@secondlayer/shared 13.11.0 → 13.13.0

package/dist/src/insights/index.d.ts

@@ -597,6 +597,7 @@ interface InsightsTable {
 	clear_streak: Generated<number>;
 	resolved_at: Date | null;
 	dismissed_at: Date | null;
+	snoozed_until: Date | null;
 }
 /** "Expected": mutes one rule for one resource until removed. */
 interface InsightMutesTable {
@@ -1090,6 +1091,7 @@ interface Database {
 	webhooks: WebhooksTable;
 	webhook_outbox: WebhookOutboxTable;
 	webhook_deliveries: WebhookDeliveriesTable;
+	webhook_replays: WebhookReplaysTable;
 	trigger_evaluator_state: TriggerEvaluatorStateTable;
 	decoded_events: DecodedEventsTable;
 	decoder_checkpoints: DecoderCheckpointsTable;
@@ -1123,6 +1125,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -1132,6 +1140,9 @@ interface Database {
 	insights: InsightsTable;
 	insight_mutes: InsightMutesTable;
 	feedback_tickets: FeedbackTicketsTable;
+	push_subscriptions: PushSubscriptionsTable;
+	push_prefs: PushPrefsTable;
+	push_sent: PushSentTable;
 }
 interface ServiceHeartbeatsTable {
 	name: string;
@@ -1224,6 +1235,36 @@ interface WebhookIncidentAlertsTable {
 	email_attempts: Generated<number>;
 	resolved_at: Date | null;
 }
+/** One browser/device push subscription; the endpoint is unique. */
+interface PushSubscriptionsTable {
+	id: Generated<string>;
+	account_id: string;
+	endpoint: string;
+	p256dh: string;
+	auth: string;
+	user_agent: string | null;
+	created_at: Generated<Date>;
+	last_success_at: Date | null;
+	failed_count: Generated<number>;
+}
+/** Per-account push toggles. A missing row means the column defaults. */
+interface PushPrefsTable {
+	account_id: string;
+	webhook_failing: Generated<boolean>;
+	subgraph_stopped: Generated<boolean>;
+	subgraph_not_serving: Generated<boolean>;
+	replay_done: Generated<boolean>;
+	spend_cap: Generated<boolean>;
+	key_repeat: Generated<boolean>;
+	updated_at: Generated<Date>;
+}
+/** A push already sent, keyed by what it was about; debounces repeat signals. */
+interface PushSentTable {
+	account_id: string;
+	key: string;
+	kind: string;
+	sent_at: Generated<Date>;
+}
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
 /** The product that started a CLI sign-in; null is `sl login`. */
 type CliDeviceProduct = "sentinel";
@@ -1244,6 +1285,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {
@@ -1301,6 +1408,8 @@ interface WebhookOutboxTable {
 	next_attempt_at: Generated<Date>;
 	status: ColumnType<OutboxStatus, OutboxStatus | undefined, OutboxStatus>;
 	is_replay: Generated<boolean>;
+	/** The replay that created this row; null for live rows. */
+	replay_id: string | null;
 	/** The chain block_time of the matched event/tx. Null for rows written
 	*  before this column existed, and for the settlement scan path (not yet
 	*  wired). Lets `delivered_at - block_time` measure end-to-end webhook
@@ -1316,6 +1425,22 @@ interface WebhookOutboxTable {
 	last_error: string | null;
 	created_at: Generated<Date>;
 }
+type WebhookReplayStatus = "scanning" | "running" | "done" | "failed";
+interface WebhookReplaysTable {
+	id: string;
+	webhook_id: string;
+	from_block: number | bigint;
+	to_block: number | bigint;
+	status: WebhookReplayStatus;
+	scanned_count: Generated<number>;
+	enqueued_count: Generated<number>;
+	total: number | null;
+	delivered: number | null;
+	gave_up: number | null;
+	error: string | null;
+	started_at: Generated<Date>;
+	finished_at: Date | null;
+}
 interface WebhookDeliveriesTable {
 	id: Generated<string>;
 	/** Nullable after migration 0077 — outbox row may be cleaned up while
@@ -1474,8 +1599,16 @@ interface InsightRule<Input> {
 * and resolves once the streak reaches `CLEAR_STREAK_TO_RESOLVE`. A rule that
 * was skipped (missing data) must stay out of `evaluatedKeys` so it never
 * counts toward clearing.
