@nylorun/runtime 0.19.1-beta → 0.21.0-beta

package/dist/redact.d.ts

@@ -1 +1,19 @@
-export declare function scrub(value: unknown, secrets: readonly string[]): unknown;
+export interface ScrubOptions {
+    /**
+     * Replace only `secrets` (R2b C8, Q16): no value under a secret-looking key, and no inline
+     * image data. A tool's answer keeps fields such as `nextToken`.
+     */
+    readonly valuesOnly?: boolean;
+    /** Told how many times a secret was replaced. */
+    readonly counted?: (replacements: number) => void;
+}
+/**
+ * `value` with each of `secrets` (those of at least 8 characters) replaced by `[redacted]`. By
+ * default also any value under a key such as `token` or `secret`, and inline image data.
+ */
+export declare function scrub(value: unknown, secrets: readonly string[], options?: ScrubOptions): unknown;
+/** `value` with `secrets` alone replaced (`valuesOnly`), and how many replacements were made. */
+export declare function scrubValues<T>(value: T, secrets: readonly string[]): {
+    value: T;
+    redacted: number;
+};

package/dist/redact.js

@@ -1,14 +1,43 @@
-export function scrub(value, secrets) {
-    if (typeof value === "string")
-        return secrets.reduce((text, secret) => secret.length >= 8 ? text.split(secret).join("[redacted]") : text, value.replace(/data:image\/[a-z0-9.+-]+;base64,[A-Za-z0-9+/=]+/giu, "[inline image data redacted]"));
-    if (Array.isArray(value))
-        return value.map((item) => scrub(item, secrets));
-    if (value && typeof value === "object")
-        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-            key,
-            /^(authorization|api[_-]?key|(?:access|refresh|id|auth)[_-]?token|token|secret|password|cookie|credentials?)$/iu.test(key)
-                ? "[redacted]"
-                : scrub(item, secrets),
-        ]));
-    return value;
+/**
+ * `value` with each of `secrets` (those of at least 8 characters) replaced by `[redacted]`. By
+ * default also any value under a key such as `token` or `secret`, and inline image data.
+ */
+export function scrub(value, secrets, options = {}) {
+    // The longest first, so a header value goes whole before the token inside it.
+    const sorted = secrets.filter((secret) => secret.length >= 8).sort((a, b) => b.length - a.length);
+    let replaced = 0;
+    const walk = (item) => {
+        if (typeof item === "string") {
+            const text = options.valuesOnly
+                ? item
+                : item.replace(/data:image\/[a-z0-9.+-]+;base64,[A-Za-z0-9+/=]+/giu, "[inline image data redacted]");
+            return sorted.reduce((current, secret) => {
+                const parts = current.split(secret);
+                replaced += parts.length - 1;
+                return parts.join("[redacted]");
+            }, text);
+        }
+        if (Array.isArray(item))
+            return item.map(walk);
+        if (item && typeof item === "object")
+            return Object.fromEntries(Object.entries(item).map(([key, entry]) => [
+                key,
+                !options.valuesOnly &&
+                    /^(authorization|api[_-]?key|(?:access|refresh|id|auth)[_-]?token|token|secret|password|cookie|credentials?)$/iu.test(key)
+                    ? "[redacted]"
+                    : walk(entry),
+            ]));
+        return item;
+    };
+    const result = walk(value);
+    options.counted?.(replaced);
+    return result;
+}
+/** `value` with `secrets` alone replaced (`valuesOnly`), and how many replacements were made. */
+export function scrubValues(value, secrets) {
+    if (secrets.length === 0)
+        return { value, redacted: 0 };
+    let redacted = 0;
+    const scrubbed = scrub(value, secrets, { valuesOnly: true, counted: (count) => (redacted = count) });
+    return { value: redacted === 0 ? value : scrubbed, redacted };
 }

package/dist/sandbox/session-sandbox.d.ts

@@ -9,3 +9,10 @@ export type SandboxedManifest = {
 };
 /** The agent's manifest with the sandbox capability added, or why it cannot take one. */
 export declare function withSandboxCapability(manifest: AgentManifest, spec: SandboxManifest): SandboxedManifest;
+/**
+ * The pinned manifest of an agent session without a sandbox: `read_artifact` for each agent of
+ * the tree with a remote MCP server or an HTTP tool (R2b C11), and `nylorun.tools` for each with
+ * a remote MCP server (R2b C10). Undefined when nothing is added, and the session pins its
+ * definition as it is.
+ */
+export declare function withPlatformTools(manifest: AgentManifest): SandboxedManifest | undefined;

