@sixb/pg 0.1.18 → 0.1.20

package/dist/index.js

@@ -1244,7 +1244,6 @@ function rowToSessionRecord(row) {
     projectId: row.project_id,
     userId: row.user_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     tokenHash: row.token_hash,
     createdAt: toDate(row.created_at),
     expiresAt: toDate(row.expires_at),
@@ -1311,7 +1310,6 @@ function rowToMagicLinkRecord(row) {
     id: row.id,
     projectId: row.project_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     email: row.email,
     tokenHash: row.token_hash,
     returnTo: row.return_to ?? undefined,
@@ -1326,7 +1324,6 @@ function rowToOidcAuthorizationAttemptRecord(row) {
     id: row.id,
     projectId: row.project_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     stateHash: row.state_hash,
     nonceHash: row.nonce_hash,
     codeVerifier: row.code_verifier,
@@ -1622,7 +1619,6 @@ async function consumeOidcAttempt(sql, params) {
 }
 async function validateCompleteSessionInput(sql, projectId, session) {
   const sessionId = assertNonEmpty(session.id, "Session id");
-  assertNonEmpty(session.audience, "Session audience");
   assertNonEmpty(session.tokenHash, "Session token hash");
   await assertSessionIdAvailable(sql, projectId, sessionId);
 }
@@ -1636,7 +1632,6 @@ async function createSession(sql, input) {
   const projectId = assertNonEmpty(input.projectId, "Project id");
   const userId = assertNonEmpty(input.userId, "User id");
   const strategyId = assertNonEmpty(input.strategyId, "Strategy id");
-  const audience = assertNonEmpty(input.audience, "Session audience");
   const tokenHash = assertNonEmpty(input.tokenHash, "Session token hash");
   await requireUserById(sql, { projectId, id: userId });
   await assertSessionIdAvailable(sql, projectId, id);
@@ -1647,7 +1642,6 @@ async function createSession(sql, input) {
         id,
         user_id,
         strategy_id,
-        audience,
         token_hash,
         created_at,
         expires_at,
@@ -1662,7 +1656,6 @@ async function createSession(sql, input) {
         ${id},
         ${userId},
         ${strategyId},
-        ${audience},
         ${tokenHash},
         ${input.createdAt},
         ${input.expiresAt},
@@ -1681,50 +1674,26 @@ async function createSession(sql, input) {
   }
 }
 async function revokeActiveSessionsForUser(sql, params) {
-  const rows = params.audience === undefined ? await sql`
-      SELECT *
-      FROM auth_sessions
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.revokedAt}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
-      ORDER BY created_at ASC, id ASC
-      FOR UPDATE
-    ` : await sql`
+  const rows = await sql`
       SELECT *
       FROM auth_sessions
       WHERE project_id = ${params.projectId}
         AND user_id = ${params.userId}
-        AND audience = ${params.audience}
         AND revoked_at IS NULL
         AND expires_at > ${params.revokedAt}
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
       ORDER BY created_at ASC, id ASC
       FOR UPDATE
     `;
-  if (params.audience === undefined) {
-    await sql`
-      UPDATE auth_sessions
-      SET revoked_at = ${params.revokedAt}
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.revokedAt}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
-    `;
-  } else {
-    await sql`
+  await sql`
       UPDATE auth_sessions
       SET revoked_at = ${params.revokedAt}
       WHERE project_id = ${params.projectId}
         AND user_id = ${params.userId}
-        AND audience = ${params.audience}
         AND revoked_at IS NULL
         AND expires_at > ${params.revokedAt}
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
     `;
-  }
   return rows.map((row) => rowToSessionRecord({
     ...row,
     revoked_at: params.revokedAt
@@ -2384,7 +2353,6 @@ class PgAuthInvitationStore {
 }
 
 // src/auth-storage/magic-links.ts
-import { resolveAuthSessionAudience } from "@sixb/core";
 import { AuthStorageError as AuthStorageError5 } from "@sixb/core/storage";
 class PgAuthMagicLinkStore {
   sql;
@@ -2396,7 +2364,6 @@ class PgAuthMagicLinkStore {
       const id = assertNonEmpty(input.id, "Magic link id");
       const projectId = assertNonEmpty(input.projectId, "Project id");
       const strategyId = assertNonEmpty(input.strategyId, "Strategy id");
-      const audience = resolveAuthSessionAudience(input.audience);
       const email = normalizeEmail(input.email);
       const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash");