+*
+* Returns the insights this pass newly opened (inserted, not updated). A
+* re-fire after a resolve is a fresh insert and counts. Nothing stored or
+* listed depends on the return value.
 */
-declare function recordEvaluation(db: Kysely<Database>, scope: InsightScope, fired: DetectedInsight[], evaluatedKeys: EvaluatedKey[], now?: Date): Promise<void>;
+declare function recordEvaluation(db: Kysely<Database>, scope: InsightScope, fired: DetectedInsight[], evaluatedKeys: EvaluatedKey[], now?: Date): Promise<{
+	opened: Array<DetectedInsight & {
+		id: string
+	}>
+}>;
 /** (kind, id) pairs that have an open insight in this scope. */
 declare function listOpenResources(db: Kysely<Database>, scope: InsightScope): Promise<{
 	kind: Insight["resource"]["kind"]
@@ -1484,7 +1617,7 @@ declare function listOpenResources(db: Kysely<Database>, scope: InsightScope): P
 }[]>;
 /**
 * Open rows plus rows resolved within `RECOVERED_VISIBLE_MS`, minus dismissed
-* and muted ones. Resolved rows come back as `recovered`. One row per
+* snoozed and muted ones. Resolved rows come back as `recovered`. One row per
 * (resource, rule): the open incident, else the latest recovered one. Ranked.
 */
 declare function listInsights(db: Kysely<Database>, scope: InsightScope, now?: Date, filter?: {
@@ -1493,6 +1626,12 @@ declare function listInsights(db: Kysely<Database>, scope: InsightScope, now?: D
 }): Promise<Insight[]>;
 /** Hide the current incident. Returns false when the id is not in scope. */
 declare function dismissInsight(db: Kysely<Database>, scope: InsightScope, id: string, now?: Date): Promise<boolean>;
+/** Hide the current incident until `until`. Returns false when the id is not in scope. */
+declare function snoozeInsight(db: Kysely<Database>, scope: InsightScope, id: string, until: Date): Promise<boolean>;
+/** Show a snoozed insight again now. Returns false when the id is not in scope. */
+declare function unsnoozeInsight(db: Kysely<Database>, scope: InsightScope, id: string): Promise<boolean>;
+/** Show a dismissed insight again. Returns false when the id is not in scope. */
+declare function undismissInsight(db: Kysely<Database>, scope: InsightScope, id: string): Promise<boolean>;
 /** Mute the insight's rule for its resource until un-muted. */
 declare function muteRule(db: Kysely<Database>, scope: InsightScope, id: string): Promise<boolean>;
 declare function unmuteRule(db: Kysely<Database>, scope: InsightScope, id: string): Promise<boolean>;
@@ -1607,4 +1746,4 @@ interface TenantEvaluateDeps extends Omit<LabelDeps, "now"> {
 * exist resolve through the normal two-pass clear.
