@shumai-one/shumai-transcode 0.6.1 → 0.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shumai-one/shumai-transcode",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Media transcoding worker for the shumai media workspace",
   "type": "module",
   "bin": {
@@ -25,12 +25,12 @@
     "exiftool-vendored": "38.1.0"
   },
   "optionalDependencies": {
-    "@shumai-one/shumai-transcode-darwin-arm64": "0.6.1",
-    "@shumai-one/shumai-transcode-darwin-x64": "0.6.1",
-    "@shumai-one/shumai-transcode-linux-arm64": "0.6.1",
-    "@shumai-one/shumai-transcode-linux-x64": "0.6.1",
-    "@shumai-one/shumai-transcode-win32-arm64": "0.6.1",
-    "@shumai-one/shumai-transcode-win32-x64": "0.6.1"
+    "@shumai-one/shumai-transcode-darwin-arm64": "0.6.3",
+    "@shumai-one/shumai-transcode-darwin-x64": "0.6.3",
+    "@shumai-one/shumai-transcode-linux-arm64": "0.6.3",
+    "@shumai-one/shumai-transcode-linux-x64": "0.6.3",
+    "@shumai-one/shumai-transcode-win32-arm64": "0.6.3",
+    "@shumai-one/shumai-transcode-win32-x64": "0.6.3"
   },
   "repository": {
     "type": "git",

package/prisma/migrations/20261026024507_hash_api_tokens/migration.sql

@@ -0,0 +1,28 @@
+-- Store API tokens as SHA-256 digests instead of plaintext.
+--
+-- Existing tokens keep working: their plaintext is hashed in place with the same
+-- algorithm the application uses (hex-encoded SHA-256 of the UTF-8 token), so
+-- clients holding the plaintext still authenticate. This migration is one-way:
+-- after it runs the plaintext values are gone.
+
+-- AlterTable: add the new columns as nullable so existing rows can be backfilled
+ALTER TABLE "api_tokens" ADD COLUMN     "token_hash" TEXT,
+ADD COLUMN     "token_hint" TEXT;
+
+-- Backfill: keep the last 4 characters for display, then hash the plaintext
+UPDATE "api_tokens"
+SET "token_hint" = right("token", 4),
+    "token_hash" = encode(sha256(convert_to("token", 'UTF8')), 'hex');
+
+-- AlterTable: enforce the final shape
+ALTER TABLE "api_tokens" ALTER COLUMN "token_hash" SET NOT NULL,
+ALTER COLUMN "token_hint" SET NOT NULL;
+
+-- DropIndex
+DROP INDEX "api_tokens_token_key";
+
+-- AlterTable
+ALTER TABLE "api_tokens" DROP COLUMN "token";
+
+-- CreateIndex
+CREATE UNIQUE INDEX "api_tokens_token_hash_key" ON "api_tokens"("token_hash");

package/prisma/migrations/20261026031904_add_audit_log_via/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "audit_logs" ADD COLUMN     "via" TEXT;

