@nylorun/runtime 0.19.1-beta → 0.21.0-beta

package/dist/store/postgres/schema.d.ts

@@ -1048,14 +1048,14 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             tableName: "vault_credentials";
             dataType: "string";
             columnType: "PgText";
-            data: "bearer" | "model" | "oauth";
+            data: "bearer" | "headers" | "model";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["bearer", "oauth", "model"];
+            enumValues: ["bearer", "headers", "model"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -1442,264 +1442,6 @@ export declare const vaultIdempotency: import("drizzle-orm/pg-core").PgTableWith
     };
     dialect: 'pg';
 }>;
-/**
- * An MCP OAuth connect between its start and its callback (F9 C2): found by the SHA-256 of its
- * `state`, used once, for ten minutes. The PKCE verifier and any client secret are sealed under
- * the vault key (`sealBytes`), which only the keys module holds.
- */
-export declare const oauthPending: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "oauth_pending";
-    schema: "nylorun";
-    columns: {
-        stateHash: import("drizzle-orm/pg-core").PgColumn<{
-            name: "stateHash";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: true;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        vaultId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "vaultId";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        server: import("drizzle-orm/pg-core").PgColumn<{
-            name: "server";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        url: import("drizzle-orm/pg-core").PgColumn<{
-            name: "url";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        tokenEndpoint: import("drizzle-orm/pg-core").PgColumn<{
-            name: "tokenEndpoint";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        clientId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "clientId";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        tokenEndpointAuth: import("drizzle-orm/pg-core").PgColumn<{
-            name: "tokenEndpointAuth";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: "client_secret_basic" | "client_secret_post" | "none";
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["none", "client_secret_basic", "client_secret_post"];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        resource: import("drizzle-orm/pg-core").PgColumn<{
-            name: "resource";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        kekId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "kekId";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        clientSecret: import("drizzle-orm/pg-core").PgColumn<{
-            name: "clientSecret";
-            tableName: "oauth_pending";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: Uint8Array<ArrayBufferLike>;
-            driverParam: Buffer<ArrayBufferLike>;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        codeVerifier: import("drizzle-orm/pg-core").PgColumn<{
-            name: "codeVerifier";
-            tableName: "oauth_pending";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: Uint8Array<ArrayBufferLike>;
-            driverParam: Buffer<ArrayBufferLike>;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        redirectUri: import("drizzle-orm/pg-core").PgColumn<{
-            name: "redirectUri";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "expiresAt";
-            tableName: "oauth_pending";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "oauth_pending";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-    };
-    dialect: 'pg';
-}>;
 export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "tenant_settings";
     schema: "nylorun";
@@ -3478,6 +3220,126 @@ export declare const definitionFileUses: import("drizzle-orm/pg-core").PgTableWi
     };
     dialect: 'pg';
 }>;
+/**
+ * The control bus (D21, D48): signals between the processes that have the Tenant open,
+ * written in the transaction that commits what they announce and notified on
+ * `nylorun_control` at commit (`control.ts`). A row outlives its notification so a process
+ * whose listener was down catches up; the Tenant sweep deletes old ones. `created_at` is the
+ * insert's own clock (`clock_timestamp()`), not its transaction's start.
+ */
+export declare const controlSignals: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "control_signals";
+    schema: "nylorun";
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "control_signals";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: "always";
+            generated: undefined;
+        }, {}, {}>;
+        kind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kind";
+            tableName: "control_signals";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sessionId";
+            tableName: "control_signals";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        turnId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "turnId";
+            tableName: "control_signals";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        generation: import("drizzle-orm/pg-core").PgColumn<{
+            name: "generation";
+            tableName: "control_signals";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "control_signals";
+            dataType: "string";
+            columnType: "PgTimestampString";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
 /**
  * Each sandbox's lifecycle stream (`nylorun.sandbox-event/1`), numbered from 0 per sandbox id.
  * Written only by the record module; not published to the stream relay.
@@ -3804,7 +3666,6 @@ export type VaultRow = typeof vaults.$inferSelect;
 export type VaultCredentialRow = typeof vaultCredentials.$inferSelect;
 export type VaultAuditRow = Omit<typeof vaultAudit.$inferSelect, "ord">;
 export type VaultIdempotencyRow = typeof vaultIdempotency.$inferSelect;
-export type OAuthPendingRow = typeof oauthPending.$inferSelect;
 export type SigningKeyRow = typeof signingKeys.$inferSelect;
 export type ModelUsageRow = typeof modelUsage.$inferSelect;
 export type ModelBudgetRow = typeof modelBudgets.$inferSelect;