 */
 declare function evaluateTenantInsights(db: Kysely3<Database>, deps?: TenantEvaluateDeps): Promise<void>;
-export { BACKFILL_DAY_SHARE, BACKFILL_FULL_PAGE_RATIO, BACKFILL_MIN_DAY_ROWS, CLEAR_STREAK_TO_RESOLVE, CREDITS_RUNWAY_WARN_DAYS, DEAD_LETTER_DELETE_AGE_DAYS, DEAD_LETTER_WARN_AGE_DAYS, DOWN_MIN_CONSECUTIVE, DUPLICATE_READS_LOOKBACK_MS, DUPLICATE_READS_MIN_PAGES, DUPLICATE_READS_WINDOW_MS, DetectedInsight, EvaluatedKey, HANDLER_ERRORS_MIN_24H, InsightRule, InsightScope, KEY_UNUSED_DAYS, LAG_MIN_SAMPLES, LAG_THRESHOLD_MS, LAG_WINDOW, LOGIN_WALL_MIN_CONSECUTIVE, LOGIN_WALL_MIN_PRIOR, LOGIN_WALL_PRIOR_JSON_RATIO, PAGE_CAP_ROWS, POLLING_FOLLOW_GAP_MS, POLLING_LOOKBACK_MS, POLLING_MAX_STDDEV_RATIO, POLLING_MIN_DURATION_MS, POLLING_MIN_EMPTY_RATIO, POLLING_MIN_REQUESTS, POLLING_STALE_INTERVALS, RATE_LIMITED_MIN_ATTEMPTS, RATE_LIMITED_MIN_RATIO, RECOVERED_VISIBLE_MS, REJECTS_MIN_CONSECUTIVE, REVOKED_KEY_ACTIVE_MS, SERVER_ERRORS_MIN_5XX, SLOWING_DAYS, SLOWING_MIN_R2, SLOWING_MIN_RISING_DAYS, SLOW_MIN_SAMPLES, SLOW_TIMEOUT_RATIO, SLOW_WINDOW, STACK_UNREACHABLE_ACTIVE_MS, STACK_UNREACHABLE_MIN_FAILURES, SUBGRAPH_LAG_BLOCKS, SUBGRAPH_LAG_LOSING_BLOCKS, SUBGRAPH_LAG_SNAPSHOTS, TEST_ENDPOINT_MIN_AGE_DAYS, TLS_WARN_DAYS, TenantEvaluateDeps, dismissInsight, evaluateTenantInsights, handoffPrompt, hostOf, listInsights, listOpenResources, maybeLabel, muteRule, plainSnippet, plural, purgeResolved, rankInsights, recordEvaluation, runRules, unmuteRule, utcDateTime, utcDay, utcTime };
+export { BACKFILL_DAY_SHARE, BACKFILL_FULL_PAGE_RATIO, BACKFILL_MIN_DAY_ROWS, CLEAR_STREAK_TO_RESOLVE, CREDITS_RUNWAY_WARN_DAYS, DEAD_LETTER_DELETE_AGE_DAYS, DEAD_LETTER_WARN_AGE_DAYS, DOWN_MIN_CONSECUTIVE, DUPLICATE_READS_LOOKBACK_MS, DUPLICATE_READS_MIN_PAGES, DUPLICATE_READS_WINDOW_MS, DetectedInsight, EvaluatedKey, HANDLER_ERRORS_MIN_24H, InsightRule, InsightScope, KEY_UNUSED_DAYS, LAG_MIN_SAMPLES, LAG_THRESHOLD_MS, LAG_WINDOW, LOGIN_WALL_MIN_CONSECUTIVE, LOGIN_WALL_MIN_PRIOR, LOGIN_WALL_PRIOR_JSON_RATIO, PAGE_CAP_ROWS, POLLING_FOLLOW_GAP_MS, POLLING_LOOKBACK_MS, POLLING_MAX_STDDEV_RATIO, POLLING_MIN_DURATION_MS, POLLING_MIN_EMPTY_RATIO, POLLING_MIN_REQUESTS, POLLING_STALE_INTERVALS, RATE_LIMITED_MIN_ATTEMPTS, RATE_LIMITED_MIN_RATIO, RECOVERED_VISIBLE_MS, REJECTS_MIN_CONSECUTIVE, REVOKED_KEY_ACTIVE_MS, SERVER_ERRORS_MIN_5XX, SLOWING_DAYS, SLOWING_MIN_R2, SLOWING_MIN_RISING_DAYS, SLOW_MIN_SAMPLES, SLOW_TIMEOUT_RATIO, SLOW_WINDOW, STACK_UNREACHABLE_ACTIVE_MS, STACK_UNREACHABLE_MIN_FAILURES, SUBGRAPH_LAG_BLOCKS, SUBGRAPH_LAG_LOSING_BLOCKS, SUBGRAPH_LAG_SNAPSHOTS, TEST_ENDPOINT_MIN_AGE_DAYS, TLS_WARN_DAYS, TenantEvaluateDeps, dismissInsight, evaluateTenantInsights, handoffPrompt, hostOf, listInsights, listOpenResources, maybeLabel, muteRule, plainSnippet, plural, purgeResolved, rankInsights, recordEvaluation, runRules, snoozeInsight, undismissInsight, unmuteRule, unsnoozeInsight, utcDateTime, utcDay, utcTime };

package/dist/src/insights/index.js

@@ -234,9 +234,10 @@ function toPayload(insight) {
   };
 }
