@secondlayer/shared 13.11.0 → 13.13.0

package/migrations/0177_oauth_mcp.ts

@@ -0,0 +1,122 @@
+import { type Kysely, sql } from "kysely";
+import { onControlPlane } from "../src/db/migration-role.ts";
+
+/**
+ * OAuth for the hosted MCP endpoint (`<api>/mcp`). An app registers itself
+ * (`oauth_clients`, public clients only), sends the person to authorize
+ * (`oauth_requests`, answered on the web consent page), swaps the one-time
+ * code (`oauth_codes`) for tokens, and holds a grant (`oauth_grants`) with one
+ * live refresh token and short-lived access tokens (`oauth_tokens`). A rotated
+ * refresh token is remembered in `oauth_refresh_retired` so a replay revokes
+ * the grant. Every code and token is stored as its SHA-256 hash only.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`
+			CREATE TABLE oauth_clients (
+				id            text PRIMARY KEY,
+				name          text NOT NULL,
+				redirect_uris text[] NOT NULL,
+				created_ip    text,
+				created_at    timestamptz NOT NULL DEFAULT now(),
+				last_used_at  timestamptz
+			)
+		`.execute(db);
+		await sql`
+			CREATE INDEX oauth_clients_unused
+				ON oauth_clients (created_at) WHERE last_used_at IS NULL
+		`.execute(db);
+
+		await sql`
+			CREATE TABLE oauth_requests (
+				id             text PRIMARY KEY,
+				client_id      text NOT NULL REFERENCES oauth_clients(id) ON DELETE CASCADE,
+				redirect_uri   text NOT NULL,
+				state          text,
+				code_challenge text NOT NULL,
+				resource       text NOT NULL,
+				status         text NOT NULL DEFAULT 'pending'
+					CHECK (status IN ('pending', 'approved', 'denied')),
+				account_id     uuid REFERENCES accounts(id) ON DELETE CASCADE,
+				created_at     timestamptz NOT NULL DEFAULT now(),
+				expires_at     timestamptz NOT NULL,
+				answered_at    timestamptz
+			)
+		`.execute(db);
+		await sql`
+			CREATE INDEX oauth_requests_expires ON oauth_requests (expires_at)
+		`.execute(db);
+
+		await sql`
+			CREATE TABLE oauth_grants (
+				id           uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+				account_id   uuid NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+				client_id    text NOT NULL REFERENCES oauth_clients(id) ON DELETE CASCADE,
+				scope        text NOT NULL DEFAULT 'mcp',
+				resource     text NOT NULL,
+				created_at   timestamptz NOT NULL DEFAULT now(),
+				last_used_at timestamptz,
+				revoked_at   timestamptz
+			)
+		`.execute(db);
+		await sql`
+			CREATE INDEX oauth_grants_account ON oauth_grants (account_id)
+		`.execute(db);
+
+		await sql`
+			CREATE TABLE oauth_codes (
+				code_hash      text PRIMARY KEY,
+				client_id      text NOT NULL REFERENCES oauth_clients(id) ON DELETE CASCADE,
+				account_id     uuid NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+				redirect_uri   text NOT NULL,
+				code_challenge text NOT NULL,
+				resource       text NOT NULL,
+				grant_id       uuid REFERENCES oauth_grants(id) ON DELETE SET NULL,
+				created_at     timestamptz NOT NULL DEFAULT now(),
+				expires_at     timestamptz NOT NULL,
+				used_at        timestamptz
+			)
+		`.execute(db);
+		await sql`
+			CREATE INDEX oauth_codes_expires ON oauth_codes (expires_at)
+		`.execute(db);
+
+		await sql`
+			CREATE TABLE oauth_tokens (
+				token_hash text PRIMARY KEY,
+				grant_id   uuid NOT NULL REFERENCES oauth_grants(id) ON DELETE CASCADE,
+				kind       text NOT NULL CHECK (kind IN ('access', 'refresh')),
+				created_at timestamptz NOT NULL DEFAULT now(),
+				expires_at timestamptz NOT NULL
+			)
+		`.execute(db);
+		await sql`
+			CREATE INDEX oauth_tokens_grant ON oauth_tokens (grant_id)
+		`.execute(db);
+		await sql`
+			CREATE INDEX oauth_tokens_expires ON oauth_tokens (expires_at)
+		`.execute(db);
+
+		await sql`
+			CREATE TABLE oauth_refresh_retired (
+				token_hash text PRIMARY KEY,
+				grant_id   uuid NOT NULL REFERENCES oauth_grants(id) ON DELETE CASCADE,
+				retired_at timestamptz NOT NULL DEFAULT now()
+			)
+		`.execute(db);
+		await sql`
+			CREATE INDEX oauth_refresh_retired_at ON oauth_refresh_retired (retired_at)
+		`.execute(db);
+	});
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`DROP TABLE IF EXISTS oauth_refresh_retired`.execute(db);
+		await sql`DROP TABLE IF EXISTS oauth_tokens`.execute(db);
+		await sql`DROP TABLE IF EXISTS oauth_codes`.execute(db);
+		await sql`DROP TABLE IF EXISTS oauth_grants`.execute(db);
+		await sql`DROP TABLE IF EXISTS oauth_requests`.execute(db);
+		await sql`DROP TABLE IF EXISTS oauth_clients`.execute(db);
+	});
+}

