@sixb/pg 0.1.18 → 0.1.20

package/dist/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAGV,YAAY,EACZ,aAAa,EACb,oBAAoB,EACrB,MAAM,oBAAoB,CAAA;AAqH3B,OAAO,KAAK,EAAe,GAAG,EAAa,MAAM,aAAa,CAAA;AAG9D,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,eAAO,MAAM,2BAA2B,wBAAwB,CAAA;AAEhE,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAAC,wBAAwB,CAAC,CAE1F;AAED,wBAAgB,MAAM,CACpB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC/D,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAAC,wBAAwB,CAAC,CAEzC;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,MAAM,GACjB,SAAS,eAAe,EAAE,CAQ5B;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,wBAAwB,CAAC,CAAA;CAC5D,GAAG,eAAe,CAqBlB;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMxF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAKrD;AAuKD,eAAO,MAAM,yBAAyB,wCAgEpC,CAAA"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAGV,YAAY,EACZ,aAAa,EACb,oBAAoB,EACrB,MAAM,oBAAoB,CAAA;AAqH3B,OAAO,KAAK,EAAe,GAAG,EAAa,MAAM,aAAa,CAAA;AAG9D,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,eAAO,MAAM,2BAA2B,wBAAwB,CAAA;AAEhE,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAAC,wBAAwB,CAAC,CAE1F;AAED,wBAAgB,MAAM,CACpB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC/D,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAAC,wBAAwB,CAAC,CAEzC;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,MAAM,GACjB,SAAS,eAAe,EAAE,CAQ5B;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,wBAAwB,CAAC,CAAA;CAC5D,GAAG,eAAe,CAqBlB;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMxF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAKrD;AAuKD,eAAO,MAAM,yBAAyB,wCAkEpC,CAAA"}

package/dist/pg-action-run-storage.d.ts

@@ -1,22 +1,15 @@
-import type { ActionRunRecord, ActionRunStorage, EnterActionRunPhaseInput, ExecutionStorage, FinishActionRunInput, ListActionRunsInput, ListActionRunsResult, LockActionMaterializationRunInput, QueueActionRunInput, RecordActionEffectsInput, RecordActionWritebackInput, StartActionRunInput } from "@sixb/core/storage";
+import type { ActionRunRecord, ActionRunStorage, ExecutionStorage, ListActionRunsInput, ListActionRunsResult, RecordActionEffectsInput, RecordActionRunInput } from "@sixb/core/storage";
 import { type PgStoreClient } from "./transactions";
 export declare class PgActionRunStorage implements ActionRunStorage {
     private readonly sql;
     private readonly executions;
     constructor(sql: PgStoreClient, executions: ExecutionStorage);
-    lockForMaterialization(input: LockActionMaterializationRunInput): Promise<ActionRunRecord>;
-    queue(input: QueueActionRunInput): Promise<ActionRunRecord>;
-    private requeueAfterEnqueueFailure;
-    start(input: StartActionRunInput): Promise<ActionRunRecord>;
-    enterPhase(input: EnterActionRunPhaseInput): Promise<ActionRunRecord>;
-    recordWriteback(input: RecordActionWritebackInput): Promise<ActionRunRecord>;
+    record(input: RecordActionRunInput): Promise<ActionRunRecord>;
     recordEffects(input: RecordActionEffectsInput): Promise<ActionRunRecord>;
-    finish(input: FinishActionRunInput): Promise<ActionRunRecord>;
     getById(params: {
         projectId: string;
         id: string;
     }): Promise<ActionRunRecord | null>;
     list(input: ListActionRunsInput): Promise<ListActionRunsResult>;
-    private requireRunningRun;
 }
 //# sourceMappingURL=pg-action-run-storage.d.ts.map

