@keystrokehq/cli 1.0.30 → 1.0.31

package/dist/{dist-B-_WEYqH.mjs → dist-BIWbmT4y.mjs}

@@ -4566,7 +4566,7 @@ const tableRegistry$1 = {
 buildPgSchema$1(tableRegistry$1);
 buildSqliteSchema$1(tableRegistry$1);
 //#endregion
-//#region ../../packages/platform-database/dist/auth-verifications-D-no86bc.mjs
+//#region ../../packages/platform-database/dist/mcp-oauth-SRTcHMWZ.mjs
 const users = pgTable("users", {
 	id: text("id").primaryKey(),
 	name: text("name").notNull(),
@@ -4691,6 +4691,95 @@ const authVerificationsSqlite = sqliteTable("verification", {
 	createdAt: integer$1("created_at", { mode: "timestamp_ms" }).notNull(),
 	updatedAt: integer$1("updated_at", { mode: "timestamp_ms" }).notNull()
 }, (table) => [index$1("verification_identifier_idx").on(table.identifier)]);
+/**
+* Tables backing keystroke as an OAuth 2.1 Authorization Server for the
+* Universal MCP server: dynamically-registered MCP/AI clients, their issued
+* access/refresh tokens, and consent records.
+*
+* NOT to be confused with `oauth_apps` / `oauth_connections`, which model the
+* inverse — keystroke as an OAuth *client* storing our users' connections to
+* third-party providers. These `mcp_oauth_*` tables are the provider side.
+*
+* Wired to Better Auth via the Drizzle adapter (`authSchemaFor`). Better Auth
+* addresses these by its fixed model names (`oauthApplication`,
+* `oauthAccessToken`, `oauthConsent`) and by field name (the JS property keys
+* below); the physical table/column names are ours to choose.
+*
+* Note: access/refresh tokens are stored as opaque plaintext bearer strings
+* (the Better Auth mcp plugin looks them up directly and cannot hash them),
+* consistent with how the `sessions` table stores session tokens. They are
+* short-lived; rely on DB access controls + at-rest encryption.
+*/
+const mcpOauthClient = pgTable("mcp_oauth_client", {
+	id: text("id").primaryKey(),
+	name: text("name").notNull(),
+	icon: text("icon"),
+	metadata: text("metadata"),
+	clientId: text("client_id").notNull().unique(),
+	clientSecret: text("client_secret"),
+	redirectUrls: text("redirect_urls").notNull(),
+	type: text("type").notNull(),
+	disabled: boolean("disabled").notNull().default(false),
+	userId: text("user_id").references(() => users.id, { onDelete: "cascade" }),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+}, (table) => [index("mcp_oauth_client_user_id_idx").on(table.userId)]);
+const mcpOauthClientSqlite = sqliteTable("mcp_oauth_client", {
+	id: text$1("id").primaryKey(),
+	name: text$1("name").notNull(),
+	icon: text$1("icon"),
+	metadata: text$1("metadata"),
+	clientId: text$1("client_id").notNull().unique(),
+	clientSecret: text$1("client_secret"),
+	redirectUrls: text$1("redirect_urls").notNull(),
+	type: text$1("type").notNull(),
+	disabled: integer$1("disabled", { mode: "boolean" }).notNull().default(false),
+	userId: text$1("user_id").references(() => usersSqlite.id, { onDelete: "cascade" }),
+	createdAt: integer$1("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer$1("updated_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [index$1("mcp_oauth_client_user_id_idx").on(table.userId)]);
+const mcpOauthAccessToken = pgTable("mcp_oauth_access_token", {
+	id: text("id").primaryKey(),
+	accessToken: text("access_token").notNull().unique(),
+	refreshToken: text("refresh_token").unique(),
+	accessTokenExpiresAt: timestamp("access_token_expires_at", { withTimezone: true }),
+	refreshTokenExpiresAt: timestamp("refresh_token_expires_at", { withTimezone: true }),
+	clientId: text("client_id").notNull(),
+	userId: text("user_id").references(() => users.id, { onDelete: "cascade" }),
+	scopes: text("scopes"),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+}, (table) => [index("mcp_oauth_access_token_client_id_idx").on(table.clientId), index("mcp_oauth_access_token_user_id_idx").on(table.userId)]);