package/migrations/0178_insight_snooze.ts

@@ -0,0 +1,22 @@
+import { type Kysely, sql } from "kysely";
+import { onControlPlane } from "../src/db/migration-role.ts";
+
+/**
+ * Hides an open insight until this time ("Until tomorrow" on the phone).
+ * Survives re-fires, like `dismissed_at`.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`
+			ALTER TABLE insights ADD COLUMN IF NOT EXISTS snoozed_until timestamptz
+		`.execute(db);
+	});
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`ALTER TABLE insights DROP COLUMN IF EXISTS snoozed_until`.execute(
+			db,
+		);
+	});
+}

package/migrations/0179_webhook_replays.ts

@@ -0,0 +1,56 @@
+import { type Kysely, sql } from "kysely";
+import { onControlPlane } from "../src/db/migration-role.ts";
+
+/**
+ * One stored record per webhook replay, so a replay can be watched (queued,
+ * delivering N of M, done) and what gave up can be requeued. The partial
+ * unique index lets the database, not process memory, enforce "one replay
+ * scanning per webhook at a time".
+ *
+ * `webhook_outbox.replay_id` links outbox rows to their replay. It is a
+ * nullable column with no default (instant) and deliberately has NO index:
+ * building one on the large, hot outbox would block delivery inserts on every
+ * hosted stack. Progress counts use the existing partial index on pending rows.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`
+			CREATE TABLE webhook_replays (
+				id             text PRIMARY KEY,
+				webhook_id     uuid NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,
+				from_block     bigint NOT NULL,
+				to_block       bigint NOT NULL,
+				status         text NOT NULL CHECK (status IN ('scanning','running','done','failed')),
+				scanned_count  integer NOT NULL DEFAULT 0,
+				enqueued_count integer NOT NULL DEFAULT 0,
+				total          integer,
+				delivered      integer,
+				gave_up        integer,
+				error          text,
+				started_at     timestamptz NOT NULL DEFAULT now(),
+				finished_at    timestamptz
+			)
+		`.execute(db);
+		await sql`
+			CREATE UNIQUE INDEX webhook_replays_one_scanning
+				ON webhook_replays (webhook_id)
+				WHERE status = 'scanning'
+		`.execute(db);
+		await sql`
+			CREATE INDEX webhook_replays_webhook_started
+				ON webhook_replays (webhook_id, started_at DESC)
+		`.execute(db);
+		await sql`
+			ALTER TABLE webhook_outbox ADD COLUMN IF NOT EXISTS replay_id text
+		`.execute(db);
+	});
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`ALTER TABLE webhook_outbox DROP COLUMN IF EXISTS replay_id`.execute(
+			db,
+		);
+		await sql`DROP TABLE IF EXISTS webhook_replays`.execute(db);
+	});
+}