package/prisma/migrations/20261029024626_add_oauth_and_jwks/migration.sql

@@ -0,0 +1,205 @@
+-- CreateTable
+CREATE TABLE "jwks" (
+    "id" TEXT NOT NULL,
+    "public_key" TEXT NOT NULL,
+    "private_key" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "expires_at" TIMESTAMP(3),
+    "alg" TEXT,
+    "crv" TEXT,
+
+    CONSTRAINT "jwks_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_clients" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "client_secret" TEXT,
+    "client_discovery_id" TEXT,
+    "disabled" BOOLEAN DEFAULT false,
+    "skip_consent" BOOLEAN,
+    "enable_end_session" BOOLEAN,
+    "subject_type" TEXT,
+    "scopes" TEXT[],
+    "client_credentials_scopes" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "user_id" TEXT,
+    "created_at" TIMESTAMP(3) DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3),
+    "name" TEXT,
+    "uri" TEXT,
+    "icon" TEXT,
+    "contacts" TEXT[],
+    "tos" TEXT,
+    "policy" TEXT,
+    "software_id" TEXT,
+    "software_version" TEXT,
+    "software_statement" TEXT,
+    "redirect_uris" TEXT[],
+    "post_logout_redirect_uris" TEXT[],
+    "backchannel_logout_uri" TEXT,
+    "backchannel_logout_session_required" BOOLEAN,
+    "token_endpoint_auth_method" TEXT,
+    "application_type" TEXT,
+    "jwks" TEXT,
+    "jwks_uri" TEXT,
+    "grant_types" TEXT[],
+    "response_types" TEXT[],
+    "require_pkce" BOOLEAN,
+    "dpop_bound_access_tokens" BOOLEAN DEFAULT false,
+    "reference_id" TEXT,
+    "metadata" JSONB,
+
+    CONSTRAINT "oauth_clients_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_resources" (
+    "id" TEXT NOT NULL,
+    "identifier" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "access_token_ttl" INTEGER,
+    "refresh_token_ttl" INTEGER,
+    "signing_algorithm" TEXT,
+    "signing_key_id" TEXT,
+    "allowed_scopes" TEXT[],
+    "custom_claims" JSONB,
+    "dpop_bound_access_tokens_required" BOOLEAN DEFAULT false,
+    "disabled" BOOLEAN DEFAULT false,
+    "created_at" TIMESTAMP(3) DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3),
+    "policy_version" INTEGER DEFAULT 1,
+    "metadata" JSONB,
+
+    CONSTRAINT "oauth_resources_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_client_resources" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "resource_id" TEXT NOT NULL,
+    "metadata" JSONB,
+    "created_at" TIMESTAMP(3) DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "oauth_client_resources_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_refresh_tokens" (
+    "id" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "session_id" TEXT,
+    "user_id" TEXT NOT NULL,
+    "reference_id" TEXT,
+    "authorization_code_id" TEXT,
+    "resources" TEXT[],
+    "requested_user_info_claims" TEXT[],
+    "expires_at" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "revoked" TIMESTAMP(3),
+    "rotated_at" TIMESTAMP(3),
+    "rotation_replay_response" TEXT,
+    "rotation_replay_expires_at" TIMESTAMP(3),
+    "auth_time" TIMESTAMP(3),
+    "confirmation" JSONB,
+    "scopes" TEXT[],
+
+    CONSTRAINT "oauth_refresh_tokens_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_access_tokens" (
+    "id" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "session_id" TEXT,
+    "user_id" TEXT,
+    "reference_id" TEXT,
+    "authorization_code_id" TEXT,
+    "resources" TEXT[],
+    "requested_user_info_claims" TEXT[],
+    "refresh_id" TEXT,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "revoked" TIMESTAMP(3),
+    "confirmation" JSONB,
+    "scopes" TEXT[],
+
+    CONSTRAINT "oauth_access_tokens_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_consents" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "user_id" TEXT,
+    "reference_id" TEXT,
+    "resources" TEXT[],
+    "requested_user_info_claims" TEXT[],
+    "scopes" TEXT[],
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "oauth_consents_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_client_assertions" (
+    "id" TEXT NOT NULL,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "oauth_client_assertions_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_clients_client_id_key" ON "oauth_clients"("client_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_resources_identifier_key" ON "oauth_resources"("identifier");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_client_resources_client_id_resource_id_key" ON "oauth_client_resources"("client_id", "resource_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_refresh_tokens_token_key" ON "oauth_refresh_tokens"("token");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_access_tokens_token_key" ON "oauth_access_tokens"("token");
+
+-- AddForeignKey
+ALTER TABLE "oauth_clients" ADD CONSTRAINT "oauth_clients_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_client_resources" ADD CONSTRAINT "oauth_client_resources_client_id_fkey" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_client_resources" ADD CONSTRAINT "oauth_client_resources_resource_id_fkey" FOREIGN KEY ("resource_id") REFERENCES "oauth_resources"("identifier") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_refresh_tokens" ADD CONSTRAINT "oauth_refresh_tokens_client_id_fkey" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_refresh_tokens" ADD CONSTRAINT "oauth_refresh_tokens_session_id_fkey" FOREIGN KEY ("session_id") REFERENCES "sessions"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_refresh_tokens" ADD CONSTRAINT "oauth_refresh_tokens_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_client_id_fkey" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_session_id_fkey" FOREIGN KEY ("session_id") REFERENCES "sessions"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_refresh_id_fkey" FOREIGN KEY ("refresh_id") REFERENCES "oauth_refresh_tokens"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_consents" ADD CONSTRAINT "oauth_consents_client_id_fkey" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_consents" ADD CONSTRAINT "oauth_consents_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261029030321_default_empty_arrays_oauth/migration.sql

