@wizeworks/lens-cloud 0.3.0-alpha.2 → 0.3.0-alpha.4

package/dist/repo/auth-prune.js

@@ -1,8 +1,20 @@
-/** Remove expired sessions and links, and sign-in counters older than a day. Better Auth ignores them already; this keeps the tables small. */
+/** Remove expired sessions, links, and OAuth rows, and sign-in counters older than a day. Better Auth ignores them already; this keeps the tables small. */
 export async function pruneAuthRows(q) {
     await q.query("DELETE FROM sessions WHERE expires_at < now()");
     await q.query("DELETE FROM verifications WHERE expires_at < now()");
     await q.query("DELETE FROM rate_limits WHERE last_request < $1", [Date.now() - 86_400_000]);
     await q.query("DELETE FROM invites WHERE status <> 'pending' AND created_at < now() - interval '90 days'");
+    await pruneOAuthRows(q, Date.now());
+}
+/** Expired OAuth tokens, grants ended 90 days ago or never consented to, and registered apps nobody connected within a day. */
+async function pruneOAuthRows(q, now) {
+    await q.query("DELETE FROM oauth_access_tokens WHERE expires_at < now() - interval '1 day'");
+    await q.query("DELETE FROM oauth_refresh_tokens WHERE expires_at < now() - interval '1 day'");
+    await q.query("DELETE FROM oauth_client_assertions WHERE expires_at < now()");
+    await q.query("DELETE FROM oauth_grants WHERE revoked_ms < $1", [now - 90 * 86_400_000]);
+    await q.query("DELETE FROM oauth_grants g WHERE g.created_ms < $1 AND NOT EXISTS (SELECT 1 FROM oauth_consents k WHERE k.reference_id = g.id)", [now - 86_400_000]);
+    await q.query(`DELETE FROM oauth_clients c WHERE c.created_at < now() - interval '1 day'
+      AND NOT EXISTS (SELECT 1 FROM oauth_grants g WHERE g.client_id = c.client_id)
+      AND NOT EXISTS (SELECT 1 FROM oauth_refresh_tokens t WHERE t.client_id = c.client_id)`);
 }
 //# sourceMappingURL=auth-prune.js.map

package/dist/repo/auth-prune.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-prune.js","sourceRoot":"","sources":["../../src/repo/auth-prune.ts"],"names":[],"mappings":"AAEA,+IAA+I;AAC/I,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAY;IAC9C,MAAM,CAAC,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,MAAM,CAAC,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACpE,MAAM,CAAC,CAAC,KAAK,CAAC,iDAAiD,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,CAAC,KAAK,CAAC,2FAA2F,CAAC,CAAC;AAC7G,CAAC"}
+{"version":3,"file":"auth-prune.js","sourceRoot":"","sources":["../../src/repo/auth-prune.ts"],"names":[],"mappings":"AAEA,4JAA4J;AAC5J,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAY;IAC9C,MAAM,CAAC,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,MAAM,CAAC,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACpE,MAAM,CAAC,CAAC,KAAK,CAAC,iDAAiD,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,CAAC,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC3G,MAAM,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,+HAA+H;AAC/H,KAAK,UAAU,cAAc,CAAC,CAAY,EAAE,GAAW;IACrD,MAAM,CAAC,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC7F,MAAM,CAAC,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAC9F,MAAM,CAAC,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9E,MAAM,CAAC,CAAC,KAAK,CAAC,gDAAgD,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IACzF,MAAM,CAAC,CAAC,KAAK,CAAC,gIAAgI,EAAE,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC;IACpK,MAAM,CAAC,CAAC,KAAK,CACX;;4FAEwF,CACzF,CAAC;AACJ,CAAC"}

package/dist/repo/billing.d.ts

@@ -0,0 +1,30 @@
+import { type Feature, type Limits, type OrgPlanRow, type PlanId } from "../billing/plans.js";
+import type { Queryable } from "../db/db.js";
+export interface OrgBilling extends OrgPlanRow {
+    /** The monthly overage limit in cents (Team and Business), or null for none. */
+    spendCapCents: number | null;
+    stripeCustomerId: string | null;
+    /** The separate monthly subscription that bills extra GB (billing/overage-sub.ts). */
+    overageSubscriptionId: string | null;
+}
+export declare function orgBilling(q: Queryable, orgId: string): Promise<OrgBilling | undefined>;
+/** The limits that apply to an organization now; unlimited while billing is off. */
+export declare function orgLimits(q: Queryable, orgId: string, billingOn: boolean): Promise<Limits>;
+export declare function orgHas(q: Queryable, orgId: string, billingOn: boolean, feature: Feature): Promise<boolean>;
+export interface PlanChange {
+    plan: PlanId;
+    /** Enterprise only. */
+    gb?: number | null;
+    retentionDays?: number | null;
+}
+/** Set the plan, lower retention to the plan's maximum, and write an audit line. Returns false when nothing changed. */
+export declare function setPlan(q: Queryable, orgId: string, change: PlanChange, actor: string, now: number): Promise<boolean>;
+export declare function setSpendCap(q: Queryable, orgId: string, cents: number | null, actor: string, now: number): Promise<void>;
+/** Organizations by id or slug, for the `plan set` command. */
+export declare function findOrg(q: Queryable, idOrSlug: string): Promise<{
+    id: string;
+    name: string;
+} | undefined>;
+/** True while a Stripe subscription still runs (or retries a payment) for the organization. */
+export declare function hasLivePlan(q: Queryable, orgId: string): Promise<boolean>;
+//# sourceMappingURL=billing.d.ts.map

package/dist/repo/billing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../../src/repo/billing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,MAAM,EAAY,KAAK,UAAU,EAAE,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,gFAAgF;IAChF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,sFAAsF;IACtF,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAKD,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAG7F;AAED,oFAAoF;AACpF,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhG;AAED,wBAAsB,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhH;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,wHAAwH;AACxH,wBAAsB,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAY3H;AAED,wBAAsB,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9H;AAED,+DAA+D;AAC/D,wBAAsB,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAG/G;AAED,+FAA+F;AAC/F,wBAAsB,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG/E"}

