@secondlayer/shared 13.10.0 → 13.12.0

package/dist/src/db/queries/contracts.d.ts

@@ -928,6 +928,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1030,13 +1036,17 @@ interface WebhookIncidentAlertsTable {
 	resolved_at: Date | null;
 }
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
-/** One browser sign-in attempt from `sl login`. Only the hash of the CLI's
-*  device code is stored; the key is minted when the CLI polls after approval. */
+/** The product that started a CLI sign-in; null is `sl login`. */
+type CliDeviceProduct = "sentinel";
+/** One browser sign-in attempt from `sl login` (or `sentinel login`). Only the
+*  hash of the CLI's device code is stored; the session is opened when the CLI
+*  polls after approval. */
 interface CliDeviceLoginsTable {
 	id: Generated<string>;
 	device_code_hash: string;
 	user_code: string;
 	client_name: string;
+	product: CliDeviceProduct | null;
 	status: Generated<CliDeviceLoginStatus>;
 	account_id: string | null;
 	key_name: string | null;
@@ -1045,6 +1055,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {

package/dist/src/db/queries/instance.d.ts

@@ -928,6 +928,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1030,13 +1036,17 @@ interface WebhookIncidentAlertsTable {
 	resolved_at: Date | null;
 }
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
-/** One browser sign-in attempt from `sl login`. Only the hash of the CLI's
-*  device code is stored; the key is minted when the CLI polls after approval. */
+/** The product that started a CLI sign-in; null is `sl login`. */
+type CliDeviceProduct = "sentinel";
+/** One browser sign-in attempt from `sl login` (or `sentinel login`). Only the
+*  hash of the CLI's device code is stored; the session is opened when the CLI
+*  polls after approval. */
 interface CliDeviceLoginsTable {
 	id: Generated<string>;
 	device_code_hash: string;
 	user_code: string;
 	client_name: string;
+	product: CliDeviceProduct | null;
 	status: Generated<CliDeviceLoginStatus>;
 	account_id: string | null;
 	key_name: string | null;
@@ -1045,6 +1055,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {

package/dist/src/db/queries/integrity.d.ts

@@ -928,6 +928,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1030,13 +1036,17 @@ interface WebhookIncidentAlertsTable {
 	resolved_at: Date | null;
 }
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
-/** One browser sign-in attempt from `sl login`. Only the hash of the CLI's
-*  device code is stored; the key is minted when the CLI polls after approval. */
+/** The product that started a CLI sign-in; null is `sl login`. */
+type CliDeviceProduct = "sentinel";
+/** One browser sign-in attempt from `sl login` (or `sentinel login`). Only the
+*  hash of the CLI's device code is stored; the session is opened when the CLI
+*  polls after approval. */
 interface CliDeviceLoginsTable {
 	id: Generated<string>;
 	device_code_hash: string;
 	user_code: string;
 	client_name: string;
+	product: CliDeviceProduct | null;
 	status: Generated<CliDeviceLoginStatus>;
 	account_id: string | null;
 	key_name: string | null;
@@ -1045,6 +1055,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {

package/dist/src/db/queries/subgraph-gaps.d.ts

@@ -928,6 +928,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1030,13 +1036,17 @@ interface WebhookIncidentAlertsTable {
 	resolved_at: Date | null;
 }
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
-/** One browser sign-in attempt from `sl login`. Only the hash of the CLI's
-*  device code is stored; the key is minted when the CLI polls after approval. */
+/** The product that started a CLI sign-in; null is `sl login`. */
+type CliDeviceProduct = "sentinel";
+/** One browser sign-in attempt from `sl login` (or `sentinel login`). Only the
+*  hash of the CLI's device code is stored; the session is opened when the CLI
+*  polls after approval. */
 interface CliDeviceLoginsTable {
 	id: Generated<string>;
 	device_code_hash: string;
 	user_code: string;
 	client_name: string;
+	product: CliDeviceProduct | null;
 	status: Generated<CliDeviceLoginStatus>;
 	account_id: string | null;
 	key_name: string | null;
@@ -1045,6 +1055,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {

package/dist/src/db/queries/subgraph-operations.d.ts

@@ -928,6 +928,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1030,13 +1036,17 @@ interface WebhookIncidentAlertsTable {
 	resolved_at: Date | null;
 }
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
-/** One browser sign-in attempt from `sl login`. Only the hash of the CLI's
-*  device code is stored; the key is minted when the CLI polls after approval. */
+/** The product that started a CLI sign-in; null is `sl login`. */
+type CliDeviceProduct = "sentinel";
+/** One browser sign-in attempt from `sl login` (or `sentinel login`). Only the
+*  hash of the CLI's device code is stored; the session is opened when the CLI
+*  polls after approval. */
 interface CliDeviceLoginsTable {
 	id: Generated<string>;
 	device_code_hash: string;
 	user_code: string;
 	client_name: string;
+	product: CliDeviceProduct | null;
 	status: Generated<CliDeviceLoginStatus>;
 	account_id: string | null;
 	key_name: string | null;
@@ -1045,6 +1055,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {

package/dist/src/db/queries/subgraphs.d.ts

@@ -928,6 +928,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1030,13 +1036,17 @@ interface WebhookIncidentAlertsTable {
 	resolved_at: Date | null;
 }
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
-/** One browser sign-in attempt from `sl login`. Only the hash of the CLI's
-*  device code is stored; the key is minted when the CLI polls after approval. */
+/** The product that started a CLI sign-in; null is `sl login`. */
+type CliDeviceProduct = "sentinel";
+/** One browser sign-in attempt from `sl login` (or `sentinel login`). Only the
+*  hash of the CLI's device code is stored; the session is opened when the CLI
+*  polls after approval. */
 interface CliDeviceLoginsTable {
 	id: Generated<string>;
 	device_code_hash: string;
 	user_code: string;
 	client_name: string;
+	product: CliDeviceProduct | null;
 	status: Generated<CliDeviceLoginStatus>;
 	account_id: string | null;
 	key_name: string | null;
@@ -1045,6 +1055,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {