@wizeworks/lens-cloud 0.3.0-alpha.1 → 0.3.0-alpha.3

package/dist/db/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAGA,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,EAAG,SAAQ,SAAS;IACnC,mEAAmE;IACnE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,8DAA8D;IAC9D,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;CACtC;AAMD,oDAAoD;AACpD,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAwB3D;AAED,oHAAoH;AACpH,wBAAsB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAa1D;AAED,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAK/C"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIrD,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,EAAG,SAAQ,SAAS;IACnC,mEAAmE;IACnE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,uGAAuG;IACvG,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzD,sGAAsG;IACtG,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;CACnE;AAMD,oDAAoD;AACpD,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAiC3D;AAED,0IAA0I;AAC1I,wBAAsB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAqB1D;AAED,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAK/C"}

package/dist/db/db.js

@@ -4,10 +4,11 @@ const wrap = (client) => ({
 /** A managed Postgres, from a `postgres://` URL. */
 export async function openPostgres(url) {
     const { default: pg } = await import("pg");
-    // Times are stored as double precision, so no bigint parsing is needed.
-    const pool = new pg.Pool({ connectionString: url, max: 10 });
+    // Times are double precision (no bigint parsing); the timeouts free connections that a runaway query or a gone client holds.
+    const pool = new pg.Pool({ connectionString: url, max: 10, statement_timeout: 120_000, idle_in_transaction_session_timeout: 60_000 });
     return {
         kind: "postgres",
+        authDatabase: pool,
         ...wrap(pool),
         async tx(fn) {
             const client = await pool.connect();
@@ -25,23 +26,40 @@ export async function openPostgres(url) {
                 client.release();
             }
         },
+        async session(fn) {
+            const client = await pool.connect();
+            try {
+                return await fn(wrap(client));
+            }
+            finally {
+                client.release();
+            }
+        },
         exec: async (sql) => void (await pool.query(sql)),
         close: () => pool.end(),
     };
 }
-/** Postgres in this process (PGlite): a folder on disk, or memory when `dir` is undefined. For tests and trials. */
+/** PGlite (a folder, or memory), for tests and trials. All queries share one Kysely queue with Better Auth: PGlite has one connection. */
 export async function openPglite(dir) {
-    const { PGlite: Lite } = await import("@electric-sql/pglite");
-    const lite = await Lite.create(dir);
-    const q = (runner) => ({
-        query: async (sql, params = []) => (await runner.query(sql, params)).rows,
+    const [{ PGlite }, { pg_trgm }, { Kysely, CompiledQuery }, { PGliteDialect }] = await Promise.all([
+        import("@electric-sql/pglite"),
+        import("@electric-sql/pglite/contrib/pg_trgm"),
+        import("kysely"),
+        import("kysely-pglite-dialect"),
+    ]);
+    const lite = await PGlite.create(dir, { extensions: { pg_trgm } });
+    const kysely = new Kysely({ dialect: new PGliteDialect(lite) });
+    const run = (k) => ({
+        query: async (sql, params = []) => (await k.executeQuery(CompiledQuery.raw(sql, params))).rows,
     });
     return {
         kind: "pglite",
-        ...q(lite),
-        tx: (fn) => lite.transaction((t) => fn(q(t))),
+        authDatabase: { db: kysely, type: "postgres", transaction: true },
+        ...run(kysely),
+        tx: (fn) => kysely.transaction().execute((t) => fn(run(t))),
+        session: (fn) => fn(run(kysely)),
         exec: async (sql) => void (await lite.exec(sql)),
-        close: () => lite.close(),
+        close: () => kysely.destroy(),
     };
 }
 /** "postgres://..." opens Postgres; "pglite:<folder>" or "memory" opens PGlite. */

package/dist/db/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAiBA,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAa,EAAE,CAAC,CAAC;IACtD,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,MAAM,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAW;CACvG,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,GAAG,IAAI,CAAC,IAAI,CAAC;QACb,KAAK,CAAC,EAAE,CAAI,EAAgC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY;IAC3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAW,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,MAA6B,EAAa,EAAE,CAAC,CAAC;QACvD,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,MAAM,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI;KACnG,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,CAAI,EAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oDAAoD,CAAC,CAAC;AACpG,CAAC"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAsBA,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAa,EAAE,CAAC,CAAC;IACtD,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,MAAM,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAW;CACvG,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,6HAA6H;IAC7H,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,CAAC,CAAC;IACtI,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,IAAI;QAClB,GAAG,IAAI,CAAC,IAAI,CAAC;QACb,KAAK,CAAC,EAAE,CAAI,EAAgC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,CAAI,EAAgC;YAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,0IAA0I;AAC1I,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY;IAC3C,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChG,MAAM,CAAC,sBAAsB,CAAC;QAC9B,MAAM,CAAC,sCAAsC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC;QAChB,MAAM,CAAC,uBAAuB,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAAoB,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,CAAC,CAAyC,EAAa,EAAE,CAAC,CAAC;QACrE,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,MAAM,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAI,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;KACxH,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE;QACjE,GAAG,GAAG,CAAC,MAAM,CAAC;QACd,EAAE,EAAE,CAAI,EAAgC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,OAAO,EAAE,CAAI,EAAgC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oDAAoD,CAAC,CAAC;AACpG,CAAC"}

package/dist/db/migrate.d.ts

@@ -1,6 +1,6 @@
 import type { Db } from "./db.js";
 /** Apply every migration not applied yet, each in its own transaction. Returns how many ran. */
 export declare function migrate(db: Db): Promise<number>;
-/** One migration as single statements, so it runs inside a transaction on every driver. */
-export declare const splitStatements: (sql: string) => string[];
+/** One migration as single statements, so it runs inside a transaction on every driver. A `$$ … $$` body (a function) stays whole. */
+export declare function splitStatements(sql: string): string[];
 //# sourceMappingURL=migrate.d.ts.map

package/dist/db/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAGlC,gGAAgG;AAChG,wBAAsB,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAcrD;AAED,2FAA2F;AAC3F,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,MAAM,EAIhC,CAAC"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAGlC,gGAAgG;AAChG,wBAAsB,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAcrD;AAED,sIAAsI;AACtI,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAWrD"}