package/dist/sandbox/session-sandbox.js

@@ -1,13 +1,23 @@
 /**
- * Gives a session the sandbox chosen when it was opened. An agent session's pinned manifest is
- * its definition plus the `nylorun.sandbox` capability (the six built-in tools, the sandbox
- * instructions and the resolved spec) and the `nylorun.artifacts` capability (`save_artifact`),
- * also added to each agent it uses as a tool, so the tree shares one spec. The sandbox's
- * instructions name the agent's skills' folders (`/skills/<name>/`). The definition in the
- * registry never changes.
+ * Gives a session the sandbox chosen when it was opened, and the platform tools its agents
+ * need. An agent session's pinned manifest is its definition plus:
+ *
+ * - with a sandbox, the `nylorun.sandbox` capability (the six built-in tools, the sandbox
+ *   instructions and the resolved spec) and the `nylorun.artifacts` capability
+ *   (`save_artifact`), also added to each agent it uses as a tool, so the tree shares one spec.
+ *   The sandbox's instructions name the agent's skills' folders (`/skills/<name>/`);
+ * - for each agent of the tree with a remote MCP server or an HTTP tool, `read_artifact` in its
+ *   `nylorun.artifacts` capability (R2b C11), with or without a sandbox: the Runtime stores a
+ *   result of those tools too large to show as an artifact, and the model reads it in pages.
+ *   An agent that declares a tool named `read_artifact` keeps its own, and sees previews only;
+ * - for each agent of the tree with a remote MCP server, the `nylorun.tools` capability (R2b
+ *   C10), empty: when the session defers some of the agent's MCP tools, its session tools put
+ *   `tool_search` and `tool_call` there. An agent that declares either name defers nothing.
+ *
+ * The definition in the registry never changes.
  */
 import { AgentManifestSchema } from "@nylorun/core/contracts";
-import { artifactsCapabilityManifest, hashManifest, sandboxCapabilityManifest, } from "@nylorun/core/define";
+import { READ_ARTIFACT_TOOL, TOOL_CALL_TOOL, TOOL_SEARCH_TOOL, TOOLS_CAPABILITY_ID, artifactsCapabilityManifest, hashManifest, sandboxCapabilityManifest, toolsCapabilityManifest, } from "@nylorun/core/define";
 import { sandboxSpecOf } from "./share.js";
 function isAgentManifest(value) {
     return (typeof value === "object" &&
@@ -19,35 +29,72 @@ function isAgentManifest(value) {
 function skillNamesOf(manifest) {
     return manifest.capabilities.flatMap((capability) => Object.keys(capability.skills ?? {})).sort();
 }
-function addCapability(manifest, spec) {
-    const capabilities = manifest.capabilities.map((capability) => capability.tools === undefined
-        ? capability
-        : {
-            ...capability,
-            tools: capability.tools.map((tool) => {
-                // Agents used as tools share the session's sandbox; flow agents used as tools run
-                // in linked sessions that inherit it.
-                if (tool.agent === undefined || !isAgentManifest(tool.agent))
-                    return tool;
-                if (sandboxSpecOf(tool.agent) !== undefined)
-                    return tool;
-                return { ...tool, agent: addCapability(tool.agent, spec) };
-            }),
+/**
+ * True when the agent itself declares a remote MCP server or an HTTP tool, whose results the
+ * Runtime may store as artifacts (R2b C11), and no tool of its own is named `read_artifact`.
+ */
+function readsStoredResults(manifest) {
+    const remote = manifest.capabilities.some((capability) => Object.keys(capability.mcpServers ?? {}).length > 0 ||
+        (capability.tools ?? []).some((tool) => tool.http !== undefined));
+    const taken = manifest.capabilities.some((capability) => (capability.tools ?? []).some((tool) => tool.name === READ_ARTIFACT_TOOL));
+    return remote && !taken;
+}
+/**
+ * True when the agent itself declares a remote MCP server, some of whose tools the session may
+ * defer (R2b C10), and names no tool `tool_search` or `tool_call` (it then keeps every tool in
+ * its list).
+ */
+function defersTools(manifest) {
+    const servers = manifest.capabilities.some((capability) => Object.keys(capability.mcpServers ?? {}).length > 0);
+    const taken = manifest.capabilities.some((capability) => capability.id === TOOLS_CAPABILITY_ID ||
