@nylorun/runtime 0.16.0-beta → 0.17.0-beta

package/dist/store/postgres/schema.d.ts

@@ -1109,14 +1109,14 @@ export declare const vaults: import("drizzle-orm/pg-core").PgTableWithColumns<{
             tableName: "vaults";
             dataType: "string";
             columnType: "PgText";
-            data: "host" | "user";
+            data: "host" | "installation" | "user";
             driverParam: string;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "host"];
+            enumValues: ["user", "installation", "host"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -1581,13 +1581,18 @@ export declare const vaultIdempotency: import("drizzle-orm/pg-core").PgTableWith
     };
     dialect: 'pg';
 }>;
-export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "tenant_settings";
+/**
+ * An MCP OAuth connect between its start and its callback (F9 C2): found by the SHA-256 of its
+ * `state`, used once, for ten minutes. The PKCE verifier and any client secret are sealed under
+ * the vault key (`sealBytes`), which only the keys module holds.
+ */
+export declare const oauthPending: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "oauth_pending";
     schema: "nylorun";
     columns: {
-        key: import("drizzle-orm/pg-core").PgColumn<{
-            name: "key";
-            tableName: "tenant_settings";
+        stateHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "stateHash";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1602,9 +1607,9 @@ export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithCo
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        value: import("drizzle-orm/pg-core").PgColumn<{
-            name: "value";
-            tableName: "tenant_settings";
+        vaultId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "vaultId";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1619,70 +1624,60 @@ export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithCo
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
-/** The Tenant's signing keys (subject tokens): the private half sealed, the public JWK not. */
-export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "signing_keys";
-    schema: "nylorun";
-    columns: {
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "signing_keys";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
+        server: import("drizzle-orm/pg-core").PgColumn<{
+            name: "server";
+            tableName: "oauth_pending";
+            dataType: "string";
+            columnType: "PgText";
             data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        state: import("drizzle-orm/pg-core").PgColumn<{
-            name: "state";
-            tableName: "signing_keys";
+        }, {}, {}>;
+        url: import("drizzle-orm/pg-core").PgColumn<{
+            name: "url";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
-            data: "current" | "previous" | "revoked" | "standby";
+            data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["standby", "current", "previous", "revoked"];
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        alg: import("drizzle-orm/pg-core").PgColumn<{
-            name: "alg";
-            tableName: "signing_keys";
+        tokenEndpoint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tokenEndpoint";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
-            data: "ES256";
+            data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["ES256"];
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        publicJwk: import("drizzle-orm/pg-core").PgColumn<{
-            name: "publicJwk";
-            tableName: "signing_keys";
+        clientId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "clientId";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1697,50 +1692,65 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        kekId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "kekId";
-            tableName: "signing_keys";
+        tokenEndpointAuth: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tokenEndpointAuth";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "client_secret_basic" | "client_secret_post" | "none";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
+            enumValues: ["none", "client_secret_basic", "client_secret_post"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        resource: import("drizzle-orm/pg-core").PgColumn<{
+            name: "resource";
+            tableName: "oauth_pending";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
             enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        nonce: import("drizzle-orm/pg-core").PgColumn<{
-            name: "nonce";
-            tableName: "signing_keys";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: Uint8Array<ArrayBufferLike>;
-            driverParam: Buffer<ArrayBufferLike>;
+        kekId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kekId";
+            tableName: "oauth_pending";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        ciphertext: import("drizzle-orm/pg-core").PgColumn<{
-            name: "ciphertext";
-            tableName: "signing_keys";
+        }, {}, {}>;
+        clientSecret: import("drizzle-orm/pg-core").PgColumn<{
+            name: "clientSecret";
+            tableName: "oauth_pending";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: Uint8Array<ArrayBufferLike>;
             driverParam: Buffer<ArrayBufferLike>;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1752,9 +1762,9 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        wrappedDek: import("drizzle-orm/pg-core").PgColumn<{
-            name: "wrappedDek";
-            tableName: "signing_keys";
+        codeVerifier: import("drizzle-orm/pg-core").PgColumn<{
+            name: "codeVerifier";
+            tableName: "oauth_pending";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: Uint8Array<ArrayBufferLike>;
@@ -1771,9 +1781,9 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "signing_keys";
+        redirectUri: import("drizzle-orm/pg-core").PgColumn<{
+            name: "redirectUri";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1788,33 +1798,61 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        activatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "activatedAt";
-            tableName: "signing_keys";
-            dataType: "string";
-            columnType: "PgText";
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expiresAt";
+            tableName: "oauth_pending";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        retiredAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "retiredAt";
-            tableName: "signing_keys";
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "oauth_pending";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+    };
+    dialect: 'pg';
+}>;
+export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "tenant_settings";
+    schema: "nylorun";
+    columns: {
+        key: import("drizzle-orm/pg-core").PgColumn<{
+            name: "key";
+            tableName: "tenant_settings";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
-            isPrimaryKey: false;
+            isPrimaryKey: true;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: [string, ...string[]];
@@ -1822,14 +1860,14 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "revokedAt";
-            tableName: "signing_keys";
+        value: import("drizzle-orm/pg-core").PgColumn<{
+            name: "value";
+            tableName: "tenant_settings";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1842,14 +1880,17 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
     };
     dialect: 'pg';
 }>;
-/** Each subject's revocation epoch. */
-export declare const subjectEpochs: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "subject_epochs";
+/**
+ * The Tenant's signing keys (delivery tokens, capability links, run and host tokens): the
+ * private half sealed, the public JWK not.
