@secondlayer/shared 13.11.0 → 13.13.0

package/dist/src/db/queries/integrity.d.ts

@@ -402,6 +402,7 @@ interface InsightsTable {
 	clear_streak: Generated<number>;
 	resolved_at: Date | null;
 	dismissed_at: Date | null;
+	snoozed_until: Date | null;
 }
 /** "Expected": mutes one rule for one resource until removed. */
 interface InsightMutesTable {
@@ -895,6 +896,7 @@ interface Database {
 	webhooks: WebhooksTable;
 	webhook_outbox: WebhookOutboxTable;
 	webhook_deliveries: WebhookDeliveriesTable;
+	webhook_replays: WebhookReplaysTable;
 	trigger_evaluator_state: TriggerEvaluatorStateTable;
 	decoded_events: DecodedEventsTable;
 	decoder_checkpoints: DecoderCheckpointsTable;
@@ -928,6 +930,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -937,6 +945,9 @@ interface Database {
 	insights: InsightsTable;
 	insight_mutes: InsightMutesTable;
 	feedback_tickets: FeedbackTicketsTable;
+	push_subscriptions: PushSubscriptionsTable;
+	push_prefs: PushPrefsTable;
+	push_sent: PushSentTable;
 }
 interface ServiceHeartbeatsTable {
 	name: string;
@@ -1029,6 +1040,36 @@ interface WebhookIncidentAlertsTable {
 	email_attempts: Generated<number>;
 	resolved_at: Date | null;
 }
+/** One browser/device push subscription; the endpoint is unique. */
+interface PushSubscriptionsTable {
+	id: Generated<string>;
+	account_id: string;
+	endpoint: string;
+	p256dh: string;
+	auth: string;
+	user_agent: string | null;
+	created_at: Generated<Date>;
+	last_success_at: Date | null;
+	failed_count: Generated<number>;
+}
+/** Per-account push toggles. A missing row means the column defaults. */
+interface PushPrefsTable {
+	account_id: string;
+	webhook_failing: Generated<boolean>;
+	subgraph_stopped: Generated<boolean>;
+	subgraph_not_serving: Generated<boolean>;
+	replay_done: Generated<boolean>;
+	spend_cap: Generated<boolean>;
+	key_repeat: Generated<boolean>;
+	updated_at: Generated<Date>;
+}
+/** A push already sent, keyed by what it was about; debounces repeat signals. */
+interface PushSentTable {
+	account_id: string;
+	key: string;
+	kind: string;
+	sent_at: Generated<Date>;
+}
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
 /** The product that started a CLI sign-in; null is `sl login`. */
 type CliDeviceProduct = "sentinel";
@@ -1049,6 +1090,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {
@@ -1106,6 +1213,8 @@ interface WebhookOutboxTable {
 	next_attempt_at: Generated<Date>;
 	status: ColumnType<OutboxStatus, OutboxStatus | undefined, OutboxStatus>;
 	is_replay: Generated<boolean>;
+	/** The replay that created this row; null for live rows. */
+	replay_id: string | null;
 	/** The chain block_time of the matched event/tx. Null for rows written
 	*  before this column existed, and for the settlement scan path (not yet
 	*  wired). Lets `delivered_at - block_time` measure end-to-end webhook
@@ -1121,6 +1230,22 @@ interface WebhookOutboxTable {
 	last_error: string | null;
 	created_at: Generated<Date>;
 }
+type WebhookReplayStatus = "scanning" | "running" | "done" | "failed";
+interface WebhookReplaysTable {
+	id: string;
+	webhook_id: string;
+	from_block: number | bigint;
+	to_block: number | bigint;
+	status: WebhookReplayStatus;
+	scanned_count: Generated<number>;
+	enqueued_count: Generated<number>;
+	total: number | null;
+	delivered: number | null;
+	gave_up: number | null;
+	error: string | null;
+	started_at: Generated<Date>;
+	finished_at: Date | null;
+}
 interface WebhookDeliveriesTable {
 	id: Generated<string>;
 	/** Nullable after migration 0077 — outbox row may be cleaned up while