+        (capability.tools ?? []).some((tool) => tool.name === TOOL_SEARCH_TOOL || tool.name === TOOL_CALL_TOOL));
+    return servers && !taken;
+}
+/** `manifest` with the session's capabilities added; the same object when none are. */
+function addCapabilities(manifest, spec) {
+    let changed = false;
+    const capabilities = manifest.capabilities.map((capability) => {
+        if (capability.tools === undefined)
+            return capability;
+        let toolsChanged = false;
+        const tools = capability.tools.map((tool) => {
+            // Agents used as tools share the session's sandbox; flow agents used as tools run in
+            // linked sessions that inherit it. One that declares its own sandbox keeps it.
+            if (tool.agent === undefined || !isAgentManifest(tool.agent))
+                return tool;
+            const agent = addCapabilities(tool.agent, sandboxSpecOf(tool.agent) === undefined ? spec : undefined);
+            if (agent === tool.agent)
+                return tool;
+            toolsChanged = true;
+            return { ...tool, agent };
         });
+        if (!toolsChanged)
+            return capability;
+        changed = true;
+        return { ...capability, tools };
+    });
+    const save = spec !== undefined;
+    const read = readsStoredResults(manifest);
+    const defer = defersTools(manifest);
+    if (!save && !read && !defer && !changed)
+        return manifest;
     return {
         ...manifest,
         // With a sandbox comes `save_artifact`, so files the agent makes reach the user (F8.1). The
         // sandbox's instructions name where the agent's skills are (R2 M4).
         capabilities: [
             ...capabilities,
-            sandboxCapabilityManifest(spec, { skills: skillNamesOf(manifest) }),
-            artifactsCapabilityManifest(),
+            ...(spec === undefined
+                ? []
+                : [sandboxCapabilityManifest(spec, { skills: skillNamesOf(manifest) })]),
+            ...(save || read ? [artifactsCapabilityManifest({ save, read })] : []),
+            // Empty: when the session defers MCP tools, its tools put tool_search and tool_call here.
+            ...(defer ? [toolsCapabilityManifest()] : []),
         ],
     };
 }
-/** The agent's manifest with the sandbox capability added, or why it cannot take one. */
-export function withSandboxCapability(manifest, spec) {
-    const sandboxed = addCapability(manifest, spec);
+/** `sandboxed` checked as a manifest, with its hash. */
+function checked(original, sandboxed) {
     const parsed = AgentManifestSchema.safeParse(sandboxed);
     if (!parsed.success) {
         const issues = parsed.error.issues.map((issue) => issue.message);
@@ -55,9 +102,23 @@ export function withSandboxCapability(manifest, spec) {
         return {
             ok: false,
             message: clash
-                ? `'${manifest.id}' declares a tool named like a sandbox tool (bash, read, write, edit, grep, glob, save_artifact). Rename it, or open the session with sandbox: false.`
-                : `'${manifest.id}' cannot take this sandbox: ${[...new Set(issues)].join("; ")}`,
+                ? `'${original.id}' declares a tool named like a sandbox tool (bash, read, write, edit, grep, glob, save_artifact). Rename it, or open the session with sandbox: false.`
+                : `'${original.id}' cannot take this sandbox: ${[...new Set(issues)].join("; ")}`,
         };
     }
     return { ok: true, manifest: sandboxed, manifestHash: hashManifest(sandboxed) };
 }
+/** The agent's manifest with the sandbox capability added, or why it cannot take one. */
+export function withSandboxCapability(manifest, spec) {
+    return checked(manifest, addCapabilities(manifest, spec));
+}
+/**
+ * The pinned manifest of an agent session without a sandbox: `read_artifact` for each agent of
+ * the tree with a remote MCP server or an HTTP tool (R2b C11), and `nylorun.tools` for each with
+ * a remote MCP server (R2b C10). Undefined when nothing is added, and the session pins its
+ * definition as it is.
+ */
+export function withPlatformTools(manifest) {
+    const pinned = addCapabilities(manifest, undefined);
+    return pinned === manifest ? undefined : checked(manifest, pinned);
+}