@@ -0,0 +1,25 @@
+-- AlterTable
+ALTER TABLE "oauth_access_tokens" ALTER COLUMN "resources" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "requested_user_info_claims" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "scopes" SET DEFAULT ARRAY[]::TEXT[];
+
+-- AlterTable
+ALTER TABLE "oauth_clients" ALTER COLUMN "scopes" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "contacts" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "redirect_uris" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "post_logout_redirect_uris" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "grant_types" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "response_types" SET DEFAULT ARRAY[]::TEXT[];
+
+-- AlterTable
+ALTER TABLE "oauth_consents" ALTER COLUMN "resources" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "requested_user_info_claims" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "scopes" SET DEFAULT ARRAY[]::TEXT[];
+
+-- AlterTable
+ALTER TABLE "oauth_refresh_tokens" ALTER COLUMN "resources" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "requested_user_info_claims" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "scopes" SET DEFAULT ARRAY[]::TEXT[];
+
+-- AlterTable
+ALTER TABLE "oauth_resources" ALTER COLUMN "allowed_scopes" SET DEFAULT ARRAY[]::TEXT[];

package/prisma/schema.prisma

@@ -249,6 +249,10 @@ model User {
   kanbanTaskComments        KanbanTaskComment[]
   kanbanTaskEvents          KanbanTaskEvent[]
   recentFiles               RecentFileItem[]
+  oauthClients              OauthClient[]
+  oauthRefreshTokens        OauthRefreshToken[]
+  oauthAccessTokens         OauthAccessToken[]
+  oauthConsents             OauthConsent[]
 
   @@map("users")
 }
@@ -264,6 +268,9 @@ model Session {
   userId    String   @map("user_id")
   user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
 
+  oauthRefreshTokens OauthRefreshToken[]
+  oauthAccessTokens  OauthAccessToken[]
+
   @@map("sessions")
 }
 
@@ -1089,7 +1096,10 @@ model Collection {
 
 model ApiToken {
   id        String   @id @default(ulid())
-  token     String   @unique @default(ulid())
+  /// SHA-256 hex digest of the plaintext token. The plaintext is never stored.
+  tokenHash String   @unique @map("token_hash")
+  /// Last characters of the plaintext token, shown in the UI to identify it.
+  tokenHint String   @map("token_hint")
   name      String
   userId    String   @map("user_id")
   user      User     @relation("UserToApiToken", fields: [userId], references: [id], onDelete: Cascade)
@@ -1129,6 +1139,8 @@ model AuditLog {
   agentId   String?     @map("agent_id")
   projectId String?     @map("project_id")
   itemId    String?     @map("item_id")
+  /// Surface the action came through: api, agent, mcp, or cli. Null for actions recorded outside Operations.
+  via       String?     @map("via")
   createdAt DateTime    @default(now()) @map("created_at")
 
   team    Team     @relation("TeamToAuditLog", fields: [teamId], references: [id], onDelete: Cascade)
@@ -1339,5 +1351,178 @@ model RecentFileItem {
   @@map("recent_file_items")
 }
 
