@secondlayer/shared 13.10.0 → 13.12.0

package/dist/src/db/queries/sync-scope.d.ts

@@ -938,6 +938,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1040,13 +1046,17 @@ interface WebhookIncidentAlertsTable {
 	resolved_at: Date | null;
 }
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
-/** One browser sign-in attempt from `sl login`. Only the hash of the CLI's
-*  device code is stored; the key is minted when the CLI polls after approval. */
+/** The product that started a CLI sign-in; null is `sl login`. */
+type CliDeviceProduct = "sentinel";
+/** One browser sign-in attempt from `sl login` (or `sentinel login`). Only the
+*  hash of the CLI's device code is stored; the session is opened when the CLI
+*  polls after approval. */
 interface CliDeviceLoginsTable {
 	id: Generated<string>;
 	device_code_hash: string;
 	user_code: string;
 	client_name: string;
+	product: CliDeviceProduct | null;
 	status: Generated<CliDeviceLoginStatus>;
 	account_id: string | null;
 	key_name: string | null;
@@ -1055,6 +1065,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {

package/dist/src/db/queries/webhooks.d.ts

@@ -928,6 +928,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1030,13 +1036,17 @@ interface WebhookIncidentAlertsTable {
 	resolved_at: Date | null;
 }
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
-/** One browser sign-in attempt from `sl login`. Only the hash of the CLI's
-*  device code is stored; the key is minted when the CLI polls after approval. */
+/** The product that started a CLI sign-in; null is `sl login`. */
+type CliDeviceProduct = "sentinel";
+/** One browser sign-in attempt from `sl login` (or `sentinel login`). Only the
+*  hash of the CLI's device code is stored; the session is opened when the CLI
+*  polls after approval. */
 interface CliDeviceLoginsTable {
 	id: Generated<string>;
 	device_code_hash: string;
 	user_code: string;
 	client_name: string;
+	product: CliDeviceProduct | null;
 	status: Generated<CliDeviceLoginStatus>;
 	account_id: string | null;
 	key_name: string | null;
@@ -1045,6 +1055,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {

package/dist/src/db/schema.d.ts

@@ -927,6 +927,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1042,13 +1048,17 @@ interface WebhookIncidentAlertsTable {
 }
 type WebhookIncidentAlert = Selectable<WebhookIncidentAlertsTable>;
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
-/** One browser sign-in attempt from `sl login`. Only the hash of the CLI's
-*  device code is stored; the key is minted when the CLI polls after approval. */
+/** The product that started a CLI sign-in; null is `sl login`. */
+type CliDeviceProduct = "sentinel";
+/** One browser sign-in attempt from `sl login` (or `sentinel login`). Only the
+*  hash of the CLI's device code is stored; the session is opened when the CLI
+*  polls after approval. */
 interface CliDeviceLoginsTable {
 	id: Generated<string>;
 	device_code_hash: string;
 	user_code: string;
 	client_name: string;
+	product: CliDeviceProduct | null;
 	status: Generated<CliDeviceLoginStatus>;
 	account_id: string | null;
 	key_name: string | null;
@@ -1058,6 +1068,74 @@ interface CliDeviceLoginsTable {
 	consumed_at: Date | null;
 }
 type CliDeviceLogin = Selectable<CliDeviceLoginsTable>;
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