package/dist/repo/billing.js

@@ -0,0 +1,47 @@
+import { isPlanId, limitsOf } from "../billing/plans.js";
+import { audit } from "./audit.js";
+const COLUMNS = `plan, plan_gb AS "planGb", plan_retention_days AS "planRetentionDays", spend_cap_cents AS "spendCapCents",
+  stripe_customer_id AS "stripeCustomerId", overage_subscription_id AS "overageSubscriptionId"`;
+export async function orgBilling(q, orgId) {
+    const [row] = await q.query(`SELECT ${COLUMNS} FROM orgs WHERE id = $1`, [orgId]);
+    return row ? { ...row, plan: isPlanId(row.plan) ? row.plan : "free" } : undefined;
+}
+/** The limits that apply to an organization now; unlimited while billing is off. */
+export async function orgLimits(q, orgId, billingOn) {
+    return limitsOf((await orgBilling(q, orgId)) ?? { plan: "free", planGb: null, planRetentionDays: null }, billingOn);
+}
+export async function orgHas(q, orgId, billingOn, feature) {
+    return !billingOn || (await orgLimits(q, orgId, billingOn)).plan.features[feature];
+}
+/** Set the plan, lower retention to the plan's maximum, and write an audit line. Returns false when nothing changed. */
+export async function setPlan(q, orgId, change, actor, now) {
+    const before = await orgBilling(q, orgId);
+    if (!before)
+        throw new Error(`No organization ${orgId}.`);
+    const custom = change.plan === "enterprise";
+    const gb = custom ? (change.gb ?? before.planGb) : null;
+    const days = custom ? (change.retentionDays ?? before.planRetentionDays) : null;
+    if (before.plan === change.plan && before.planGb === gb && before.planRetentionDays === days)
+        return false;
+    const max = limitsOf({ plan: change.plan, planGb: gb, planRetentionDays: days }, true).maxRetentionDays;
+    await q.query("UPDATE orgs SET plan = $1, plan_gb = $2, plan_retention_days = $3, retention_days = LEAST(retention_days, $4) WHERE id = $5", [change.plan, gb, days, max, orgId]);
+    if (change.plan !== "team" && change.plan !== "business")
+        await q.query("UPDATE orgs SET spend_cap_cents = NULL WHERE id = $1", [orgId]);
+    await audit(q, orgId, actor, "plan.change", { from: before.plan, plan: change.plan, ...(custom ? { gb, retentionDays: days } : {}) }, now);
+    return true;
+}
+export async function setSpendCap(q, orgId, cents, actor, now) {
+    await q.query("UPDATE orgs SET spend_cap_cents = $1 WHERE id = $2", [cents, orgId]);
+    await audit(q, orgId, actor, "billing.cap", { capUsd: cents === null ? null : cents / 100 }, now);
+}
+/** Organizations by id or slug, for the `plan set` command. */
+export async function findOrg(q, idOrSlug) {
+    const [row] = await q.query("SELECT id, name FROM orgs WHERE id = $1 OR slug = $1", [idOrSlug]);
+    return row;
+}
+/** True while a Stripe subscription still runs (or retries a payment) for the organization. */
+export async function hasLivePlan(q, orgId) {
+    const [row] = await q.query("SELECT EXISTS (SELECT 1 FROM subscriptions WHERE reference_id = $1 AND status IN ('active', 'trialing', 'past_due')) AS live", [orgId]);
+    return row?.live === true;
+}
+//# sourceMappingURL=billing.js.map

package/dist/repo/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../../src/repo/billing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,QAAQ,EAAe,QAAQ,EAAgC,MAAM,qBAAqB,CAAC;AAElH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAYnC,MAAM,OAAO,GAAG;+FAC+E,CAAC;AAEhG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,KAAa;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAa,UAAU,OAAO,0BAA0B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9F,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,KAAa,EAAE,SAAkB;IAC7E,OAAO,QAAQ,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,CAAY,EAAE,KAAa,EAAE,SAAkB,EAAE,OAAgB;IAC5F,OAAO,CAAC,SAAS,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC;AASD,wHAAwH;AACxH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,CAAY,EAAE,KAAa,EAAE,MAAkB,EAAE,KAAa,EAAE,GAAW;IACvG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,GAAG,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3G,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,gBAAgB,CAAC;IACxG,MAAM,CAAC,CAAC,KAAK,CAAC,6HAA6H,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAClL,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,CAAC,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACzI,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3I,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAY,EAAE,KAAa,EAAE,KAAoB,EAAE,KAAa,EAAE,GAAW;IAC7G,MAAM,CAAC,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AACpG,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,CAAY,EAAE,QAAgB;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAA+B,sDAAsD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9H,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAY,EAAE,KAAa;IAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAoB,8HAA8H,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACxL,OAAO,GAAG,EAAE,IAAI,KAAK,IAAI,CAAC;AAC5B,CAAC"}

package/dist/repo/grants.d.ts

@@ -0,0 +1,30 @@
+import type { Queryable } from "../db/db.js";
+/** What one person let one connected app (an OAuth client, such as Claude) read: one organization, all of it or some projects. */
+export interface Grant {
+    id: string;
+    userId: string;
+    orgId: string;
+    clientId: string;
+    /** Every project of the organization, also ones made later. */
+    allProjects: boolean;
+    projectIds: string[];
+    createdMs: number;
+    usedMs: number | null;
+}
+/** A grant with the app's name and the organization's, for the connected apps lists. */
+export interface GrantView extends Grant {
+    clientName: string | null;
+    orgName: string;
+    userEmail: string;
+}
+/** A new grant from the consent page. Older grants of this person to this app end, with their tokens: the app holds only the newest. */
+export declare function createGrant(q: Queryable, g: Omit<Grant, "id" | "usedMs" | "createdMs">, sessionId: string, now: number): Promise<string>;
+/** The grant this session just chose on the consent page, for Better Auth to tie the consent to. */
+export declare function pendingGrantId(q: Queryable, sessionId: string, now: number): Promise<string | undefined>;
+/** An open grant by id. Marks it used (at most once a minute). */
+export declare function grantById(q: Queryable, id: string, now: number): Promise<Grant | undefined>;
+/** End a grant: its tokens and consent go too, so the app must ask again. False when it was not open. */
+export declare function endGrant(q: Queryable, id: string, now: number): Promise<boolean>;
+export declare function grantsOfUser(q: Queryable, userId: string): Promise<GrantView[]>;
+export declare function grantsOfOrg(q: Queryable, orgId: string): Promise<GrantView[]>;
+//# sourceMappingURL=grants.d.ts.map