package/dist/store/postgres/schema.js

@@ -129,8 +129,8 @@ export const vaultCredentials = nylorun.table("vault_credentials", {
     id: textC().primaryKey(),
     vaultId: text().notNull(),
     name: text().notNull(),
-    type: text({ enum: ["bearer", "oauth", "model"] }).notNull(),
-    /** JSON text of the non-secret binding (url, or provider and model). */
+    type: text({ enum: ["bearer", "headers", "model"] }).notNull(),
+    /** JSON text of the non-secret binding: url (and via, identity, header names), or provider and model. */
     bindingJson: text().notNull(),
     expiresAt: text(),
     createdAt: textC().notNull(),
@@ -165,40 +165,6 @@ export const vaultIdempotency = nylorun.table("vault_idempotency", {
     /** JSON text of the original response. */
     response: text().notNull(),
 });
-/**
- * An MCP OAuth connect between its start and its callback (F9 C2): found by the SHA-256 of its
- * `state`, used once, for ten minutes. The PKCE verifier and any client secret are sealed under
- * the vault key (`sealBytes`), which only the keys module holds.
- */
-export const oauthPending = nylorun.table("oauth_pending", {
-    stateHash: text().primaryKey(),
-    vaultId: text().notNull(),
-    /** The MCP server's name in the agent, the credential's name. */
-    server: text().notNull(),
-    /** The MCP server's URL (normalized): the credential's binding. */
-    url: text().notNull(),
-    tokenEndpoint: text().notNull(),
-    clientId: text().notNull(),
-    /** How the client authenticates at the token endpoint: `none`, `client_secret_basic` or `client_secret_post`. */
-    tokenEndpointAuth: text({ enum: ["none", "client_secret_basic", "client_secret_post"] }).notNull(),
-    /** The RFC 8707 resource indicator sent with the authorization request, if any. */
-    resource: text(),
-    kekId: text().notNull(),
-    /** Sealed; null for a public client. */
-    clientSecret: bytes(),
-    /** Sealed. */
-    codeVerifier: bytes().notNull(),
-    redirectUri: text().notNull(),
-    expiresAt: textC().notNull(),
-    createdAt: textC().notNull(),
-}, (t) => [
-    foreignKey({
-        name: "oauth_pending_vault_id_fkey",
-        columns: [t.vaultId],
-        foreignColumns: [vaults.id],
-    }).onDelete("cascade"),
-    index("oauth_pending_expires").on(t.expiresAt),
-]);
 export const tenantSettings = nylorun.table("tenant_settings", {
     key: text().primaryKey(),
     value: text().notNull(),
@@ -435,6 +401,26 @@ export const definitionFileUses = nylorun.table("definition_file_uses", {
     primaryKey({ name: "definition_file_uses_pkey", columns: [t.agentId, t.manifestHash, t.sha256] }),
     index("definition_file_uses_sha256").on(t.sha256),
 ]);
+/**
+ * The control bus (D21, D48): signals between the processes that have the Tenant open,
+ * written in the transaction that commits what they announce and notified on
+ * `nylorun_control` at commit (`control.ts`). A row outlives its notification so a process
+ * whose listener was down catches up; the Tenant sweep deletes old ones. `created_at` is the
+ * insert's own clock (`clock_timestamp()`), not its transaction's start.
+ */
+export const controlSignals = nylorun.table("control_signals", {
+    id: bigint({ mode: "number" }).primaryKey().generatedAlwaysAsIdentity(),
+    kind: text().notNull(),
+    sessionId: textC(),
+    turnId: textC(),
+    generation: integer(),
+    createdAt: timestamp({ withTimezone: true, mode: "string" })
+        .notNull()
+        .default(sql `clock_timestamp()`),
+}, (t) => [
+    index("control_signals_created_at").on(t.createdAt),
+    check("control_signals_kind_check", sql `${t.kind} IN ('session.cancel', 'sessions.reset')`),
+]);
 // ---------------------------------------------------------------------------
 // nylorun_streams: the record
 /**

