
+    /** Refuse passwords found in known breaches (sends a 5-character hash prefix to api.pwnedpasswords.com). Default: on with Postgres. */
+    checkPwnedPasswords?: boolean;
+    /** Identity provider origins for OIDC single sign-on, for example https://acme.okta.com. The cloud fetches OIDC settings only from these. */
+    ssoOrigins?: string[];
     redactKeys?: string[];
     uiDir?: string;
-    /** For tests: the clock and the HTTP client alerts use. */
+    /** For tests: the clock, the HTTP client alerts use, and a mail sender in place of SMTP. */
     now?: () => number;
     fetch?: typeof fetch;
+    sendMail?: (mail: Mail) => Promise<void>;
+    /** For tests: false keeps background jobs off, so a test runs them itself. Default true. */
+    jobs?: boolean;
 }
-export type CloudConfig = Required<Omit<CloudOptions, "uiDir" | "publicUrl">> & {
-    uiDir: string | undefined;
-    publicUrl: string | undefined;
+type Optional = "uiDir" | "clickhouseUrl" | "publicUrl" | "smtpUrl" | "resendApiKey" | "resendWebhookSecret" | "mailReplyTo" | "sendMail" | "authSecret" | "setupToken" | "checkPwnedPasswords";
+export type CloudConfig = Required<Omit<CloudOptions, Optional>> & Pick<CloudOptions, Optional> & {
     secureCookies: boolean;
 };
 export declare function resolveConfig(o?: CloudOptions): CloudConfig;
+export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iIAAiI;IACjI,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAErK,wBAAgB,aAAa,CAAC,CAAC,GAAE,YAAiB,GAAG,WAAW,CAiB/D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iIAAiI;IACjI,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qIAAqI;IACrI,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oHAAoH;IACpH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iIAAiI;IACjI,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0HAA0H;IAC1H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uHAAuH;IACvH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uIAAuI;IACvI,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,6IAA6I;IAC7I,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,KAAK,QAAQ,GAAG,OAAO,GAAG,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,GAAG,qBAAqB,GAAG,aAAa,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,qBAAqB,CAAC;AAChM,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAqB7H,wBAAgB,aAAa,CAAC,CAAC,GAAE,YAAiB,GAAG,WAAW,CA+B/D"}

package/dist/config.js

@@ -1,7 +1,32 @@
 import { DEFAULT_REDACT_KEYS } from "@wizeworks/lens-core";
+/** Mail links must use the public address: a link built from the request's Host header could point anywhere. */
+function checkMail(o) {
+    if ((o.smtpUrl || o.resendApiKey) && !o.publicUrl)
+        throw new Error("Sending mail needs --public-url, so links in emails point at this cloud.");
+    if (o.smtpUrl && o.resendApiKey)
+        throw new Error("Pick one mail service: --resend-api-key or --smtp-url, not both.");
+    if (o.smtpUrl && !/^smtps?:\/\//.test(o.smtpUrl))
+        throw new Error("--smtp-url must start with smtp:// or smtps://.");
+    if (o.resendApiKey && !o.resendApiKey.startsWith("re_"))
+        throw new Error("--resend-api-key must be a Resend API key (it starts with re_).");
+    if (o.resendWebhookSecret && !o.resendWebhookSecret.startsWith("whsec_"))
+        throw new Error("--resend-webhook-secret must start with whsec_.");
+}
+/** Each SSO origin as a bare origin: https, or http on this machine only. */
+function ssoOriginsOf(list) {
+    return list.map((raw) => {
+        const url = URL.canParse(raw) ? new URL(raw) : null;
+        const local = url?.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+        if (!url || (url.protocol !== "https:" && !local) || raw.includes("*"))
+            throw new Error(`--sso-origins: "${raw}" must be an https:// origin, like https://acme.okta.com.`);
+        return url.origin;
+    });
+}
 export function resolveConfig(o = {}) {
+    checkMail(o);
     return {
         database: o.database ?? "pglite:./.wizelens-cloud",
+        clickhouseUrl: o.clickhouseUrl,
         port: o.port ?? 5970,
         host: o.host ?? "0.0.0.0",
         publicUrl: o.publicUrl?.replace(/\/+$/, ""),
@@ -10,6 +35,18 @@ export function resolveConfig(o = {}) {
         ingestPerMinute: o.ingestPerMinute ?? 1200,
         alertIntervalMs: o.alertIntervalMs ?? 60_000,
         allowPrivateWebhooks: o.allowPrivateWebhooks ?? false,
+        smtpUrl: o.smtpUrl,
+        resendApiKey: o.resendApiKey,
+        resendWebhookSecret: o.resendWebhookSecret,
+        mailFrom: o.mailFrom ?? `WizeLens <no-reply@${o.publicUrl ? new URL(o.publicUrl).hostname : "localhost"}>`,
+        mailReplyTo: o.mailReplyTo,
+        trustProxy: o.trustProxy ?? false,
+        sendMail: o.sendMail,
+        jobs: o.jobs ?? true,
+        authSecret: o.authSecret,
+        setupToken: o.setupToken,
+        checkPwnedPasswords: o.checkPwnedPasswords,
+        ssoOrigins: ssoOriginsOf(o.ssoOrigins ?? []),
         redactKeys: o.redactKeys ?? [...DEFAULT_REDACT_KEYS],
         uiDir: o.uiDir,
         now: o.now ?? Date.now,

