@wizeworks/lens-cloud 0.3.0-alpha.2 → 0.3.0-alpha.4

package/README.md

@@ -35,10 +35,14 @@ WIZELENS_HUB_TOKEN=wl_ik_...
 | `--resend-webhook-secret <s>` | `WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET` | none: the `whsec_…` secret of the Resend webhook (see below) |
 | `--smtp-url <url>` | `WIZELENS_CLOUD_SMTP_URL` | none: or mail over SMTP (`smtp://user:pass@host:587` or `smtps://…:465`) |
 | `--mail-from <address>` | `WIZELENS_CLOUD_MAIL_FROM` | `WizeLens <no-reply@<public host>>` |
+| `--mail-reply-to <address>` | `WIZELENS_CLOUD_MAIL_REPLY_TO` | none: replies go to the sender |
 | `--trust-proxy` | `WIZELENS_CLOUD_TRUST_PROXY=1` | off (client address from the last `X-Forwarded-For` entry) |
 | `--setup-token <text>` | `WIZELENS_CLOUD_SETUP_TOKEN` | random, printed at start while no account exists |
 | `--[no-]check-pwned-passwords` | `WIZELENS_CLOUD_CHECK_PWNED=1\|0` | on with Postgres, off with PGlite |
 | `--sso-origins <list>` | `WIZELENS_CLOUD_SSO_ORIGINS` | none: identity provider origins for OIDC single sign-on, comma separated (`https://acme.okta.com`) |
+| `--stripe-secret-key <key>` | `WIZELENS_CLOUD_STRIPE_SECRET_KEY` | none: billing off, every organization unlimited. With it: plans, limits, and the Billing page |
+| `--stripe-webhook-secret <s>` | `WIZELENS_CLOUD_STRIPE_WEBHOOK_SECRET` | none; required with a Stripe key (webhook: `<public-url>/_wizelens/api/auth/stripe/webhook`) |
+| `--stripe-prices <json>` | `WIZELENS_CLOUD_STRIPE_PRICES` | none; required with a Stripe key: what `wizelens-cloud stripe-setup` prints |
 
 Put it behind https, and set `--public-url` to the https address: cookies are then Secure, and passkeys and email links use it.
 Sending mail needs `--public-url`. Without `--resend-api-key` or `--smtp-url`, nobody gets email: reset and invite links are in

package/dist/alerts/evaluate.d.ts

@@ -1,9 +1,10 @@
+import { type AlertNoticeState, type AlertRule, type AnomalyAlertValue } from "@wizeworks/lens-core";
 import type { CloudApp } from "../app.js";
-import { type AlertRule } from "../repo/alerts.js";
-import { type Notice } from "./notify.js";
-/** Send a notice and keep it as an event. */
-export declare function notify(app: CloudApp, rule: AlertRule, state: Notice["state"], value: number | null, now: number): Promise<string>;
-/** Check one rule. It notifies only when the state changes: ok to firing, or firing to ok. */
+/** Send a notice and keep it as an event, with the problem it names. */
+export declare function notify(app: CloudApp, rule: AlertRule, state: AlertNoticeState, value: number | null, now: number, anomaly?: AnomalyAlertValue): Promise<string>;
+/** True when the value breaks the rule. */
+export declare const breaches: (rule: AlertRule, value: number | null) => boolean;
+/** Check one rule: keep its value, and send a notice when it starts or stops firing, or a reminder while it keeps firing. */
 export declare function evaluateRule(app: CloudApp, rule: AlertRule, now: number): Promise<void>;
 /** Check every enabled rule once. One failing rule does not stop the others. */
 export declare function evaluateAll(app: CloudApp): Promise<void>;

package/dist/alerts/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAY,KAAK,SAAS,EAAgC,MAAM,mBAAmB,CAAC;AAK3F,OAAO,EAAW,KAAK,MAAM,EAAe,MAAM,aAAa,CAAC;AAsDhE,6CAA6C;AAC7C,wBAAsB,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKvI;AAED,8FAA8F;AAC9F,wBAAsB,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7F;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9D"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,gBAAgB,EAErB,KAAK,SAAS,EAGd,KAAK,iBAAiB,EAYvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAiF1C,wEAAwE;AACxE,wBAAsB,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAMrK;AAED,2CAA2C;AAC3C,eAAO,MAAM,QAAQ,SAAU,SAAS,SAAS,MAAM,GAAG,IAAI,KAAG,OAC2G,CAAC;AAY7K,6HAA6H;AAC7H,wBAAsB,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7F;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9D"}