       await lockAdvisoryKeys(tx, [authLockKey("magic-links", projectId, email)]);
@@ -2414,7 +2381,6 @@ class PgAuthMagicLinkStore {
             project_id,
             id,
             strategy_id,
-            audience,
             email,
             token_hash,
             return_to,
@@ -2424,7 +2390,6 @@ class PgAuthMagicLinkStore {
             ${projectId},
             ${id},
             ${strategyId},
-            ${audience},
             ${email},
             ${tokenHash},
             ${input.returnTo ?? null},
@@ -2472,7 +2437,6 @@ class PgAuthMagicLinkStore {
 }
 
 // src/auth-storage/oidc-attempts.ts
-import { resolveAuthSessionAudience as resolveAuthSessionAudience2 } from "@sixb/core";
 import { AuthStorageError as AuthStorageError6 } from "@sixb/core/storage";
 class PgAuthOidcAuthorizationAttemptStore {
   sql;
@@ -2483,7 +2447,6 @@ class PgAuthOidcAuthorizationAttemptStore {
     const id = assertNonEmpty(input.id, "OIDC authorization attempt id");
     const projectId = assertNonEmpty(input.projectId, "Project id");
     const strategyId = assertNonEmpty(input.strategyId, "Strategy id");
-    const audience = resolveAuthSessionAudience2(input.audience);
     const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash");
     const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash");
     const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier");
@@ -2496,7 +2459,6 @@ class PgAuthOidcAuthorizationAttemptStore {
           project_id,
           id,
           strategy_id,
-          audience,
           state_hash,
           nonce_hash,
           code_verifier,
@@ -2507,7 +2469,6 @@ class PgAuthOidcAuthorizationAttemptStore {
           ${projectId},
           ${id},
           ${strategyId},
-          ${audience},
           ${stateHash},
           ${nonceHash},
           ${codeVerifier},
@@ -2765,21 +2726,6 @@ class PgAuthSessionStore {
   async getById(params) {
     return getSessionById(this.sql, params);
   }
-  async getActiveByUserId(params) {
-    const [row] = await this.sql`
-      SELECT *
-      FROM auth_sessions
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND audience = ${params.audience}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.now}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.now})
-      ORDER BY created_at DESC, id DESC
-      LIMIT 1
-    `;
-    return row ? rowToSessionRecord(row) : null;
-  }
   async listActiveByUserId(params) {
     const rows = await this.sql`
       SELECT *
@@ -2795,7 +2741,7 @@ class PgAuthSessionStore {
   }
   async findValidByTokenHash(params) {
     const row = await getSessionRowById(this.sql, params);
-    if (!row || row.refresh_token_hash !== null || row.audience !== params.audience || row.token_hash !== params.tokenHash || !isLiveSessionRow(row, params.now)) {
+    if (!row || row.refresh_token_hash !== null || row.token_hash !== params.tokenHash || !isLiveSessionRow(row, params.now)) {
       return null;
     }
     return rowToSessionRecord(row);
@@ -2855,7 +2801,6 @@ class PgAuthSessionStore {
           last_seen_at = ${params.now}
       WHERE project_id = ${params.projectId}
         AND id = ${params.id}
-        AND audience = ${params.audience}
         AND token_hash = ${params.tokenHash}
         AND refresh_token_hash IS NULL
         AND revoked_at IS NULL
@@ -2883,11 +2828,7 @@ class PgAuthSessionStore {
   }
   async revokeActiveForUser(params) {
     return runPgTransaction(this.sql, async (tx) => {
-      const locks = [authLockKey("sessions", params.projectId, params.userId)];
-      if (params.audience) {
-        locks.push(authLockKey("sessions", params.projectId, params.userId, params.audience));
-      }
-      await lockAdvisoryKeys(tx, locks);
+      await lockAdvisoryKeys(tx, [authLockKey("sessions", params.projectId, params.userId)]);
       return revokeActiveSessionsForUser(tx, params);
     });
   }
@@ -3146,7 +3087,6 @@ class PgAuthStorage {
         };
       }
       await validateCompleteSessionInput(tx, projectId, input.session);
-      assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
       let newUserId;
       if (shouldCreateUser) {
         newUserId = assertNonEmpty(input.newUserId, "User id");
@@ -3251,7 +3191,6 @@ class PgAuthStorage {
         };
       }
       await validateCompleteSessionInput(tx, projectId, input.session);
-      assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
       let newUserId;
       if (shouldCreateUser) {
         newUserId = assertNonEmpty(input.newUserId, "User id");
