@secondlayer/shared 11.17.0 → 11.19.0

package/dist/src/archive/range-digest.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/archive/semantic-digest-builder.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/coverage/index.d.ts

@@ -554,7 +554,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/index.d.ts

@@ -238,7 +238,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/chain-reorgs.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/contracts.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/instance.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/integrity.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/subgraph-gaps.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/subgraph-operations.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/subgraphs.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/sync-scope.d.ts

@@ -247,7 +247,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/webhooks.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/schema.d.ts

@@ -236,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/index-http.d.ts

@@ -56,6 +56,10 @@ type RuneStreamsEvent = {
 	event_type: RuneEventType
 	rune_id: string
 	payload: RuneEventPayload
+	/** The event's block time, ISO 8601. Absent when the indexer has no header
+	*  time for that block yet (rows written before block times were recorded,
+	*  until backfilled). */
+	ts?: string
 	/** True when this event's block is past the finality boundary (immutable).
 	*  Optional for back-compat with the same reasoning as `StreamsEventBase`. */
 	finalized?: boolean

package/dist/src/index.d.ts

@@ -236,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/node/local-client.d.ts

@@ -237,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/streams-rows/index.d.ts

@@ -223,6 +223,10 @@ type RuneStreamsEvent = {
 	event_type: RuneEventType
 	rune_id: string
 	payload: RuneEventPayload
+	/** The event's block time, ISO 8601. Absent when the indexer has no header
+	*  time for that block yet (rows written before block times were recorded,
+	*  until backfilled). */
+	ts?: string
 	/** True when this event's block is past the finality boundary (immutable).
 	*  Optional for back-compat with the same reasoning as `StreamsEventBase`. */
 	finalized?: boolean

package/migrations/0151_api_keys_sentinel_product.ts

@@ -0,0 +1,42 @@
+import { type Kysely, sql } from "kysely";
+import { onControlPlane } from "../src/db/migration-role.ts";
+
+/**
+ * Sentinel agent keys: `api_keys.product = 'sentinel'` plus nullable `areas`
+ * jsonb holding Sentinel's permission areas (`{plans, monitoring, alerts}`,
+ * each none|read|write). Only `/internal/sentinel/keys` mints them; they
+ * authenticate nothing on secondlayer itself (hosted /v1 and `requireAuth`
+ * accept `account` keys only), Sentinel resolves them server-to-server.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`SET lock_timeout = '30s'`.execute(db);
+		await sql`ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS areas jsonb`.execute(
+			db,
+		);
+		await sql`
+			ALTER TABLE api_keys DROP CONSTRAINT IF EXISTS api_keys_product_check
+		`.execute(db);
+		await sql`
+			ALTER TABLE api_keys
+				ADD CONSTRAINT api_keys_product_check
+				CHECK (product IN ('account', 'streams', 'index', 'sentinel'))
+		`.execute(db);
+	});
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`SET lock_timeout = '30s'`.execute(db);
+		await sql`DELETE FROM api_keys WHERE product = 'sentinel'`.execute(db);
+		await sql`
+			ALTER TABLE api_keys DROP CONSTRAINT IF EXISTS api_keys_product_check
+		`.execute(db);
+		await sql`
+			ALTER TABLE api_keys
+				ADD CONSTRAINT api_keys_product_check
+				CHECK (product IN ('account', 'streams', 'index'))
+		`.execute(db);
+		await sql`ALTER TABLE api_keys DROP COLUMN IF EXISTS areas`.execute(db);
+	});
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secondlayer/shared",
-	"version": "11.17.0",
+	"version": "11.19.0",
 	"description": "Internal building blocks shared across Secondlayer packages.",
 	"license": "MIT",
 	"repository": {