package/dist/repo/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/repo/grants.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C,kIAAkI;AAClI,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wFAAwF;AACxF,MAAM,WAAW,SAAU,SAAQ,KAAK;IACtC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AA0BD,wIAAwI;AACxI,wBAAsB,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9I;AAED,oGAAoG;AACpG,wBAAsB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM9G;AAED,kEAAkE;AAClE,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAKjG;AAED,yGAAyG;AACzG,wBAAsB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMtF;AAWD,wBAAsB,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAErF;AAED,wBAAsB,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEnF"}

package/dist/repo/grants.js

@@ -0,0 +1,57 @@
+import { newId } from "../auth/crypto.js";
+/** How long a choice on the consent page waits for its consent. */
+const PENDING_MS = 10 * 60_000;
+const COLUMNS = "g.id, g.user_id, g.org_id, g.client_id, g.all_projects, g.project_ids, g.created_ms, g.used_ms";
+const toGrant = (r) => ({
+    id: r.id,
+    userId: r.user_id,
+    orgId: r.org_id,
+    clientId: r.client_id,
+    allProjects: r.all_projects,
+    projectIds: JSON.parse(r.project_ids),
+    createdMs: r.created_ms,
+    usedMs: r.used_ms,
+});
+/** A new grant from the consent page. Older grants of this person to this app end, with their tokens: the app holds only the newest. */
+export async function createGrant(q, g, sessionId, now) {
+    const id = newId();
+    const old = await q.query("SELECT id FROM oauth_grants WHERE user_id = $1 AND client_id = $2 AND revoked_ms IS NULL", [g.userId, g.clientId]);
+    for (const o of old)
+        await endGrant(q, o.id, now);
+    await q.query("INSERT INTO oauth_grants (id, user_id, org_id, client_id, session_id, all_projects, project_ids, created_ms) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", [id, g.userId, g.orgId, g.clientId, sessionId, g.allProjects, JSON.stringify(g.allProjects ? [] : g.projectIds), now]);
+    return id;
+}
+/** The grant this session just chose on the consent page, for Better Auth to tie the consent to. */
+export async function pendingGrantId(q, sessionId, now) {
+    const [row] = await q.query("SELECT id FROM oauth_grants WHERE session_id = $1 AND created_ms > $2 AND revoked_ms IS NULL ORDER BY created_ms DESC LIMIT 1", [sessionId, now - PENDING_MS]);
+    return row?.id;
+}
+/** An open grant by id. Marks it used (at most once a minute). */
+export async function grantById(q, id, now) {
+    const [row] = await q.query(`SELECT ${COLUMNS} FROM oauth_grants g WHERE g.id = $1 AND g.revoked_ms IS NULL`, [id]);
+    if (!row)
+        return undefined;
+    if (!row.used_ms || now - row.used_ms > 60_000)
+        await q.query("UPDATE oauth_grants SET used_ms = $1 WHERE id = $2", [now, id]);
+    return toGrant(row);
+}
+/** End a grant: its tokens and consent go too, so the app must ask again. False when it was not open. */
+export async function endGrant(q, id, now) {
+    const rows = await q.query("UPDATE oauth_grants SET revoked_ms = $1 WHERE id = $2 AND revoked_ms IS NULL RETURNING id", [now, id]);
+    await q.query("DELETE FROM oauth_access_tokens WHERE reference_id = $1", [id]);
+    await q.query("DELETE FROM oauth_refresh_tokens WHERE reference_id = $1", [id]);
+    await q.query("DELETE FROM oauth_consents WHERE reference_id = $1", [id]);
+    return rows.length > 0;
+}
+const VIEW = `SELECT ${COLUMNS}, c.name AS client_name, o.name AS org_name, u.email AS user_email
+  FROM oauth_grants g JOIN oauth_clients c ON c.client_id = g.client_id JOIN orgs o ON o.id = g.org_id JOIN users u ON u.id = g.user_id`;
+const toView = (r) => ({ ...toGrant(r), clientName: r.client_name, orgName: r.org_name, userEmail: r.user_email });
+/** Open grants the person gave consent for. */
+const DONE = "g.revoked_ms IS NULL AND EXISTS (SELECT 1 FROM oauth_consents k WHERE k.reference_id = g.id)";
+export async function grantsOfUser(q, userId) {
+    return (await q.query(`${VIEW} WHERE g.user_id = $1 AND ${DONE} ORDER BY g.created_ms DESC`, [userId])).map(toView);
+}
+export async function grantsOfOrg(q, orgId) {
+    return (await q.query(`${VIEW} WHERE g.org_id = $1 AND ${DONE} ORDER BY g.created_ms DESC`, [orgId])).map(toView);
+}
+//# sourceMappingURL=grants.js.map

package/dist/repo/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/repo/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,mEAAmE;AACnE,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC;AAiC/B,MAAM,OAAO,GAAG,gGAAgG,CAAC;AAEjH,MAAM,OAAO,GAAG,CAAC,CAAW,EAAS,EAAE,CAAC,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM;IACf,QAAQ,EAAE,CAAC,CAAC,SAAS;IACrB,WAAW,EAAE,CAAC,CAAC,YAAY;IAC3B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAa;IACjD,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;CAClB,CAAC,CAAC;AAEH,wIAAwI;AACxI,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAY,EAAE,CAA6C,EAAE,SAAiB,EAAE,GAAW;IAC3H,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,KAAK,CAAiB,0FAA0F,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9J,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,CAAC,CAAC,KAAK,CACX,sJAAsJ,EACtJ,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CACtH,CAAC;IACF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAY,EAAE,SAAiB,EAAE,GAAW;IAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CACzB,+HAA+H,EAC/H,CAAC,SAAS,EAAE,GAAG,GAAG,UAAU,CAAC,CAC9B,CAAC;IACF,OAAO,GAAG,EAAE,EAAE,CAAC;AACjB,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,EAAU,EAAE,GAAW;IACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAW,UAAU,OAAO,+DAA+D,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9H,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM;QAAE,MAAM,CAAC,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/H,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAY,EAAE,EAAU,EAAE,GAAW;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,2FAA2F,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACnI,MAAM,CAAC,CAAC,KAAK,CAAC,yDAAyD,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,CAAC,KAAK,CAAC,0DAA0D,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,CAAC,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,IAAI,GAAG,UAAU,OAAO;wIAC0G,CAAC;AAGzI,MAAM,MAAM,GAAG,CAAC,CAAU,EAAa,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;AAEvI,+CAA+C;AAC/C,MAAM,IAAI,GAAG,8FAA8F,CAAC;AAE5G,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAY,EAAE,MAAc;IAC7D,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAU,GAAG,IAAI,6BAA6B,IAAI,6BAA6B,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC/H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAY,EAAE,KAAa;IAC3D,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAU,GAAG,IAAI,4BAA4B,IAAI,6BAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7H,CAAC"}