+model Jwks {
+  id         String    @id @default(ulid())
+  publicKey  String    @map("public_key")
+  privateKey String    @map("private_key")
+  createdAt  DateTime  @default(now()) @map("created_at")
+  expiresAt  DateTime? @map("expires_at")
+  alg        String?
+  crv        String?
+
+  @@map("jwks")
+}
+
+model OauthClient {
+  id                               String                @id @default(ulid())
+  clientId                         String                @unique @map("client_id")
+  clientSecret                     String?               @map("client_secret")
+  clientDiscoveryId                String?               @map("client_discovery_id")
+  disabled                         Boolean?              @default(false)
+  skipConsent                      Boolean?              @map("skip_consent")
+  enableEndSession                 Boolean?              @map("enable_end_session")
+  subjectType                      String?               @map("subject_type")
+  scopes                           String[]              @default([])
+  clientCredentialsScopes          String[]              @default([]) @map("client_credentials_scopes")
+  userId                           String?               @map("user_id")
+  user                             User?                 @relation(fields: [userId], references: [id], onDelete: Cascade)
+  createdAt                        DateTime?             @default(now()) @map("created_at")
+  updatedAt                        DateTime?             @updatedAt @map("updated_at")
+  name                             String?
+  uri                              String?
+  icon                             String?
+  contacts                         String[]              @default([])
+  tos                              String?
+  policy                           String?
+  softwareId                       String?               @map("software_id")
+  softwareVersion                  String?               @map("software_version")
+  softwareStatement                String?               @map("software_statement")
+  redirectUris                     String[]              @default([]) @map("redirect_uris")
+  postLogoutRedirectUris           String[]              @default([]) @map("post_logout_redirect_uris")
+  backchannelLogoutUri             String?               @map("backchannel_logout_uri")
+  backchannelLogoutSessionRequired Boolean?              @map("backchannel_logout_session_required")
+  tokenEndpointAuthMethod          String?               @map("token_endpoint_auth_method")
+  applicationType                  String?               @map("application_type")
+  jwks                             String?
+  jwksUri                          String?               @map("jwks_uri")
+  grantTypes                       String[]              @default([]) @map("grant_types")
+  responseTypes                    String[]              @default([]) @map("response_types")
+  requirePKCE                      Boolean?              @map("require_pkce")
+  dpopBoundAccessTokens            Boolean?              @default(false) @map("dpop_bound_access_tokens")
+  referenceId                      String?               @map("reference_id")
+  /// [OauthMetadata]
+  metadata                         Json?
+
+  clientResources                  OauthClientResource[]
+  refreshTokens                    OauthRefreshToken[]
+  accessTokens                     OauthAccessToken[]
+  consents                         OauthConsent[]
+
+  @@map("oauth_clients")
+}
+
+model OauthResource {
+  id                            String                @id @default(ulid())
+  identifier                    String                @unique
+  name                          String
+  accessTokenTtl                Int?                  @map("access_token_ttl")
+  refreshTokenTtl               Int?                  @map("refresh_token_ttl")
+  signingAlgorithm              String?               @map("signing_algorithm")
+  signingKeyId                  String?               @map("signing_key_id")
+  allowedScopes                 String[]              @default([]) @map("allowed_scopes")
+  /// [OauthCustomClaims]
+  customClaims                  Json?                 @map("custom_claims")
+  dpopBoundAccessTokensRequired Boolean?              @default(false) @map("dpop_bound_access_tokens_required")
+  disabled                      Boolean?              @default(false)
+  createdAt                     DateTime?             @default(now()) @map("created_at")
+  updatedAt                     DateTime?             @updatedAt @map("updated_at")
+  policyVersion                 Int?                  @default(1) @map("policy_version")
+  /// [OauthMetadata]
+  metadata                      Json?
+
+  clientResources               OauthClientResource[]