package/dist/alerts/evaluate.js

@@ -1,48 +1,69 @@
-import { alertBreached, alignNow, alertContext, alertMessage, alertPage, computePage, metricAlertMessage, metricAlertUnit, metricAlertValueOf } from "@wizeworks/lens-core";
-import { addEvent, enabledRules, saveEvaluation } from "../repo/alerts.js";
-import { loadMetricAlertData } from "../repo/metric-read.js";
-import { cloudExecutor, projectRetentionMs } from "../scale-exec.js";
+import { alertBreached, alertContext, alertMessage, alertPage, alertStep, alignNow, anomalyAlertMessage, anomalyAlertPage, computePage, metricAlertMessage, metricAlertUnit, metricAlertValueOf, opHolds, sloBurnMessage, sloBurnPage, sloContext, } from "@wizeworks/lens-core";
+import { deliver } from "@wizeworks/lens-hub/kit";
 import { alertMail } from "../mail/templates.js";
+import { addEvent } from "../repo/alert-events.js";
+import { enabledRules, saveEvaluation } from "../repo/alerts.js";
+import { sloById } from "../repo/slos.js";
 import { memberEmails } from "../repo/users.js";
-import { deliver } from "./notify.js";
-/** Names for the notice: project and the dashboard link. */
-async function noticeOf(app, rule, state, value, now) {
+import { projectRetentionMs } from "../scale-exec.js";
+import { problemFor } from "./problem-link.js";
+/** Names for the notice: project, the link to the rule's page, and for a firing rule the problem it is part of. */
+async function noticeOf(app, rule, state, value, now, anomaly) {
     const [p] = await app.db.query("SELECT name FROM projects WHERE id = $1", [rule.projectId]);
-    const base = app.baseUrl();
+    const above = rule.op === "above_normal" ? (anomaly ?? (await measureAnomaly(app, rule, now))) : null;
+    const breach = above?.breach ?? null;
     return {
+        ruleId: rule.id,
         rule: rule.name,
         project: p?.name ?? rule.projectId,
         state,
-        message: await messageOf(app, rule, state, value, now),
+        message: above ? anomalyAlertMessage(rule.metric, above, state) : await messageOf(app, rule, state, value, now),
         value,
         threshold: rule.threshold,
         timeMs: now,
-        url: `${base}/_wizelens/#/alerts?project=${rule.projectId}`,
+        url: `${app.baseUrl()}/_wizelens/#/alerts/${rule.id}?project=${rule.projectId}`,
+        baseline: breach ? { normal: breach.normal, upper: breach.upper } : null,
+        problem: state === "fired" || state === "remind" ? await problemFor(app, rule, now, breach?.row ?? null) : null,
     };
 }
 /** One OpenTelemetry metric over the rule's window (from its rollups), and a sample series for its unit. */
 async function measureMetric(app, rule, now) {
     const at = alignNow(now);
     const q = { projectId: rule.projectId, env: rule.env || undefined, service: rule.metricService || undefined };
-    const data = await loadMetricAlertData(app.db, q, rule.metricName, { from: at - rule.windowMs, to: at }, at);
+    const data = await app.telemetry.metricAlertData(q, rule.metricName, { from: at - rule.windowMs, to: at }, at);
     const stat = rule.metricStat || "avg";
     return { value: metricAlertValueOf(data, stat), sample: data.series[0], stat };
 }
 async function messageOf(app, rule, state, value, now) {
+    if (rule.metric === "slo")
+        return sloBurnMessage((await sloById(app.db, rule.projectId, rule.sloId))?.name ?? rule.sloId, rule.op, value, rule.threshold, state);
     if (rule.metric !== "metric")
-        return alertMessage(rule.metric, rule.op, value, rule.threshold, state);
+        return alertMessage(rule.metric, rule.op, value, rule.threshold, state, rule.logSearch);
     const { sample, stat } = await measureMetric(app, rule, now);
     const unit = sample ? metricAlertUnit(sample, stat) : "";
     return metricAlertMessage(rule.metricName, stat, rule.op, value, rule.threshold, unit, state);
 }
-/** The metric over the rule's window: from the stats tables, or from the metric's points. */
+async function executorOf(app, rule, env = rule.env) {
+    const retentionMs = await projectRetentionMs(app.db, rule.projectId, app.config.retentionDays);
+    return app.telemetry.executor(rule.projectId, retentionMs, env || undefined);
+}
+/** An "above normal" rule: every service and endpoint over the window against the same window in earlier weeks (or days). */
+async function measureAnomaly(app, rule, now) {
+    const page = anomalyAlertPage(rule.metric, rule.threshold);
+    return computePage(page, alertContext(rule.windowMs, alignNow(now)), await executorOf(app, rule));
+}
+/** The metric over the rule's window: from the stats tables (one service or endpoint when scoped, or a log search), or from the metric's points. */
 async function measure(app, rule, now) {
     if (rule.metric === "metric")
         return (await measureMetric(app, rule, now)).value;
-    const retentionMs = await projectRetentionMs(app.db, rule.projectId, app.config.retentionDays);
-    return computePage(alertPage(rule.metric), alertContext(rule.windowMs, alignNow(now)), cloudExecutor(app.db, rule.projectId, retentionMs, rule.env || undefined));
+    if (rule.metric === "slo") {
+        const slo = await sloById(app.db, rule.projectId, rule.sloId);
+        return slo ? computePage(sloBurnPage(slo), sloContext(rule.windowMs, alignNow(now)), await executorOf(app, rule, "")) : null;
+    }
+    const page = alertPage(rule.metric, { service: rule.service, endpoint: rule.endpoint }, rule.logSearch);
+    return computePage(page, alertContext(rule.windowMs, alignNow(now)), await executorOf(app, rule));
 }
-/** Webhooks, Slack, and email. Email goes only to addresses that still belong to confirmed members of the organization. */
+/** Webhooks, chat, PagerDuty, and email. Email goes only to addresses that still belong to confirmed members of the organization. */
 async function outboxOf(app, projectId) {
     const [p] = await app.db.query("SELECT org_id FROM projects WHERE id = $1", [projectId]);
     const members = new Set(p ? await memberEmails(app.db, p.org_id, app.mailer.live) : []);
@@ -53,23 +74,34 @@ async function outboxOf(app, projectId) {
         const note = app.mailer.live ? `sent to ${ok.length}` : "mail is not set up (see the cloud log)";
         return `email: ${note}${ok.length < to.length ? `, ${to.length - ok.length} no longer members` : ""}`;
     };
-    return { http: app.config.fetch, allowPrivate: app.config.allowPrivateWebhooks, email };
+    return { http: app.config.fetch, allowPrivate: app.config.allowPrivateWebhooks, email, pagerDutyUrl: app.config.pagerDutyUrl };
 }
-/** Send a notice and keep it as an event. */
-export async function notify(app, rule, state, value, now) {
-    const notice = await noticeOf(app, rule, state, value, now);
+/** Send a notice and keep it as an event, with the problem it names. */
+export async function notify(app, rule, state, value, now, anomaly) {
+    const notice = await noticeOf(app, rule, state, value, now, anomaly);
     const delivery = await deliver(rule.channels, notice, await outboxOf(app, rule.projectId));
-    await addEvent(app.db, rule, { kind: state, value, message: notice.message, timeMs: now, delivery });
+    const problem = notice.problem ? { id: notice.problem.id, title: notice.problem.title, url: notice.problem.url } : null;
+    await addEvent(app.db, rule, { kind: state, value, message: notice.message, timeMs: now, delivery, problem });
     return delivery;
 }
-/** Check one rule. It notifies only when the state changes: ok to firing, or firing to ok. */
-export async function evaluateRule(app, rule, now) {
+/** True when the value breaks the rule. */
+export const breaches = (rule, value) => rule.metric === "metric" || rule.metric === "slo" ? value !== null && opHolds(rule.op, value, rule.threshold) : alertBreached(rule.metric, rule.op, value, rule.threshold);
+/** Whether a rule breaks now, and for "above normal" rules what broke it. */
+async function verdictOf(app, rule, now) {
+    if (rule.op === "above_normal") {
+        const anomaly = await measureAnomaly(app, rule, now);
+        return { breached: anomaly.breach !== null, value: anomaly.value, anomaly };
+    }
     const value = await measure(app, rule, now);
-    const firing = rule.metric === "metric" ? value !== null && (rule.op === ">" ? value > rule.threshold : value < rule.threshold) : alertBreached(rule.metric, rule.op, value, rule.threshold);
-    const next = firing ? "firing" : "ok";
-    await saveEvaluation(app.db, rule.id, next, value, now);
-    if (next !== rule.state)
-        await notify(app, rule, firing ? "fired" : "resolved", value, now);
+    return { breached: breaches(rule, value), value };
+}
+/** Check one rule: keep its value, and send a notice when it starts or stops firing, or a reminder while it keeps firing. */
+export async function evaluateRule(app, rule, now) {
+    const { breached, value, anomaly } = await verdictOf(app, rule, now);
+    const step = alertStep(rule, breached, now);
+    await saveEvaluation(app.db, rule, { state: step.state, ackMs: step.ackMs, notified: step.notice !== null }, value, now);
+    if (step.notice)
+        await notify(app, rule, step.notice, value, now, anomaly);
 }
 /** Check every enabled rule once. One failing rule does not stop the others. */
 export async function evaluateAll(app) {