package/migrations/0180_push.ts

@@ -0,0 +1,54 @@
+import { type Kysely, sql } from "kysely";
+import { onControlPlane } from "../src/db/migration-role.ts";
+
+/**
+ * Web push for the installed phone app.
+ *
+ * `push_subscriptions`: one row per browser/device subscription. `endpoint` is
+ * unique, so the same browser re-subscribing (or signing in as another
+ * account) moves its row instead of duplicating it. `failed_count` counts
+ * delivery errors since the last success; 404/410 responses delete the row.
+ *
+ * `push_prefs`: one row per account, written on first change. A missing row
+ * means the column defaults, so most accounts never have one.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`
+			CREATE TABLE push_subscriptions (
+				id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+				account_id      uuid NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+				endpoint        text NOT NULL UNIQUE,
+				p256dh          text NOT NULL,
+				auth            text NOT NULL,
+				user_agent      text,
+				created_at      timestamptz NOT NULL DEFAULT now(),
+				last_success_at timestamptz,
+				failed_count    integer NOT NULL DEFAULT 0
+			)
+		`.execute(db);
+		await sql`
+			CREATE INDEX push_subscriptions_account
+				ON push_subscriptions (account_id)
+		`.execute(db);
+		await sql`
+			CREATE TABLE push_prefs (
+				account_id           uuid PRIMARY KEY REFERENCES accounts(id) ON DELETE CASCADE,
+				webhook_failing      boolean NOT NULL DEFAULT true,
+				subgraph_stopped     boolean NOT NULL DEFAULT true,
+				subgraph_not_serving boolean NOT NULL DEFAULT true,
+				replay_done          boolean NOT NULL DEFAULT true,
+				spend_cap            boolean NOT NULL DEFAULT false,
+				key_repeat           boolean NOT NULL DEFAULT false,
+				updated_at           timestamptz NOT NULL DEFAULT now()
+			)
+		`.execute(db);
+	});
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`DROP TABLE IF EXISTS push_prefs`.execute(db);
+		await sql`DROP TABLE IF EXISTS push_subscriptions`.execute(db);
+	});
+}

package/migrations/0181_push_sent.ts

@@ -0,0 +1,30 @@
+import { type Kysely, sql } from "kysely";
+import { onControlPlane } from "../src/db/migration-role.ts";
+
+/**
+ * One row per push already sent, so a signal that is seen again never pushes
+ * twice. `key` encodes "once per what" (an outage, a stop, a finished
+ * replay). Rows are purged after 30 days.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`
+			CREATE TABLE push_sent (
+				account_id uuid NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+				key        text NOT NULL,
+				kind       text NOT NULL,
+				sent_at    timestamptz NOT NULL DEFAULT now(),
+				PRIMARY KEY (account_id, key)
+			)
+		`.execute(db);
+		await sql`
+			CREATE INDEX push_sent_sent_at ON push_sent (sent_at)
+		`.execute(db);
+	});
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await onControlPlane(async () => {
+		await sql`DROP TABLE IF EXISTS push_sent`.execute(db);
+	});
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secondlayer/shared",
-	"version": "13.11.0",
+	"version": "13.13.0",
 	"description": "Internal building blocks shared across Secondlayer packages.",
 	"license": "MIT",
 	"repository": {
@@ -85,6 +85,10 @@
 			"types": "./dist/src/db/queries/webhooks.d.ts",
 			"import": "./dist/src/db/queries/webhooks.js"
 		},
+		"./db/queries/webhook-replays": {
+			"types": "./dist/src/db/queries/webhook-replays.d.ts",
+			"import": "./dist/src/db/queries/webhook-replays.js"
+		},
 		"./crypto/standard-webhooks": {
 			"types": "./dist/src/crypto/standard-webhooks.d.ts",
 			"import": "./dist/src/crypto/standard-webhooks.js"