+
+  @@map("oauth_resources")
+}
+
+model OauthClientResource {
+  id         String        @id @default(ulid())
+  clientId   String        @map("client_id")
+  client     OauthClient   @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  resourceId String        @map("resource_id")
+  resource   OauthResource @relation(fields: [resourceId], references: [identifier], onDelete: Cascade)
+  /// [OauthMetadata]
+  metadata   Json?
+  createdAt  DateTime?     @default(now()) @map("created_at")
+
+  @@unique([clientId, resourceId])
+  @@map("oauth_client_resources")
+}
+
+model OauthRefreshToken {
+  id                      String             @id @default(ulid())
+  token                   String             @unique
+  clientId                String             @map("client_id")
+  client                  OauthClient        @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  sessionId               String?            @map("session_id")
+  session                 Session?           @relation(fields: [sessionId], references: [id], onDelete: SetNull)
+  userId                  String             @map("user_id")
+  user                    User               @relation(fields: [userId], references: [id], onDelete: Cascade)
+  referenceId             String?            @map("reference_id")
+  authorizationCodeId     String?            @map("authorization_code_id")
+  resources               String[]           @default([])
+  requestedUserInfoClaims String[]           @default([]) @map("requested_user_info_claims")
+  expiresAt               DateTime           @map("expires_at")
+  createdAt               DateTime           @default(now()) @map("created_at")
+  revoked                 DateTime?
+  rotatedAt               DateTime?          @map("rotated_at")
+  rotationReplayResponse  String?            @map("rotation_replay_response")
+  rotationReplayExpiresAt DateTime?          @map("rotation_replay_expires_at")
+  authTime                DateTime?          @map("auth_time")
+  /// [OauthConfirmation]
+  confirmation            Json?
+  scopes                  String[]           @default([])
+
+  accessTokens            OauthAccessToken[]
+
+  @@map("oauth_refresh_tokens")
+}
+
+model OauthAccessToken {
+  id                      String             @id @default(ulid())
+  token                   String             @unique
+  clientId                String             @map("client_id")
+  client                  OauthClient        @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  sessionId               String?            @map("session_id")
+  session                 Session?           @relation(fields: [sessionId], references: [id], onDelete: SetNull)
+  userId                  String?            @map("user_id")
+  user                    User?              @relation(fields: [userId], references: [id], onDelete: Cascade)
+  referenceId             String?            @map("reference_id")
+  authorizationCodeId     String?            @map("authorization_code_id")
+  resources               String[]           @default([])
+  requestedUserInfoClaims String[]           @default([]) @map("requested_user_info_claims")
+  refreshId               String?            @map("refresh_id")
+  refreshToken            OauthRefreshToken? @relation(fields: [refreshId], references: [id], onDelete: Cascade)
+  expiresAt               DateTime           @map("expires_at")
+  createdAt               DateTime           @default(now()) @map("created_at")
+  revoked                 DateTime?
+  /// [OauthConfirmation]
+  confirmation            Json?
+  scopes                  String[]           @default([])
+
+  @@map("oauth_access_tokens")
+}
+
+model OauthConsent {
+  id                      String      @id @default(ulid())
+  clientId                String      @map("client_id")
+  client                  OauthClient @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  userId                  String?     @map("user_id")
+  user                    User?       @relation(fields: [userId], references: [id], onDelete: Cascade)
+  referenceId             String?     @map("reference_id")
+  resources               String[]    @default([])
+  requestedUserInfoClaims String[]    @default([]) @map("requested_user_info_claims")
+  scopes                  String[]    @default([])
+  createdAt               DateTime    @default(now()) @map("created_at")
+  updatedAt               DateTime    @updatedAt @map("updated_at")
+
+  @@map("oauth_consents")
+}
+
+model OauthClientAssertion {
+  id        String   @id @default(ulid())
+  expiresAt DateTime @map("expires_at")
 
+  @@map("oauth_client_assertions")
+}
 

package/bin/chunk-c8cevptj.js

@@ -1,2 +0,0 @@
-// @bun
-import{f,I,h}from"./chunk-fy14v1v4.js";export{f as ENV_KEY,I as ENV_SECRET,h as fromEnv};