+const mcpOauthAccessTokenSqlite = sqliteTable("mcp_oauth_access_token", {
+	id: text$1("id").primaryKey(),
+	accessToken: text$1("access_token").notNull().unique(),
+	refreshToken: text$1("refresh_token").unique(),
+	accessTokenExpiresAt: integer$1("access_token_expires_at", { mode: "timestamp_ms" }),
+	refreshTokenExpiresAt: integer$1("refresh_token_expires_at", { mode: "timestamp_ms" }),
+	clientId: text$1("client_id").notNull(),
+	userId: text$1("user_id").references(() => usersSqlite.id, { onDelete: "cascade" }),
+	scopes: text$1("scopes"),
+	createdAt: integer$1("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer$1("updated_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [index$1("mcp_oauth_access_token_client_id_idx").on(table.clientId), index$1("mcp_oauth_access_token_user_id_idx").on(table.userId)]);
+const mcpOauthConsent = pgTable("mcp_oauth_consent", {
+	id: text("id").primaryKey(),
+	clientId: text("client_id").notNull(),
+	userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+	scopes: text("scopes"),
+	consentGiven: boolean("consent_given").notNull().default(false),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+}, (table) => [index("mcp_oauth_consent_client_id_idx").on(table.clientId), index("mcp_oauth_consent_user_id_idx").on(table.userId)]);
+const mcpOauthConsentSqlite = sqliteTable("mcp_oauth_consent", {
+	id: text$1("id").primaryKey(),
+	clientId: text$1("client_id").notNull(),
+	userId: text$1("user_id").notNull().references(() => usersSqlite.id, { onDelete: "cascade" }),
+	scopes: text$1("scopes"),
+	consentGiven: integer$1("consent_given", { mode: "boolean" }).notNull().default(false),
+	createdAt: integer$1("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer$1("updated_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [index$1("mcp_oauth_consent_client_id_idx").on(table.clientId), index$1("mcp_oauth_consent_user_id_idx").on(table.userId)]);
 createRequire(import.meta.url);
 function buildPgSchema(registry) {
 	return Object.fromEntries(Object.entries(registry).map(([name, { pg }]) => [name, pg]));
@@ -5120,6 +5209,18 @@ const tableRegistry = {
 		pg: oauthConnections,
 		sqlite: oauthConnectionsSqlite
 	},
+	mcpOauthClient: {
+		pg: mcpOauthClient,
+		sqlite: mcpOauthClientSqlite
+	},
+	mcpOauthAccessToken: {
+		pg: mcpOauthAccessToken,
+		sqlite: mcpOauthAccessTokenSqlite
+	},
+	mcpOauthConsent: {
+		pg: mcpOauthConsent,
+		sqlite: mcpOauthConsentSqlite
+	},
 	secretValues: {
 		pg: secretValues,
 		sqlite: secretValuesSqlite
@@ -12549,4 +12650,4 @@ async function emitStoredRouteManifestForProject(projectRoot) {
 //#endregion
 export { discoverEntries as A, validateImportedTriggerAttachment as C, webhookRouteFromEndpoint as D, webhookMatchSchemaForBindings as E, walkTypeScriptFiles as F, entryIdFromFile as M, readKeystrokeIgnoreDirective as N, workflowRouteFromKey as O, shouldSkipKeystrokeModuleFile as P, toStoredRouteManifest as S, webhookManifestAttachmentSchemasFromBindings as T, importWorkflowDefinition as _, buildWebhookBindingsByRoute as a, schemaToJson as b, countAgentCredentials as c, discoverTriggerAttachments as d, discoverWorkflowEntries as f, importTriggerAttachments as g, importAgentDefinition as h, buildStoredRouteManifestFromContext as i, discoverModuleFileEntries as j, packAssetDirs as k, discoverAgentEntries as l, emitStoredRouteManifestForProject as m, agentRouteFromKey as n, collectAgentAppSlugs as o, discoverWorkflows as p, buildStoredRouteManifestForProject as r, collectAgentToolSlugs as s, agentManifestEntry as t, discoverSkillManifestEntries as u, persistStoredRouteManifest as v, validateImportedWorkflowDefinition as w, serializeRouteManifest as x, pollGroupId as y };
 
-//# sourceMappingURL=dist-B-_WEYqH.mjs.map
+//# sourceMappingURL=dist-BIWbmT4y.mjs.map