package/dist/src/db/queries/subgraph-gaps.d.ts

@@ -402,6 +402,7 @@ interface InsightsTable {
 	clear_streak: Generated<number>;
 	resolved_at: Date | null;
 	dismissed_at: Date | null;
+	snoozed_until: Date | null;
 }
 /** "Expected": mutes one rule for one resource until removed. */
 interface InsightMutesTable {
@@ -895,6 +896,7 @@ interface Database {
 	webhooks: WebhooksTable;
 	webhook_outbox: WebhookOutboxTable;
 	webhook_deliveries: WebhookDeliveriesTable;
+	webhook_replays: WebhookReplaysTable;
 	trigger_evaluator_state: TriggerEvaluatorStateTable;
 	decoded_events: DecodedEventsTable;
 	decoder_checkpoints: DecoderCheckpointsTable;
@@ -928,6 +930,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -937,6 +945,9 @@ interface Database {
 	insights: InsightsTable;
 	insight_mutes: InsightMutesTable;
 	feedback_tickets: FeedbackTicketsTable;
+	push_subscriptions: PushSubscriptionsTable;
+	push_prefs: PushPrefsTable;
+	push_sent: PushSentTable;
 }
 interface ServiceHeartbeatsTable {
 	name: string;
@@ -1029,6 +1040,36 @@ interface WebhookIncidentAlertsTable {
 	email_attempts: Generated<number>;
 	resolved_at: Date | null;
 }
+/** One browser/device push subscription; the endpoint is unique. */
+interface PushSubscriptionsTable {
+	id: Generated<string>;
+	account_id: string;
+	endpoint: string;
+	p256dh: string;
+	auth: string;
+	user_agent: string | null;
+	created_at: Generated<Date>;
+	last_success_at: Date | null;
+	failed_count: Generated<number>;
+}
+/** Per-account push toggles. A missing row means the column defaults. */
+interface PushPrefsTable {
+	account_id: string;
+	webhook_failing: Generated<boolean>;
+	subgraph_stopped: Generated<boolean>;
+	subgraph_not_serving: Generated<boolean>;
+	replay_done: Generated<boolean>;
+	spend_cap: Generated<boolean>;
+	key_repeat: Generated<boolean>;
+	updated_at: Generated<Date>;
+}
+/** A push already sent, keyed by what it was about; debounces repeat signals. */
+interface PushSentTable {
+	account_id: string;
+	key: string;
+	kind: string;
+	sent_at: Generated<Date>;
+}
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
 /** The product that started a CLI sign-in; null is `sl login`. */
 type CliDeviceProduct = "sentinel";
@@ -1049,6 +1090,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {
@@ -1106,6 +1213,8 @@ interface WebhookOutboxTable {
 	next_attempt_at: Generated<Date>;
 	status: ColumnType<OutboxStatus, OutboxStatus | undefined, OutboxStatus>;
 	is_replay: Generated<boolean>;
+	/** The replay that created this row; null for live rows. */
+	replay_id: string | null;
 	/** The chain block_time of the matched event/tx. Null for rows written
 	*  before this column existed, and for the settlement scan path (not yet
 	*  wired). Lets `delivered_at - block_time` measure end-to-end webhook
@@ -1121,6 +1230,22 @@ interface WebhookOutboxTable {
 	last_error: string | null;
 	created_at: Generated<Date>;
 }
+type WebhookReplayStatus = "scanning" | "running" | "done" | "failed";
+interface WebhookReplaysTable {
+	id: string;
+	webhook_id: string;
+	from_block: number | bigint;
+	to_block: number | bigint;
+	status: WebhookReplayStatus;
+	scanned_count: Generated<number>;
+	enqueued_count: Generated<number>;
+	total: number | null;
+	delivered: number | null;
+	gave_up: number | null;
+	error: string | null;
+	started_at: Generated<Date>;
+	finished_at: Date | null;
+}
 interface WebhookDeliveriesTable {
 	id: Generated<string>;
 	/** Nullable after migration 0077 — outbox row may be cleaned up while

