@nylorun/runtime 0.20.0-beta → 0.21.1-beta

package/dist/store/postgres/schema.d.ts

@@ -1048,14 +1048,14 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             tableName: "vault_credentials";
             dataType: "string";
             columnType: "PgText";
-            data: "bearer" | "model" | "oauth";
+            data: "bearer" | "headers" | "model";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["bearer", "oauth", "model"];
+            enumValues: ["bearer", "headers", "model"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -1442,264 +1442,6 @@ export declare const vaultIdempotency: import("drizzle-orm/pg-core").PgTableWith
     };
     dialect: 'pg';
 }>;
-/**
- * An MCP OAuth connect between its start and its callback (F9 C2): found by the SHA-256 of its
- * `state`, used once, for ten minutes. The PKCE verifier and any client secret are sealed under
- * the vault key (`sealBytes`), which only the keys module holds.
- */
-export declare const oauthPending: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "oauth_pending";
-    schema: "nylorun";
-    columns: {
-        stateHash: import("drizzle-orm/pg-core").PgColumn<{
-            name: "stateHash";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: true;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        vaultId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "vaultId";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        server: import("drizzle-orm/pg-core").PgColumn<{
-            name: "server";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        url: import("drizzle-orm/pg-core").PgColumn<{
-            name: "url";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        tokenEndpoint: import("drizzle-orm/pg-core").PgColumn<{
-            name: "tokenEndpoint";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        clientId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "clientId";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        tokenEndpointAuth: import("drizzle-orm/pg-core").PgColumn<{
-            name: "tokenEndpointAuth";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: "client_secret_basic" | "client_secret_post" | "none";
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["none", "client_secret_basic", "client_secret_post"];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        resource: import("drizzle-orm/pg-core").PgColumn<{
-            name: "resource";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        kekId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "kekId";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        clientSecret: import("drizzle-orm/pg-core").PgColumn<{
-            name: "clientSecret";
-            tableName: "oauth_pending";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: Uint8Array<ArrayBufferLike>;
-            driverParam: Buffer<ArrayBufferLike>;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        codeVerifier: import("drizzle-orm/pg-core").PgColumn<{
-            name: "codeVerifier";
-            tableName: "oauth_pending";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: Uint8Array<ArrayBufferLike>;
-            driverParam: Buffer<ArrayBufferLike>;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        redirectUri: import("drizzle-orm/pg-core").PgColumn<{
-            name: "redirectUri";
-            tableName: "oauth_pending";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "expiresAt";
-            tableName: "oauth_pending";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "oauth_pending";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-    };
-    dialect: 'pg';
-}>;
 export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "tenant_settings";
     schema: "nylorun";
@@ -3598,6 +3340,109 @@ export declare const controlSignals: import("drizzle-orm/pg-core").PgTableWithCo
     };
     dialect: 'pg';
 }>;
+/**
+ * The wake outbox (architecture §12.3): one row per wake a committed transaction asked for
+ * (`Tx.wake`), written in that transaction, so a commit never loses its wake. The row is
+ * deleted once Durable Session Execution has accepted the wake; until then the Tenant sweep
+ * delivers it again, with the same idempotency key (`dedupe_key`, or `wake:<id>` without
+ * one). `created_at` is the insert's own clock (`clock_timestamp()`).
+ */
+export declare const wakes: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "wakes";
+    schema: "nylorun";
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "wakes";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sessionId";
+            tableName: "wakes";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "wakes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        dedupeKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "dedupeKey";
+            tableName: "wakes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "wakes";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
 /**
  * Each sandbox's lifecycle stream (`nylorun.sandbox-event/1`), numbered from 0 per sandbox id.
  * Written only by the record module; not published to the stream relay.
@@ -3924,7 +3769,6 @@ export type VaultRow = typeof vaults.$inferSelect;
 export type VaultCredentialRow = typeof vaultCredentials.$inferSelect;
 export type VaultAuditRow = Omit<typeof vaultAudit.$inferSelect, "ord">;
 export type VaultIdempotencyRow = typeof vaultIdempotency.$inferSelect;
-export type OAuthPendingRow = typeof oauthPending.$inferSelect;
 export type SigningKeyRow = typeof signingKeys.$inferSelect;
 export type ModelUsageRow = typeof modelUsage.$inferSelect;
 export type ModelBudgetRow = typeof modelBudgets.$inferSelect;