package/dist/db/migrate.js

@@ -17,9 +17,19 @@ export async function migrate(db) {
     }
     return ran;
 }
-/** One migration as single statements, so it runs inside a transaction on every driver. */
-export const splitStatements = (sql) => sql
-    .split(/;\s*\n/)
-    .map((s) => s.trim().replace(/;$/, ""))
-    .filter(Boolean);
+/** One migration as single statements, so it runs inside a transaction on every driver. A `$$ … $$` body (a function) stays whole. */
+export function splitStatements(sql) {
+    const out = [];
+    let current = "";
+    let quoted = false;
+    for (const line of sql.split("\n")) {
+        current += `${line}\n`;
+        if ((line.match(/\$\$/g)?.length ?? 0) % 2 === 1)
+            quoted = !quoted;
+        if (!quoted && /;\s*$/.test(line))
+            (out.push(current), (current = ""));
+    }
+    out.push(current);
+    return out.map((s) => s.trim().replace(/;$/, "")).filter(Boolean);
+}
 //# sourceMappingURL=migrate.js.map

package/dist/db/migrate.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE3D,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAM;IAClC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAsB,yCAAyC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7H,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAChC,MAAM,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC;gBAAE,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAClF,MAAM,CAAC,CAAC,KAAK,CAAC,uEAAuE,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC,CAAC,CAAC;QACH,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAY,EAAE,CACvD,GAAG;KACA,KAAK,CAAC,QAAQ,CAAC;KACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;KACtC,MAAM,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE3D,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAM;IAClC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAsB,yCAAyC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7H,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAChC,MAAM,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC;gBAAE,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAClF,MAAM,CAAC,CAAC,KAAK,CAAC,uEAAuE,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC,CAAC,CAAC;QACH,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sIAAsI;AACtI,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;QACnE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC"}

package/dist/db/schema-auth.d.ts

@@ -0,0 +1,2 @@
+export declare const AUTH_MIGRATION = "\nALTER TABLE users ADD COLUMN email_verified BOOLEAN NOT NULL DEFAULT FALSE;\nALTER TABLE users ADD COLUMN image TEXT;\nALTER TABLE users ADD COLUMN created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP;\nALTER TABLE users ADD COLUMN updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP;\nALTER TABLE users ADD COLUMN two_factor_enabled BOOLEAN DEFAULT FALSE;\nUPDATE users SET email = lower(email), email_verified = TRUE, created_at = to_timestamp(created_ms / 1000.0), updated_at = to_timestamp(created_ms / 1000.0);\nCREATE TABLE accounts (\n  id TEXT NOT NULL PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL,\n  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, access_token TEXT, refresh_token TEXT, id_token TEXT,\n  access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT,\n  created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP, updated_at TIMESTAMPTZ NOT NULL\n);\nCREATE INDEX accounts_user_id_idx ON accounts (user_id);\nCREATE UNIQUE INDEX ux_accounts_provider_account ON accounts (provider_id, account_id);\nINSERT INTO accounts (id, account_id, provider_id, user_id, password, created_at, updated_at)\n  SELECT gen_random_uuid()::text, id, 'credential', id, password_hash, created_at, CURRENT_TIMESTAMP FROM users;\nALTER TABLE users DROP COLUMN password_hash;\nALTER TABLE users DROP COLUMN created_ms;\nDROP TABLE sessions;\nCREATE TABLE sessions (\n  id TEXT NOT NULL PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE,\n  created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT,\n  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, active_org_id TEXT\n);\nCREATE INDEX sessions_user_id_idx ON sessions (user_id);\nALTER TABLE orgs ADD COLUMN logo TEXT;\nALTER TABLE orgs ADD COLUMN metadata TEXT;\nALTER TABLE orgs ADD COLUMN created_at TIMESTAMPTZ;\nUPDATE orgs SET created_at = to_timestamp(created_ms / 1000.0);\nALTER TABLE orgs ALTER COLUMN created_at SET NOT NULL;\nALTER TABLE orgs DROP COLUMN created_ms;\nALTER TABLE members ADD COLUMN id TEXT;\nALTER TABLE members ADD COLUMN created_at TIMESTAMPTZ;\nUPDATE members SET id = gen_random_uuid()::text, created_at = to_timestamp(created_ms / 1000.0);\nALTER TABLE members DROP CONSTRAINT members_pkey;\nALTER TABLE members ALTER COLUMN id SET NOT NULL;\nALTER TABLE members ALTER COLUMN created_at SET NOT NULL;\nALTER TABLE members DROP COLUMN created_ms;\nALTER TABLE members ADD PRIMARY KEY (id);\nCREATE UNIQUE INDEX ux_members_org_user ON members (org_id, user_id);\nCREATE INDEX members_org_id_idx ON members (org_id);\nCREATE INDEX members_user_id_idx ON members (user_id);\nDROP INDEX ix_members_user;\nALTER TABLE invites RENAME TO legacy_invites;\nCREATE TABLE invites (\n  id TEXT NOT NULL PRIMARY KEY, org_id TEXT NOT NULL REFERENCES orgs (id) ON DELETE CASCADE, email TEXT NOT NULL, role TEXT,\n  status TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  inviter_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE\n);\nCREATE INDEX invites_org_id_idx ON invites (org_id);\nCREATE INDEX invites_email_idx ON invites (email);\nINSERT INTO invites (id, org_id, email, role, status, expires_at, created_at, inviter_id)\n  SELECT gen_random_uuid()::text, i.org_id, lower(i.email), i.role, 'pending', to_timestamp(i.expires_ms / 1000.0), to_timestamp(i.created_ms / 1000.0),\n    COALESCE((SELECT u.id FROM users u WHERE u.id = i.created_by),\n      (SELECT m.user_id FROM members m WHERE m.org_id = i.org_id AND m.role = 'owner' ORDER BY m.created_at LIMIT 1))\n  FROM legacy_invites i\n  WHERE i.accepted_ms IS NULL AND i.expires_ms > extract(epoch FROM CURRENT_TIMESTAMP) * 1000\n    AND EXISTS (SELECT 1 FROM members m WHERE m.org_id = i.org_id AND m.role = 'owner');\nDROP TABLE legacy_invites;\nCREATE TABLE verifications (\n  id TEXT NOT NULL PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL,\n  created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP, updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP\n);\nCREATE INDEX verifications_identifier_idx ON verifications (identifier);\nCREATE TABLE two_factors (\n  id TEXT NOT NULL PRIMARY KEY, secret TEXT NOT NULL, backup_codes TEXT NOT NULL, user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,\n  verified BOOLEAN, failed_verification_count INTEGER, locked_until TIMESTAMPTZ\n);\nCREATE INDEX two_factors_secret_idx ON two_factors (secret);\nCREATE INDEX two_factors_user_id_idx ON two_factors (user_id);\nCREATE TABLE passkeys (\n  id TEXT NOT NULL PRIMARY KEY, name TEXT, public_key TEXT NOT NULL, user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,\n  credential_id TEXT NOT NULL, counter INTEGER NOT NULL, device_type TEXT NOT NULL, backed_up BOOLEAN NOT NULL, transports TEXT,\n  created_at TIMESTAMPTZ, aaguid TEXT\n);\nCREATE INDEX passkeys_user_id_idx ON passkeys (user_id);\nCREATE INDEX passkeys_credential_id_idx ON passkeys (credential_id);\nCREATE TABLE rate_limits (id TEXT NOT NULL PRIMARY KEY, key TEXT NOT NULL UNIQUE, count INTEGER NOT NULL, last_request BIGINT NOT NULL);\nCREATE TABLE cloud_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);\nCREATE FUNCTION wl_org_keeps_owner() RETURNS trigger LANGUAGE plpgsql AS $$\nDECLARE oid TEXT := COALESCE(OLD.org_id, NEW.org_id);\nBEGIN\n  IF EXISTS (SELECT 1 FROM orgs WHERE id = oid) AND NOT EXISTS (SELECT 1 FROM members WHERE org_id = oid AND role = 'owner') THEN\n    RAISE EXCEPTION 'organization % must keep at least one owner', oid USING ERRCODE = 'check_violation';\n  END IF;\n  RETURN NULL;\nEND $$;\nCREATE CONSTRAINT TRIGGER members_keep_owner AFTER UPDATE OR DELETE ON members\n  DEFERRABLE INITIALLY DEFERRED FOR EACH ROW EXECUTE FUNCTION wl_org_keeps_owner();\n";
+//# sourceMappingURL=schema-auth.d.ts.map