package/dist/store/postgres/connect.d.ts

@@ -41,3 +41,13 @@ export declare function createPostgresClient(url: string, options?: PostgresClie
 export declare function assertLogicalReplication(sql: Sql): Promise<void>;
 /** Separate, bounded pool for read projections; inherits the Tenant connection credentials. */
 export declare function createPostgresReadClient(source: PostgresClient): PostgresClient;
+/**
+ * One connection of its own for `LISTEN` (the control bus, `control.ts`), with `source`'s
+ * database and credentials. It never idles out. `onClose` runs when the connection ends for
+ * any reason; the caller listens again, which connects again. A `LISTEN` needs a session of
+ * its own: behind a pooler in transaction mode it would not hear a thing.
+ */
+export declare function createPostgresListenClient(source: PostgresClient, handlers: {
+    onNotify: (channel: string, payload: string) => void;
+    onClose: () => void;
+}): PostgresClient;

package/dist/store/postgres/connect.js

@@ -40,9 +40,9 @@ export async function assertLogicalReplication(sql) {
     if (!row.replicates)
         throw new Error("The Runtime's Postgres role cannot replicate: grant it REPLICATION (ALTER ROLE … REPLICATION). See DEPLOYMENT.md.");
 }
-/** Separate, bounded pool for read projections; inherits the Tenant connection credentials. */
-export function createPostgresReadClient(source) {
-    const options = {
+/** Where `source` connects, as whom: for clients that share its database and credentials. */
+function connectionOf(source) {
+    return {
         host: source.options.host.length === 1
             ? source.options.host[0]
             : source.options.host
@@ -54,6 +54,12 @@ export function createPostgresReadClient(source) {
         pass: source.options.pass ?? "",
         ssl: source.options.ssl,
         path: source.options.path,
+    };
+}
+/** Separate, bounded pool for read projections; inherits the Tenant connection credentials. */
+export function createPostgresReadClient(source) {
+    const options = {
+        ...connectionOf(source),
         max: 4,
         idle_timeout: 30,
         connect_timeout: 2,
@@ -69,3 +75,24 @@ export function createPostgresReadClient(source) {
     const pool = postgres(options);
     return pool;
 }
+/**
+ * One connection of its own for `LISTEN` (the control bus, `control.ts`), with `source`'s
+ * database and credentials. It never idles out. `onClose` runs when the connection ends for
+ * any reason; the caller listens again, which connects again. A `LISTEN` needs a session of
+ * its own: behind a pooler in transaction mode it would not hear a thing.
+ */
+export function createPostgresListenClient(source, handlers) {
+    const options = {
+        ...connectionOf(source),
+        max: 1,
+        idle_timeout: 0,
+        max_lifetime: null,
+        connect_timeout: 10,
+        fetch_types: false,
+        onnotice() { },
+        onnotify: handlers.onNotify,
+        onclose: () => handlers.onClose(),
+        connection: { application_name: "nylorun-control" },
+    };
+    return postgres(options);
+}

package/dist/store/postgres/control.d.ts

@@ -0,0 +1,14 @@
+import type { Sql } from "postgres";
+import type { ControlSignal, FollowSignalsOptions, SignalFollower } from "../types.js";
+import type { Database, Queryable } from "./db.js";
+/** The channel every signal is notified on. */
+export declare const CONTROL_CHANNEL = "nylorun_control";
+/** Puts `signal` on the bus in the transaction `db` runs: a row, notified at commit. */
+export declare function writeSignal(db: Queryable, signal: ControlSignal): Promise<void>;
+/** Deletes the signals written before `before`; returns how many. */
+export declare function pruneSignals(db: Queryable, before: Date): Promise<number>;
+/**
+ * Follows the bus on `source`'s database (`SessionStore.followSignals`). Resolves once the
+ * start is fixed; the first LISTEN may still be retrying, and the poll covers it meanwhile.
+ */
+export declare function followControlSignals(source: Sql, db: Database, onSignal: (signal: ControlSignal) => void, options?: FollowSignalsOptions): Promise<SignalFollower>;