@@ -3459,16 +3398,12 @@ class PgAuthStorage {
     return this.applyGroups(sql, { ...input, groupIds, source: "directory" });
   }
   async createSignInSession(sql, input) {
-    await lockAdvisoryKeys(sql, [
-      authLockKey("sessions", input.projectId, input.userId),
-      authLockKey("sessions", input.projectId, input.userId, input.session.audience)
-    ]);
+    await lockAdvisoryKeys(sql, [authLockKey("sessions", input.projectId, input.userId)]);
     return createSession(sql, {
       id: input.session.id,
       projectId: input.projectId,
       userId: input.userId,
       strategyId: input.strategyId,
-      audience: input.session.audience,
       tokenHash: input.session.tokenHash,
       createdAt: input.session.createdAt,
       expiresAt: input.session.expiresAt,
@@ -3514,12 +3449,6 @@ class PgAuthStorage {
     return rowToIdentityRecord(row);
   }
 }
-function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
-  if (sessionAudience === storedAudience) {
-    return;
-  }
-  throw new AuthStorageError11("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
-}
 function assertCompletableDeviceAuthorization(authorization, input) {
   if (authorization.deviceCodeHash !== input.deviceCodeHash) {
     throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Invalid device authorization.");
@@ -8015,6 +7944,181 @@ CREATE INDEX idx_ontology_sources_drained
   WHERE status = 'superseded' AND root_count = 0;
 `;
 
+// src/migrations/061-terminal-action-runs.sql
+var _061_terminal_action_runs_default = `-- Actions run in the request that asks for them and record their run once, when it ends. No run
+-- is queued, running, or cancelled any more, and every run has started and finished.
+
+-- A run left running after its edits committed, as a crash between the commit and the end of the
+-- run left it, succeeded: its edits and their outbox facts are in the commit. A run that stopped
+-- during its effects keeps that phase, and records effects that never ended.
+UPDATE action_runs AS run
+SET
+  status = 'succeeded',
+  error = NULL,
+  finished_at = committed.committed_at,
+  phase = CASE WHEN run.phase = 'effects' THEN 'effects' ELSE 'commit' END,
+  effects_status = CASE
+    WHEN run.phase = 'effects' AND run.effects_status IS NULL THEN 'failed'
+    ELSE run.effects_status
+  END,
+  effects_completed_at = CASE
+    WHEN run.phase = 'effects' AND run.effects_status IS NULL THEN now()
+    ELSE run.effects_completed_at
+  END,
+  effects_error = CASE
+    WHEN run.phase = 'effects' AND run.effects_status IS NULL THEN jsonb_build_object(
+      'code', 'internal.unexpected',
+      'message', 'Abandoned: Actions now run synchronously; these effects never finished.',
+      'retryable', false,
+      'at', to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+      'details', jsonb_build_object('actionId', run.action_id, 'runId', run.id, 'phase', 'effects')
+    )
+    ELSE run.effects_error
+  END
+FROM ontology_commits AS committed
+WHERE run.status IN ('queued', 'running')
+  AND committed.origin_kind = 'action'
+  AND committed.project_id = run.project_id
+  AND committed.origin_run_id = run.id;
+
+-- Any other run left queued or running never finished, and nothing will resume it.
+UPDATE action_runs
+SET
+  status = 'failed',
+  finished_at = now(),
+  error = jsonb_build_object(
+    'code', 'internal.unexpected',
+    'message', 'Abandoned: Actions now run synchronously; this run never finished.',
+    'retryable', false,
+    'at', to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+    'details', jsonb_build_object('actionId', action_id, 'runId', id)
+  )
+WHERE status IN ('queued', 'running');
+
+-- A cancelled run failed: it keeps the failure it recorded.
+UPDATE action_runs SET status = 'failed' WHERE status = 'cancelled';
+
+-- Every failed run carries a failure. One recorded before failures were kept explains itself.
+UPDATE action_runs
+SET error = jsonb_build_object(
+  'code', 'internal.unexpected',
+  'message', 'This run failed before Sixb recorded why.',
+  'retryable', false,
+  'at', to_char(COALESCE(finished_at, now()) AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+  'details', jsonb_build_object('actionId', action_id, 'runId', id)
+)
+WHERE status = 'failed' AND error IS NULL;
+
+-- The phases \`request\`, \`enqueue\`, and \`cancelled\` are gone: a run that stopped in one of them
+-- never got past validation. A run starts when it was queued at the latest.