package/dist/alerts/evaluate.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE5K,OAAO,EAAE,QAAQ,EAAkB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,OAAO,EAA4B,MAAM,aAAa,CAAC;AAEhE,4DAA4D;AAC5D,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IAC/G,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAmB,yCAAyC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,SAAS;QAClC,KAAK;QACL,OAAO,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC;QACtD,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG,IAAI,+BAA+B,IAAI,CAAC,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,aAAa,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IACtE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;IAC9G,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IAChH,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAChG,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,OAAO,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/F,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;AACpK,CAAC;AAED,2HAA2H;AAC3H,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,SAAiB;IACtD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,CAAC,EAAqB,EAAE,CAAS,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,EAAE;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,wCAAwC,CAAC;QACjG,OAAO,UAAU,IAAI,GAAG,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxG,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC;AAC1F,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAa,EAAE,IAAe,EAAE,KAAsB,EAAE,KAAoB,EAAE,GAAW;IACpH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3F,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7L,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAa;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC"}
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/alerts/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,YAAY,EACZ,YAAY,EAEZ,SAAS,EAET,SAAS,EACT,QAAQ,EAER,mBAAmB,EACnB,gBAAgB,EAEhB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,OAAO,EACP,cAAc,EACd,WAAW,EACX,UAAU,GACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,OAAO,EAA4B,MAAM,yBAAyB,CAAC;AAE5E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,mHAAmH;AACnH,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,IAAe,EAAE,KAAuB,EAAE,KAAoB,EAAE,GAAW,EAAE,OAA2B;IAC7I,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAmB,yCAAyC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;IACrC,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,SAAS;QAClC,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAuB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC;QAChI,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,uBAAuB,IAAI,CAAC,EAAE,YAAY,IAAI,CAAC,SAAS,EAAE;QAC/E,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;QACxE,OAAO,EAAE,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KAChH,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,aAAa,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IACtE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;IAC9G,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa,EAAE,IAAe,EAAE,KAAuB,EAAE,KAAoB,EAAE,GAAW;IACjH,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjK,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACtH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAChG,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,IAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG;IACtE,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/F,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;AAC/E,CAAC;AAED,6HAA6H;AAC7H,KAAK,UAAU,cAAc,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IACvE,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5E,OAAO,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,oJAAoJ;AACpJ,KAAK,UAAU,OAAO,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/H,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxG,OAAO,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,qIAAqI;AACrI,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,SAAiB;IACtD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,CAAC,EAAqB,EAAE,CAAS,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,EAAE;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,wCAAwC,CAAC;QACjG,OAAO,UAAU,IAAI,GAAG,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxG,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;AACjI,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAa,EAAE,IAAe,EAAE,KAAuB,EAAE,KAAoB,EAAE,GAAW,EAAE,OAA2B;IAClJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxH,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9G,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAe,EAAE,KAAoB,EAAW,EAAE,CACzE,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;AAE7K,6EAA6E;AAC7E,KAAK,UAAU,SAAS,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAClE,IAAI,IAAI,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,6HAA6H;AAC7H,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW;IAC5E,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACzH,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AAC7E,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAa;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC"}