+ */
+export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "signing_keys";
     schema: "nylorun";
     columns: {
-        subject: import("drizzle-orm/pg-core").PgColumn<{
-            name: "subject";
-            tableName: "subject_epochs";
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "signing_keys";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
@@ -1866,119 +1907,103 @@ export declare const subjectEpochs: import("drizzle-orm/pg-core").PgTableWithCol
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        epoch: import("drizzle-orm/pg-core").PgColumn<{
-            name: "epoch";
-            tableName: "subject_epochs";
-            dataType: "number";
-            columnType: "PgBigInt53";
-            data: number;
-            driverParam: string | number;
+        state: import("drizzle-orm/pg-core").PgColumn<{
+            name: "state";
+            tableName: "signing_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: "current" | "previous" | "revoked" | "standby";
+            driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: ["standby", "current", "previous", "revoked"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "revokedAt";
-            tableName: "subject_epochs";
+        alg: import("drizzle-orm/pg-core").PgColumn<{
+            name: "alg";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "ES256";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: ["ES256"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
-/** Each subject's turn bucket: tokens left and when they were last refilled. */
-export declare const subjectUsage: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "subject_usage";
-    schema: "nylorun";
-    columns: {
-        subject: import("drizzle-orm/pg-core").PgColumn<{
-            name: "subject";
-            tableName: "subject_usage";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
+        publicJwk: import("drizzle-orm/pg-core").PgColumn<{
+            name: "publicJwk";
+            tableName: "signing_keys";
+            dataType: "string";
+            columnType: "PgText";
             data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        turnTokens: import("drizzle-orm/pg-core").PgColumn<{
-            name: "turnTokens";
-            tableName: "subject_usage";
-            dataType: "number";
-            columnType: "PgDoublePrecision";
-            data: number;
-            driverParam: string | number;
+        }, {}, {}>;
+        kekId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kekId";
+            tableName: "signing_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        refilledAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "refilledAt";
-            tableName: "subject_usage";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
+        nonce: import("drizzle-orm/pg-core").PgColumn<{
+            name: "nonce";
+            tableName: "signing_keys";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
-/** Publishable keys (Host feature `browser-access`): public by design. */
-export declare const publishableKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "publishable_keys";
-    schema: "nylorun";
-    columns: {
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "publishable_keys";
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        ciphertext: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ciphertext";
+            tableName: "signing_keys";
             dataType: "custom";
             columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: undefined;
@@ -1988,13 +2013,13 @@ export declare const publishableKeys: import("drizzle-orm/pg-core").PgTableWithC
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        key: import("drizzle-orm/pg-core").PgColumn<{
-            name: "key";
-            tableName: "publishable_keys";
+        wrappedDek: import("drizzle-orm/pg-core").PgColumn<{
+            name: "wrappedDek";
+            tableName: "signing_keys";
             dataType: "custom";
             columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -2007,9 +2032,9 @@ export declare const publishableKeys: import("drizzle-orm/pg-core").PgTableWithC
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        name: import("drizzle-orm/pg-core").PgColumn<{
-            name: "name";
-            tableName: "publishable_keys";
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -2024,14 +2049,14 @@ export declare const publishableKeys: import("drizzle-orm/pg-core").PgTableWithC
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        originsJson: import("drizzle-orm/pg-core").PgColumn<{
-            name: "originsJson";
-            tableName: "publishable_keys";
+        activatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "activatedAt";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2041,14 +2066,14 @@ export declare const publishableKeys: import("drizzle-orm/pg-core").PgTableWithC
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "publishable_keys";
+        retiredAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "retiredAt";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2060,7 +2085,7 @@ export declare const publishableKeys: import("drizzle-orm/pg-core").PgTableWithC
         }, {}, {}>;
         revokedAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "revokedAt";
-            tableName: "publishable_keys";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -3979,9 +4004,8 @@ export type VaultRow = typeof vaults.$inferSelect;
 export type VaultCredentialRow = typeof vaultCredentials.$inferSelect;
 export type VaultAuditRow = Omit<typeof vaultAudit.$inferSelect, "ord">;
 export type VaultIdempotencyRow = typeof vaultIdempotency.$inferSelect;
+export type OAuthPendingRow = typeof oauthPending.$inferSelect;
 export type SigningKeyRow = typeof signingKeys.$inferSelect;
-export type SubjectUsageRow = typeof subjectUsage.$inferSelect;
-export type PublishableKeyRow = typeof publishableKeys.$inferSelect;
 export type ModelUsageRow = typeof modelUsage.$inferSelect;
 export type ModelBudgetRow = typeof modelBudgets.$inferSelect;
 export type ToolCrossingRow = typeof toolCrossings.$inferSelect;