package/dist/repo/issues.d.ts

@@ -0,0 +1,15 @@
+import type { IssueKind, IssueState } from "@wizeworks/lens-core";
+import type { Queryable } from "../db/db.js";
+/** Every issue state of a project. */
+export declare function listIssues(q: Queryable, projectId: string): Promise<IssueState[]>;
+/** One issue's state, or undefined. */
+export declare function issueOf(q: Queryable, projectId: string, kind: IssueKind, key: string): Promise<IssueState | undefined>;
+/** Keep a state, or remove it (null: back to plain unresolved). */
+export declare function saveIssue(q: Queryable, projectId: string, kind: IssueKind, key: string, state: IssueState | null, actor: string): Promise<void>;
+/** Members of an organization a person can assign issues to. */
+export declare function assignableMembers(q: Queryable, orgId: string): Promise<{
+    id: string;
+    name: string;
+    email: string;
+}[]>;
+//# sourceMappingURL=issues.d.ts.map

package/dist/repo/issues.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issues.d.ts","sourceRoot":"","sources":["../../src/repo/issues.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAsB7C,sCAAsC;AACtC,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAGvF;AAED,uCAAuC;AACvC,wBAAsB,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAG5H;AAED,mEAAmE;AACnE,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrJ;AAED,gEAAgE;AAChE,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CAE3H"}

package/dist/repo/issues.js

@@ -0,0 +1,31 @@
+const stateOf = (r) => ({
+    kind: r.kind,
+    key: r.key,
+    status: r.status,
+    untilMs: r.until_ms === null ? null : Number(r.until_ms),
+    resolvedMs: r.resolved_ms === null ? null : Number(r.resolved_ms),
+    assignee: r.assignee,
+    updatedMs: Number(r.updated_ms),
+});
+/** Every issue state of a project. */
+export async function listIssues(q, projectId) {
+    const rows = await q.query("SELECT kind, key, status, until_ms, resolved_ms, assignee, updated_ms FROM issues WHERE project_id = $1", [projectId]);
+    return rows.map(stateOf);
+}
+/** One issue's state, or undefined. */
+export async function issueOf(q, projectId, kind, key) {
+    const [row] = await q.query("SELECT kind, key, status, until_ms, resolved_ms, assignee, updated_ms FROM issues WHERE project_id = $1 AND kind = $2 AND key = $3", [projectId, kind, key]);
+    return row ? stateOf(row) : undefined;
+}
+/** Keep a state, or remove it (null: back to plain unresolved). */
+export async function saveIssue(q, projectId, kind, key, state, actor) {
+    if (!state)
+        return void (await q.query("DELETE FROM issues WHERE project_id = $1 AND kind = $2 AND key = $3", [projectId, kind, key]));
+    await q.query(`INSERT INTO issues (project_id, kind, key, status, until_ms, resolved_ms, assignee, updated_ms, updated_by) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+     ON CONFLICT (project_id, kind, key) DO UPDATE SET status = $4, until_ms = $5, resolved_ms = $6, assignee = $7, updated_ms = $8, updated_by = $9`, [projectId, kind, key, state.status, state.untilMs, state.resolvedMs, state.assignee, state.updatedMs, actor]);
+}
+/** Members of an organization a person can assign issues to. */
+export async function assignableMembers(q, orgId) {
+    return q.query("SELECT u.id, u.name, u.email FROM members m JOIN users u ON u.id = m.user_id WHERE m.org_id = $1 ORDER BY u.name, u.email", [orgId]);
+}
+//# sourceMappingURL=issues.js.map

package/dist/repo/issues.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issues.js","sourceRoot":"","sources":["../../src/repo/issues.ts"],"names":[],"mappings":"AAcA,MAAM,OAAO,GAAG,CAAC,CAAM,EAAc,EAAE,CAAC,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAiB;IACzB,GAAG,EAAE,CAAC,CAAC,GAAG;IACV,MAAM,EAAE,CAAC,CAAC,MAA8B;IACxC,OAAO,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;IACjE,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;CAChC,CAAC,CAAC;AAEH,sCAAsC;AACtC,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,SAAiB;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,CAAM,yGAAyG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACxJ,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,CAAY,EAAE,SAAiB,EAAE,IAAe,EAAE,GAAW;IACzF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAM,oIAAoI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/L,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,SAAiB,EAAE,IAAe,EAAE,GAAW,EAAE,KAAwB,EAAE,KAAa;IACpI,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,qEAAqE,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACvI,MAAM,CAAC,CAAC,KAAK,CACX;qJACiJ,EACjJ,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAC9G,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,CAAY,EAAE,KAAa;IACjE,OAAO,CAAC,CAAC,KAAK,CAA8C,2HAA2H,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AACpM,CAAC"}