package/dist/alerts/problem-link.d.ts

@@ -0,0 +1,12 @@
+import type { CloudApp } from "../app.js";
+import type { AlertRule } from "../repo/alerts.js";
+import type { NoticeProblem } from "@wizeworks/lens-hub/kit";
+/** The dashboard link to one problem: its id in the range it was found in, plus the time and service that find it again later. */
+export declare function problemUrl(base: string, projectId: string, p: {
+    id: string;
+    startMs: number;
+    row: string | null;
+}): string;
+/** The problem near `now` (on `service`, when given) from the last 24 hours, or null. A failure never stops the notice. */
+export declare function problemFor(app: CloudApp, rule: AlertRule, now: number, service: string | null): Promise<NoticeProblem | null>;
+//# sourceMappingURL=problem-link.d.ts.map

package/dist/alerts/problem-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"problem-link.d.ts","sourceRoot":"","sources":["../../src/alerts/problem-link.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,kIAAkI;AAClI,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,CAI1H;AAED,2HAA2H;AAC3H,wBAAsB,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAcnI"}

package/dist/alerts/problem-link.js

@@ -0,0 +1,31 @@
+import { causeText } from "@wizeworks/lens-core";
+import { projectPage } from "../routes/models.js";
+/** Notices look for problems in the last 24 hours, and their links open that range, so the id matches. */
+const PROBLEM_RANGE = "24h";
+/** The dashboard link to one problem: its id in the range it was found in, plus the time and service that find it again later. */
+export function problemUrl(base, projectId, p) {
+    const q = new URLSearchParams({ project: projectId, range: PROBLEM_RANGE, problem: p.id, at: String(Math.round(p.startMs)) });
+    if (p.row)
+        q.set("focus", p.row);
+    return `${base}/_wizelens/#/problems?${q.toString()}`;
+}
+/** The problem near `now` (on `service`, when given) from the last 24 hours, or null. A failure never stops the notice. */
+export async function problemFor(app, rule, now, service) {
+    try {
+        const [p] = await app.db.query("SELECT org_id FROM projects WHERE id = $1", [rule.projectId]);
+        if (!p)
+            return null;
+        const params = { at: String(now), ...(service ? { focus: service } : {}) };
+        const m = await projectPage(app, { id: rule.projectId, orgId: p.org_id }, "problems", PROBLEM_RANGE, params, rule.env || undefined);
+        const found = m.selected;
+        if (!found)
+            return null;
+        const row = found.anomalies[0]?.row ?? null;
+        return { id: found.id, title: found.title, cause: found.cause ? causeText(found.cause) : null, url: problemUrl(app.baseUrl(), rule.projectId, { id: found.id, startMs: found.startMs, row }) };
+    }
+    catch (err) {
+        console.error(`[wizelens-cloud] problem for alert ${rule.id} failed:`, err);
+        return null;
+    }
+}
+//# sourceMappingURL=problem-link.js.map

package/dist/alerts/problem-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"problem-link.js","sourceRoot":"","sources":["../../src/alerts/problem-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,0GAA0G;AAC1G,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,kIAAkI;AAClI,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAiB,EAAE,CAAsD;IAChH,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,GAAG;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,GAAG,IAAI,yBAAyB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,2HAA2H;AAC3H,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,IAAe,EAAE,GAAW,EAAE,OAAsB;IAClG,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAClH,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,MAAM,GAA2B,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACnG,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC;QACpI,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACjM,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,sCAAsC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/app.d.ts

@@ -1,13 +1,20 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import type { MapLoader } from "@wizeworks/lens-core";
 import type { WizeAuth } from "./auth/auth.js";
 import type { AuthSecret } from "./auth/secret.js";
+import type { Billing } from "./billing/service.js";
+import type { Changes } from "./changes.js";
 import type { CloudConfig } from "./config.js";
 import type { Db } from "./db/db.js";
 import type { RouteCtx } from "./http/router.js";
 import type { Mailer } from "./mail/mailer.js";
+import type { SettingsCache } from "./repo/settings.js";
+import type { TelemetryStore } from "./telemetry/store.js";
 /** Everything a request handler needs. */
 export interface CloudApp {
     db: Db;
+    /** Spans, logs, metrics, and stats: Postgres in small mode, ClickHouse in scale mode. */
+    telemetry: TelemetryStore;
     config: CloudConfig;
     version: string;
     startedMs: number;
@@ -16,6 +23,14 @@ export interface CloudApp {
     secrets: readonly AuthSecret[];
     /** Better Auth. Ready once the cloud listens (its address goes into links and cookie checks). */
     readonly auth: WizeAuth;
+    /** Plans, usage, limits, and Stripe (with billing on). */
+    billing: Billing;
+    /** New data per project, for open dashboards. */
+    changes: Changes;
+    /** Uploaded source maps of one project, cached. */
+    maps(projectId: string): MapLoader;
+    /** Project settings, cached for ingest and settle. */
+    settings: SettingsCache;
     /** The address for links: the public URL, or the address the cloud listens on. */
     baseUrl(req?: IncomingMessage): string;
 }