+type OauthClient = Selectable<OauthClientsTable>;
+type OauthGrant = Selectable<OauthGrantsTable>;
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {
@@ -1322,4 +1400,4 @@ type WaitlistSignup = Selectable<WaitlistSignupsTable>;
 type InsertWaitlistSignup = Insertable<WaitlistSignupsTable>;
 type ContactRequest = Selectable<ContactRequestsTable>;
 type InsertContactRequest = Insertable<ContactRequestsTable>;
-export { Account, AccountBalanceAlerts, AccountBalanceAlertsTable, AccountCredits, AccountCreditsTable, AccountSpendCap, AccountSpendCapsTable, AccountsTable, ApiFailedRequest, ApiFailedRequestsTable, ApiKey, ApiKeysTable, ApiRequestLogRow, ApiRequestLogTable, ArchiveFetch, ArchiveFetchesTable, Block, BlocksTable, BnsMarketplaceAction, BnsMarketplaceEventsTable, BnsNameEventTopic, BnsNameEventsTable, BnsNamesTable, BnsNamespaceEventStatus, BnsNamespaceEventsTable, BnsNamespacesTable, BurnBlockRewardSlotsTable, BurnBlockRewardsTable, ChainReadCacheTable, ChainReorgsTable, CliDeviceLogin, CliDeviceLoginStatus, CliDeviceLoginsTable, ContactRequest, ContactRequestsTable, Contract, ContractsTable, CoverageSegmentsTable, Database, DeadLetterEventsTable, DecodedEventsTable, DecoderCheckpointsTable, Event, EventsArchiveTable, EventsTable, FailureClass, FailureUnit, FeedbackTicket, FeedbackTicketsTable, IndexProgress, IndexProgressTable, InsertAccount, InsertAccountBalanceAlerts, InsertAccountCredits, InsertAccountSpendCap, InsertApiFailedRequest, InsertApiKey, InsertApiRequestLogRow, InsertArchiveFetch, InsertBlock, InsertContactRequest, InsertContract, InsertEvent, InsertFeedbackTicket, InsertIndexProgress, InsertMagicLink, InsertMempoolTransaction, InsertSession, InsertStateWrite, InsertSubgraph, InsertSubgraphGap, InsertSubgraphHealthSnapshot, InsertSubgraphOperation, InsertTransaction, InsertUsageLedgerRow, InsertVmEvent, InsertWaitlistSignup, InsertWebhook, InsertWebhookDelivery, InsertWebhookOutbox, InsightMutesTable, InsightsTable, InstancesTable, MagicLink, MagicLinksTable, MempoolTransaction, MempoolTransactionsTable, NativeClock, ObserverJournalStatus, ObserverJournalTable, OutboxStatus, PendingForkBlocksTable, Pox4CallsTable, Pox4FunctionName, Pox5CycleSignersTable, Pox5CyclesTable, Pox5EventTopic, Pox5EventsTable, ProcessedStripeEventsTable, RepairMode, RetryState, RunStatus, SbtcEventTopic, SbtcEventsTable, SbtcSettlementsTable, SbtcTokenEventType, SbtcTokenEventsTable, SentinelAccount, SentinelAccountsTable, ServiceHeartbeatsTable, Session, SessionsTable, StageBlockReceiptsTable, StageFailuresTable, StageKind, StageRegistryTable, StageRunsTable, StateWrite, StateWritesArchiveTable, StateWritesTable, Subgraph, SubgraphErrorGroupsTable, SubgraphGap, SubgraphGapsTable, SubgraphHealthSnapshot, SubgraphHealthSnapshotsTable, SubgraphOperation, SubgraphOperationKind, SubgraphOperationStatus, SubgraphOperationsTable, SubgraphProcessingStatsTable, SubgraphViolationsTable, SubgraphsTable, SyncScopesTable, Transaction, TransactionsArchiveTable, TransactionsTable, TriggerEvaluatorState, TriggerEvaluatorStateTable, UpdateAccountBalanceAlerts, UpdateAccountCredits, UpdateAccountSpendCap, UpdateApiKey, UpdateArchiveFetch, UpdateBlock, UpdateContract, UpdateEvent, UpdateIndexProgress, UpdateSubgraph, UpdateSubgraphOperation, UpdateTransaction, UpdateUsageLedgerRow, UpdateVmEvent, UpdateWebhook, UpdateWebhookOutbox, UsageLedgerRow, UsageLedgerTable, VmEvent, VmEventsArchiveTable, VmEventsTable, Waitlist, WaitlistSignup, WaitlistSignupsTable, WaitlistsTable, Webhook, WebhookDeliveriesTable, WebhookDelivery, WebhookFormat, WebhookIncidentAlert, WebhookIncidentAlertsTable, WebhookKind, WebhookOutbox, WebhookOutboxTable, WebhookStatus, WebhooksTable };