package/dist/pg-action-run-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pg-action-run-storage.d.ts","sourceRoot":"","sources":["../src/pg-action-run-storage.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAKV,eAAe,EACf,gBAAgB,EAEhB,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAI3B,OAAO,EAAE,KAAK,aAAa,EAAoB,MAAM,gBAAgB,CAAA;AAErE,qBAAa,kBAAmB,YAAW,gBAAgB;IAEvD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,GAAG,EAAE,aAAa,EAClB,UAAU,EAAE,gBAAgB;IAGzC,sBAAsB,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,eAAe,CAAC;IAyB1F,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC;YAuEnD,0BAA0B;IAyClC,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC;IA8B3D,UAAU,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC;IAerE,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,eAAe,CAAC;IAqC5E,aAAa,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC;IA+BxE,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAqC7D,OAAO,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IASnF,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;YAkHvD,iBAAiB;CAwBhC"}
+{"version":3,"file":"pg-action-run-storage.d.ts","sourceRoot":"","sources":["../src/pg-action-run-storage.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAIV,eAAe,EAEf,gBAAgB,EAEhB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EAAE,KAAK,aAAa,EAAoB,MAAM,gBAAgB,CAAA;AAErE,qBAAa,kBAAmB,YAAW,gBAAgB;IAEvD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,GAAG,EAAE,aAAa,EAClB,UAAU,EAAE,gBAAgB;IAGzC,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAuE7D,aAAa,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC;IA2BxE,OAAO,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IASnF,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAiHtE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixb/pg",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "PostgreSQL storage provider for Sixb",
   "keywords": [
     "sixb",
@@ -40,10 +40,10 @@
     "postgres": "^3.4.5"
   },
   "peerDependencies": {
-    "@sixb/core": "0.1.18"
+    "@sixb/core": "0.1.20"
   },
   "devDependencies": {
-    "@sixb/core": "0.1.18",
+    "@sixb/core": "0.1.20",
     "@types/bun": "latest",
     "typescript": "^5.7.0"
   },

package/src/auth-storage/auth-storage.ts

@@ -234,7 +234,6 @@ export class PgAuthStorage implements AuthStorage {
         }
 
         await validateCompleteSessionInput(tx, projectId, input.session)
-        assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience)
 
         let newUserId: string | undefined
         if (shouldCreateUser) {
@@ -394,7 +393,6 @@ export class PgAuthStorage implements AuthStorage {
         }
 
         await validateCompleteSessionInput(tx, projectId, input.session)
-        assertSignInSessionAudience(projectId, input.session.audience, attempt.audience)
 
         let newUserId: string | undefined
         if (shouldCreateUser) {
@@ -719,17 +717,13 @@ export class PgAuthStorage implements AuthStorage {
       readonly userId: string
     }
   ): Promise<SessionRecord> {
-    await lockAdvisoryKeys(sql, [
-      authLockKey("sessions", input.projectId, input.userId),
-      authLockKey("sessions", input.projectId, input.userId, input.session.audience),
-    ])
+    await lockAdvisoryKeys(sql, [authLockKey("sessions", input.projectId, input.userId)])
 
     return createSession(sql, {
       id: input.session.id,
       projectId: input.projectId,
       userId: input.userId,
       strategyId: input.strategyId,
-      audience: input.session.audience,
       tokenHash: input.session.tokenHash,
       createdAt: input.session.createdAt,
       expiresAt: input.session.expiresAt,
@@ -795,21 +789,6 @@ export class PgAuthStorage implements AuthStorage {
   }
 }
 
-function assertSignInSessionAudience(
-  projectId: string,
-  sessionAudience: string,
-  storedAudience: string
-): void {
-  if (sessionAudience === storedAudience) {
-    return
-  }
-
-  throw new AuthStorageError(
-    "invalid_input",
-    `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`
-  )
-}
-
 function assertCompletableDeviceAuthorization(
   authorization: DeviceAuthorizationRecord,
   input: CompleteDeviceAuthorizationInput

package/src/auth-storage/magic-links.ts

@@ -1,4 +1,3 @@
-import { resolveAuthSessionAudience } from "@sixb/core"
 import type {
   AuthMagicLinkStore,
   CreateAuthMagicLinkInput,
@@ -31,7 +30,6 @@ export class PgAuthMagicLinkStore implements AuthMagicLinkStore {
       const id = assertNonEmpty(input.id, "Magic link id")
       const projectId = assertNonEmpty(input.projectId, "Project id")
       const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-      const audience = resolveAuthSessionAudience(input.audience)
       const email = normalizeEmail(input.email)
       const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash")
 