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,0CAA0C;AAC1C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,kFAAkF;IAClF,OAAO,CAAC,GAAG,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,GAAI,SAAQ,QAAQ;IACnC,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,0CAA0C;AAC1C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,EAAE,CAAC;IACP,yFAAyF;IACzF,SAAS,EAAE,cAAc,CAAC;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,sDAAsD;IACtD,QAAQ,EAAE,aAAa,CAAC;IACxB,kFAAkF;IAClF,OAAO,CAAC,GAAG,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,GAAI,SAAQ,QAAQ;IACnC,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC"}

package/dist/auth/auth.d.ts

@@ -30,6 +30,12 @@ export interface WizeAuth {
             name: string;
             slug: string;
         } | null>;
+        wizelensOAuthVerify(a: {
+            body: {
+                token: string;
+            };
+        }): Promise<Record<string, unknown> | null>;
+        getOAuthServerConfig(...args: unknown[]): Promise<unknown>;
     };
 }
 interface SessionUser {
@@ -41,8 +47,8 @@ interface SessionUser {
 }
 /** Better Auth for the cloud: accounts, sessions, 2FA, passkeys, SSO, organizations, members, and invites (docs/CONTRACT.md, "Tenancy and access"). */
 export declare function createAuth(deps: AuthDeps): WizeAuth;
-/** A new organization with `userId` as owner, the cloud's default retention, a first project, and an audit line. */
-export declare function createOrgFor(auth: WizeAuth, deps: Pick<AuthDeps, "db" | "retentionDays">, userId: string, name: string): Promise<{
+/** A new organization with `userId` as owner, the cloud's default retention (Free plan's at most, with billing on), a first project, and an audit line. */
+export declare function createOrgFor(auth: WizeAuth, deps: Pick<AuthDeps, "db" | "retentionDays" | "billingOn">, userId: string, name: string): Promise<{
     id: string;
     name: string;
     slug: string;

package/dist/auth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AA4C1C,4GAA4G;AAC5G,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,GAAG,EAAE;QACH,UAAU,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE,WAAW,CAAC;YAAC,OAAO,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACpG,cAAc,CAAC,CAAC,EAAE;YAAE,IAAI,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtF,kBAAkB,CAAC,CAAC,EAAE;YAAE,IAAI,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;KAC7I,CAAC;CACH;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAED,uJAAuJ;AACvJ,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAGnD;AAED,oHAAoH;AACpH,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAWlL"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAiE1C,4GAA4G;AAC5G,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,GAAG,EAAE;QACH,UAAU,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE,WAAW,CAAC;YAAC,OAAO,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACpG,cAAc,CAAC,CAAC,EAAE;YAAE,IAAI,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtF,kBAAkB,CAAC,CAAC,EAAE;YAAE,IAAI,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QAC5I,mBAAmB,CAAC,CAAC,EAAE;YAAE,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7F,oBAAoB,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC5D,CAAC;CACH;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAED,uJAAuJ;AACvJ,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAGnD;AAED,2JAA2J;AAC3J,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,eAAe,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAYhM"}

package/dist/auth/auth.js

@@ -1,4 +1,5 @@
 import { betterAuth } from "better-auth";
+import { PLANS } from "../billing/plans.js";
 import { audit } from "../repo/audit.js";
 import { freeSlug } from "../repo/orgs.js";
 import { createProject } from "../repo/projects.js";
@@ -9,9 +10,30 @@ import { authPlugins } from "./plugins.js";
 import { securityDbHooks } from "./security-notices.js";
 import { afterSignup, confirmSsoEmail } from "./signup.js";
 const ALWAYS_OFF = ["/sign-in/social", "/link-social", "/get-access-token", "/refresh-token", "/account-info", "/delete-user/callback", "/update-session"];
+/** OAuth routes the cloud does not use: apps register themselves, and grants (repo/grants.ts) hold every consent. */
+const OAUTH_OFF = [
+    "/oauth2/introspect",
+    "/oauth2/userinfo",
+    "/oauth2/end-session",
+    "/oauth2/public-client-prelogin",
+    "/oauth2/get-consent",
+    "/oauth2/get-consents",
+    "/oauth2/update-consent",
+    "/oauth2/delete-consent",
+    "/oauth2/create-client",
+    "/oauth2/get-client",
+    "/oauth2/get-clients",
+    "/oauth2/update-client",
+    "/oauth2/delete-client",
+    "/oauth2/client/rotate-secret",
+    "/admin/oauth2/create-client",
+    "/admin/oauth2/update-client",
+    "/admin/oauth2/resources",
+];
 /** Invite ids are link secrets: no route lists them (managers see them on our Team page), nor, without real mail, by "their" email. */
 const disabledPaths = (deps) => [
     ...ALWAYS_OFF,
+    ...OAUTH_OFF,
     "/organization/list-invitations",
     "/organization/get-full-organization",
     ...(deps.mailer.live ? [] : ["/organization/list-user-invitations"]),
@@ -46,7 +68,7 @@ export function createAuth(deps) {
     const auth = build(deps, (userId, name) => createOrgFor(auth, deps, userId, name));
     return auth;
 }
-/** A new organization with `userId` as owner, the cloud's default retention, a first project, and an audit line. */
+/** A new organization with `userId` as owner, the cloud's default retention (Free plan's at most, with billing on), a first project, and an audit line. */
 export async function createOrgFor(auth, deps, userId, name) {
     const clean = name.trim().slice(0, 100) || "My organization";
     const org = await auth.api.createOrganization({ body: { name: clean, slug: await freeSlug(deps.db, clean), userId } });
@@ -54,7 +76,8 @@ export async function createOrgFor(auth, deps, userId, name) {
         throw new Error("Could not create the organization.");
     const now = Date.now();
     await deps.db.tx(async (q) => {
-        await q.query("UPDATE orgs SET retention_days = $1 WHERE id = $2", [deps.retentionDays, org.id]);
+        const plan = deps.billingOn ? "free" : "unlimited";
+        await q.query("UPDATE orgs SET retention_days = $1, plan = $2 WHERE id = $3", [Math.min(deps.retentionDays, PLANS[plan].maxRetentionDays), plan, org.id]);
         await createProject(q, org.id, "My app", now);
         await audit(q, org.id, `user:${userId}`, "org.create", { name: clean }, now);
     });