package/dist/db/schema-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-auth.d.ts","sourceRoot":"","sources":["../../src/db/schema-auth.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,cAAc,8xLA0F1B,CAAC"}

package/dist/db/schema-auth.js

@@ -0,0 +1,93 @@
+// Migration 4: accounts move to Better Auth (names in auth/schema-names.ts). Rows and ids stay; sessions start over; invites get new links.
+export const AUTH_MIGRATION = `
+ALTER TABLE users ADD COLUMN email_verified BOOLEAN NOT NULL DEFAULT FALSE;
+ALTER TABLE users ADD COLUMN image TEXT;
+ALTER TABLE users ADD COLUMN created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP;
+ALTER TABLE users ADD COLUMN updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP;
+ALTER TABLE users ADD COLUMN two_factor_enabled BOOLEAN DEFAULT FALSE;
+UPDATE users SET email = lower(email), email_verified = TRUE, created_at = to_timestamp(created_ms / 1000.0), updated_at = to_timestamp(created_ms / 1000.0);
+CREATE TABLE accounts (
+  id TEXT NOT NULL PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL,
+  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, access_token TEXT, refresh_token TEXT, id_token TEXT,
+  access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP, updated_at TIMESTAMPTZ NOT NULL
+);
+CREATE INDEX accounts_user_id_idx ON accounts (user_id);
+CREATE UNIQUE INDEX ux_accounts_provider_account ON accounts (provider_id, account_id);
+INSERT INTO accounts (id, account_id, provider_id, user_id, password, created_at, updated_at)
+  SELECT gen_random_uuid()::text, id, 'credential', id, password_hash, created_at, CURRENT_TIMESTAMP FROM users;
+ALTER TABLE users DROP COLUMN password_hash;
+ALTER TABLE users DROP COLUMN created_ms;
+DROP TABLE sessions;
+CREATE TABLE sessions (
+  id TEXT NOT NULL PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT,
+  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, active_org_id TEXT
+);
+CREATE INDEX sessions_user_id_idx ON sessions (user_id);
+ALTER TABLE orgs ADD COLUMN logo TEXT;
+ALTER TABLE orgs ADD COLUMN metadata TEXT;
+ALTER TABLE orgs ADD COLUMN created_at TIMESTAMPTZ;
+UPDATE orgs SET created_at = to_timestamp(created_ms / 1000.0);
+ALTER TABLE orgs ALTER COLUMN created_at SET NOT NULL;
+ALTER TABLE orgs DROP COLUMN created_ms;
+ALTER TABLE members ADD COLUMN id TEXT;
+ALTER TABLE members ADD COLUMN created_at TIMESTAMPTZ;
+UPDATE members SET id = gen_random_uuid()::text, created_at = to_timestamp(created_ms / 1000.0);
+ALTER TABLE members DROP CONSTRAINT members_pkey;
+ALTER TABLE members ALTER COLUMN id SET NOT NULL;
+ALTER TABLE members ALTER COLUMN created_at SET NOT NULL;
+ALTER TABLE members DROP COLUMN created_ms;
+ALTER TABLE members ADD PRIMARY KEY (id);
+CREATE UNIQUE INDEX ux_members_org_user ON members (org_id, user_id);
+CREATE INDEX members_org_id_idx ON members (org_id);
+CREATE INDEX members_user_id_idx ON members (user_id);
+DROP INDEX ix_members_user;
+ALTER TABLE invites RENAME TO legacy_invites;
+CREATE TABLE invites (
+  id TEXT NOT NULL PRIMARY KEY, org_id TEXT NOT NULL REFERENCES orgs (id) ON DELETE CASCADE, email TEXT NOT NULL, role TEXT,
+  status TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  inviter_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE
+);
+CREATE INDEX invites_org_id_idx ON invites (org_id);
+CREATE INDEX invites_email_idx ON invites (email);
+INSERT INTO invites (id, org_id, email, role, status, expires_at, created_at, inviter_id)
+  SELECT gen_random_uuid()::text, i.org_id, lower(i.email), i.role, 'pending', to_timestamp(i.expires_ms / 1000.0), to_timestamp(i.created_ms / 1000.0),
+    COALESCE((SELECT u.id FROM users u WHERE u.id = i.created_by),
+      (SELECT m.user_id FROM members m WHERE m.org_id = i.org_id AND m.role = 'owner' ORDER BY m.created_at LIMIT 1))
+  FROM legacy_invites i
+  WHERE i.accepted_ms IS NULL AND i.expires_ms > extract(epoch FROM CURRENT_TIMESTAMP) * 1000
+    AND EXISTS (SELECT 1 FROM members m WHERE m.org_id = i.org_id AND m.role = 'owner');
+DROP TABLE legacy_invites;
+CREATE TABLE verifications (
+  id TEXT NOT NULL PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP, updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX verifications_identifier_idx ON verifications (identifier);
+CREATE TABLE two_factors (
+  id TEXT NOT NULL PRIMARY KEY, secret TEXT NOT NULL, backup_codes TEXT NOT NULL, user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+  verified BOOLEAN, failed_verification_count INTEGER, locked_until TIMESTAMPTZ
+);
+CREATE INDEX two_factors_secret_idx ON two_factors (secret);
+CREATE INDEX two_factors_user_id_idx ON two_factors (user_id);
+CREATE TABLE passkeys (
+  id TEXT NOT NULL PRIMARY KEY, name TEXT, public_key TEXT NOT NULL, user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+  credential_id TEXT NOT NULL, counter INTEGER NOT NULL, device_type TEXT NOT NULL, backed_up BOOLEAN NOT NULL, transports TEXT,
+  created_at TIMESTAMPTZ, aaguid TEXT
+);
+CREATE INDEX passkeys_user_id_idx ON passkeys (user_id);
+CREATE INDEX passkeys_credential_id_idx ON passkeys (credential_id);
+CREATE TABLE rate_limits (id TEXT NOT NULL PRIMARY KEY, key TEXT NOT NULL UNIQUE, count INTEGER NOT NULL, last_request BIGINT NOT NULL);
+CREATE TABLE cloud_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+CREATE FUNCTION wl_org_keeps_owner() RETURNS trigger LANGUAGE plpgsql AS $$
+DECLARE oid TEXT := COALESCE(OLD.org_id, NEW.org_id);
+BEGIN
+  IF EXISTS (SELECT 1 FROM orgs WHERE id = oid) AND NOT EXISTS (SELECT 1 FROM members WHERE org_id = oid AND role = 'owner') THEN
+    RAISE EXCEPTION 'organization % must keep at least one owner', oid USING ERRCODE = 'check_violation';
+  END IF;
+  RETURN NULL;
+END $$;
+CREATE CONSTRAINT TRIGGER members_keep_owner AFTER UPDATE OR DELETE ON members
+  DEFERRABLE INITIALLY DEFERRED FOR EACH ROW EXECUTE FUNCTION wl_org_keeps_owner();
+`;
+//# sourceMappingURL=schema-auth.js.map