+UPDATE action_runs
+SET
+  phase = CASE
+    WHEN phase IN ('validation', 'writeback', 'edits', 'commit', 'effects') THEN phase
+    ELSE 'validation'
+  END,
+  started_at = COALESCE(started_at, queued_at),
+  finished_at = COALESCE(finished_at, now()),
+  writeback_completed_at = CASE
+    WHEN writeback_status IS NULL THEN NULL
+    ELSE COALESCE(writeback_completed_at, finished_at, now())
+  END,
+  effects_completed_at = CASE
+    WHEN effects_status IS NULL THEN NULL
+    ELSE COALESCE(effects_completed_at, finished_at, now())
+  END
+WHERE phase IS NULL
+  OR phase NOT IN ('validation', 'writeback', 'edits', 'commit', 'effects')
+  OR started_at IS NULL
+  OR finished_at IS NULL
+  OR (writeback_status IS NOT NULL AND writeback_completed_at IS NULL)
+  OR (effects_status IS NOT NULL AND effects_completed_at IS NULL);
+
+-- A failure names the phase its run ended in, and only Action codes: an enqueue failure, which no
+-- run can meet any more, reads as the unexpected error it now is.
+UPDATE action_runs
+SET error = jsonb_set(
+  CASE
+    WHEN error->>'code' = 'queue.enqueue_failed'
+      THEN error || '{"code": "internal.unexpected", "retryable": false}'::jsonb
+    ELSE error
+  END,
+  '{details,phase}',
+  to_jsonb(phase)
+)
+WHERE error IS NOT NULL
+  AND (
+    error->'details'->>'phase' IS DISTINCT FROM phase
+    OR error->>'code' = 'queue.enqueue_failed'
+  );
+
+-- The status and phase checks were unnamed. Drop exactly the two that admit the removed values.
+DO $$
+DECLARE lifecycle_constraint RECORD;
+BEGIN
+  FOR lifecycle_constraint IN
+    SELECT conname
+    FROM pg_constraint
+    WHERE conrelid = 'action_runs'::regclass
+      AND contype = 'c'
+      AND (
+        pg_get_constraintdef(oid) LIKE '%''queued''%'
+        OR pg_get_constraintdef(oid) LIKE '%''enqueue''%'
+      )
+  LOOP
+    EXECUTE format('ALTER TABLE action_runs DROP CONSTRAINT %I', lifecycle_constraint.conname);
+  END LOOP;
+END $$;
+
+-- The listing indexes ordered runs by \`COALESCE(started_at, queued_at)\`.
+DROP INDEX idx_action_runs_project_started;
+DROP INDEX idx_action_runs_project_action_started;
+DROP INDEX idx_action_runs_project_object_started;
+DROP INDEX idx_action_runs_project_status_started;
+
+ALTER TABLE action_runs
+  DROP COLUMN queued_at,
+  ALTER COLUMN phase SET NOT NULL,
+  ALTER COLUMN started_at SET NOT NULL,
+  ALTER COLUMN finished_at SET NOT NULL,
+  ADD CONSTRAINT action_runs_status_check CHECK (status IN ('succeeded', 'failed')),
+  ADD CONSTRAINT action_runs_phase_check CHECK (
+    phase IN ('validation', 'writeback', 'edits', 'commit', 'effects')
+  ),
+  ADD CONSTRAINT action_runs_failure_check CHECK ((status = 'failed') = (error IS NOT NULL));
+
+CREATE INDEX idx_action_runs_project_started
+  ON action_runs (project_id, started_at DESC);
+CREATE INDEX idx_action_runs_project_action_started
+  ON action_runs (project_id, action_id, started_at DESC);
+CREATE INDEX idx_action_runs_project_object_started
+  ON action_runs (project_id, object_type_id, primary_id, started_at DESC);
+CREATE INDEX idx_action_runs_project_status_started
+  ON action_runs (project_id, status, started_at DESC);
+`;
+
+// src/migrations/062-drop-auth-audience.sql
+var _062_drop_auth_audience_default = `-- A project has one browser app, so sessions, magic links and sign-in attempts no longer name the
+-- one they belong to. Atlas's browser sessions end here: their cookie is no longer read. Native
+-- sessions carried Atlas's name only because the column needed a value, so they stay.
+UPDATE auth_sessions
+SET revoked_at = now()
+WHERE audience = 'atlas'
+  AND refresh_token_hash IS NULL
+  AND revoked_at IS NULL;
+
+-- Dropping the column drops the two indexes that name it.
