@12-apps/prisma 6.6.0 → 6.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@12-apps/prisma",
-  "version": "6.6.0",
+  "version": "6.7.0",
   "sideEffects": false,
   "description": "Prisma host: the multi-file schema folder, the plugin migration seam, and the shared PrismaClient singleton with its audit / append-only extensions",
   "main": "dist/index.js",
@@ -68,7 +68,7 @@
   },
   "devDependencies": {
     "@12-apps/audit": "^5.7.1",
-    "@12-apps/auth": "^2.19.0",
+    "@12-apps/auth": "^2.21.0",
     "@12-apps/discounts": "^1.13.0",
     "@12-apps/entitlements": "^3.10.0",
     "@12-apps/entity-lifecycle": "^4.13.0",
@@ -76,14 +76,14 @@
     "@12-apps/feature-flags": "^2.4.1",
     "@12-apps/i18n": "^1.3.0",
     "@12-apps/jobs": "^4.5.0",
-    "@12-apps/mcp": "^3.16.0",
-    "@12-apps/notifications": "^4.9.0",
+    "@12-apps/mcp": "^3.17.0",
+    "@12-apps/notifications": "^4.11.0",
     "@12-apps/onboarding": "^2.7.0",
-    "@12-apps/payments-backend": "^4.26.0",
+    "@12-apps/payments-backend": "^4.27.1",
     "@12-apps/product-research": "^2.10.0",
     "@12-apps/rbac": "^4.14.0",
     "@12-apps/realtime": "^2.6.0",
-    "@12-apps/report-builder": "^5.14.0",
+    "@12-apps/report-builder": "^5.14.1",
     "@12-apps/shift": "^3.4.0",
     "@12-apps/typescript-config": "^1.21.0",
     "@types/node": "^22.10.6",

package/prisma/migrations/20260910120000_add_refresh_grace_seal/migration.sql

@@ -0,0 +1,37 @@
+-- @12-apps/mcp: the sealed successor that makes refresh rotation RETRYABLE.
+--
+-- `oauth_refresh_tokens.grace_seal` holds a token's own plaintext, encrypted
+-- (AES-256-GCM) under a key derived by HKDF from the plaintext of the token it
+-- was rotated FROM, with its grace deadline sealed inside the same blob.
+--
+-- WHY THE COLUMN EXISTS. Rotation-on-use with replay revocation cannot tell a
+-- thief from a client that used one token twice for an innocent reason, and
+-- there are two routine innocent reasons: a response lost to a proxy timeout,
+-- and two of the client's own sessions refreshing at the same moment. Both were
+-- punished as theft — the whole lineage revoked, including the successor just
+-- handed to whoever won — which killed a live connection and sent a human back
+-- through the full authorization flow. With this column, re-presenting a
+-- just-consumed token inside the window returns THAT SAME successor instead, so
+-- one successor is still all that ever exists and no second family is created.
+--
+-- WHY IT IS NOT A PLAINTEXT COLUMN. The key is never stored: it is derived from
+-- the parent, which is itself only ever stored hashed. A dump of this table
+-- therefore yields ciphertext and nothing that opens it, so the package's
+-- "hashed, never plaintext" invariant is unchanged. The only party that can open
+-- a seal is one presenting the parent — which is the party being served, and
+-- which already held the token that mints the successor.
+--
+-- The seal is CLEARED whenever a token is consumed or revoked, and that is the
+-- bound on what it costs: a seal opens only under the plaintext it was rotated
+-- from, so spent seals left in place would chain — one historical plaintext plus
+-- a copy of this table would walk forward to the live token offline, with no
+-- server call and therefore no replay detection.
+--
+-- Nullable, but NOT optional: the package writes this field on every rotation,
+-- so a deployment that raises the package version without applying this
+-- migration gets a runtime failure on every refresh, not a quietly disabled
+-- window. Apply it in the same change as the version raise. Guarded with
+-- IF NOT EXISTS like every other statement this package ships, so a host that
+-- already added the column adopts the migration as a no-op.
+ALTER TABLE "oauth_refresh_tokens"
+  ADD COLUMN IF NOT EXISTS "grace_seal" TEXT;

package/prisma/plugin-migrations.json

@@ -38,6 +38,7 @@
     "20260821140000_discounts_package_owned",
     "20260824120000_payments_pending_verification",
     "20260826170000_locale_preferences",
-    "20260830120000_discount_weekly_schedule"
+    "20260830120000_discount_weekly_schedule",
+    "20260910120000_add_refresh_grace_seal"
   ]
 }

package/prisma/schema/mcp.prisma

@@ -71,6 +71,16 @@ model OAuthRefreshToken {
   revokedAt   DateTime? @map("revoked_at")
   createdAt   DateTime  @default(now()) @map("created_at")
 
+  // This token's own plaintext, SEALED under a key derived from the plaintext of
+  // the token it was rotated from, with its grace deadline inside the sealed
+  // blob. It is what lets a rotation be RETRIED: re-presenting the consumed
+  // parent within the window returns this same successor instead of revoking the
+  // lineage, so a lost response or two concurrent refreshes no longer end the
+  // connection. Only a caller holding the parent can open it, so the "never store
+  // a token in the clear" rule is intact — a dump of this table yields ciphertext
+  // and no key. Null on a root token, and whenever the window is turned off.
+  graceSeal   String?   @map("grace_seal")
+
   // `tokenHash` is already indexed by its `@unique` constraint — the
   // lookup-on-presentation path — so no separate `@@index([tokenHash])` is added
   // (it would be redundant). The composite index serves per-user/per-client