package/dist/db/schema-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-auth.js","sourceRoot":"","sources":["../../src/db/schema-auth.ts"],"names":[],"mappings":"AAAA,4IAA4I;AAC5I,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0F7B,CAAC"}

package/dist/db/schema-mail.d.ts

@@ -0,0 +1,2 @@
+export declare const MAIL_MIGRATION = "\nCREATE TABLE mail_suppressions (\n  email TEXT NOT NULL PRIMARY KEY, reason TEXT NOT NULL CHECK (reason IN ('bounce', 'complaint')), detail TEXT NOT NULL,\n  created_ms DOUBLE PRECISION NOT NULL\n);\n";
+//# sourceMappingURL=schema-mail.d.ts.map

package/dist/db/schema-mail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-mail.d.ts","sourceRoot":"","sources":["../../src/db/schema-mail.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,cAAc,+MAK1B,CAAC"}

package/dist/db/schema-mail.js

@@ -0,0 +1,8 @@
+// Migration 6: addresses mail must skip. A hard bounce skips every email; a spam complaint skips all but mail the person asked for.
+export const MAIL_MIGRATION = `
+CREATE TABLE mail_suppressions (
+  email TEXT NOT NULL PRIMARY KEY, reason TEXT NOT NULL CHECK (reason IN ('bounce', 'complaint')), detail TEXT NOT NULL,
+  created_ms DOUBLE PRECISION NOT NULL
+);
+`;
+//# sourceMappingURL=schema-mail.js.map

package/dist/db/schema-mail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-mail.js","sourceRoot":"","sources":["../../src/db/schema-mail.ts"],"names":[],"mappings":"AAAA,oIAAoI;AACpI,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;CAK7B,CAAC"}