 async function recordEvaluation(db, scope, fired, evaluatedKeys, now = new Date) {
-  await db.transaction().execute(async (trx) => {
+  return db.transaction().execute(async (trx) => {
+    const opened = [];
     for (const insight of fired) {
-      await sql2`
+      const { rows } = await sql2`
 				INSERT INTO insights
 					(account_id, resource_kind, resource_id, rule, severity, impact,
 					 payload, first_seen_at, last_seen_at)
@@ -253,7 +254,11 @@ async function recordEvaluation(db, scope, fired, evaluatedKeys, now = new Date)
 					impact = EXCLUDED.impact,
 					last_seen_at = EXCLUDED.last_seen_at,
 					clear_streak = 0
+				RETURNING id, (xmax = 0) AS inserted
 			`.execute(trx);
+      const row = rows[0];
+      if (row?.inserted)
+        opened.push({ ...insight, id: row.id });
     }
     const firedKeys = new Set(fired.map((i) => `${i.resource.kind}\x00${i.resource.id}\x00${i.rule}`));
     for (const key of evaluatedKeys) {
@@ -274,6 +279,7 @@ async function recordEvaluation(db, scope, fired, evaluatedKeys, now = new Date)
 					AND resolved_at IS NULL
 			`.execute(trx);
     }
+    return { opened };
   });
 }
 async function listOpenResources(db, scope) {
@@ -301,6 +307,7 @@ async function listInsights(db, scope, now = new Date, filter = {}) {
 			ORDER BY resource_kind, resource_id, rule, resolved_at DESC NULLS FIRST
 		) i
 		WHERE i.dismissed_at IS NULL
+			AND (i.snoozed_until IS NULL OR i.snoozed_until <= ${now})
 			AND NOT EXISTS (
 				SELECT 1 FROM insight_mutes m
 				WHERE ${scopeWhere(scope, sql2.ref("m.account_id"))}
@@ -331,6 +338,33 @@ async function dismissInsight(db, scope, id, now = new Date) {
 	`.execute(db);
   return Number(result.numAffectedRows ?? 0) > 0;
 }
+async function snoozeInsight(db, scope, id, until) {
+  if (!UUID_RE.test(id))
+    return false;
+  const result = await sql2`
+		UPDATE insights SET snoozed_until = ${until}
+		WHERE id = ${id}::uuid AND ${scopeWhere(scope)}
+	`.execute(db);
+  return Number(result.numAffectedRows ?? 0) > 0;
+}
+async function unsnoozeInsight(db, scope, id) {
+  if (!UUID_RE.test(id))
+    return false;
+  const result = await sql2`
+		UPDATE insights SET snoozed_until = NULL
+		WHERE id = ${id}::uuid AND ${scopeWhere(scope)}
+	`.execute(db);
+  return Number(result.numAffectedRows ?? 0) > 0;
+}
+async function undismissInsight(db, scope, id) {
+  if (!UUID_RE.test(id))
+    return false;
+  const result = await sql2`
+		UPDATE insights SET dismissed_at = NULL
+		WHERE id = ${id}::uuid AND ${scopeWhere(scope)}
+	`.execute(db);
+  return Number(result.numAffectedRows ?? 0) > 0;
+}
 async function muteRule(db, scope, id) {
   if (!UUID_RE.test(id))
     return false;
@@ -2301,11 +2335,14 @@ export {
   rankInsights,
   recordEvaluation,
   runRules2 as runRules,
+  snoozeInsight,
+  undismissInsight,
   unmuteRule,
+  unsnoozeInsight,
   utcDateTime,
   utcDay,
   utcTime
 };
 
-//# debugId=44F809365B6CC2B464756E2164756E21
+//# debugId=43EF1744AA425D2F64756E2164756E21
 //# sourceMappingURL=index.js.map