+ALTER TABLE auth_sessions DROP COLUMN audience;
+CREATE INDEX idx_auth_sessions_user_active
+  ON auth_sessions (project_id, user_id, expires_at DESC, created_at DESC, id DESC)
+  WHERE revoked_at IS NULL;
+CREATE INDEX idx_auth_sessions_user_created
+  ON auth_sessions (project_id, user_id, created_at DESC, id DESC);
+
+ALTER TABLE auth_magic_links DROP COLUMN audience;
+ALTER TABLE auth_oidc_authorization_attempts DROP COLUMN audience;
+`;
+
 // src/migrations.ts
 var POSTGRES_STORAGE_ADAPTER_ID = "SixbPostgresStorage";
 function pgSql(id, sqlText) {
@@ -8241,7 +8345,9 @@ var postgresStorageMigrations = defineMigrations({
     pgSql("057-audio-transcription", _057_audio_transcription_default),
     pgSql("058-reranking-model-kind", _058_reranking_model_kind_default),
     pgSql("059-file-download-grants", _059_file_download_grants_default),
-    pgSql("060-drained-source-versions", _060_drained_source_versions_default)
+    pgSql("060-drained-source-versions", _060_drained_source_versions_default),
+    pgSql("061-terminal-action-runs", _061_terminal_action_runs_default),
+    pgSql("062-drop-auth-audience", _062_drop_auth_audience_default)
   ]
 });
 
@@ -15681,12 +15787,8 @@ import {
   serializeActionRunFailure
 } from "@sixb/core/internal/action-run-storage";
 import { assertActionRunExecution } from "@sixb/core/internal/action-run-storage-provider";
-import {
-  actionRunPhaseRecordsEqual,
-  canRequeueActionRunAfterEnqueueFailure,
-  finishActionRunPhase
-} from "@sixb/core/internal/storage";
-import { ActionRunError, isTerminalActionRun } from "@sixb/core/storage";
+import { normalizeRecordActionRunInput, resolveActionRunEffects } from "@sixb/core/internal/storage";
+import { ActionRunError } from "@sixb/core/storage";
 class PgActionRunStorage {
   sql;
   executions;
@@ -15694,227 +15796,83 @@ class PgActionRunStorage {
     this.sql = sql;
     this.executions = executions;
   }
-  async lockForMaterialization(input) {
-    const [row] = await this.sql`
-      SELECT *
-      FROM action_runs
-      WHERE project_id = ${input.projectId} AND id = ${input.runId}
-      FOR UPDATE
-    `;
-    if (!row) {
-      throw new ActionRunError(`[SixbPg] Action run '${input.runId}' not found for project '${input.projectId}'.`);
-    }
-    if (row.action_id !== input.actionId) {
-      throw new ActionRunError(`[SixbPg] Action run '${input.runId}' does not belong to action '${input.actionId}'.`);
-    }
-    if (row.status !== "running") {
-      throw new ActionRunError(`[SixbPg] Action run '${input.runId}' cannot materialize from status '${row.status}'.`);
-    }
-    return rowToActionRunRecord(row);
-  }
-  async queue(input) {
+  async record(input) {
+    const record = normalizeRecordActionRunInput(input);
     await assertActionRunExecution({
       executions: this.executions,
-      projectId: input.projectId,
-      executionId: input.executionId,
-      runId: input.id,
-      actionId: input.actionId
-    });
-    try {
-      const [row] = await this.sql`
-        INSERT INTO action_runs (
-          project_id,
-          id,
-          execution_id,
-          action_id,
-          subject_kind,
-          object_type_id,
-          primary_id,
-          status,
-          phase,
-          queued_at,
-          started_at,
-          finished_at,
-          params,
-          idempotency_key,
-          writeback_status,
-          writeback_completed_at,
-          writeback_result,
-          writeback_error,
-          effects_status,
-          effects_completed_at,
-          effects_error,
-          error
-        ) VALUES (
-          ${input.projectId},
-          ${input.id},
-          ${input.executionId},
-          ${input.actionId},
-          ${input.subject.kind},
-          ${input.subject.kind === "object" ? input.subject.objectTypeId : null},
-          ${input.subject.kind === "object" ? input.subject.primaryId : null},
-          ${"queued"},
-          ${"request"},
-          ${input.queuedAt ?? new Date},
-          ${null},
-          ${null},
-          ${JSON.stringify(input.params)}::text::jsonb,
-          ${input.idempotencyKey},
-          ${null},
-          ${null},
-          ${null},
-          ${null},
-          ${null},
-          ${null},
-          ${null},
-          ${null}
-        )
-        RETURNING *
-      `;
-      return rowToActionRunRecord(row);
-    } catch (error) {
-      if (isUniqueViolation(error)) {