package/dist/store/postgres/store.js

@@ -52,11 +52,12 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { and, count, eq, getTableColumns, gte, inArray, isNotNull, isNull, lt, lte, ne, or, sql, } from "drizzle-orm";
 import { appendEvent, appendSandboxEvent } from "../../record/index.js";
 import { OwnershipLostError, PrincipalRoleConflict } from "../ownership.js";
+import { followControlSignals, pruneSignals, writeSignal } from "./control.js";
 import { database, driverError } from "./db.js";
 import { expectedSchemaVersion, readSchemaVersion } from "./migrate.js";
 import { createPostgresRecordReader } from "./record.js";
 import { postgresRecordWriter, postgresSandboxRecordWriter } from "./record-writer.js";
-import { artifacts, artifactVersions, artifactContent, definitionFiles, definitionFileUses, commands, definitions, effects, links, modelBudgets, modelUsage, principals, sandboxes, sandboxEvents, sandboxResources, sessionEvents, sessionLogHeads, sessions, toJson, toolCrossings, signingKeys, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, oauthPending, } from "./schema.js";
+import { artifacts, artifactVersions, artifactContent, definitionFiles, definitionFileUses, commands, definitions, effects, links, modelBudgets, modelUsage, principals, sandboxes, sandboxEvents, sandboxResources, sessionEvents, sessionLogHeads, sessions, toJson, toolCrossings, signingKeys, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, } from "./schema.js";
 export function createPostgresSessionStore(options) {
     return new PostgresSessionStore(options);
 }
@@ -175,6 +176,11 @@ class PostgresSessionStore {
             return { ok: false, schemaVersion: 0, expectedSchemaVersion };
         }
     }
+    followSignals(onSignal, options) {
+        if (this.closed)
+            throw new Error("SessionStore is closed");
+        return followControlSignals(this.sql, this.db, onSignal, options);
+    }
     /** Rejects new transactions and waits for running ones. Does not end the pool. */
     async close() {
         this.closed = true;
@@ -583,6 +589,15 @@ class PostgresTx {
             definitions: row.definitions,
         };
     }
+    // --- control bus (D21) ---------------------------------------------------
+    async signal(signal) {
+        this.check();
+        await writeSignal(this.db, signal);
+    }
+    async pruneSignals(before) {
+        this.check();
+        return pruneSignals(this.db, before);
+    }
     // --- basin generations --------------------------------------------------
     async basinGenerations() {
         this.check();
@@ -750,23 +765,6 @@ class PostgresTx {
         this.check();
         await this.db.insert(vaultIdempotency).values(row);
     }
-    async insertOAuthPending(row) {
-        this.check();
-        await this.db.insert(oauthPending).values(row);
-    }
-    async takeOAuthPending(stateHash) {
-        this.check();
-        const [row] = await this.db
-            .delete(oauthPending)
-            .where(eq(oauthPending.stateHash, stateHash))
-            .returning();
-        return row;
-    }
-    async deleteExpiredOAuthPending(now) {
-        this.check();
-        const result = await this.db.delete(oauthPending).where(lt(oauthPending.expiresAt, now));
-        return result.count;
-    }
     // --- signing keys --------------------------------------------------------
     async lockSigningKeys() {
         this.check();