package/dist/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5H,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;AAE3J,uIAAuI;AACvI,MAAM,aAAa,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC;IACxC,GAAG,UAAU;IACb,gCAAgC;IAChC,qCAAqC;IACrC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC;CACrE,CAAC;AAEF,kHAAkH;AAClH,SAAS,eAAe,CAAC,IAAc,EAAE,SAAoE;IAC3G,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;AACxJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAc,EAAE,SAAoE;IACjG,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5D,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY;QAC9B,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,GAAG,YAAY,CAAC,IAAI,CAAC;QACrB,GAAG,cAAc,EAAE;QACnB,SAAS,EAAE,gBAAgB,EAAE;QAC7B,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC;QAC/B,aAAa,EAAE,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;QAC/C,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC;AAqBD,uJAAuJ;AACvJ,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAwB,CAAC;IAC1G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,IAA4C,EAAE,MAAc,EAAE,IAAY;IAC3H,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,iBAAiB,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACvH,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,CAAC,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,MAAM,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5H,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;AAC3J,qHAAqH;AACrH,MAAM,SAAS,GAAG;IAChB,oBAAoB;IACpB,kBAAkB;IAClB,qBAAqB;IACrB,gCAAgC;IAChC,qBAAqB;IACrB,sBAAsB;IACtB,wBAAwB;IACxB,wBAAwB;IACxB,uBAAuB;IACvB,oBAAoB;IACpB,qBAAqB;IACrB,uBAAuB;IACvB,uBAAuB;IACvB,8BAA8B;IAC9B,6BAA6B;IAC7B,6BAA6B;IAC7B,yBAAyB;CAC1B,CAAC;AAEF,uIAAuI;AACvI,MAAM,aAAa,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC;IACxC,GAAG,UAAU;IACb,GAAG,SAAS;IACZ,gCAAgC;IAChC,qCAAqC;IACrC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC;CACrE,CAAC;AAEF,kHAAkH;AAClH,SAAS,eAAe,CAAC,IAAc,EAAE,SAAoE;IAC3G,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;AACxJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAc,EAAE,SAAoE;IACjG,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5D,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY;QAC9B,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,GAAG,YAAY,CAAC,IAAI,CAAC;QACrB,GAAG,cAAc,EAAE;QACnB,SAAS,EAAE,gBAAgB,EAAE;QAC7B,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC;QAC/B,aAAa,EAAE,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;QAC/C,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC;AAuBD,uJAAuJ;AACvJ,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAwB,CAAC;IAC1G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2JAA2J;AAC3J,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,IAA0D,EAAE,MAAc,EAAE,IAAY;IACzI,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,iBAAiB,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACvH,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;QACnD,MAAM,CAAC,CAAC,KAAK,CAAC,8DAA8D,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1J,MAAM,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,MAAM,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC"}

package/dist/auth/billing-hooks.d.ts

@@ -0,0 +1,9 @@
+import { type createAuthMiddleware } from "better-auth/api";
+import type { AuthDeps } from "./deps.js";
+type HookCtx = Parameters<Parameters<typeof createAuthMiddleware>[0]>[0];
+/** SSO setup needs a plan with SSO; plan calls must name the organization, since only organizations hold plans. */
+export declare function billingGuard(deps: AuthDeps, ctx: HookCtx): Promise<void>;
+/** Each change an identity provider makes through SCIM goes to the organization's audit log. */
+export declare function auditScim(deps: AuthDeps, ctx: HookCtx): Promise<void>;
+export {};
+//# sourceMappingURL=billing-hooks.d.ts.map

package/dist/auth/billing-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing-hooks.d.ts","sourceRoot":"","sources":["../../src/auth/billing-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAKtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,KAAK,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAOzE,mHAAmH;AACnH,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAY9E;AAWD,gGAAgG;AAChG,wBAAsB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAW3E"}