package/dist/repo/keys.d.ts

@@ -0,0 +1,51 @@
+import type { Queryable } from "../db/db.js";
+export type KeyKind = "ingest" | "read";
+export declare const INGEST_SCOPES: readonly ["traces", "logs", "metrics"];
+export declare const READ_SCOPES: readonly ["api", "mcp"];
+export type IngestScope = (typeof INGEST_SCOPES)[number];
+export type ReadScope = (typeof READ_SCOPES)[number];
+export type KeyScope = IngestScope | ReadScope;
+export interface ApiKey {
+    id: string;
+    kind: KeyKind;
+    name: string;
+    prefix: string;
+    /** Ingest keys: exactly one project. Read keys: the projects they may read. */
+    projectIds: string[];
+    /** What the key may do; null for everything its kind allows. */
+    scopes: KeyScope[] | null;
+    createdMs: number;
+    lastUsedMs: number | null;
+    /** The key stops working at this time; null for never. */
+    expiresMs: number | null;
+    /** The key this one replaced. */
+    rotatedFrom: string | null;
+}
+export declare const keyAllows: (key: Pick<ApiKey, "scopes">, scope: KeyScope) => boolean;
+/** Checked scopes for a kind: null (all) when none or all are picked. Throws a message for people on a bad one. */
+export declare function scopesFor(kind: KeyKind, raw: unknown): KeyScope[] | null;
+export interface KeyExtras {
+    scopes?: KeyScope[] | null;
+    expiresMs?: number | null;
+    rotatedFrom?: string;
+}
+/** A new key. Returns the secret once; only its hash is kept. */
+export declare function createKey(q: Queryable, orgId: string, kind: KeyKind, name: string, projectIds: string[], by: string, now: number, x?: KeyExtras): Promise<{
+    id: string;
+    token: string;
+}>;
+/** Keys not revoked, newest first; expired ones too, so people see them and clean up. */
+export declare function listKeys(q: Queryable, orgId: string): Promise<ApiKey[]>;
+export declare function keyInOrg(q: Queryable, orgId: string, keyId: string): Promise<ApiKey | undefined>;
+export declare function revokeKey(q: Queryable, orgId: string, keyId: string, now: number): Promise<boolean>;
+/** A new secret with the same name, kind, projects, scopes, and lifetime. The old one keeps working for `graceMs`, so apps can switch. */
+export declare function rotateKey(q: Queryable, orgId: string, old: ApiKey, by: string, now: number, graceMs: number): Promise<{
+    id: string;
+    token: string;
+    oldExpiresMs: number;
+}>;
+/** The key for a secret, when it is valid and not expired. Marks it used (at most once a minute). */
+export declare function keyByToken(q: Queryable, token: string, now: number): Promise<(ApiKey & {
+    orgId: string;
+}) | undefined>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/repo/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/repo/keys.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AACxC,eAAO,MAAM,aAAa,YAAI,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AACpE,eAAO,MAAM,WAAW,YAAI,KAAK,EAAE,KAAK,CAAU,CAAC;AACnD,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AACzD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gEAAgE;IAChE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iCAAiC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAWD,eAAO,MAAM,SAAS,QAAS,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,QAAQ,KAAG,OAAoD,CAAC;AAE9H,mHAAmH;AACnH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,QAAQ,EAAE,GAAG,IAAI,CAOxE;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,iEAAiE;AACjE,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,GAAE,SAAc;;;GASzJ;AAED,yFAAyF;AACzF,wBAAsB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAG7E;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAGtG;AAED,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGzG;AAED,0IAA0I;AAC1I,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;;;;GAMjH;AAED,qGAAqG;AACrG,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,CAAC,CAK5H"}

package/dist/repo/keys.js

@@ -0,0 +1,58 @@
+// API keys: ingest keys send one project's data, read keys read some projects. Optional expiry, scopes, and rotation with a grace period.
+import { hashToken, newId, newToken } from "../auth/crypto.js";
+export const INGEST_SCOPES = ["traces", "logs", "metrics"];
+export const READ_SCOPES = ["api", "mcp"];
+const KEY_COLUMNS = `id, org_id, kind, name, prefix, project_ids, scopes, created_ms AS "createdMs", last_used_ms AS "lastUsedMs", expires_ms AS "expiresMs", rotated_from AS "rotatedFrom"`;
+const toKey = ({ project_ids, scopes, org_id: _org, ...k }) => ({ ...k, projectIds: JSON.parse(project_ids), scopes: scopes ? JSON.parse(scopes) : null });
+export const keyAllows = (key, scope) => !key.scopes || key.scopes.includes(scope);
+/** Checked scopes for a kind: null (all) when none or all are picked. Throws a message for people on a bad one. */
+export function scopesFor(kind, raw) {
+    if (raw === undefined || raw === null)
+        return null;
+    const all = kind === "ingest" ? INGEST_SCOPES : READ_SCOPES;
+    if (!Array.isArray(raw) || raw.some((s) => !all.includes(s)))
+        throw new Error(`Scopes for a ${kind} key are: ${all.join(", ")}.`);
+    const picked = all.filter((s) => raw.includes(s));
+    if (!picked.length)
+        throw new Error("Pick at least one scope.");
+    return picked.length === all.length ? null : picked;
+}
+/** A new key. Returns the secret once; only its hash is kept. */
+export async function createKey(q, orgId, kind, name, projectIds, by, now, x = {}) {
+    const token = newToken(kind);
+    const id = newId();
+    await q.query(`INSERT INTO api_keys (id, org_id, kind, project_ids, name, prefix, token_hash, created_by, created_ms, scopes, expires_ms, rotated_from)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`, [id, orgId, kind, JSON.stringify(projectIds), name.trim().slice(0, 100) || kind, token.slice(0, 12), hashToken(token), by, now, x.scopes ? JSON.stringify(x.scopes) : null, x.expiresMs ?? null, x.rotatedFrom ?? null]);
+    return { id, token };
+}
+/** Keys not revoked, newest first; expired ones too, so people see them and clean up. */
+export async function listKeys(q, orgId) {
+    const rows = await q.query(`SELECT ${KEY_COLUMNS} FROM api_keys WHERE org_id = $1 AND revoked_ms IS NULL ORDER BY created_ms DESC`, [orgId]);
+    return rows.map(toKey);
+}
+export async function keyInOrg(q, orgId, keyId) {
+    const [row] = await q.query(`SELECT ${KEY_COLUMNS} FROM api_keys WHERE org_id = $1 AND id = $2 AND revoked_ms IS NULL`, [orgId, keyId]);
+    return row && toKey(row);
+}
+export async function revokeKey(q, orgId, keyId, now) {
+    const rows = await q.query("UPDATE api_keys SET revoked_ms = $1 WHERE org_id = $2 AND id = $3 AND revoked_ms IS NULL RETURNING id", [now, orgId, keyId]);
+    return rows.length > 0;
+}
+/** A new secret with the same name, kind, projects, scopes, and lifetime. The old one keeps working for `graceMs`, so apps can switch. */
+export async function rotateKey(q, orgId, old, by, now, graceMs) {
+    const life = old.expiresMs === null ? null : old.expiresMs - old.createdMs;
+    const key = await createKey(q, orgId, old.kind, old.name, old.projectIds, by, now, { scopes: old.scopes, expiresMs: life === null ? null : now + life, rotatedFrom: old.id });
+    const until = Math.min(old.expiresMs ?? Infinity, now + graceMs);
+    await q.query("UPDATE api_keys SET expires_ms = $1 WHERE id = $2", [until, old.id]);
+    return { ...key, oldExpiresMs: until };
+}
+/** The key for a secret, when it is valid and not expired. Marks it used (at most once a minute). */
+export async function keyByToken(q, token, now) {
+    const [row] = await q.query(`SELECT ${KEY_COLUMNS} FROM api_keys WHERE token_hash = $1 AND revoked_ms IS NULL AND (expires_ms IS NULL OR expires_ms > $2)`, [hashToken(token), now]);
+    if (!row)
+        return undefined;
+    if (!row.lastUsedMs || now - row.lastUsedMs > 60_000)
+        await q.query("UPDATE api_keys SET last_used_ms = $1 WHERE id = $2", [now, row.id]);
+    return { ...toKey(row), orgId: row.org_id };
+}
+//# sourceMappingURL=keys.js.map