package/dist/store/postgres/tenant.d.ts

@@ -11,6 +11,8 @@
  *    tables of a pre-release build of it. It is never touched: this release starts fresh.
  * 2. Apply the missing migrations (`migrate.ts`). A database with migrations this Runtime
  *    does not know is `schema-too-new`; a migration Postgres rejects is `migration-failed`.
+ *    `0016_mcp_oauth_removed` deletes the vault's MCP OAuth credentials (protocol 10), each
+ *    with an audit row; the open returns them (`removedCredentials`) for a boot warning.
  * 3. When `nylorun.tenant` is empty, create the Tenant: its row (id, name, created time) and
  *    its first principals. A database whose row is gone but that holds a Tenant's data
  *    (principals, sessions, agents, vaults, keys) is `envelope-invalid`, never given a new
@@ -74,6 +76,18 @@ export interface OpenedTenantDatabase {
         from: number;
         to: number;
     };
+    /**
+     * The MCP OAuth credentials this call's migration `0016_mcp_oauth_removed` deleted (protocol
+     * 10), from the audit rows it wrote: the Host names each in a boot warning. Empty otherwise.
+     */
+    removedCredentials: RemovedCredential[];
+}
+/** A vault credential a migration deleted. */
+export interface RemovedCredential {
+    vaultId: string;
+    credentialId: string;
+    /** The URL it was bound to. */
+    url: string | null;
 }
 /**
  * Migrates the database, creates its Tenant when it has none, and opens its Session Store.

package/dist/store/postgres/tenant.js

@@ -4,8 +4,10 @@ import { TenantEnvelopeSchema, } from "@nylorun/core/contracts";
 import { openError, TenantOpenError } from "../../tenant/cause.js";
 import { database, driverError } from "./db.js";
 import { applyMigrations, assertCurrentLayout, isStatementError, lockMigrations, shippedMigrations, } from "./migrate.js";
-import { definitions, principals, sessions, signingKeys, TENANT_SCHEMA, tenant, vaults, } from "./schema.js";
+import { definitions, principals, sessions, signingKeys, TENANT_SCHEMA, tenant, vaultAudit, vaults, } from "./schema.js";
 import { createPostgresSessionStore } from "./store.js";
+/** The migration that deletes the vault's `oauth` credentials, each with an audit row. */
+const OAUTH_REMOVED_MIGRATION = "0016_mcp_oauth_removed";
 /**
  * Migrates the database, creates its Tenant when it has none, and opens its Session Store.
  * Throws a `TenantOpenError` with the cause when the Tenant cannot be opened (see above).
@@ -22,7 +24,8 @@ export async function openTenantDatabase(options) {
             await assertCurrentLayout(tx);
             const migrated = await applyMigrations(tx, migrations);
             const created = await ensureTenant(tx, options.create, migrated, now);
-            return { created, migrated };
+            const removedCredentials = await removedBy(tx, migrations, migrated);
+            return { created, migrated, removedCredentials };
         });
     }
     catch (thrown) {
@@ -82,6 +85,23 @@ export async function readTenantEnvelope(q) {
         throw driverError(error);
     }
 }
+/**
+ * The credentials `0016_mcp_oauth_removed` deleted, when this transaction applied it: its
+ * audit rows (actor `migration`). Empty when it ran before, or is not among `migrations`.
+ */
+async function removedBy(tx, migrations, migrated) {
+    const index = migrations.findIndex((migration) => migration.tag === OAUTH_REMOVED_MIGRATION);
+    if (index < migrated.from || index >= migrated.to)
+        return [];
+    const rows = await tx
+        .select({ vaultId: vaultAudit.vaultId, credentialId: vaultAudit.credentialId, url: vaultAudit.target })
+        .from(vaultAudit)
+        .where(and(eq(vaultAudit.actor, "migration"), eq(vaultAudit.action, "delete")))
+        .orderBy(vaultAudit.ord);
+    return rows.flatMap((row) => row.vaultId && row.credentialId
+        ? [{ vaultId: row.vaultId, credentialId: row.credentialId, url: row.url }]
+        : []);
+}
 /**
  * Creates the Tenant when there is none, and adds the principals it is missing. Records the
  * schema version on the Tenant row when this transaction migrated.