-        return this.requeueAfterEnqueueFailure(input);
-      }
-      throw error;
-    }
-  }
-  async requeueAfterEnqueueFailure(input) {
-    return runPgTransaction(this.sql, async (tx) => {
-      const [existing] = await tx`
-        SELECT * FROM action_runs
-        WHERE project_id = ${input.projectId} AND id = ${input.id}
-        FOR UPDATE
-      `;
-      if (!existing || !canRequeueActionRunAfterEnqueueFailure(rowToActionRunRecord(existing), input)) {
-        throw new ActionRunError(`[SixbPg] Action run '${input.id}' already exists for project '${input.projectId}'.`);
-      }
-      const [updated] = await tx`
-        UPDATE action_runs
-        SET
-          status = ${"queued"},
-          phase = ${"request"},
-          queued_at = ${input.queuedAt ?? new Date},
-          started_at = ${null},
-          finished_at = ${null},
-          writeback_status = ${null},
-          writeback_completed_at = ${null},
-          writeback_result = ${null},
-          writeback_error = ${null},
-          effects_status = ${null},
-          effects_completed_at = ${null},
-          effects_error = ${null},
-          error = ${null}
-        WHERE project_id = ${input.projectId} AND id = ${input.id}
-        RETURNING *
-      `;
-      return rowToActionRunRecord(updated);
+      projectId: record.projectId,
+      executionId: record.executionId,
+      runId: record.id,
+      actionId: record.actionId
     });
-  }
-  async start(input) {
-    const [updated] = await this.sql`
-      UPDATE action_runs
-      SET
-        status = ${"running"},
-        phase = ${input.phase ?? "validation"},
-        started_at = ${input.startedAt ?? new Date},
-        error = ${null}
-      WHERE project_id = ${input.projectId}
-        AND id = ${input.id}
-        AND status = ${"queued"}
+    const [row] = await this.sql`
+      INSERT INTO action_runs (
+        project_id,
+        id,
+        execution_id,
+        action_id,
+        subject_kind,
+        object_type_id,
+        primary_id,
+        status,
+        phase,
+        started_at,
+        finished_at,
+        params,
+        idempotency_key,
+        writeback_status,
+        writeback_completed_at,
+        writeback_result,
+        writeback_error,
+        error
+      ) VALUES (
+        ${record.projectId},
+        ${record.id},
+        ${record.executionId},
+        ${record.actionId},
+        ${record.subject.kind},
+        ${record.subject.kind === "object" ? record.subject.objectTypeId : null},
+        ${record.subject.kind === "object" ? record.subject.primaryId : null},
+        ${record.status},
+        ${record.phase},
+        ${record.startedAt},
+        ${record.finishedAt},
+        ${JSON.stringify(record.params)}::text::jsonb,
+        ${record.idempotencyKey},
+        ${record.writeback?.status ?? null},
+        ${record.writeback?.completedAt ?? null},
+        ${record.writeback?.status === "succeeded" ? JSON.stringify(record.writeback.result) : null}::text::jsonb,
+        ${record.writeback?.status === "failed" ? serializeActionRunFailure(record.writeback.error, "writeback") : null}::text::jsonb,
+        ${record.status === "failed" ? serializeActionRunFailure(record.error) : null}::text::jsonb
+      )
+      ON CONFLICT DO NOTHING
       RETURNING *
     `;
-    if (updated) {
-      return rowToActionRunRecord(updated);
-    }
-    const existing = await this.getById({ projectId: input.projectId, id: input.id });
-    if (!existing) {
-      throw new ActionRunError(`[SixbPg] Action run '${input.id}' not found for project '${input.projectId}'.`);
-    }
-    throw new ActionRunError(`[SixbPg] Action run '${input.id}' cannot start from status '${existing.status}'.`);
-  }
-  async enterPhase(input) {
-    return runPgTransaction(this.sql, async (tx) => {
-      await this.requireRunningRun(tx, input.projectId, input.id, "transition phase");
-      const [updated] = await tx`
-        UPDATE action_runs
-        SET phase = ${input.phase}
-        WHERE project_id = ${input.projectId} AND id = ${input.id}
-        RETURNING *
-      `;
-      return rowToActionRunRecord(updated);
-    });
-  }
-  async recordWriteback(input) {
-    return runPgTransaction(this.sql, async (tx) => {
-      const existing = await this.requireRunningRun(tx, input.projectId, input.id, "record writeback");
-      const nextWriteback = toWritebackRecord(input, new Date(input.completedAt ?? new Date));