package/dist/db/schema-notify.d.ts

@@ -0,0 +1,2 @@
+export declare const NOTIFY_MIGRATION = "\nALTER TABLE audit ADD COLUMN noticed BOOLEAN NOT NULL DEFAULT TRUE;\nALTER TABLE audit ALTER COLUMN noticed SET DEFAULT FALSE;\nCREATE INDEX ix_audit_unnoticed ON audit (time_ms) WHERE NOT noticed;\nCREATE TABLE mail_prefs (\n  user_id TEXT NOT NULL PRIMARY KEY REFERENCES users (id) ON DELETE CASCADE, team BOOLEAN NOT NULL DEFAULT TRUE,\n  health BOOLEAN NOT NULL DEFAULT TRUE, digests BOOLEAN NOT NULL DEFAULT TRUE, time_zone TEXT NOT NULL DEFAULT 'UTC', digest_hour SMALLINT NOT NULL DEFAULT 8\n);\nCREATE TABLE digest_prefs (\n  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects (id) ON DELETE CASCADE,\n  daily BOOLEAN NOT NULL, weekly BOOLEAN NOT NULL, monthly BOOLEAN NOT NULL, PRIMARY KEY (user_id, project_id)\n);\nCREATE TABLE digest_sends (\n  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects (id) ON DELETE CASCADE,\n  period TEXT NOT NULL, period_key TEXT NOT NULL, sent_ms DOUBLE PRECISION NOT NULL, PRIMARY KEY (user_id, project_id, period, period_key)\n);\nCREATE TABLE known_devices (\n  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, device TEXT NOT NULL, first_ms DOUBLE PRECISION NOT NULL,\n  last_ms DOUBLE PRECISION NOT NULL, PRIMARY KEY (user_id, device)\n);\nCREATE TABLE project_health (\n  project_id TEXT NOT NULL PRIMARY KEY REFERENCES projects (id) ON DELETE CASCADE, quiet BOOLEAN NOT NULL, changed_ms DOUBLE PRECISION NOT NULL\n);\n";
+//# sourceMappingURL=schema-notify.d.ts.map

package/dist/db/schema-notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-notify.d.ts","sourceRoot":"","sources":["../../src/db/schema-notify.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gBAAgB,g+CAuB5B,CAAC"}

package/dist/db/schema-notify.js

@@ -0,0 +1,26 @@
+// Migration 7: notices and digests. Old audit lines count as noticed, so an upgrade sends nothing for the past.
+export const NOTIFY_MIGRATION = `
+ALTER TABLE audit ADD COLUMN noticed BOOLEAN NOT NULL DEFAULT TRUE;
+ALTER TABLE audit ALTER COLUMN noticed SET DEFAULT FALSE;
+CREATE INDEX ix_audit_unnoticed ON audit (time_ms) WHERE NOT noticed;
+CREATE TABLE mail_prefs (
+  user_id TEXT NOT NULL PRIMARY KEY REFERENCES users (id) ON DELETE CASCADE, team BOOLEAN NOT NULL DEFAULT TRUE,
+  health BOOLEAN NOT NULL DEFAULT TRUE, digests BOOLEAN NOT NULL DEFAULT TRUE, time_zone TEXT NOT NULL DEFAULT 'UTC', digest_hour SMALLINT NOT NULL DEFAULT 8
+);
+CREATE TABLE digest_prefs (
+  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects (id) ON DELETE CASCADE,
+  daily BOOLEAN NOT NULL, weekly BOOLEAN NOT NULL, monthly BOOLEAN NOT NULL, PRIMARY KEY (user_id, project_id)
+);
+CREATE TABLE digest_sends (
+  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects (id) ON DELETE CASCADE,
+  period TEXT NOT NULL, period_key TEXT NOT NULL, sent_ms DOUBLE PRECISION NOT NULL, PRIMARY KEY (user_id, project_id, period, period_key)
+);
+CREATE TABLE known_devices (
+  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, device TEXT NOT NULL, first_ms DOUBLE PRECISION NOT NULL,
+  last_ms DOUBLE PRECISION NOT NULL, PRIMARY KEY (user_id, device)
+);
+CREATE TABLE project_health (
+  project_id TEXT NOT NULL PRIMARY KEY REFERENCES projects (id) ON DELETE CASCADE, quiet BOOLEAN NOT NULL, changed_ms DOUBLE PRECISION NOT NULL
+);
+`;
+//# sourceMappingURL=schema-notify.js.map

package/dist/db/schema-notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-notify.js","sourceRoot":"","sources":["../../src/db/schema-notify.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuB/B,CAAC"}

package/dist/db/schema-search.d.ts

@@ -0,0 +1,2 @@
+export declare const SEARCH_MIGRATION = "\nCREATE TABLE fact_search (\n  project_id TEXT NOT NULL, kind TEXT NOT NULL, trace_id TEXT NOT NULL, owner TEXT NOT NULL, env TEXT NOT NULL DEFAULT '', time_ms DOUBLE PRECISION NOT NULL,\n  span_id TEXT, service TEXT NOT NULL, name TEXT, method TEXT, path TEXT, route TEXT, status INTEGER, outcome TEXT, duration_ms DOUBLE PRECISION,\n  level_rank SMALLINT, category TEXT, span_kind TEXT, end_user TEXT, error BOOLEAN NOT NULL, message TEXT, text TEXT NOT NULL,\n  PRIMARY KEY (project_id, kind, trace_id, owner)\n);\nCREATE INDEX ix_fact_search_time ON fact_search (project_id, kind, time_ms);\nCREATE TABLE fact_attrs (\n  project_id TEXT NOT NULL, trace_id TEXT NOT NULL, src TEXT NOT NULL, owner TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, num DOUBLE PRECISION\n);\nCREATE INDEX ix_fact_attrs_trace ON fact_attrs (project_id, trace_id, src, owner, key);\nCREATE INDEX ix_fact_attrs_key ON fact_attrs (project_id, key, value);\n";
+//# sourceMappingURL=schema-search.d.ts.map

package/dist/db/schema-search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-search.d.ts","sourceRoot":"","sources":["../../src/db/schema-search.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gBAAgB,o7BAa5B,CAAC"}

package/dist/db/schema-search.js

@@ -0,0 +1,16 @@
+// Migration 8: search rows (one per request, trace, span, and log line) and attribute values, built when traces settle.
+export const SEARCH_MIGRATION = `
+CREATE TABLE fact_search (
+  project_id TEXT NOT NULL, kind TEXT NOT NULL, trace_id TEXT NOT NULL, owner TEXT NOT NULL, env TEXT NOT NULL DEFAULT '', time_ms DOUBLE PRECISION NOT NULL,
+  span_id TEXT, service TEXT NOT NULL, name TEXT, method TEXT, path TEXT, route TEXT, status INTEGER, outcome TEXT, duration_ms DOUBLE PRECISION,
+  level_rank SMALLINT, category TEXT, span_kind TEXT, end_user TEXT, error BOOLEAN NOT NULL, message TEXT, text TEXT NOT NULL,
+  PRIMARY KEY (project_id, kind, trace_id, owner)
+);
+CREATE INDEX ix_fact_search_time ON fact_search (project_id, kind, time_ms);
+CREATE TABLE fact_attrs (
+  project_id TEXT NOT NULL, trace_id TEXT NOT NULL, src TEXT NOT NULL, owner TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, num DOUBLE PRECISION
+);
+CREATE INDEX ix_fact_attrs_trace ON fact_attrs (project_id, trace_id, src, owner, key);
+CREATE INDEX ix_fact_attrs_key ON fact_attrs (project_id, key, value);
+`;
+//# sourceMappingURL=schema-search.js.map