package/dist/auth/billing-hooks.js

@@ -0,0 +1,49 @@
+import { APIError } from "better-auth/api";
+import { planRequired } from "../billing/gate.js";
+import { audit } from "../repo/audit.js";
+import { orgHas } from "../repo/billing.js";
+import { scimTokenOf } from "../repo/scim-tokens.js";
+const SSO_SETUP = new Set(["/sso/register", "/sso/update-provider"]);
+/** Plan calls that act for someone; the Stripe redirect back (`/subscription/success`) is not one. */
+const PLAN_CALL = /^\/subscription\/(upgrade|cancel|restore|list|billing-portal)$/;
+const str = (v) => (typeof v === "string" ? v : undefined);
+/** SSO setup needs a plan with SSO; plan calls must name the organization, since only organizations hold plans. */
+export async function billingGuard(deps, ctx) {
+    const body = (ctx.body ?? {});
+    if (SSO_SETUP.has(ctx.path)) {
+        const orgId = str(body.organizationId) ?? (await providerOrg(ctx, str(body.providerId)));
+        if (orgId && !(await orgHas(deps.db, orgId, deps.billingOn, "sso")))
+            throw new APIError("PAYMENT_REQUIRED", { message: planRequired("sso").message, code: "PLAN_REQUIRED" });
+    }
+    if (PLAN_CALL.test(ctx.path)) {
+        const query = (ctx.query ?? {});
+        const type = str(body.customerType) ?? str(query.customerType);
+        const ref = str(body.referenceId) ?? str(query.referenceId);
+        if (type !== "organization" || !ref)
+            throw new APIError("BAD_REQUEST", { message: "Plans belong to an organization: send customerType organization and its referenceId." });
+    }
+}
+async function providerOrg(ctx, providerId) {
+    if (!providerId)
+        return undefined;
+    const row = await ctx.context.adapter.findOne({ model: "ssoProvider", where: [{ field: "providerId", value: providerId }] });
+    return row?.organizationId ?? undefined;
+}
+const SCIM_CHANGE = /^\/scim\/v2\/(Users|Groups)(\/[^/]+)?$/;
+const VERB = { POST: "create", PUT: "update", PATCH: "update", DELETE: "delete" };
+/** Each change an identity provider makes through SCIM goes to the organization's audit log. */
+export async function auditScim(deps, ctx) {
+    const verb = VERB[ctx.request?.method ?? ""];
+    const m = SCIM_CHANGE.exec(ctx.path);
+    if (!verb || !m)
+        return;
+    const bearer = ctx.headers?.get("authorization")?.replace(/^bearer\s+/i, "") ?? "";
+    const token = await scimTokenOf(deps.db, bearer, Date.now());
+    if (!token)
+        return;
+    const kind = m[1] === "Users" ? "user" : "group";
+    const body = (ctx.body ?? {});
+    const detail = { resource: kind, id: m[2]?.slice(1), userName: str(body.userName), displayName: str(body.displayName), tokenId: token.id };
+    await audit(deps.db, token.orgId, `scim:${token.id}`, `scim.${kind}.${verb}`, detail, Date.now());
+}
+//# sourceMappingURL=billing-hooks.js.map

package/dist/auth/billing-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing-hooks.js","sourceRoot":"","sources":["../../src/auth/billing-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAKrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;AACrE,sGAAsG;AACtG,MAAM,SAAS,GAAG,gEAAgE,CAAC;AACnF,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAEpE,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,GAAY;IAC7D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzF,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IAC/K,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sFAAsF,EAAE,CAAC,CAAC;IAC9K,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,UAA8B;IACrE,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAqC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACjK,OAAO,GAAG,EAAE,cAAc,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAC7D,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAE1G,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,GAAY;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAAE,OAAO;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACnF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3I,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,IAAI,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACpG,CAAC"}

package/dist/auth/bridge.js

@@ -1,8 +1,8 @@
 import { toNodeHandler } from "better-auth/node";
 import { AUTH_BASE_PATH, CLIENT_IP_HEADER } from "./options.js";
 const SAFE = new Set(["GET", "HEAD", "OPTIONS"]);
-/** Paths an outside party posts to (sign-in providers), which cannot send the dashboard header. None are on yet; SSO adds them. */
-const EXTERNAL = [/^\/callback\/[^/]+$/, /^\/sso\/callback(\/[^/]+)?$/, /^\/sso\/saml2\/sp\/(acs|slo)\/[^/]+$/];
+/** Paths an outside party posts to (sign-in providers, OAuth apps such as Claude, SCIM from identity providers), which cannot send the dashboard header. */
+const EXTERNAL = [/^\/callback\/[^/]+$/, /^\/sso\/callback(\/[^/]+)?$/, /^\/sso\/saml2\/sp\/(acs|slo)\/[^/]+$/, /^\/oauth2\/(token|register|revoke)$/, /^\/scim\/v2\/[A-Za-z]+(\/[^/]+)?$/];
 const IP_HEADERS = ["x-forwarded-for", "x-real-ip", "cf-connecting-ip", "true-client-ip", "forwarded", CLIENT_IP_HEADER];
 const MAX_BODY = 64 * 1024;
 const MAX_EXTERNAL_BODY = 1024 * 1024;

package/dist/auth/bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/auth/bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACjD,mIAAmI;AACnI,MAAM,QAAQ,GAAa,CAAC,qBAAqB,EAAE,6BAA6B,EAAE,sCAAsC,CAAC,CAAC;AAC1H,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AACzH,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC,yHAAyH;AACzH,MAAM,UAAU,QAAQ,CAAC,GAAoB,EAAE,UAAmB;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/G,MAAM,EAAE,GAAG,UAAU,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAChH,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe;IAChE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1G,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,kIAAkI;AAClI,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,UAAmB;IAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACxE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;YAClI,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/auth/bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACjD,4JAA4J;AAC5J,MAAM,QAAQ,GAAa,CAAC,qBAAqB,EAAE,6BAA6B,EAAE,sCAAsC,EAAE,qCAAqC,EAAE,mCAAmC,CAAC,CAAC;AACtM,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AACzH,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC,yHAAyH;AACzH,MAAM,UAAU,QAAQ,CAAC,GAAoB,EAAE,UAAmB;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/G,MAAM,EAAE,GAAG,UAAU,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAChH,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe;IAChE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1G,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,kIAAkI;AAClI,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,UAAmB;IAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACxE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;YAClI,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/crypto.d.ts