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAgC3D,MAAM,UAAU,aAAa,CAAC,CAAC,GAAiB,EAAE;IAChD,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,0BAA0B;QAClD,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;QACzB,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;QAC5B,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,EAAE;QACpC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;QAC1C,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,MAAM;QAC5C,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,IAAI,KAAK;QACrD,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,mBAAmB,CAAC;QACpD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK;QACvB,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AA2D3D,gHAAgH;AAChH,SAAS,SAAS,CAAC,CAAe;IAChC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC/I,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC5I,IAAI,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AAC/I,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAAuB;IAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,KAAK,GAAG,GAAG,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,2DAA2D,CAAC,CAAC;QAC3K,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAC,GAAiB,EAAE;IAChD,SAAS,CAAC,CAAC,CAAC,CAAC;IACb,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,0BAA0B;QAClD,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;QACzB,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;QAC5B,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,EAAE;QACpC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;QAC1C,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,MAAM;QAC5C,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,IAAI,KAAK;QACrD,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,sBAAsB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG;QAC1G,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,KAAK;QACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,mBAAmB,CAAC;QACpD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK;QACvB,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/copy-cli.d.ts

@@ -0,0 +1,3 @@
+/** `wizelens-cloud copy-telemetry`: move existing telemetry into ClickHouse, once. `--force`: also into projects ClickHouse has, after the switch. */
+export declare function copyMain(argv: string[]): Promise<void>;
+//# sourceMappingURL=copy-cli.d.ts.map

package/dist/copy-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"copy-cli.d.ts","sourceRoot":"","sources":["../src/copy-cli.ts"],"names":[],"mappings":"AASA,sJAAsJ;AACtJ,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5D"}

package/dist/copy-cli.js

@@ -0,0 +1,24 @@
+import { optionsFromArgs } from "./cli-args.js";
+import { resolveConfig } from "./config.js";
+import { openDb } from "./db/db.js";
+import { migrate } from "./db/migrate.js";
+import { copyTelemetry } from "./telemetry/copy.js";
+import { openTelemetry } from "./telemetry/index.js";
+const USAGE = "Usage: wizelens-cloud copy-telemetry --database <postgres url> --clickhouse <url> [--force]";
+/** `wizelens-cloud copy-telemetry`: move existing telemetry into ClickHouse, once. `--force`: also into projects ClickHouse has, after the switch. */
+export async function copyMain(argv) {
+    const force = argv.includes("--force");
+    const options = optionsFromArgs(argv.filter((a) => a !== "--force"), process.env);
+    if (options === "help" || !options.clickhouseUrl)
+        throw new Error(USAGE);
+    const config = resolveConfig({ ...options, jobs: false });
+    const db = await openDb(config.database);
+    await migrate(db);
+    const to = await openTelemetry(config, db);
+    console.info("Copying telemetry from the database into ClickHouse...");
+    const done = await copyTelemetry(db, to, config.now(), (line) => console.info(line), force);
+    console.info(`Done: ${done.traces} traces and ${done.points} metric points. Start the cloud with --clickhouse; it settles them.`);
+    await to.close();
+    await db.close();
+}
+//# sourceMappingURL=copy-cli.js.map

package/dist/copy-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copy-cli.js","sourceRoot":"","sources":["../src/copy-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,KAAK,GAAG,6FAA6F,CAAC;AAE5G,sJAAsJ;AACtJ,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAc;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAClF,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5F,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,eAAe,IAAI,CAAC,MAAM,qEAAqE,CAAC,CAAC;IAClI,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACjB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/db/db.d.ts

@@ -1,3 +1,4 @@
+import type { BetterAuthOptions } from "better-auth";
 /** Something that runs SQL: the database, or one transaction. Postgres syntax, `$1` parameters. */
 export interface Queryable {
     query<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]>;
@@ -5,14 +6,18 @@ export interface Queryable {
 export interface Db extends Queryable {
     /** Run `fn` in one transaction. It rolls back when `fn` throws. */
     tx<T>(fn: (q: Queryable) => Promise<T>): Promise<T>;
-    /** Run several statements without parameters (migrations). */
+    /** Run `fn` on one connection, outside a transaction (session settings, CREATE INDEX CONCURRENTLY). */
+    session<T>(fn: (q: Queryable) => Promise<T>): Promise<T>;
+    /** Run several statements without parameters (migrations, before anything else uses the database). */
     exec(sql: string): Promise<void>;
     close(): Promise<void>;
     readonly kind: "postgres" | "pglite";
+    /** The same database, for Better Auth. */
+    readonly authDatabase: NonNullable<BetterAuthOptions["database"]>;
 }
 /** A managed Postgres, from a `postgres://` URL. */
 export declare function openPostgres(url: string): Promise<Db>;
-/** Postgres in this process (PGlite): a folder on disk, or memory when `dir` is undefined. For tests and trials. */
+/** PGlite (a folder, or memory), for tests and trials. All queries share one Kysely queue with Better Auth: PGlite has one connection. */
 export declare function openPglite(dir?: string): Promise<Db>;
 /** "postgres://..." opens Postgres; "pglite:<folder>" or "memory" opens PGlite. */
 export declare function openDb(url: string): Promise<Db>;