package/dist/store/postgres/control.js

@@ -0,0 +1,187 @@
+/**
+ * The control bus on Postgres (blueprint D21, D48): how one process tells the others with the
+ * Tenant open to act now. `session.cancel` aborts the advance of a cancelled turn;
+ * `sessions.reset` moves the session streams to the Tenant's new basin generation. Nothing
+ * internal goes through S2, which only serves API listeners.
+ *
+ * - **Write.** `writeSignal` inserts a `control_signals` row and calls `pg_notify` on
+ *   `nylorun_control`, in the caller's transaction. Postgres sends the notification to every
+ *   listening session when the transaction commits and drops it on rollback, so a signal
+ *   exists exactly when what it announces committed.
+ * - **Follow.** `followControlSignals` holds one connection of its own that LISTENs (a pooled
+ *   connection cannot). Each notification reads back the signals of the last
+ *   `WINDOW_SECONDS` and delivers those this follower has not delivered yet. So does a poll
+ *   every `pollMs`, and every LISTEN after a reconnect: Postgres does not queue notifications
+ *   for a session that is not connected, and the rows are what catches up. Ids are never read
+ *   as a cursor: they are allocated at insert and commit out of order, so a later id can be
+ *   visible first.
+ * - **Start.** A follower delivers the signals written from its start on (the database's
+ *   clock), never older ones.
+ * - **Prune.** A row outlives its notification only for the read-back; the Tenant sweep
+ *   deletes old ones (`pruneSignals`).
+ */
+import { gte, lt, sql } from "drizzle-orm";
+import { createPostgresListenClient } from "./connect.js";
+import { controlSignals } from "./schema.js";
+/** The channel every signal is notified on. */
+export const CONTROL_CHANNEL = "nylorun_control";
+/** How far back a read-back looks. Longer than the poll, so a missed notification is caught. */
+const WINDOW_SECONDS = 120;
+const POLL_MS = 5000;
+const RETRY_MIN_MS = 100;
+const RETRY_MAX_MS = 5000;
+const SIGNAL = {
+    id: controlSignals.id,
+    kind: controlSignals.kind,
+    sessionId: controlSignals.sessionId,
+    turnId: controlSignals.turnId,
+    generation: controlSignals.generation,
+};
+/** Puts `signal` on the bus in the transaction `db` runs: a row, notified at commit. */
+export async function writeSignal(db, signal) {
+    const [row] = await db
+        .insert(controlSignals)
+        .values({
+        kind: signal.type,
+        sessionId: signal.type === "session.cancel" ? signal.sessionId : null,
+        turnId: signal.type === "session.cancel" ? (signal.turnId ?? null) : null,
+        generation: signal.type === "sessions.reset" ? signal.generation : null,
+    })
+        .returning({ id: controlSignals.id });
+    // The payload is only the id: a follower reads the rows back either way.
+    await db.execute(sql `SELECT pg_notify(${CONTROL_CHANNEL}, ${String(row.id)})`);
+}
+/** Deletes the signals written before `before`; returns how many. */
+export async function pruneSignals(db, before) {
+    const deleted = await db
+        .delete(controlSignals)
+        .where(lt(controlSignals.createdAt, before.toISOString()))
+        .returning({ id: controlSignals.id });
+    return deleted.length;
+}
+/**
+ * Follows the bus on `source`'s database (`SessionStore.followSignals`). Resolves once the
+ * start is fixed; the first LISTEN may still be retrying, and the poll covers it meanwhile.
+ */
+export async function followControlSignals(source, db, onSignal, options = {}) {
+    const pollMs = options.pollMs ?? POLL_MS;
+    const onError = options.onError ?? (() => { });
+    // Drizzle leaves timestamps to its column types, so a raw read of one is text.
+    const [start] = await db.execute(sql `SELECT clock_timestamp()::text AS now`);
+    const since = start.now;
+    /** Ids delivered, with when (this process's clock), until no read-back can return them. */
+    const delivered = new Map();
+    let stopped = false;
+    let retry;
+    let delay = RETRY_MIN_MS;
+    let draining;
+    let again = false;
+    const client = createPostgresListenClient(source, {
+        onNotify: (channel) => {
+            if (channel === CONTROL_CHANNEL)
+                drain();
+        },
+        // The connection ended (Postgres restarted, the network dropped): listen again, which
+        // connects again, and read back what was missed meanwhile.
+        onClose: () => relisten(),
+    });
+    function relisten() {
+        if (stopped || retry)
+            return;
+        retry = setTimeout(() => {
+            retry = undefined;
+            void listen();
+        }, delay);
+        retry.unref();
+        delay = Math.min(delay * 2, RETRY_MAX_MS);
+    }
+    async function listen() {
+        if (stopped)
+            return;
+        try {
+            await client.unsafe(`LISTEN ${CONTROL_CHANNEL}`);
+            delay = RETRY_MIN_MS;
+            drain();
+        }
+        catch (error) {
+            if (stopped)
+                return;
+            onError(error);
+            relisten();
+        }
+    }
+    function drain() {
+        if (stopped)
+            return;
+        if (draining) {
+            again = true;
+            return;
+        }
+        draining = (async () => {
+            do {
+                again = false;
+                try {
+                    const rows = await db
+                        .select(SIGNAL)
+                        .from(controlSignals)
+                        .where(gte(controlSignals.createdAt, sql `greatest(${since}::timestamptz, clock_timestamp() - make_interval(secs => ${WINDOW_SECONDS}))`))
+                        .orderBy(controlSignals.id);
+                    for (const row of rows)
+                        deliver(row);
+                }
+                catch (error) {
+                    if (!stopped)
+                        onError(error);
+                }
+                forgetOld();
+            } while (again && !stopped);
+        })().finally(() => {
+            draining = undefined;
+        });
+    }
+    function deliver(row) {
+        if (stopped || delivered.has(row.id))
+            return;
+        delivered.set(row.id, Date.now());
+        const signal = signalOf(row);
+        if (!signal)
+            return;
+        try {
+            onSignal(signal);
+        }
+        catch (error) {
+            onError(error);
+        }
+    }
+    /** A row a read-back can still return is younger than the window: keep twice that. */
+    function forgetOld() {
+        const before = Date.now() - 2 * WINDOW_SECONDS * 1000;
+        for (const [id, at] of delivered)
+            if (at < before)
+                delivered.delete(id);
+    }
+    const poll = setInterval(drain, pollMs);
+    poll.unref();
+    await listen();
+    return {
+        async close() {
+            stopped = true;
+            clearInterval(poll);
+            if (retry)
+                clearTimeout(retry);
+            await draining;
+            await client.end({ timeout: 0 });
+        },
+    };
+}
+function signalOf(row) {
+    if (row.kind === "session.cancel" && row.sessionId !== null)
+        return {
+            type: "session.cancel",
+            sessionId: row.sessionId,
+            ...(row.turnId !== null ? { turnId: row.turnId } : {}),
+        };
+    if (row.kind === "sessions.reset" && row.generation !== null)
+        return { type: "sessions.reset", generation: row.generation };
+    return undefined;
+}