package/dist/db/schema-search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-search.js","sourceRoot":"","sources":["../../src/db/schema-search.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;CAa/B,CAAC"}

package/dist/db/schema-sso.d.ts

@@ -0,0 +1,2 @@
+export declare const SSO_MIGRATION = "\nCREATE TABLE sso_providers (\n  id TEXT NOT NULL PRIMARY KEY, provider_id TEXT NOT NULL UNIQUE, issuer TEXT NOT NULL, domain TEXT NOT NULL, domain_verified BOOLEAN,\n  oidc_config TEXT, saml_config TEXT, user_id TEXT REFERENCES users (id) ON DELETE SET NULL,\n  org_id TEXT NOT NULL REFERENCES orgs (id) ON DELETE CASCADE\n);\nCREATE INDEX sso_providers_user_id_idx ON sso_providers (user_id);\nCREATE INDEX sso_providers_org_id_idx ON sso_providers (org_id);\nCREATE FUNCTION wl_sso_accounts_go() RETURNS trigger LANGUAGE plpgsql AS $$\nBEGIN\n  DELETE FROM accounts WHERE provider_id = OLD.provider_id;\n  RETURN NULL;\nEND $$;\nCREATE TRIGGER sso_providers_accounts_go AFTER DELETE ON sso_providers FOR EACH ROW EXECUTE FUNCTION wl_sso_accounts_go();\n";
+//# sourceMappingURL=schema-sso.d.ts.map

package/dist/db/schema-sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-sso.d.ts","sourceRoot":"","sources":["../../src/db/schema-sso.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,aAAa,0vBAczB,CAAC"}

package/dist/db/schema-sso.js

@@ -0,0 +1,17 @@
+// Migration 5: single sign-on providers, one organization each (Better Auth's SSO plugin; names in auth/schema-names.ts).
+export const SSO_MIGRATION = `
+CREATE TABLE sso_providers (
+  id TEXT NOT NULL PRIMARY KEY, provider_id TEXT NOT NULL UNIQUE, issuer TEXT NOT NULL, domain TEXT NOT NULL, domain_verified BOOLEAN,
+  oidc_config TEXT, saml_config TEXT, user_id TEXT REFERENCES users (id) ON DELETE SET NULL,
+  org_id TEXT NOT NULL REFERENCES orgs (id) ON DELETE CASCADE
+);
+CREATE INDEX sso_providers_user_id_idx ON sso_providers (user_id);
+CREATE INDEX sso_providers_org_id_idx ON sso_providers (org_id);
+CREATE FUNCTION wl_sso_accounts_go() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  DELETE FROM accounts WHERE provider_id = OLD.provider_id;
+  RETURN NULL;
+END $$;
+CREATE TRIGGER sso_providers_accounts_go AFTER DELETE ON sso_providers FOR EACH ROW EXECUTE FUNCTION wl_sso_accounts_go();
+`;
+//# sourceMappingURL=schema-sso.js.map

package/dist/db/schema-sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-sso.js","sourceRoot":"","sources":["../../src/db/schema-sso.ts"],"names":[],"mappings":"AAAA,0HAA0H;AAC1H,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;CAc5B,CAAC"}

package/dist/db/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAoMvC,CAAC;AAEF,eAAO,MAAM,gBAAgB,uHAAuH,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAyMvC,CAAC;AAEF,eAAO,MAAM,gBAAgB,uHAAuH,CAAC"}

package/dist/db/schema.js

@@ -1,3 +1,8 @@
+import { AUTH_MIGRATION } from "./schema-auth.js";
+import { MAIL_MIGRATION } from "./schema-mail.js";
+import { NOTIFY_MIGRATION } from "./schema-notify.js";
+import { SEARCH_MIGRATION } from "./schema-search.js";
+import { SSO_MIGRATION } from "./schema-sso.js";
 // Cloud schema, one entry per version. Never edit a shipped entry: add a new one (docs/CONTRACT.md, "Cloud storage").
 export const MIGRATIONS = [
     `
@@ -195,6 +200,11 @@ CREATE INDEX ix_metric_10s_time ON metric_10s (project_id, bucket_ms);
 CREATE INDEX ix_metric_5m_time ON metric_5m (project_id, bucket_ms);
 CREATE INDEX ix_metric_1h_time ON metric_1h (project_id, bucket_ms);
 `,
+    AUTH_MIGRATION,
+    SSO_MIGRATION,
+    MAIL_MIGRATION,
+    NOTIFY_MIGRATION,
+    SEARCH_MIGRATION,
 ];
 export const MIGRATIONS_TABLE = `CREATE TABLE IF NOT EXISTS wizelens_migrations (version INTEGER PRIMARY KEY, applied_ms DOUBLE PRECISION NOT NULL)`;
 //# sourceMappingURL=schema.js.map

package/dist/db/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAAA,sHAAsH;AACtH,MAAM,CAAC,MAAM,UAAU,GAAsB;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6ED;IACC;;;;;;;;;;CAUD;IACC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyGD;CACA,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,oHAAoH,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,sHAAsH;AACtH,MAAM,CAAC,MAAM,UAAU,GAAsB;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6ED;IACC;;;;;;;;;;CAUD;IACC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyGD;IACC,cAAc;IACd,aAAa;IACb,cAAc;IACd,gBAAgB;IAChB,gBAAgB;CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,oHAAoH,CAAC"}

package/dist/db/trigram.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from "./db.js";
+/** Add pg_trgm and the indexes, with no time limit (a big table takes minutes). False when the database has no pg_trgm. */
+export declare function ensureTrigram(db: Db): Promise<boolean>;
+//# sourceMappingURL=trigram.d.ts.map