+export { Account, AccountBalanceAlerts, AccountBalanceAlertsTable, AccountCredits, AccountCreditsTable, AccountSpendCap, AccountSpendCapsTable, AccountsTable, ApiFailedRequest, ApiFailedRequestsTable, ApiKey, ApiKeysTable, ApiRequestLogRow, ApiRequestLogTable, ArchiveFetch, ArchiveFetchesTable, Block, BlocksTable, BnsMarketplaceAction, BnsMarketplaceEventsTable, BnsNameEventTopic, BnsNameEventsTable, BnsNamesTable, BnsNamespaceEventStatus, BnsNamespaceEventsTable, BnsNamespacesTable, BurnBlockRewardSlotsTable, BurnBlockRewardsTable, ChainReadCacheTable, ChainReorgsTable, CliDeviceLogin, CliDeviceLoginStatus, CliDeviceLoginsTable, CliDeviceProduct, ContactRequest, ContactRequestsTable, Contract, ContractsTable, CoverageSegmentsTable, Database, DeadLetterEventsTable, DecodedEventsTable, DecoderCheckpointsTable, Event, EventsArchiveTable, EventsTable, FailureClass, FailureUnit, FeedbackTicket, FeedbackTicketsTable, IndexProgress, IndexProgressTable, InsertAccount, InsertAccountBalanceAlerts, InsertAccountCredits, InsertAccountSpendCap, InsertApiFailedRequest, InsertApiKey, InsertApiRequestLogRow, InsertArchiveFetch, InsertBlock, InsertContactRequest, InsertContract, InsertEvent, InsertFeedbackTicket, InsertIndexProgress, InsertMagicLink, InsertMempoolTransaction, InsertSession, InsertStateWrite, InsertSubgraph, InsertSubgraphGap, InsertSubgraphHealthSnapshot, InsertSubgraphOperation, InsertTransaction, InsertUsageLedgerRow, InsertVmEvent, InsertWaitlistSignup, InsertWebhook, InsertWebhookDelivery, InsertWebhookOutbox, InsightMutesTable, InsightsTable, InstancesTable, MagicLink, MagicLinksTable, MempoolTransaction, MempoolTransactionsTable, NativeClock, OauthClient, OauthClientsTable, OauthCodesTable, OauthGrant, OauthGrantsTable, OauthRefreshRetiredTable, OauthRequestStatus, OauthRequestsTable, OauthTokenKind, OauthTokensTable, ObserverJournalStatus, ObserverJournalTable, OutboxStatus, PendingForkBlocksTable, Pox4CallsTable, Pox4FunctionName, Pox5CycleSignersTable, Pox5CyclesTable, Pox5EventTopic, Pox5EventsTable, ProcessedStripeEventsTable, RepairMode, RetryState, RunStatus, SbtcEventTopic, SbtcEventsTable, SbtcSettlementsTable, SbtcTokenEventType, SbtcTokenEventsTable, SentinelAccount, SentinelAccountsTable, ServiceHeartbeatsTable, Session, SessionsTable, StageBlockReceiptsTable, StageFailuresTable, StageKind, StageRegistryTable, StageRunsTable, StateWrite, StateWritesArchiveTable, StateWritesTable, Subgraph, SubgraphErrorGroupsTable, SubgraphGap, SubgraphGapsTable, SubgraphHealthSnapshot, SubgraphHealthSnapshotsTable, SubgraphOperation, SubgraphOperationKind, SubgraphOperationStatus, SubgraphOperationsTable, SubgraphProcessingStatsTable, SubgraphViolationsTable, SubgraphsTable, SyncScopesTable, Transaction, TransactionsArchiveTable, TransactionsTable, TriggerEvaluatorState, TriggerEvaluatorStateTable, UpdateAccountBalanceAlerts, UpdateAccountCredits, UpdateAccountSpendCap, UpdateApiKey, UpdateArchiveFetch, UpdateBlock, UpdateContract, UpdateEvent, UpdateIndexProgress, UpdateSubgraph, UpdateSubgraphOperation, UpdateTransaction, UpdateUsageLedgerRow, UpdateVmEvent, UpdateWebhook, UpdateWebhookOutbox, UsageLedgerRow, UsageLedgerTable, VmEvent, VmEventsArchiveTable, VmEventsTable, Waitlist, WaitlistSignup, WaitlistSignupsTable, WaitlistsTable, Webhook, WebhookDeliveriesTable, WebhookDelivery, WebhookFormat, WebhookIncidentAlert, WebhookIncidentAlertsTable, WebhookKind, WebhookOutbox, WebhookOutboxTable, WebhookStatus, WebhooksTable };

package/dist/src/index.d.ts

@@ -1146,6 +1146,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1261,13 +1267,17 @@ interface WebhookIncidentAlertsTable {
 }
 type WebhookIncidentAlert = Selectable<WebhookIncidentAlertsTable>;
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
-/** One browser sign-in attempt from `sl login`. Only the hash of the CLI's
-*  device code is stored; the key is minted when the CLI polls after approval. */
+/** The product that started a CLI sign-in; null is `sl login`. */
+type CliDeviceProduct = "sentinel";
+/** One browser sign-in attempt from `sl login` (or `sentinel login`). Only the
+*  hash of the CLI's device code is stored; the session is opened when the CLI
+*  polls after approval. */
 interface CliDeviceLoginsTable {
 	id: Generated<string>;
 	device_code_hash: string;
 	user_code: string;
 	client_name: string;
+	product: CliDeviceProduct | null;
 	status: Generated<CliDeviceLoginStatus>;
 	account_id: string | null;
 	key_name: string | null;
@@ -1277,6 +1287,74 @@ interface CliDeviceLoginsTable {
 	consumed_at: Date | null;
 }
 type CliDeviceLogin = Selectable<CliDeviceLoginsTable>;
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
+type OauthClient = Selectable<OauthClientsTable>;
+type OauthGrant = Selectable<OauthGrantsTable>;
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {
@@ -2553,6 +2631,12 @@ declare const TABLE_TO_DB: {
 	sessions: string
 	magic_links: string
 	cli_device_logins: string
+	oauth_clients: string
+	oauth_requests: string
+	oauth_codes: string
+	oauth_grants: string
+	oauth_tokens: string
+	oauth_refresh_retired: string
 	account_spend_caps: string
 	processed_stripe_events: string
 	webhooks: string
@@ -3678,4 +3762,4 @@ declare function publicKeyPemFromPrivate(privateKeyPem: string): string;
 declare function ed25519KeyId(publicKeyPem: string): string;
 declare function signEd25519(payload: string, privateKey: KeyObject): string;
 declare function verifyEd25519(payload: string, signatureBase64: string, publicKey: KeyObject): boolean;
-export { Account, AccountBalanceAlerts, AccountBalanceAlertsTable, AccountCredits, AccountCreditsTable, AccountSpendCap, AccountSpendCapsTable, AccountsTable, ApiFailedRequest, ApiFailedRequestsTable, ApiKey, ApiKeyRevokedError, ApiKeysTable, ApiRequestLogRow, ApiRequestLogTable, ArchiveFetch, ArchiveFetchesTable, AuthenticationError, AuthorizationError, BILLING_PAUSED_PREFIX, Block, BlocksTable, BnsMarketplaceAction, BnsMarketplaceEventsTable, BnsNameEventTopic, BnsNameEventsTable, BnsNamesTable, BnsNamespaceEventStatus, BnsNamespaceEventsTable, BnsNamespacesTable, BurnBlockRewardSlotsTable, BurnBlockRewardsTable, CHAIN_TRIGGER_FIELDS, CHAIN_TRIGGER_TYPES, CODE_TO_STATUS, ChainApplyDeliveryOf, ChainApplyEnvelope, ChainApplyEnvelopeOf, ChainEventEnvelope, ChainFtBurnData, ChainFtMintData, ChainFtTransferData, ChainNftBurnData, ChainNftMintData, ChainNftTransferData, ChainPrintEventData, ChainReadCacheTable, ChainReorgOrphanedEntry, ChainReorgRollbackDelivery, ChainReorgRollbackEnvelope, ChainReorgsTable, ChainStxBurnData, ChainStxLockData, ChainStxMintData, ChainStxTransferData, ChainTestDelivery, ChainTxLevelEvent, ChainWebhookDelivery, ChainWebhookEnvelope, CliDeviceLogin, CliDeviceLoginStatus, CliDeviceLoginsTable, ContactRequest, ContactRequestsTable, Contract, ContractsTable, CoverageSegmentsTable, CreateWebhookRequest, CreateWebhookRequestSchema, CreateWebhookResponse, DB_TO_STREAMS_EVENT_TYPE, DECODED_EVENT_TYPES2 as DECODED_EVENT_TYPES, DEFAULT_BTC_CONFIRMATIONS, Database, DatabaseError, DbPlane, DbReadRow, DbSplitStatus, DeadLetterEventsTable, DeadRow, DecodedEventType2 as DecodedEventType, DecodedEventsTable, DecoderCheckpointsTable, DeliveryRow, DeploySubgraphRequest, DeploySubgraphRequestSchema, DeploySubgraphResponse, EMPTY_RANGE_EVENT_INDEX_SENTINEL, Env, ErrorCode, ErrorCodes, Event, EventsArchiveTable, EventsTable, FailureClass, FailureUnit, FeedbackTicket, FeedbackTicketsTable, ForbiddenError, HealthHour, HealthSnapshotPoint, INSIGHT_SEVERITIES, IndexColumn, IndexColumnType, IndexPrimaryKey, IndexProgress, IndexProgressTable, InsertAccount, InsertAccountBalanceAlerts, InsertAccountCredits, InsertAccountSpendCap, InsertApiFailedRequest, InsertApiKey, InsertApiRequestLogRow, InsertArchiveFetch, InsertBlock, InsertContactRequest, InsertContract, InsertEvent, InsertFeedbackTicket, InsertIndexProgress, InsertMagicLink, InsertMempoolTransaction, InsertSession, InsertStateWrite, InsertSubgraph, InsertSubgraphGap, InsertSubgraphHealthSnapshot, InsertSubgraphOperation, InsertTransaction, InsertUsageLedgerRow, InsertVmEvent, InsertWaitlistSignup, InsertWebhook, InsertWebhookDelivery, InsertWebhookOutbox, Insight, InsightEvidence, InsightEvidenceSchema, InsightListResponse, InsightListResponseSchema, InsightMutesTable, InsightResourceKind, InsightResourceKindSchema, InsightSchema, InsightSeverity, InsightSeveritySchema, InsightsTable, InstancesTable, KeyRotatedError, MagicLink, MagicLinksTable, MempoolTransaction, MempoolTransactionsTable, MigrationRole, NativeClock, NotFoundError, NumericAsText, ObserverJournalStatus, ObserverJournalTable, OutboxStatus, ParsedCreateWebhookRequest, ParsedReplayWebhookRequest, ParsedUpdateWebhookRequest, PaymentRequiredError, PendingForkBlocksTable, Pox4CallsTable, Pox4FunctionName, Pox5CycleSignersTable, Pox5CyclesTable, Pox5EventTopic, Pox5EventsTable, ProcessedStripeEventsTable, RUNE_EVENT_TYPES, RateLimitError, ReindexResponse, RepairMode, ReplayResult, ReplayWebhookRequest, ReplayWebhookRequestSchema, RetryState, RotateSecretResponse, RunStatus, RuneApplyDeliveryOf, RuneApplyEnvelope, RuneEventType, SEVERITY_ORDER, SOURCE_READ_COLUMNS, SOURCE_READ_PKS, SOURCE_READ_TYPES, STREAMS_DB_EVENT_TYPES, STREAMS_EVENT_TYPES, STREAMS_TO_DB_EVENT_TYPES, SbtcDepositEvent, SbtcEventTopic, SbtcEventsTable, SbtcSettlementsTable, SbtcTokenEventType, SbtcTokenEventsTable, SbtcWithdrawalEvent, SbtcWithdrawalSweptConfirmedEvent, SecondLayerError, SentinelAccount, SentinelAccountsTable, ServiceHeartbeatsTable, Session, SessionsTable, StageBlockReceiptsTable, StageFailuresTable, StageKind, StageRegistryTable, StageRunsTable, StateWrite, StateWritesArchiveTable, StateWritesTable, StreamsCursor, StreamsDbEventType, StreamsEventType, Subgraph, SubgraphAgentSchema, SubgraphAggregateParams, SubgraphAggregateResponse, SubgraphDetail, SubgraphErrorGroupsTable, SubgraphGap, SubgraphGapEntry, SubgraphGapRange, SubgraphGapsResponse, SubgraphGapsTable, SubgraphHealthSnapshot, SubgraphHealthSnapshotsTable, SubgraphOperation, SubgraphOperationKind, SubgraphOperationStatus, SubgraphOperationsTable, SubgraphProcessingStatsTable, SubgraphQueryParams, SubgraphSpecFormat, SubgraphSpecOptions, SubgraphSummary, SubgraphSyncInfo, SubgraphVerification, SubgraphViolationsTable, SubgraphsTable, SyncScopesTable, TABLE_TO_DB, TenantSuspendedError, Transaction, TransactionsArchiveTable, TransactionsTable, TriggerEvaluatorState, TriggerEvaluatorStateTable, UpdateAccountBalanceAlerts, UpdateAccountCredits, UpdateAccountSpendCap, UpdateApiKey, UpdateArchiveFetch, UpdateBlock, UpdateContract, UpdateEvent, UpdateIndexProgress, UpdateSubgraph, UpdateSubgraphOperation, UpdateTransaction, UpdateUsageLedgerRow, UpdateVmEvent, UpdateWebhook, UpdateWebhookOutbox, UpdateWebhookRequest, UpdateWebhookRequestSchema, UsageLedgerRow, UsageLedgerTable, VM_EVENT_TYPES, VM_NODE_TO_STORED_TYPE2 as VM_NODE_TO_STORED_TYPE, VM_STORED_TO_NODE_TYPE, ValidationError, VersionConflictError, VmEvent, VmEventType, VmEventsArchiveTable, VmEventsTable, VmNodeEventType, WEBHOOK_FORMATS, WEBHOOK_STATUSES, Waitlist, WaitlistSignup, WaitlistSignupsTable, WaitlistsTable, Webhook, WebhookDeliveriesTable, WebhookDelivery, WebhookDetail, WebhookFormat, WebhookFormatSchema, WebhookIncidentAlert, WebhookIncidentAlertsTable, WebhookKind, WebhookOutbox, WebhookOutboxTable, WebhookStatus, WebhookStatusSchema, WebhookSummary, WebhooksTable, applicationDatabaseUrl, assertDbSplit, billingPausedCode, blockEndCursor, bucketHourly, closeDb, closeDbOrTimeout, committedHeight, compareStreamsCursor, exports_hmac as crypto, decodeStreamsCursor, describeDbUrl, exports_ed25519 as ed25519, encodeStreamsCursor, finalizedBurnHeight, formatWebhookSchemaErrors, generateSubgraphAgentSchema, generateSubgraphMarkdown, generateSubgraphOpenApi, generateSubgraphSpec, getDb, getDbSplitStatus, getEnv, getErrorMessage, getMigrationRole, getRawClient, getSourceDb, getTargetDb, isBnsDecoderEnabled, isEmptyRangeCursor, isPox4DecoderEnabled, isPox5DecoderEnabled, isSbtcDecoderEnabled, jsonb, logger, onChainPlane, onControlPlane, parseJsonb, resolveSourceUrl, resolveTargetUrl, setMigrationRole, sql };
+export { Account, AccountBalanceAlerts, AccountBalanceAlertsTable, AccountCredits, AccountCreditsTable, AccountSpendCap, AccountSpendCapsTable, AccountsTable, ApiFailedRequest, ApiFailedRequestsTable, ApiKey, ApiKeyRevokedError, ApiKeysTable, ApiRequestLogRow, ApiRequestLogTable, ArchiveFetch, ArchiveFetchesTable, AuthenticationError, AuthorizationError, BILLING_PAUSED_PREFIX, Block, BlocksTable, BnsMarketplaceAction, BnsMarketplaceEventsTable, BnsNameEventTopic, BnsNameEventsTable, BnsNamesTable, BnsNamespaceEventStatus, BnsNamespaceEventsTable, BnsNamespacesTable, BurnBlockRewardSlotsTable, BurnBlockRewardsTable, CHAIN_TRIGGER_FIELDS, CHAIN_TRIGGER_TYPES, CODE_TO_STATUS, ChainApplyDeliveryOf, ChainApplyEnvelope, ChainApplyEnvelopeOf, ChainEventEnvelope, ChainFtBurnData, ChainFtMintData, ChainFtTransferData, ChainNftBurnData, ChainNftMintData, ChainNftTransferData, ChainPrintEventData, ChainReadCacheTable, ChainReorgOrphanedEntry, ChainReorgRollbackDelivery, ChainReorgRollbackEnvelope, ChainReorgsTable, ChainStxBurnData, ChainStxLockData, ChainStxMintData, ChainStxTransferData, ChainTestDelivery, ChainTxLevelEvent, ChainWebhookDelivery, ChainWebhookEnvelope, CliDeviceLogin, CliDeviceLoginStatus, CliDeviceLoginsTable, CliDeviceProduct, ContactRequest, ContactRequestsTable, Contract, ContractsTable, CoverageSegmentsTable, CreateWebhookRequest, CreateWebhookRequestSchema, CreateWebhookResponse, DB_TO_STREAMS_EVENT_TYPE, DECODED_EVENT_TYPES2 as DECODED_EVENT_TYPES, DEFAULT_BTC_CONFIRMATIONS, Database, DatabaseError, DbPlane, DbReadRow, DbSplitStatus, DeadLetterEventsTable, DeadRow, DecodedEventType2 as DecodedEventType, DecodedEventsTable, DecoderCheckpointsTable, DeliveryRow, DeploySubgraphRequest, DeploySubgraphRequestSchema, DeploySubgraphResponse, EMPTY_RANGE_EVENT_INDEX_SENTINEL, Env, ErrorCode, ErrorCodes, Event, EventsArchiveTable, EventsTable, FailureClass, FailureUnit, FeedbackTicket, FeedbackTicketsTable, ForbiddenError, HealthHour, HealthSnapshotPoint, INSIGHT_SEVERITIES, IndexColumn, IndexColumnType, IndexPrimaryKey, IndexProgress, IndexProgressTable, InsertAccount, InsertAccountBalanceAlerts, InsertAccountCredits, InsertAccountSpendCap, InsertApiFailedRequest, InsertApiKey, InsertApiRequestLogRow, InsertArchiveFetch, InsertBlock, InsertContactRequest, InsertContract, InsertEvent, InsertFeedbackTicket, InsertIndexProgress, InsertMagicLink, InsertMempoolTransaction, InsertSession, InsertStateWrite, InsertSubgraph, InsertSubgraphGap, InsertSubgraphHealthSnapshot, InsertSubgraphOperation, InsertTransaction, InsertUsageLedgerRow, InsertVmEvent, InsertWaitlistSignup, InsertWebhook, InsertWebhookDelivery, InsertWebhookOutbox, Insight, InsightEvidence, InsightEvidenceSchema, InsightListResponse, InsightListResponseSchema, InsightMutesTable, InsightResourceKind, InsightResourceKindSchema, InsightSchema, InsightSeverity, InsightSeveritySchema, InsightsTable, InstancesTable, KeyRotatedError, MagicLink, MagicLinksTable, MempoolTransaction, MempoolTransactionsTable, MigrationRole, NativeClock, NotFoundError, NumericAsText, OauthClient, OauthClientsTable, OauthCodesTable, OauthGrant, OauthGrantsTable, OauthRefreshRetiredTable, OauthRequestStatus, OauthRequestsTable, OauthTokenKind, OauthTokensTable, ObserverJournalStatus, ObserverJournalTable, OutboxStatus, ParsedCreateWebhookRequest, ParsedReplayWebhookRequest, ParsedUpdateWebhookRequest, PaymentRequiredError, PendingForkBlocksTable, Pox4CallsTable, Pox4FunctionName, Pox5CycleSignersTable, Pox5CyclesTable, Pox5EventTopic, Pox5EventsTable, ProcessedStripeEventsTable, RUNE_EVENT_TYPES, RateLimitError, ReindexResponse, RepairMode, ReplayResult, ReplayWebhookRequest, ReplayWebhookRequestSchema, RetryState, RotateSecretResponse, RunStatus, RuneApplyDeliveryOf, RuneApplyEnvelope, RuneEventType, SEVERITY_ORDER, SOURCE_READ_COLUMNS, SOURCE_READ_PKS, SOURCE_READ_TYPES, STREAMS_DB_EVENT_TYPES, STREAMS_EVENT_TYPES, STREAMS_TO_DB_EVENT_TYPES, SbtcDepositEvent, SbtcEventTopic, SbtcEventsTable, SbtcSettlementsTable, SbtcTokenEventType, SbtcTokenEventsTable, SbtcWithdrawalEvent, SbtcWithdrawalSweptConfirmedEvent, SecondLayerError, SentinelAccount, SentinelAccountsTable, ServiceHeartbeatsTable, Session, SessionsTable, StageBlockReceiptsTable, StageFailuresTable, StageKind, StageRegistryTable, StageRunsTable, StateWrite, StateWritesArchiveTable, StateWritesTable, StreamsCursor, StreamsDbEventType, StreamsEventType, Subgraph, SubgraphAgentSchema, SubgraphAggregateParams, SubgraphAggregateResponse, SubgraphDetail, SubgraphErrorGroupsTable, SubgraphGap, SubgraphGapEntry, SubgraphGapRange, SubgraphGapsResponse, SubgraphGapsTable, SubgraphHealthSnapshot, SubgraphHealthSnapshotsTable, SubgraphOperation, SubgraphOperationKind, SubgraphOperationStatus, SubgraphOperationsTable, SubgraphProcessingStatsTable, SubgraphQueryParams, SubgraphSpecFormat, SubgraphSpecOptions, SubgraphSummary, SubgraphSyncInfo, SubgraphVerification, SubgraphViolationsTable, SubgraphsTable, SyncScopesTable, TABLE_TO_DB, TenantSuspendedError, Transaction, TransactionsArchiveTable, TransactionsTable, TriggerEvaluatorState, TriggerEvaluatorStateTable, UpdateAccountBalanceAlerts, UpdateAccountCredits, UpdateAccountSpendCap, UpdateApiKey, UpdateArchiveFetch, UpdateBlock, UpdateContract, UpdateEvent, UpdateIndexProgress, UpdateSubgraph, UpdateSubgraphOperation, UpdateTransaction, UpdateUsageLedgerRow, UpdateVmEvent, UpdateWebhook, UpdateWebhookOutbox, UpdateWebhookRequest, UpdateWebhookRequestSchema, UsageLedgerRow, UsageLedgerTable, VM_EVENT_TYPES, VM_NODE_TO_STORED_TYPE2 as VM_NODE_TO_STORED_TYPE, VM_STORED_TO_NODE_TYPE, ValidationError, VersionConflictError, VmEvent, VmEventType, VmEventsArchiveTable, VmEventsTable, VmNodeEventType, WEBHOOK_FORMATS, WEBHOOK_STATUSES, Waitlist, WaitlistSignup, WaitlistSignupsTable, WaitlistsTable, Webhook, WebhookDeliveriesTable, WebhookDelivery, WebhookDetail, WebhookFormat, WebhookFormatSchema, WebhookIncidentAlert, WebhookIncidentAlertsTable, WebhookKind, WebhookOutbox, WebhookOutboxTable, WebhookStatus, WebhookStatusSchema, WebhookSummary, WebhooksTable, applicationDatabaseUrl, assertDbSplit, billingPausedCode, blockEndCursor, bucketHourly, closeDb, closeDbOrTimeout, committedHeight, compareStreamsCursor, exports_hmac as crypto, decodeStreamsCursor, describeDbUrl, exports_ed25519 as ed25519, encodeStreamsCursor, finalizedBurnHeight, formatWebhookSchemaErrors, generateSubgraphAgentSchema, generateSubgraphMarkdown, generateSubgraphOpenApi, generateSubgraphSpec, getDb, getDbSplitStatus, getEnv, getErrorMessage, getMigrationRole, getRawClient, getSourceDb, getTargetDb, isBnsDecoderEnabled, isEmptyRangeCursor, isPox4DecoderEnabled, isPox5DecoderEnabled, isSbtcDecoderEnabled, jsonb, logger, onChainPlane, onControlPlane, parseJsonb, resolveSourceUrl, resolveTargetUrl, setMigrationRole, sql };

package/dist/src/index.js

@@ -844,6 +844,12 @@ var TABLE_TO_DB = {
   sessions: "target",
   magic_links: "target",
   cli_device_logins: "target",
+  oauth_clients: "target",
+  oauth_requests: "target",
+  oauth_codes: "target",
+  oauth_grants: "target",
+  oauth_tokens: "target",
+  oauth_refresh_retired: "target",
   account_spend_caps: "target",
   processed_stripe_events: "target",
   webhooks: "target",
@@ -2402,5 +2408,5 @@ export {
   sql2 as sql
 };
 
-//# debugId=8DA4E9043B36B14364756E2164756E21
+//# debugId=D706D905F1A1003364756E2164756E21
 //# sourceMappingURL=index.js.map