package/dist/store/postgres/drizzle/0015_control_signals.sql

@@ -0,0 +1,11 @@
+CREATE TABLE "nylorun"."control_signals" (
+	"id" bigint PRIMARY KEY GENERATED ALWAYS AS IDENTITY (sequence name "nylorun"."control_signals_id_seq" INCREMENT BY 1 MINVALUE 1 MAXVALUE 9223372036854775807 START WITH 1 CACHE 1),
+	"kind" text NOT NULL,
+	"session_id" text COLLATE "C",
+	"turn_id" text COLLATE "C",
+	"generation" integer,
+	"created_at" timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+	CONSTRAINT "control_signals_kind_check" CHECK ("nylorun"."control_signals"."kind" IN ('session.cancel', 'sessions.reset'))
+);
+--> statement-breakpoint
+CREATE INDEX "control_signals_created_at" ON "nylorun"."control_signals" USING btree ("created_at");

package/dist/store/postgres/drizzle/0016_mcp_oauth_removed.sql

@@ -0,0 +1,5 @@
+DROP TABLE "nylorun"."oauth_pending" CASCADE;--> statement-breakpoint
+INSERT INTO "nylorun"."vault_audit" ("id", "at", "actor", "action", "vault_id", "credential_id", "target", "outcome")
+SELECT gen_random_uuid()::text, to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'), 'migration', 'delete', "vault_id", "id", "binding_json"::jsonb ->> 'url', 'deleted'
+FROM "nylorun"."vault_credentials" WHERE "type" = 'oauth' ORDER BY "vault_id", "id";--> statement-breakpoint
+DELETE FROM "nylorun"."vault_credentials" WHERE "type" = 'oauth';

package/dist/store/postgres/drizzle/meta/_journal.json

@@ -106,6 +106,20 @@
       "when": 1791218903443,
       "tag": "0014_action_endpoints_removed",
       "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "7",
+      "when": 1791296131735,
+      "tag": "0015_control_signals",
+      "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "7",
+      "when": 1791395759051,
+      "tag": "0016_mcp_oauth_removed",
+      "breakpoints": true
     }
   ]
 }