package/dist/repo/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/repo/keys.ts"],"names":[],"mappings":"AAAA,0IAA0I;AAC1I,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAI/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AACpE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,KAAK,CAAU,CAAC;AA4BnD,MAAM,WAAW,GAAG,wKAAwK,CAAC;AAC7L,MAAM,KAAK,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAEvM,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAA2B,EAAE,KAAe,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE9H,mHAAmH;AACnH,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,GAAY;IACnD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,GAAG,GAAsB,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IAC/E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAW,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,aAAa,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5I,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAe,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACtD,CAAC;AAQD,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,KAAa,EAAE,IAAa,EAAE,IAAY,EAAE,UAAoB,EAAE,EAAU,EAAE,GAAW,EAAE,CAAC,GAAc,EAAE;IACxJ,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,CAAC,KAAK,CACX;gEAC4D,EAC5D,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CACxN,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAY,EAAE,KAAa;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,CAAS,UAAU,WAAW,kFAAkF,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACrJ,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAY,EAAE,KAAa,EAAE,KAAa;IACvE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAS,UAAU,WAAW,qEAAqE,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAChJ,OAAO,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,KAAa,EAAE,KAAa,EAAE,GAAW;IACrF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,uGAAuG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACzJ,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,0IAA0I;AAC1I,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,KAAa,EAAE,GAAW,EAAE,EAAU,EAAE,GAAW,EAAE,OAAe;IAChH,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAC3E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9K,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACjE,MAAM,CAAC,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,KAAa,EAAE,GAAW;IACvE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAS,UAAU,WAAW,yGAAyG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7L,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,GAAG,MAAM;QAAE,MAAM,CAAC,CAAC,KAAK,CAAC,qDAAqD,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1I,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC9C,CAAC"}

package/dist/repo/log-retention.d.ts

@@ -0,0 +1,8 @@
+import type { Queryable } from "../db/db.js";
+/** How long each project keeps log lines, in days: its own log retention, else what the project keeps traces for. */
+export declare const LOG_DAYS_SQL = "COALESCE(p.log_retention_days, LEAST(COALESCE(p.retention_days, o.retention_days), o.retention_days))";
+/** Log retention days per project; projects that no longer exist are left out. */
+export declare function logDaysOf(q: Queryable, projectIds?: readonly string[]): Promise<Map<string, number>>;
+/** Drop log lines past each project's log retention: raw lines, their facts and search rows, and the log rollups. Loose batches go with the traces (pruneByRetention). */
+export declare function pruneLogsByRetention(q: Queryable, now: number): Promise<void>;
+//# sourceMappingURL=log-retention.d.ts.map

package/dist/repo/log-retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-retention.d.ts","sourceRoot":"","sources":["../../src/repo/log-retention.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C,qHAAqH;AACrH,eAAO,MAAM,YAAY,0GAAiD,CAAC;AAE3E,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAI1G;AAED,0KAA0K;AAC1K,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnF"}

package/dist/repo/log-retention.js

@@ -0,0 +1,20 @@
+import { logPruneStatements, PG_DIALECT } from "@wizeworks/lens-core";
+import { runStatements } from "../settle.js";
+import { KEEP_DAYS } from "./settings.js";
+const DAY_MS = 86_400_000;
+/** How long each project keeps log lines, in days: its own log retention, else what the project keeps traces for. */
+export const LOG_DAYS_SQL = `COALESCE(p.log_retention_days, ${KEEP_DAYS})`;
+/** Log retention days per project; projects that no longer exist are left out. */
+export async function logDaysOf(q, projectIds) {
+    const where = projectIds ? "WHERE p.id = ANY($1)" : "";
+    const rows = await q.query(`SELECT p.id, ${LOG_DAYS_SQL} AS d FROM projects p JOIN orgs o ON o.id = p.org_id ${where}`, projectIds ? [[...projectIds]] : []);
+    return new Map(rows.map((r) => [r.id, r.d]));
+}
+/** Drop log lines past each project's log retention: raw lines, their facts and search rows, and the log rollups. Loose batches go with the traces (pruneByRetention). */
+export async function pruneLogsByRetention(q, now) {
+    for (const [project, days] of await logDaysOf(q)) {
+        await q.query("DELETE FROM logs WHERE project_id = $1 AND time_ms < $2", [project, now - days * DAY_MS]);
+        await runStatements(q, logPruneStatements(PG_DIALECT, project, now, days * DAY_MS));
+    }
+}
+//# sourceMappingURL=log-retention.js.map

package/dist/repo/log-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-retention.js","sourceRoot":"","sources":["../../src/repo/log-retention.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,qHAAqH;AACrH,MAAM,CAAC,MAAM,YAAY,GAAG,kCAAkC,SAAS,GAAG,CAAC;AAE3E,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,UAA8B;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,CAA4B,gBAAgB,YAAY,wDAAwD,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxL,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,0KAA0K;AAC1K,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,CAAY,EAAE,GAAW;IAClE,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,CAAC,KAAK,CAAC,yDAAyD,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;QACzG,MAAM,aAAa,CAAC,CAAC,EAAE,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC;AACH,CAAC"}

package/dist/repo/metric-read.d.ts

@@ -7,6 +7,8 @@ export interface MetricQuery {
 }
 /** The metrics page data for one project, from the metric rollup tiers. `now` is rounded down to 10 s. */
 export declare function loadMetricData(q: Queryable, m: MetricQuery, range: TimeRange, params: Readonly<Record<string, string>>, now: number): Promise<MetricData>;
+/** Host and Kubernetes series for one project, from the metric rollup tiers. */
+export declare function loadInfraData(q: Queryable, m: MetricQuery, range: TimeRange, params: Readonly<Record<string, string>>, now: number): Promise<MetricData>;
 /** One metric over an alert rule's window, from the metric rollup tiers. */
 export declare function loadMetricAlertData(q: Queryable, m: MetricQuery, name: string, w: TimeWindow, now: number): Promise<MetricAlertData>;
 //# sourceMappingURL=metric-read.d.ts.map

package/dist/repo/metric-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metric-read.d.ts","sourceRoot":"","sources":["../../src/repo/metric-read.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAKf,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,0GAA0G;AAC1G,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAEzJ;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEpI"}
+{"version":3,"file":"metric-read.d.ts","sourceRoot":"","sources":["../../src/repo/metric-read.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAKf,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,0GAA0G;AAC1G,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAEzJ;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAExJ;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEpI"}

package/dist/repo/metric-read.js

@@ -1,9 +1,13 @@
-import { alignNow, metricAlertSteps, metricPageSteps, runMetricAsync, } from "@wizeworks/lens-core";
+import { alignNow, infraSteps, metricAlertSteps, metricPageSteps, runMetricAsync, } from "@wizeworks/lens-core";
 const run = (q) => (s) => q.query(s.sql, s.args);
 /** The metrics page data for one project, from the metric rollup tiers. `now` is rounded down to 10 s. */
 export function loadMetricData(q, m, range, params, now) {
     return runMetricAsync(metricPageSteps("pg", { project: m.projectId, env: m.env }, range, alignNow(now), params), run(q));
 }
+/** Host and Kubernetes series for one project, from the metric rollup tiers. */
+export function loadInfraData(q, m, range, params, now) {
+    return runMetricAsync(infraSteps("pg", { project: m.projectId, env: m.env }, range, alignNow(now), params), run(q));
+}
 /** One metric over an alert rule's window, from the metric rollup tiers. */
 export function loadMetricAlertData(q, m, name, w, now) {
     return runMetricAsync(metricAlertSteps("pg", { project: m.projectId, env: m.env, service: m.service }, name, w, now), run(q));

package/dist/repo/metric-read.js.map

@@ -1 +1 @@
-{"version":3,"file":"metric-read.js","sourceRoot":"","sources":["../../src/repo/metric-read.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EAER,gBAAgB,EAEhB,eAAe,EAGf,cAAc,GAGf,MAAM,sBAAsB,CAAC;AAS9B,MAAM,GAAG,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAA0B,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAwB,CAAC;AAEvH,0GAA0G;AAC1G,MAAM,UAAU,cAAc,CAAC,CAAY,EAAE,CAAc,EAAE,KAAgB,EAAE,MAAwC,EAAE,GAAW;IAClI,OAAO,cAAc,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,CAAY,EAAE,CAAc,EAAE,IAAY,EAAE,CAAa,EAAE,GAAW;IACxG,OAAO,cAAc,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChI,CAAC"}
+{"version":3,"file":"metric-read.js","sourceRoot":"","sources":["../../src/repo/metric-read.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,UAAU,EAEV,gBAAgB,EAEhB,eAAe,EAGf,cAAc,GAGf,MAAM,sBAAsB,CAAC;AAS9B,MAAM,GAAG,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAA0B,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAwB,CAAC;AAEvH,0GAA0G;AAC1G,MAAM,UAAU,cAAc,CAAC,CAAY,EAAE,CAAc,EAAE,KAAgB,EAAE,MAAwC,EAAE,GAAW;IAClI,OAAO,cAAc,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,CAAY,EAAE,CAAc,EAAE,KAAgB,EAAE,MAAwC,EAAE,GAAW;IACjI,OAAO,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACtH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,CAAY,EAAE,CAAc,EAAE,IAAY,EAAE,CAAa,EAAE,GAAW;IACxG,OAAO,cAAc,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChI,CAAC"}

package/dist/repo/metric-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metric-write.d.ts","sourceRoot":"","sources":["../../src/repo/metric-write.ts"],"names":[],"mappings":"AACA,OAAO,EAQL,KAAK,WAAW,EAYjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C,wDAAwD;AACxD,eAAO,MAAM,aAAa,UAA6D,CAAC;AAsBxF,+GAA+G;AAC/G,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcjJ;AAED,4HAA4H;AAC5H,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjF"}
+{"version":3,"file":"metric-write.d.ts","sourceRoot":"","sources":["../../src/repo/metric-write.ts"],"names":[],"mappings":"AACA,OAAO,EAQL,KAAK,WAAW,EAYjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAO7C,wDAAwD;AACxD,eAAO,MAAM,aAAa,UAA6D,CAAC;AAsBxF,+GAA+G;AAC/G,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcjJ;AAED,4HAA4H;AAC5H,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjF"}

package/dist/repo/metric-write.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { groupMetricSeries, mergeStoredHists, metricBatchWrites, metricHistOfColumns, metricHistStateSql, metricPlaceholderValues, metricSeriesInsertSql, metricSeriesUpsertSql, metricSeriesValues, metricStateOfColumns, tierCutoff, metricStateSql, metricTierUpsertSql, metricTierValues, seriesKeyOf, TIERS, } from "@wizeworks/lens-core";
+import { KEEP_DAYS } from "./settings.js";
 // Metric rollups at ingest (docs/CONTRACT.md, "Cloud storage"): written with the raw points, in the same transaction.
 const CHUNK = 200;
 const sha1 = (text) => createHash("sha1").update(text).digest("hex");
@@ -47,7 +48,7 @@ export async function pruneMetricRollups(q, now) {
     for (const t of TIERS.filter((x) => x.keepMs !== null))
         await q.query(`DELETE FROM metric_${t.name} WHERE bucket_ms <= $1`, [tierCutoff(t, now, t.keepMs)]);
     const scope = "USING projects p, orgs o WHERE p.id = m.project_id AND o.id = p.org_id";
-    await q.query(`DELETE FROM metric_1h m ${scope} AND m.bucket_ms <= $1 - o.retention_days * 86400000.0`, [now - 3_600_000]);
-    await q.query(`DELETE FROM metric_series m ${scope} AND m.last_ms < $1 - o.retention_days * 86400000.0`, [now]);
+    await q.query(`DELETE FROM metric_1h m ${scope} AND m.bucket_ms <= $1 - ${KEEP_DAYS} * 86400000.0`, [now - 3_600_000]);
+    await q.query(`DELETE FROM metric_series m ${scope} AND m.last_ms < $1 - ${KEEP_DAYS} * 86400000.0`, [now]);
 }
 //# sourceMappingURL=metric-write.js.map