package/dist/db/trigram.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trigram.d.ts","sourceRoot":"","sources":["../../src/db/trigram.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAa,MAAM,SAAS,CAAC;AAc7C,2HAA2H;AAC3H,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAgB5D"}

package/dist/db/trigram.js

@@ -0,0 +1,34 @@
+// Best effort (docs/SEARCH-PLAN.md, small mode): with pg_trgm, "contains" searches read GIN trigram indexes; without it they scan the time window.
+const COLUMNS = [["fact_search", "text"], ["fact_requests", "search"], ["fact_traces", "search"], ["fact_logs", "search"]];
+/** One index, built without blocking writes; a half-built one from a stopped run is dropped first. */
+async function buildIndex(q, table, col) {
+    const name = `ix_${table}_trgm`;
+    const [old] = await q.query("SELECT i.indisvalid AS valid FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid WHERE c.relname = $1", [name]);
+    if (old?.valid)
+        return;
+    if (old)
+        await q.query(`DROP INDEX CONCURRENTLY IF EXISTS ${name}`);
+    await q.query(`CREATE INDEX CONCURRENTLY IF NOT EXISTS ${name} ON ${table} USING gin (${col} gin_trgm_ops)`);
+}
+/** Add pg_trgm and the indexes, with no time limit (a big table takes minutes). False when the database has no pg_trgm. */
+export async function ensureTrigram(db) {
+    return db.session(async (q) => {
+        try {
+            await q.query("CREATE EXTENSION IF NOT EXISTS pg_trgm");
+        }
+        catch (err) {
+            console.warn(`pg_trgm is not available, so text searches scan the time window: ${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+        await q.query("SET statement_timeout = 0");
+        try {
+            for (const [table, col] of COLUMNS)
+                await buildIndex(q, table, col);
+        }
+        finally {
+            await q.query("RESET statement_timeout");
+        }
+        return true;
+    });
+}
+//# sourceMappingURL=trigram.js.map

package/dist/db/trigram.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trigram.js","sourceRoot":"","sources":["../../src/db/trigram.ts"],"names":[],"mappings":"AAEA,mJAAmJ;AACnJ,MAAM,OAAO,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAU,CAAC;AAEpI,sGAAsG;AACtG,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,KAAa,EAAE,GAAW;IAChE,MAAM,IAAI,GAAG,MAAM,KAAK,OAAO,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAqB,2GAA2G,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACrK,IAAI,GAAG,EAAE,KAAK;QAAE,OAAO;IACvB,IAAI,GAAG;QAAE,MAAM,CAAC,CAAC,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,CAAC,KAAK,CAAC,2CAA2C,IAAI,OAAO,KAAK,eAAe,GAAG,gBAAgB,CAAC,CAAC;AAC/G,CAAC;AAED,2HAA2H;AAC3H,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAM;IACxC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,oEAAoE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrI,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,OAAO;gBAAE,MAAM,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/http.d.ts

@@ -6,6 +6,8 @@ export declare class HttpError extends Error {
 }
 export declare const fail: (status: number, message: string) => never;
 export declare function sendJson(res: ServerResponse, status: number, value: unknown, headers?: Record<string, string | string[]>): void;
+/** The body exactly as sent, for signature checks. Throws 413 past 1 MB. */
+export declare function readRawBody(req: IncomingMessage): Promise<string>;
 /** A small JSON body. Throws 400 for bad JSON or more than 1 MB. */
 export declare function readJsonBody(req: IncomingMessage): Promise<Record<string, unknown>>;
 export declare function cookieOf(req: IncomingMessage, name: string): string | undefined;

package/dist/http/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,oDAAoD;AACpD,qBAAa,SAAU,SAAQ,KAAK;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM;IADzB,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EAGhB;CACF;AAED,eAAO,MAAM,IAAI,WAAY,MAAM,WAAW,MAAM,KAAG,KAEtD,CAAC;AAEF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAM,GAAG,IAAI,CAGnI;AAED,oEAAoE;AACpE,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiBzF;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM/E;AAED,wFAAwF;AACxF,eAAO,MAAM,MAAM,SAAU,MAAM,SAAS,MAAM,WAAW,MAAM,UAAU,OAAO,KAAG,MACgC,CAAC;AAExH,eAAO,MAAM,QAAQ,QAAS,eAAe,KAAG,MAAM,GAAG,SAGxD,CAAC;AAEF,uEAAuE;AACvE,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,UAAO,GAAG,MAAM,CAKvF"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,oDAAoD;AACpD,qBAAa,SAAU,SAAQ,KAAK;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM;IADzB,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EAGhB;CACF;AAED,eAAO,MAAM,IAAI,WAAY,MAAM,WAAW,MAAM,KAAG,KAEtD,CAAC;AAEF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAM,GAAG,IAAI,CAGnI;AAED,4EAA4E;AAC5E,wBAAsB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAUvE;AAED,oEAAoE;AACpE,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CASzF;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM/E;AAED,wFAAwF;AACxF,eAAO,MAAM,MAAM,SAAU,MAAM,SAAS,MAAM,WAAW,MAAM,UAAU,OAAO,KAAG,MACgC,CAAC;AAExH,eAAO,MAAM,QAAQ,QAAS,eAAe,KAAG,MAAM,GAAG,SAGxD,CAAC;AAEF,uEAAuE;AACvE,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,UAAO,GAAG,MAAM,CAKvF"}

package/dist/http/http.js

@@ -14,8 +14,8 @@ export function sendJson(res, status, value, headers = {}) {
     res.writeHead(status, { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store", ...headers });
     res.end(JSON.stringify(value));
 }
-/** A small JSON body. Throws 400 for bad JSON or more than 1 MB. */
-export async function readJsonBody(req) {
+/** The body exactly as sent, for signature checks. Throws 413 past 1 MB. */
+export async function readRawBody(req) {
     const chunks = [];
     let size = 0;
     for await (const chunk of req) {
@@ -25,7 +25,11 @@ export async function readJsonBody(req) {
             fail(413, "The body is too large.");
         chunks.push(buf);
     }
-    const text = Buffer.concat(chunks).toString("utf8");
+    return Buffer.concat(chunks).toString("utf8");
+}
+/** A small JSON body. Throws 400 for bad JSON or more than 1 MB. */
+export async function readJsonBody(req) {
+    const text = await readRawBody(req);
     try {
         const v = text ? JSON.parse(text) : {};
         return v && typeof v === "object" && !Array.isArray(v) ? v : fail(400, "Send a JSON object.");