package/dist/store/postgres/schema.js

@@ -129,8 +129,8 @@ export const vaultCredentials = nylorun.table("vault_credentials", {
     id: textC().primaryKey(),
     vaultId: text().notNull(),
     name: text().notNull(),
-    type: text({ enum: ["bearer", "oauth", "model"] }).notNull(),
-    /** JSON text of the non-secret binding (url, or provider and model). */
+    type: text({ enum: ["bearer", "headers", "model"] }).notNull(),
+    /** JSON text of the non-secret binding: url (and via, identity, header names), or provider and model. */
     bindingJson: text().notNull(),
     expiresAt: text(),
     createdAt: textC().notNull(),
@@ -165,40 +165,6 @@ export const vaultIdempotency = nylorun.table("vault_idempotency", {
     /** JSON text of the original response. */
     response: text().notNull(),
 });
-/**
- * An MCP OAuth connect between its start and its callback (F9 C2): found by the SHA-256 of its
- * `state`, used once, for ten minutes. The PKCE verifier and any client secret are sealed under
- * the vault key (`sealBytes`), which only the keys module holds.
- */
-export const oauthPending = nylorun.table("oauth_pending", {
-    stateHash: text().primaryKey(),
-    vaultId: text().notNull(),
-    /** The MCP server's name in the agent, the credential's name. */
-    server: text().notNull(),
-    /** The MCP server's URL (normalized): the credential's binding. */
-    url: text().notNull(),
-    tokenEndpoint: text().notNull(),
-    clientId: text().notNull(),
-    /** How the client authenticates at the token endpoint: `none`, `client_secret_basic` or `client_secret_post`. */
-    tokenEndpointAuth: text({ enum: ["none", "client_secret_basic", "client_secret_post"] }).notNull(),
-    /** The RFC 8707 resource indicator sent with the authorization request, if any. */
-    resource: text(),
-    kekId: text().notNull(),
-    /** Sealed; null for a public client. */
-    clientSecret: bytes(),
-    /** Sealed. */
-    codeVerifier: bytes().notNull(),
-    redirectUri: text().notNull(),
-    expiresAt: textC().notNull(),
-    createdAt: textC().notNull(),
-}, (t) => [
-    foreignKey({
-        name: "oauth_pending_vault_id_fkey",
-        columns: [t.vaultId],
-        foreignColumns: [vaults.id],
-    }).onDelete("cascade"),
-    index("oauth_pending_expires").on(t.expiresAt),
-]);
 export const tenantSettings = nylorun.table("tenant_settings", {
     key: text().primaryKey(),
     value: text().notNull(),
@@ -455,6 +421,22 @@ export const controlSignals = nylorun.table("control_signals", {
     index("control_signals_created_at").on(t.createdAt),
     check("control_signals_kind_check", sql `${t.kind} IN ('session.cancel', 'sessions.reset')`),
 ]);
+/**
+ * The wake outbox (architecture §12.3): one row per wake a committed transaction asked for
+ * (`Tx.wake`), written in that transaction, so a commit never loses its wake. The row is
+ * deleted once Durable Session Execution has accepted the wake; until then the Tenant sweep
+ * delivers it again, with the same idempotency key (`dedupe_key`, or `wake:<id>` without
+ * one). `created_at` is the insert's own clock (`clock_timestamp()`).
+ */
+export const wakes = nylorun.table("wakes", {
+    id: textC().primaryKey(),
+    sessionId: textC().notNull(),
+    reason: text().notNull(),
+    dedupeKey: text(),
+    createdAt: timestamp({ withTimezone: true, mode: "date" })
+        .notNull()
+        .default(sql `clock_timestamp()`),
+}, (t) => [index("wakes_created_at").on(t.createdAt)]);
 // ---------------------------------------------------------------------------
 // nylorun_streams: the record
 /**

