@secondlayer/shared 11.18.0 → 11.19.1

package/dist/src/archive/range-digest.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/archive/semantic-digest-builder.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/coverage/index.d.ts

@@ -477,7 +477,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -554,7 +553,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/index.d.ts

@@ -161,7 +161,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -238,7 +237,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/chain-reorgs.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/contracts.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/instance.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/integrity.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/subgraph-gaps.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/subgraph-operations.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/subgraphs.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/sync-scope.d.ts

@@ -170,7 +170,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -247,7 +246,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/queries/webhooks.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/db/schema.d.ts

@@ -159,7 +159,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -236,7 +235,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/index.d.ts

@@ -159,7 +159,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -236,7 +235,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/dist/src/node/local-client.d.ts

@@ -160,7 +160,6 @@ interface SubgraphsTable {
 	expires_at: Date | null;
 	/** (event type, contract) probe pairs persisted at deploy for weight classification. */
 	sparse_probe_targets: unknown | null;
-	sandbox_workers: Generated<boolean>;
 	created_at: Generated<Date>;
 	updated_at: Generated<Date>;
 }
@@ -237,7 +236,9 @@ interface ApiKeysTable {
 	rate_limit: Generated<number>;
 	ip_address: string;
 	account_id: string;
-	product: Generated<"account" | "streams" | "index">;
+	product: Generated<"account" | "streams" | "index" | "sentinel">;
+	/** Sentinel permission areas; set only on `product = 'sentinel'` keys. */
+	areas: unknown | null;
 	tier: "free" | "build" | "scale" | "enterprise" | "internal" | null;
 	last_used_at: Date | null;
 	revoked_at: Date | null;

package/migrations/0151_api_keys_sentinel_product.ts

@@ -0,0 +1,42 @@
+import { type Kysely, sql } from "kysely";
+import { onControlPlane } from "../src/db/migration-role.ts";
+
+/**
+ * Sentinel agent keys: `api_keys.product = 'sentinel'` plus nullable `areas`
+ * jsonb holding Sentinel's permission areas (`{plans, monitoring, alerts}`,
+ * each none|read|write). Only `/internal/sentinel/keys` mints them; they
+ * authenticate nothing on secondlayer itself (hosted /v1 and `requireAuth`
+ * accept `account` keys only), Sentinel resolves them server-to-server.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`SET lock_timeout = '30s'`.execute(db);
+		await sql`ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS areas jsonb`.execute(
+			db,
+		);
+		await sql`
+			ALTER TABLE api_keys DROP CONSTRAINT IF EXISTS api_keys_product_check
+		`.execute(db);
+		await sql`
+			ALTER TABLE api_keys
+				ADD CONSTRAINT api_keys_product_check
+				CHECK (product IN ('account', 'streams', 'index', 'sentinel'))
+		`.execute(db);
+	});
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`SET lock_timeout = '30s'`.execute(db);
+		await sql`DELETE FROM api_keys WHERE product = 'sentinel'`.execute(db);
+		await sql`
+			ALTER TABLE api_keys DROP CONSTRAINT IF EXISTS api_keys_product_check
+		`.execute(db);
+		await sql`
+			ALTER TABLE api_keys
+				ADD CONSTRAINT api_keys_product_check
+				CHECK (product IN ('account', 'streams', 'index'))
+		`.execute(db);
+		await sql`ALTER TABLE api_keys DROP COLUMN IF EXISTS areas`.execute(db);
+	});
+}

package/migrations/0152_drop_subgraphs_sandbox_workers.ts

@@ -0,0 +1,24 @@
+import { type Kysely, sql } from "kysely";
+import { onControlPlane } from "../src/db/migration-role.ts";
+
+// The subprocess handler sandbox is gone (hosted stacks isolate handlers with
+// gVisor), so its per-subgraph opt-in column has no reader. Control-plane
+// (TARGET) — the subgraphs control-plane table.
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await sql`SET lock_timeout = '30s'`.execute(db);
+	await onControlPlane(async () => {
+		await sql`
+			ALTER TABLE subgraphs
+				DROP COLUMN IF EXISTS sandbox_workers
+		`.execute(db);
+	});
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`
+			ALTER TABLE subgraphs
+				ADD COLUMN IF NOT EXISTS sandbox_workers BOOLEAN NOT NULL DEFAULT FALSE
+		`.execute(db);
+	});
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secondlayer/shared",
-	"version": "11.18.0",
+	"version": "11.19.1",
 	"description": "Internal building blocks shared across Secondlayer packages.",
 	"license": "MIT",
 	"repository": {