-      const currentWriteback = toActionRunWritebackRecord(existing);
-      if (currentWriteback) {
-        if (actionRunPhaseRecordsEqual(currentWriteback, nextWriteback)) {
-          return rowToActionRunRecord(existing);
-        }
-        throw new ActionRunError(`[SixbPg] Action run '${input.id}' already has a different writeback record.`);
-      }
-      const [updated] = await tx`
-        UPDATE action_runs
-        SET
-          phase = ${"writeback"},
-          writeback_status = ${input.status},
-          writeback_completed_at = ${nextWriteback.completedAt},
-          writeback_result = ${input.status === "succeeded" ? JSON.stringify(input.result) : null}::text::jsonb,
-          writeback_error = ${input.status === "failed" ? serializeActionRunFailure(input.error, "writeback") : null}::text::jsonb
-        WHERE project_id = ${input.projectId} AND id = ${input.id}
-        RETURNING *
-      `;
-      return rowToActionRunRecord(updated);
-    });
+    if (row)
+      return rowToActionRunRecord(row);
+    const [conflict] = await this.sql`
+      SELECT id FROM action_runs
+      WHERE project_id = ${record.projectId} AND id = ${record.id}
+    `;
+    throw new ActionRunError(conflict ? `[SixbPg] Action run '${record.id}' is already recorded for project '${record.projectId}'.` : `[SixbPg] Execution '${record.executionId}' already belongs to another Action run.`);
   }
   async recordEffects(input) {
-    return runPgTransaction(this.sql, async (tx) => {
-      const existing = await this.requireRunningRun(tx, input.projectId, input.id, "record effects");
-      const nextEffects = toEffectsRecord(input, new Date(input.completedAt ?? new Date));
-      const currentEffects = toActionRunEffectsRecord(existing);
-      if (currentEffects) {
-        if (actionRunPhaseRecordsEqual(currentEffects, nextEffects)) {
-          return rowToActionRunRecord(existing);
-        }
-        throw new ActionRunError(`[SixbPg] Action run '${input.id}' already has a different effects record.`);
-      }
-      const [updated] = await tx`
-        UPDATE action_runs
-        SET
-          phase = ${"effects"},
-          effects_status = ${input.status},
-          effects_completed_at = ${nextEffects.completedAt},
-          effects_error = ${input.status === "failed" ? serializeActionRunFailure(input.error, "effects") : null}::text::jsonb
-        WHERE project_id = ${input.projectId} AND id = ${input.id}
-        RETURNING *
-      `;
-      return rowToActionRunRecord(updated);
-    });
-  }
-  async finish(input) {
     return runPgTransaction(this.sql, async (tx) => {
       const [existing] = await tx`
         SELECT * FROM action_runs
         WHERE project_id = ${input.projectId} AND id = ${input.id}
         FOR UPDATE
       `;
-      if (!existing) {
-        throw new ActionRunError(`[SixbPg] Action run '${input.id}' not found for project '${input.projectId}'.`);
-      }
-      if (isTerminalActionRun({ status: existing.status })) {
-        throw new ActionRunError(`[SixbPg] Action run '${input.id}' cannot finish from terminal status '${existing.status}'.`);
-      }
-      const phase = finishActionRunPhase(input, existing.phase);
+      const { run, effects } = resolveActionRunEffects(existing ? rowToActionRunRecord(existing) : null, input);
+      if (!effects)
+        return run;
       const [updated] = await tx`
         UPDATE action_runs
         SET
-          status = ${input.status},
-          phase = ${phase},
-          finished_at = ${input.finishedAt ?? new Date},
-          error = ${input.status === "succeeded" ? null : serializeActionRunFailure(input.error)}::text::jsonb
+          phase = ${"effects"},
+          effects_status = ${effects.status},
+          effects_completed_at = ${effects.completedAt},
+          effects_error = ${effects.status === "failed" ? serializeActionRunFailure(effects.error, "effects") : null}::text::jsonb
         WHERE project_id = ${input.projectId} AND id = ${input.id}
         RETURNING *
       `;
@@ -15987,11 +15945,11 @@ class PgActionRunStorage {
       params.push(...input.statuses);
     }
     if (input.startedAfter) {
-      whereClauses.push(`COALESCE(started_at, queued_at) >= $${index++}`);
+      whereClauses.push(`started_at >= $${index++}`);
       params.push(input.startedAfter);
     }
     if (input.startedBefore) {
-      whereClauses.push(`COALESCE(started_at, queued_at) <= $${index++}`);
+      whereClauses.push(`started_at <= $${index++}`);