package/dist/src/db/queries/subgraph-operations.d.ts

@@ -402,6 +402,7 @@ interface InsightsTable {
 	clear_streak: Generated<number>;
 	resolved_at: Date | null;
 	dismissed_at: Date | null;
+	snoozed_until: Date | null;
 }
 /** "Expected": mutes one rule for one resource until removed. */
 interface InsightMutesTable {
@@ -895,6 +896,7 @@ interface Database {
 	webhooks: WebhooksTable;
 	webhook_outbox: WebhookOutboxTable;
 	webhook_deliveries: WebhookDeliveriesTable;
+	webhook_replays: WebhookReplaysTable;
 	trigger_evaluator_state: TriggerEvaluatorStateTable;
 	decoded_events: DecodedEventsTable;
 	decoder_checkpoints: DecoderCheckpointsTable;
@@ -928,6 +930,12 @@ interface Database {
 	account_balance_alerts: AccountBalanceAlertsTable;
 	webhook_incident_alerts: WebhookIncidentAlertsTable;
 	cli_device_logins: CliDeviceLoginsTable;
+	oauth_clients: OauthClientsTable;
+	oauth_requests: OauthRequestsTable;
+	oauth_codes: OauthCodesTable;
+	oauth_grants: OauthGrantsTable;
+	oauth_tokens: OauthTokensTable;
+	oauth_refresh_retired: OauthRefreshRetiredTable;
 	sentinel_accounts: SentinelAccountsTable;
 	waitlists: WaitlistsTable;
 	waitlist_signups: WaitlistSignupsTable;
@@ -937,6 +945,9 @@ interface Database {
 	insights: InsightsTable;
 	insight_mutes: InsightMutesTable;
 	feedback_tickets: FeedbackTicketsTable;
+	push_subscriptions: PushSubscriptionsTable;
+	push_prefs: PushPrefsTable;
+	push_sent: PushSentTable;
 }
 interface ServiceHeartbeatsTable {
 	name: string;
@@ -1029,6 +1040,36 @@ interface WebhookIncidentAlertsTable {
 	email_attempts: Generated<number>;
 	resolved_at: Date | null;
 }
+/** One browser/device push subscription; the endpoint is unique. */
+interface PushSubscriptionsTable {
+	id: Generated<string>;
+	account_id: string;
+	endpoint: string;
+	p256dh: string;
+	auth: string;
+	user_agent: string | null;
+	created_at: Generated<Date>;
+	last_success_at: Date | null;
+	failed_count: Generated<number>;
+}
+/** Per-account push toggles. A missing row means the column defaults. */
+interface PushPrefsTable {
+	account_id: string;
+	webhook_failing: Generated<boolean>;
+	subgraph_stopped: Generated<boolean>;
+	subgraph_not_serving: Generated<boolean>;
+	replay_done: Generated<boolean>;
+	spend_cap: Generated<boolean>;
+	key_repeat: Generated<boolean>;
+	updated_at: Generated<Date>;
+}
+/** A push already sent, keyed by what it was about; debounces repeat signals. */
+interface PushSentTable {
+	account_id: string;
+	key: string;
+	kind: string;
+	sent_at: Generated<Date>;
+}
 type CliDeviceLoginStatus = "pending" | "approved" | "denied" | "consumed";
 /** The product that started a CLI sign-in; null is `sl login`. */
 type CliDeviceProduct = "sentinel";
@@ -1049,6 +1090,72 @@ interface CliDeviceLoginsTable {
 	approved_at: Date | null;
 	consumed_at: Date | null;
 }
+/** An app that registered itself (RFC 7591). Public clients only: no secret. */
+interface OauthClientsTable {
+	id: string;
+	/** The app's own claim, validated at registration; shown quoted. */
+	name: string;
+	redirect_uris: string[];
+	created_ip: string | null;
+	created_at: Generated<Date>;
+	/** Set when it first gets tokens; never-used clients are purged. */
+	last_used_at: Date | null;
+}
+type OauthRequestStatus = "pending" | "approved" | "denied";
+/** One authorize request waiting for (or answered on) the consent page. */
+interface OauthRequestsTable {
+	id: string;
+	client_id: string;
+	redirect_uri: string;
+	state: string | null;
+	code_challenge: string;
+	resource: string;
+	status: Generated<OauthRequestStatus>;
+	account_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	answered_at: Date | null;
+}
+/** A one-time authorization code, bound to its client, redirect, PKCE
+*  challenge, resource and account. */
+interface OauthCodesTable {
+	code_hash: string;
+	client_id: string;
+	account_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	resource: string;
+	/** The grant its one use made, so a replay can revoke it. */
+	grant_id: string | null;
+	created_at: Generated<Date>;
+	expires_at: Date;
+	used_at: Date | null;
+}
+/** What a person allowed one app to do: use the hosted MCP as them. */
+interface OauthGrantsTable {
+	id: Generated<string>;
+	account_id: string;
+	client_id: string;
+	scope: Generated<string>;
+	resource: string;
+	created_at: Generated<Date>;
+	last_used_at: Date | null;
+	revoked_at: Date | null;
+}
+type OauthTokenKind = "access" | "refresh";
+interface OauthTokensTable {
+	token_hash: string;
+	grant_id: string;
+	kind: OauthTokenKind;
+	created_at: Generated<Date>;
+	expires_at: Date;
+}
+/** A refresh token a rotation replaced: presented again, it revokes the grant. */
+interface OauthRefreshRetiredTable {
+	token_hash: string;
+	grant_id: string;
+	retired_at: Generated<Date>;
+}
 /** Accounts Sentinel's service key may touch: created by Sentinel, or the
 *  owner opted in. */
 interface SentinelAccountsTable {
@@ -1107,6 +1214,8 @@ interface WebhookOutboxTable {
 	next_attempt_at: Generated<Date>;
 	status: ColumnType<OutboxStatus, OutboxStatus | undefined, OutboxStatus>;
 	is_replay: Generated<boolean>;
+	/** The replay that created this row; null for live rows. */
+	replay_id: string | null;
 	/** The chain block_time of the matched event/tx. Null for rows written
 	*  before this column existed, and for the settlement scan path (not yet
 	*  wired). Lets `delivered_at - block_time` measure end-to-end webhook
@@ -1122,6 +1231,22 @@ interface WebhookOutboxTable {
 	last_error: string | null;
 	created_at: Generated<Date>;
 }
+type WebhookReplayStatus = "scanning" | "running" | "done" | "failed";
+interface WebhookReplaysTable {
+	id: string;
+	webhook_id: string;
+	from_block: number | bigint;
+	to_block: number | bigint;
+	status: WebhookReplayStatus;
+	scanned_count: Generated<number>;
+	enqueued_count: Generated<number>;
+	total: number | null;
+	delivered: number | null;
+	gave_up: number | null;
+	error: string | null;
+	started_at: Generated<Date>;
+	finished_at: Date | null;
+}
 interface WebhookDeliveriesTable {
 	id: Generated<string>;
 	/** Nullable after migration 0077 — outbox row may be cleaned up while