@@ -3,6 +3,8 @@ export declare const TOKEN_PREFIX: {
     readonly ingest: "wl_ik_";
     readonly read: "wl_rk_";
     readonly share: "wl_sh_";
+    readonly status: "wl_st_";
+    readonly scim: "wl_sc_";
 };
 export type TokenKind = keyof typeof TOKEN_PREFIX;
 /** A new random token. Only its hash is stored. */

package/dist/auth/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAIA,6EAA6E;AAC7E,eAAO,MAAM,YAAY;aAAK,MAAM,EAAE,QAAQ;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,QAAQ;CAAW,CAAC;AAC3F,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC;AAElD,mDAAmD;AACnD,eAAO,MAAM,QAAQ,SAAU,SAAS,KAAG,MAAyE,CAAC;AAErH,eAAO,MAAM,SAAS,UAAW,MAAM,KAAG,MAA0D,CAAC;AAErG,eAAO,MAAM,KAAK,QAAO,MAAsB,CAAC;AAEhD,iFAAiF;AACjF,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAMX,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAIA,6EAA6E;AAC7E,eAAO,MAAM,YAAY;aAAK,MAAM,EAAE,QAAQ;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,QAAQ;aAAE,MAAM,EAAE,QAAQ;aAAE,IAAI,EAAE,QAAQ;CAAW,CAAC;AAC7H,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC;AAElD,mDAAmD;AACnD,eAAO,MAAM,QAAQ,SAAU,SAAS,KAAG,MAAyE,CAAC;AAErH,eAAO,MAAM,SAAS,UAAW,MAAM,KAAG,MAA0D,CAAC;AAErG,eAAO,MAAM,KAAK,QAAO,MAAsB,CAAC;AAEhD,iFAAiF;AACjF,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAMX,CAAC"}

package/dist/auth/crypto.js

@@ -1,7 +1,7 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-// Our own secrets: data-plane keys and share links. Passwords, sessions, and invites are Better Auth's.
+// Our own secrets: data-plane keys, share links, and status page links. Passwords, sessions, and invites are Better Auth's.
 /** Kinds of secret tokens. The prefix tells a person what a token is for. */
-export const TOKEN_PREFIX = { ingest: "wl_ik_", read: "wl_rk_", share: "wl_sh_" };
+export const TOKEN_PREFIX = { ingest: "wl_ik_", read: "wl_rk_", share: "wl_sh_", status: "wl_st_", scim: "wl_sc_" };
 /** A new random token. Only its hash is stored. */
 export const newToken = (kind) => `${TOKEN_PREFIX[kind]}${randomBytes(24).toString("base64url")}`;
 export const hashToken = (token) => createHash("sha256").update(token).digest("hex");

package/dist/auth/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,wGAAwG;AAExG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAW,CAAC;AAG3F,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAe,EAAU,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAErH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,UAAU,EAAE,CAAC;AAEhD,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI;KACD,WAAW,EAAE;KACb,SAAS,CAAC,MAAM,CAAC;KACjB,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;KAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;KACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,4HAA4H;AAE5H,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC;AAG7H,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAe,EAAU,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAErH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,UAAU,EAAE,CAAC;AAEhD,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI;KACD,WAAW,EAAE;KACb,SAAS,CAAC,MAAM,CAAC;KACjB,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;KAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;KACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC"}

package/dist/auth/deps.d.ts

@@ -1,3 +1,4 @@
+import type { StripeDeps } from "../billing/stripe-plugin.js";
 import type { SignupMode } from "../config.js";
 import type { Db } from "../db/db.js";
 import type { Mailer } from "../mail/mailer.js";
@@ -7,6 +8,8 @@ export interface AuthDeps {
     db: Db;
     /** The cloud's own origin, for links and passkeys, for example https://lens.example.com. */
     publicUrl: string;
+    /** Another origin agents use for MCP only (`--mcp-url`), for example https://mcp.wizelens.com. */
+    mcpUrl?: string;
     /** Origins allowed to send changes: the public one (and its 127.0.0.1 twin for a local default). */
     trustedOrigins: string[];
     /** Identity provider origins the cloud may fetch OIDC settings from (`--sso-origins`). */
@@ -21,6 +24,10 @@ export interface AuthDeps {
     };
     checkPwned: boolean;
     retentionDays: number;
+    /** Billing is on (a Stripe key): plans limit features and retention. Off: everything is unlimited. */
+    billingOn: boolean;
+    /** The Stripe plugin's client, secret, prices, and plan sync, when billing is on. */
+    stripe?: StripeDeps;
 }
 /** A link into the dashboard. Tokens go in the hash, so they never reach a server log. */
 export declare const appLink: (deps: Pick<AuthDeps, "publicUrl">, route: string, token: string) => string;