       params.push(input.startedBefore);
     }
     const where = `WHERE ${whereClauses.join(" AND ")}`;
@@ -16002,7 +15960,7 @@ class PgActionRunStorage {
     let query = `
       SELECT * FROM action_runs
       ${where}
-      ORDER BY COALESCE(started_at, queued_at) ${order}, id ${order}
+      ORDER BY started_at ${order}, id ${order}
     `;
     if (input.limit !== undefined) {
       query += ` LIMIT $${index++} OFFSET $${index++}`;
@@ -16020,32 +15978,12 @@ class PgActionRunStorage {
       total
     };
   }
-  async requireRunningRun(runner, projectId, id, operation) {
-    const [existing] = await runner`
-      SELECT * FROM action_runs
-      WHERE project_id = ${projectId} AND id = ${id}
-      FOR UPDATE
-    `;
-    if (!existing) {
-      throw new ActionRunError(`[SixbPg] Action run '${id}' not found for project '${projectId}'.`);
-    }
-    if (existing.status !== "running") {
-      throw new ActionRunError(`[SixbPg] Action run '${id}' cannot ${operation} from status '${existing.status}'.`);
-    }
-    return existing;
-  }
-}
-function toActionRunFailure(row) {
-  return row.error === null ? undefined : parseActionRunFailure(row.error);
-}
-function parsePhaseFailure(value, expectedPhase) {
-  return parseActionRunFailure(value, expectedPhase);
 }
 function toActionRunWritebackRecord(row) {
   if (!row.writeback_status) {
     return;
   }
-  const completedAt = row.writeback_completed_at ? new Date(row.writeback_completed_at) : new Date(row.queued_at);
+  const completedAt = new Date(row.writeback_completed_at ?? row.finished_at);
   if (row.writeback_status === "succeeded") {
     return {
       status: "succeeded",
@@ -16056,14 +15994,14 @@ function toActionRunWritebackRecord(row) {
   return {
     status: "failed",
     completedAt,
-    error: parsePhaseFailure(row.writeback_error, "writeback")
+    error: parseActionRunFailure(row.writeback_error, "writeback")
   };
 }
 function toActionRunEffectsRecord(row) {
   if (!row.effects_status) {
     return;
   }
-  const completedAt = row.effects_completed_at ? new Date(row.effects_completed_at) : new Date(row.queued_at);
+  const completedAt = new Date(row.effects_completed_at ?? row.finished_at);
   if (row.effects_status === "succeeded") {
     return {
       status: "succeeded",
@@ -16073,54 +16011,29 @@ function toActionRunEffectsRecord(row) {
   return {
     status: "failed",
     completedAt,
-    error: parsePhaseFailure(row.effects_error, "effects")
-  };
-}
-function toWritebackRecord(input, completedAt) {
-  if (input.status === "succeeded") {
-    return {
-      status: "succeeded",
-      completedAt,
-      result: input.result
-    };
-  }
-  return {
-    status: "failed",
-    completedAt,
-    error: input.error
-  };
-}
-function toEffectsRecord(input, completedAt) {
-  if (input.status === "succeeded") {
-    return {
-      status: "succeeded",
-      completedAt
-    };
-  }
-  return {
-    status: "failed",
-    completedAt,
-    error: input.error
+    error: parseActionRunFailure(row.effects_error, "effects")
   };
 }
 function rowToActionRunRecord(row) {
-  return {
+  const writeback = toActionRunWritebackRecord(row);
+  const effects = toActionRunEffectsRecord(row);
+  const fields = {
     id: row.id,
     projectId: row.project_id,
     executionId: row.execution_id,
     actionId: row.action_id,
     subject: rowToActionSubject(row),
-    status: row.status,
-    phase: row.phase ?? undefined,
-    queuedAt: new Date(row.queued_at),
-    startedAt: row.started_at ? new Date(row.started_at) : undefined,
-    finishedAt: row.finished_at ? new Date(row.finished_at) : undefined,
+    phase: row.phase,
+    startedAt: new Date(row.started_at),
+    finishedAt: new Date(row.finished_at),
     params: row.params,
     idempotencyKey: row.idempotency_key,
-    writeback: toActionRunWritebackRecord(row),
-    effects: toActionRunEffectsRecord(row),
-    error: toActionRunFailure(row)
+    ...writeback === undefined ? {} : { writeback },
+    ...effects === undefined ? {} : { effects }
   };
+  if (row.status === "succeeded")
+    return { ...fields, status: "succeeded" };
+  return { ...fields, status: "failed", error: parseActionRunFailure(row.error) };
 }
 function rowToActionSubject(row) {
   if (row.subject_kind === "none") {
@@ -21065,4 +20978,4 @@ export {
   migratePostgresStorage
 };
 
-//# debugId=51821498ED16AC6B64756E2164756E21
+//# debugId=971E14D4D5198C8B64756E2164756E21