package/dist/http/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/http/http.ts"],"names":[],"mappings":"AAEA,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7B,oDAAoD;AACpD,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEvB,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;IAIjB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,OAAe,EAAS,EAAE;IAC7D,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,KAAc,EAAE,OAAO,GAAsC,EAAE;IAC3H,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACtH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC1E,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,IAAI,GAAG,QAAQ;YAAE,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC7H,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS;YAAE,MAAM,GAAG,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAoB,EAAE,IAAY;IACzD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,OAAe,EAAE,MAAe,EAAU,EAAE,CAC9F,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,6CAA6C,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAExH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAsB,EAAE;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,GAAG,CAAC,IAA6B,EAAE,GAAW,EAAE,QAAQ,GAAG,IAAI;IAC7E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,gBAAgB,CAAC,CAAC;IACjD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/http/http.ts"],"names":[],"mappings":"AAEA,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7B,oDAAoD;AACpD,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEvB,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;IAIjB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,OAAe,EAAS,EAAE;IAC7D,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,KAAc,EAAE,OAAO,GAAsC,EAAE;IAC3H,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACtH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC1E,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,IAAI,GAAG,QAAQ;YAAE,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IACrD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC7H,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS;YAAE,MAAM,GAAG,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAoB,EAAE,IAAY;IACzD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,OAAe,EAAE,MAAe,EAAU,EAAE,CAC9F,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,6CAA6C,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAExH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAsB,EAAE;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,GAAG,CAAC,IAA6B,EAAE,GAAW,EAAE,QAAQ,GAAG,IAAI;IAC7E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,gBAAgB,CAAC,CAAC;IACjD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/jobs.d.ts

@@ -1,4 +1,4 @@
 import type { CloudApp } from "./app.js";
-/** Background work: retention, settling stats, rollup aging, expired sessions, and alert rules. Returns a function that stops it. */
+/** Background work: retention, old services, stats, rollups, sessions, alert rules, team and health notices, and digests. Returns a function that stops it. */
 export declare function startJobs(app: CloudApp): () => void;
 //# sourceMappingURL=jobs.d.ts.map

package/dist/jobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../src/jobs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA0BzC,qIAAqI;AACrI,wBAAgB,SAAS,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,IAAI,CAcnD"}
+{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../src/jobs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAgCzC,+JAA+J;AAC/J,wBAAgB,SAAS,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,IAAI,CAmBnD"}

package/dist/jobs.js

@@ -1,10 +1,16 @@
 import { evaluateAll } from "./alerts/evaluate.js";
-import { pruneByRetention, pruneMetricsByRetention } from "./repo/trace-write.js";
-import { pruneSessions } from "./repo/users.js";
-import { pruneRollups, settleCloud } from "./settle.js";
+import { pruneAuthRows } from "./repo/auth-prune.js";
+import { pruneServices } from "./repo/services.js";
+import { sendDigests } from "./notify/digest.js";
+import { checkHealth } from "./notify/health.js";
+import { sendTeamNotices } from "./notify/team.js";
 const HOUSEKEEPING_MS = 10 * 60_000;
 const SETTLE_MS = 3_000;
+/** A settle run this big means a backlog: settle again at once instead of waiting for the next tick. */
+const SETTLE_BACKLOG = 1_000;
 const ROLLUP_PRUNE_MS = 60_000;
+const NOTICE_MS = 60_000;
+const DIGEST_MS = 10 * 60_000;
 /** Run `job` now and then every `everyMs`. A failed run logs and waits for the next one. */
 function every(name, everyMs, job) {
     let running = false;
@@ -22,20 +28,26 @@ function every(name, everyMs, job) {
     first.unref();
     return () => (clearInterval(timer), clearTimeout(first));
 }
-/** Background work: retention, settling stats, rollup aging, expired sessions, and alert rules. Returns a function that stops it. */
+/** Background work: retention, old services, stats, rollups, sessions, alert rules, team and health notices, and digests. Returns a function that stops it. */
 export function startJobs(app) {
     const now = app.config.now;
     const stops = [
-        every("retention", HOUSEKEEPING_MS, async () => {
-            while ((await pruneByRetention(app.db, now())) > 0)
+        every("retention", HOUSEKEEPING_MS, () => app.telemetry.prune(now())),
+        every("services", HOUSEKEEPING_MS, () => pruneServices(app.db, now())),
+        every("settle", SETTLE_MS, async () => {
+            const o = { defaultRetentionDays: app.config.retentionDays, onSettled: (p) => app.changes.emit(p) };
+            while ((await app.telemetry.settle(now(), o)) >= SETTLE_BACKLOG)
                 ;
-            await pruneMetricsByRetention(app.db, now());
-            await pruneRollups(app.db, now(), true);
         }),
-        every("settle", SETTLE_MS, () => settleCloud(app.db, now(), { defaultRetentionDays: app.config.retentionDays })),
-        every("rollups", ROLLUP_PRUNE_MS, () => pruneRollups(app.db, now())),
-        every("sessions", HOUSEKEEPING_MS, () => pruneSessions(app.db, now())),
+        every("rollups", ROLLUP_PRUNE_MS, () => app.telemetry.pruneRollups(now())),
+        every("sessions", HOUSEKEEPING_MS, () => pruneAuthRows(app.db)),
         every("alerts", app.config.alertIntervalMs, () => evaluateAll(app)),
+        every("team notices", NOTICE_MS, async () => {
+            while ((await sendTeamNotices(app)) > 0)
+                ;
+        }),
+        every("project health", HOUSEKEEPING_MS, () => checkHealth(app)),
+        every("digests", DIGEST_MS, () => sendDigests(app)),
     ];
     return () => stops.forEach((stop) => stop());
 }