package/dist/repo/metric-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"metric-write.js","sourceRoot":"","sources":["../../src/repo/metric-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,iBAAiB,EAEjB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EAEvB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,cAAc,EAEd,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,KAAK,GACN,MAAM,sBAAsB,CAAC;AAG9B,sHAAsH;AACtH,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE7E,wDAAwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,eAAe,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAExF,qFAAqF;AACrF,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,KAA4B,EAAE,IAAiB;IACrF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,8GAA8G;AAC9G,KAAK,UAAU,WAAW,CAAC,CAAY,EAAE,SAAiB,EAAE,GAAW,EAAE,KAAiC;IACxG,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxI,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1I,CAAC;IACD,OAAO,CAAC,CAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,CAAC;AAC3F,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAY,EAAE,SAAiB,EAAE,GAAW,EAAE,MAA8B,EAAE,GAAW;IAChI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IAChJ,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACjE,gBAAgB,CAAC,KAAK,EAAE,MAAM,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED,4HAA4H;AAC5H,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAY,EAAE,GAAW;IAChE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;QAAE,MAAM,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,IAAI,wBAAwB,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC;IAC7J,MAAM,KAAK,GAAG,wEAAwE,CAAC;IACvF,MAAM,CAAC,CAAC,KAAK,CAAC,2BAA2B,KAAK,wDAAwD,EAAE,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3H,MAAM,CAAC,CAAC,KAAK,CAAC,+BAA+B,KAAK,qDAAqD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAClH,CAAC"}
+{"version":3,"file":"metric-write.js","sourceRoot":"","sources":["../../src/repo/metric-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,iBAAiB,EAEjB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EAEvB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,cAAc,EAEd,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,KAAK,GACN,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,sHAAsH;AACtH,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE7E,wDAAwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,eAAe,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAExF,qFAAqF;AACrF,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,KAA4B,EAAE,IAAiB;IACrF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,8GAA8G;AAC9G,KAAK,UAAU,WAAW,CAAC,CAAY,EAAE,SAAiB,EAAE,GAAW,EAAE,KAAiC;IACxG,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxI,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1I,CAAC;IACD,OAAO,CAAC,CAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,CAAC;AAC3F,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAY,EAAE,SAAiB,EAAE,GAAW,EAAE,MAA8B,EAAE,GAAW;IAChI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IAChJ,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACjE,gBAAgB,CAAC,KAAK,EAAE,MAAM,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED,4HAA4H;AAC5H,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAY,EAAE,GAAW;IAChE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;QAAE,MAAM,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,IAAI,wBAAwB,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC;IAC7J,MAAM,KAAK,GAAG,wEAAwE,CAAC;IACvF,MAAM,CAAC,CAAC,KAAK,CAAC,2BAA2B,KAAK,4BAA4B,SAAS,eAAe,EAAE,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IACvH,MAAM,CAAC,CAAC,KAAK,CAAC,+BAA+B,KAAK,yBAAyB,SAAS,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9G,CAAC"}

package/dist/repo/orgs.d.ts

@@ -5,6 +5,8 @@ export interface Org {
     name: string;
     slug: string;
     retentionDays: number;
+    /** The plan column; "unlimited" is what applies while billing is off (routes/me.ts). */
+    plan: string;
 }
 export interface Membership extends Org {
     role: Role;

package/dist/repo/orgs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/repo/orgs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAW,SAAQ,GAAG;IACrC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,MAAM;IACrB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,qDAAqD;AACrD,wBAAsB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1E;AAED,eAAO,MAAM,UAAU,MAAO,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,UAAU,EAAE,CACqE,CAAC;AAEpJ,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAG7G;AAED,wBAAsB,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpG;AAED,eAAO,MAAM,WAAW,MAAO,SAAS,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAKvE,CAAC;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,cAAc,MAAO,SAAS,SAAS,MAAM,KAAG,OAAO,CAAC,aAAa,EAAE,CAIjF,CAAC;AAEJ,0IAA0I;AAC1I,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIpF"}
+{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/repo/orgs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAW,SAAQ,GAAG;IACrC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,MAAM;IACrB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,qDAAqD;AACrD,wBAAsB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1E;AAED,eAAO,MAAM,UAAU,MAAO,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,UAAU,EAAE,CACqE,CAAC;AAEpJ,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAG7G;AAED,wBAAsB,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpG;AAED,eAAO,MAAM,WAAW,MAAO,SAAS,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAKvE,CAAC;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,cAAc,MAAO,SAAS,SAAS,MAAM,KAAG,OAAO,CAAC,aAAa,EAAE,CAIjF,CAAC;AAEJ,0IAA0I;AAC1I,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpF"}

package/dist/repo/orgs.js

@@ -1,6 +1,6 @@
 import { slugOf } from "../auth/crypto.js";
 import { deleteProjectData } from "./projects.js";
-const ORG_COLUMNS = `o.id, o.name, o.slug, o.retention_days AS "retentionDays"`;
+const ORG_COLUMNS = `o.id, o.name, o.slug, o.retention_days AS "retentionDays", o.plan`;
 const ms = (column) => `(extract(epoch FROM ${column}) * 1000)::double precision`;
 /** A slug no organization has yet, from the name. */
 export async function freeSlug(q, name) {
@@ -28,6 +28,10 @@ export async function deleteOrgEverything(q, orgId) {
     for (const { id } of await q.query("SELECT id FROM projects WHERE org_id = $1", [orgId]))
         await deleteProjectData(q, id);
     await q.query("DELETE FROM audit WHERE org_id = $1", [orgId]);
+    await q.query("DELETE FROM subscriptions WHERE reference_id = $1", [orgId]);
+    // SCIM rows carry the organization as their provisioning domain (auth/scim.ts); group members and grants go with them.
+    for (const t of ["scim_groups", "scim_users", "scim_identity_tombstones", "scim_connection_bindings"])
+        await q.query(`DELETE FROM ${t} WHERE provisioning_domain_id = $1`, [orgId]);
     await q.query("DELETE FROM orgs WHERE id = $1", [orgId]);
 }
 //# sourceMappingURL=orgs.js.map