package/dist/store/postgres/store.js

@@ -49,6 +49,7 @@
  * `timestamptz`.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
+import { randomUUID } from "node:crypto";
 import { and, count, eq, getTableColumns, gte, inArray, isNotNull, isNull, lt, lte, ne, or, sql, } from "drizzle-orm";
 import { appendEvent, appendSandboxEvent } from "../../record/index.js";
 import { OwnershipLostError, PrincipalRoleConflict } from "../ownership.js";
@@ -57,7 +58,7 @@ import { database, driverError } from "./db.js";
 import { expectedSchemaVersion, readSchemaVersion } from "./migrate.js";
 import { createPostgresRecordReader } from "./record.js";
 import { postgresRecordWriter, postgresSandboxRecordWriter } from "./record-writer.js";
-import { artifacts, artifactVersions, artifactContent, definitionFiles, definitionFileUses, commands, definitions, effects, links, modelBudgets, modelUsage, principals, sandboxes, sandboxEvents, sandboxResources, sessionEvents, sessionLogHeads, sessions, toJson, toolCrossings, signingKeys, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, oauthPending, } from "./schema.js";
+import { artifacts, artifactVersions, artifactContent, definitionFiles, definitionFileUses, commands, definitions, effects, links, modelBudgets, modelUsage, principals, sandboxes, sandboxEvents, sandboxResources, sessionEvents, sessionLogHeads, sessions, toJson, toolCrossings, signingKeys, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, wakes, } from "./schema.js";
 export function createPostgresSessionStore(options) {
     return new PostgresSessionStore(options);
 }
@@ -110,7 +111,7 @@ class PostgresSessionStore {
         let t;
         // Wrapped so `begin` does not treat an array result as queries to await.
         const run = this.db.transaction(async (db) => {
-            t = new PostgresTx(db, this.tenantId, this.now);
+            t = new PostgresTx(db, this.tenantId, this.now, this.deleteWake);
             try {
                 return { value: await this.active.run(this, () => fn(t)) };
             }
@@ -153,6 +154,10 @@ class PostgresSessionStore {
         }
         return result.value;
     }
+    /** Deletes a delivered outbox request, outside any transaction (`Tx.wake`). */
+    deleteWake = async (id) => {
+        await this.db.delete(wakes).where(eq(wakes.id, id));
+    };
     onCommit(listener) {
         this.listeners.add(listener);
         return () => this.listeners.delete(listener);
@@ -256,21 +261,27 @@ const SIGNING_KEY_STAMP = {
 };
 /** The audit columns a row has (`ord` only orders them). */
 const { ord: _ord, ...AUDIT } = getTableColumns(vaultAudit);
-const SESSION_TABLES = [sessions, commands, effects, links];
+const SESSION_TABLES = [sessions, commands, effects, links, wakes];
+/** An outbox row as it is delivered: the wake's own dedupe key, or one made from the row id. */
+function outboxWake(id, reason, dedupeKey) {
+    return { reason, dedupeKey: dedupeKey ?? `wake:${id}` };
+}
 /** The inserted row's `column` (`ON CONFLICT … DO UPDATE`). */
 const excluded = (column) => sql.raw(`excluded.${column}`);
 class PostgresTx {
     db;
     tenantId;
     now;
+    deleteWake;
     closed = false;
     events = [];
     generations = [];
     callbacks = [];
-    constructor(db, tenantId, now) {
+    constructor(db, tenantId, now, deleteWake) {
         this.db = db;
         this.tenantId = tenantId;
         this.now = now;
+        this.deleteWake = deleteWake;
     }
     check() {
         if (this.closed)
@@ -345,6 +356,45 @@ class PostgresTx {
         this.check();
         this.callbacks.push(fn);
     }
+    // --- wake outbox ---------------------------------------------------------
+    async wake(sessionId, wake, deliver) {
+        this.check();
+        const id = randomUUID();
+        await this.db.insert(wakes).values({
+            id,
+            sessionId,
+            reason: wake.reason,
+            dedupeKey: wake.dedupeKey ?? null,
+        });
+        const delivered = outboxWake(id, wake.reason, wake.dedupeKey ?? null);
+        // A rejection goes to the store's error hook (as every callback's), and the row stays.
+        this.callbacks.push(async () => {
+            if ((await deliver(sessionId, delivered)) === false)
+                return;
+            await this.deleteWake(id);
+        });
+    }
+    async pendingWakes(before, limit) {
+        this.check();
+        const rows = await this.db
+            .select()
+            .from(wakes)
+            .where(lt(wakes.createdAt, before))
+            .orderBy(wakes.createdAt, wakes.id)
+            .limit(limit);
+        return rows.map((row) => ({
+            id: row.id,
+            sessionId: row.sessionId,
+            wake: outboxWake(row.id, row.reason, row.dedupeKey),
+            createdAt: row.createdAt.toISOString(),
+        }));
+    }
+    async deleteWakes(ids) {
+        this.check();
+        if (ids.length === 0)
+            return;
+        await this.db.delete(wakes).where(inArray(wakes.id, [...ids]));
+    }
     // --- ownership -----------------------------------------------------------
     async takeOwnership(sessionId, claim) {
         this.check();
@@ -765,23 +815,6 @@ class PostgresTx {
         this.check();
         await this.db.insert(vaultIdempotency).values(row);
     }
-    async insertOAuthPending(row) {
-        this.check();
-        await this.db.insert(oauthPending).values(row);
-    }
-    async takeOAuthPending(stateHash) {
-        this.check();
-        const [row] = await this.db
-            .delete(oauthPending)
-            .where(eq(oauthPending.stateHash, stateHash))
-            .returning();
-        return row;
-    }
-    async deleteExpiredOAuthPending(now) {
-        this.check();
-        const result = await this.db.delete(oauthPending).where(lt(oauthPending.expiresAt, now));
-        return result.count;
-    }
     // --- signing keys --------------------------------------------------------
     async lockSigningKeys() {
         this.check();

package/dist/store/postgres/tenant.d.ts

@@ -11,6 +11,8 @@
  *    tables of a pre-release build of it. It is never touched: this release starts fresh.
  * 2. Apply the missing migrations (`migrate.ts`). A database with migrations this Runtime
  *    does not know is `schema-too-new`; a migration Postgres rejects is `migration-failed`.
+ *    `0016_mcp_oauth_removed` deletes the vault's MCP OAuth credentials (protocol 10), each
+ *    with an audit row; the open returns them (`removedCredentials`) for a boot warning.
  * 3. When `nylorun.tenant` is empty, create the Tenant: its row (id, name, created time) and
  *    its first principals. A database whose row is gone but that holds a Tenant's data
  *    (principals, sessions, agents, vaults, keys) is `envelope-invalid`, never given a new
@@ -74,6 +76,18 @@ export interface OpenedTenantDatabase {
         from: number;
         to: number;
     };
+    /**
+     * The MCP OAuth credentials this call's migration `0016_mcp_oauth_removed` deleted (protocol
+     * 10), from the audit rows it wrote: the Host names each in a boot warning. Empty otherwise.
+     */
+    removedCredentials: RemovedCredential[];
+}
+/** A vault credential a migration deleted. */
+export interface RemovedCredential {
+    vaultId: string;
+    credentialId: string;
+    /** The URL it was bound to. */
+    url: string | null;
 }
 /**
  * Migrates the database, creates its Tenant when it has none, and opens its Session Store.

package/dist/store/postgres/tenant.js

@@ -4,8 +4,10 @@ import { TenantEnvelopeSchema, } from "@nylorun/core/contracts";
 import { openError, TenantOpenError } from "../../tenant/cause.js";
 import { database, driverError } from "./db.js";
 import { applyMigrations, assertCurrentLayout, isStatementError, lockMigrations, shippedMigrations, } from "./migrate.js";
-import { definitions, principals, sessions, signingKeys, TENANT_SCHEMA, tenant, vaults, } from "./schema.js";
+import { definitions, principals, sessions, signingKeys, TENANT_SCHEMA, tenant, vaultAudit, vaults, } from "./schema.js";
 import { createPostgresSessionStore } from "./store.js";
+/** The migration that deletes the vault's `oauth` credentials, each with an audit row. */
+const OAUTH_REMOVED_MIGRATION = "0016_mcp_oauth_removed";
 /**
  * Migrates the database, creates its Tenant when it has none, and opens its Session Store.
  * Throws a `TenantOpenError` with the cause when the Tenant cannot be opened (see above).
@@ -22,7 +24,8 @@ export async function openTenantDatabase(options) {
             await assertCurrentLayout(tx);
             const migrated = await applyMigrations(tx, migrations);
             const created = await ensureTenant(tx, options.create, migrated, now);
-            return { created, migrated };
+            const removedCredentials = await removedBy(tx, migrations, migrated);
+            return { created, migrated, removedCredentials };
         });
     }
     catch (thrown) {
@@ -82,6 +85,23 @@ export async function readTenantEnvelope(q) {
         throw driverError(error);
     }
 }
+/**
+ * The credentials `0016_mcp_oauth_removed` deleted, when this transaction applied it: its
+ * audit rows (actor `migration`). Empty when it ran before, or is not among `migrations`.
+ */
+async function removedBy(tx, migrations, migrated) {
+    const index = migrations.findIndex((migration) => migration.tag === OAUTH_REMOVED_MIGRATION);
+    if (index < migrated.from || index >= migrated.to)
+        return [];
+    const rows = await tx
+        .select({ vaultId: vaultAudit.vaultId, credentialId: vaultAudit.credentialId, url: vaultAudit.target })
+        .from(vaultAudit)
+        .where(and(eq(vaultAudit.actor, "migration"), eq(vaultAudit.action, "delete")))
+        .orderBy(vaultAudit.ord);
+    return rows.flatMap((row) => row.vaultId && row.credentialId
+        ? [{ vaultId: row.vaultId, credentialId: row.credentialId, url: row.url }]
+        : []);
+}
 /**
  * Creates the Tenant when there is none, and adds the principals it is missing. Records the
  * schema version on the Tenant row when this transaction migrated.