@@ -56,7 +54,6 @@ export class PgAuthMagicLinkStore implements AuthMagicLinkStore {
             project_id,
             id,
             strategy_id,
-            audience,
             email,
             token_hash,
             return_to,
@@ -66,7 +63,6 @@ export class PgAuthMagicLinkStore implements AuthMagicLinkStore {
             ${projectId},
             ${id},
             ${strategyId},
-            ${audience},
             ${email},
             ${tokenHash},
             ${input.returnTo ?? null},

package/src/auth-storage/oidc-attempts.ts

@@ -1,4 +1,3 @@
-import { resolveAuthSessionAudience } from "@sixb/core"
 import type {
   AuthOidcAuthorizationAttemptStore,
   CreateOidcAuthorizationAttemptInput,
@@ -25,7 +24,6 @@ export class PgAuthOidcAuthorizationAttemptStore implements AuthOidcAuthorizatio
     const id = assertNonEmpty(input.id, "OIDC authorization attempt id")
     const projectId = assertNonEmpty(input.projectId, "Project id")
     const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-    const audience = resolveAuthSessionAudience(input.audience)
     const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash")
     const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash")
     const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier")
@@ -43,7 +41,6 @@ export class PgAuthOidcAuthorizationAttemptStore implements AuthOidcAuthorizatio
           project_id,
           id,
           strategy_id,
-          audience,
           state_hash,
           nonce_hash,
           code_verifier,
@@ -54,7 +51,6 @@ export class PgAuthOidcAuthorizationAttemptStore implements AuthOidcAuthorizatio
           ${projectId},
           ${id},
           ${strategyId},
-          ${audience},
           ${stateHash},
           ${nonceHash},
           ${codeVerifier},

package/src/auth-storage/rows.ts

@@ -67,7 +67,6 @@ export interface PgAuthSessionRow {
   readonly id: string
   readonly user_id: string
   readonly strategy_id: string
-  readonly audience: SessionRecord["audience"]
   readonly token_hash: string
   readonly created_at: PgDate
   readonly expires_at: PgDate
@@ -132,7 +131,6 @@ export interface PgAuthMagicLinkRow {
   readonly project_id: string
   readonly id: string
   readonly strategy_id: string
-  readonly audience: MagicLinkRecord["audience"]
   readonly email: string
   readonly token_hash: string
   readonly return_to: string | null
@@ -146,7 +144,6 @@ export interface PgAuthOidcAttemptRow {
   readonly project_id: string
   readonly id: string
   readonly strategy_id: string
-  readonly audience: OidcAuthorizationAttemptRecord["audience"]
   readonly state_hash: string
   readonly nonce_hash: string
   readonly code_verifier: string
@@ -229,7 +226,6 @@ export function rowToSessionRecord(row: PgAuthSessionRow): SessionRecord {
     projectId: row.project_id,
     userId: row.user_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     tokenHash: row.token_hash,
     createdAt: toDate(row.created_at),
     expiresAt: toDate(row.expires_at),
@@ -306,7 +302,6 @@ export function rowToMagicLinkRecord(row: PgAuthMagicLinkRow): MagicLinkRecord {
     id: row.id,
     projectId: row.project_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     email: row.email,
     tokenHash: row.token_hash,
     returnTo: row.return_to ?? undefined,
@@ -324,7 +319,6 @@ export function rowToOidcAuthorizationAttemptRecord(
     id: row.id,
     projectId: row.project_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     stateHash: row.state_hash,
     nonceHash: row.nonce_hash,
     codeVerifier: row.code_verifier,

package/src/auth-storage/sessions.ts

@@ -1,4 +1,3 @@
-import type { AuthSessionAudience } from "@sixb/core"
 import type {
   AuthSessionStore,
   CreateAuthSessionInput,
@@ -38,28 +37,6 @@ export class PgAuthSessionStore implements AuthSessionStore {
     return getSessionById(this.sql, params)
   }
 
-  async getActiveByUserId(params: {
-    readonly projectId: string
-    readonly userId: string
-    readonly audience: AuthSessionAudience
-    readonly now: Date
-  }): Promise<SessionRecord | null> {
-    const [row] = await this.sql<PgAuthSessionRow[]>`
-      SELECT *
-      FROM auth_sessions
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND audience = ${params.audience}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.now}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.now})
-      ORDER BY created_at DESC, id DESC
-      LIMIT 1
-    `
-
-    return row ? rowToSessionRecord(row) : null
-  }
-
   async listActiveByUserId(params: {
     readonly projectId: string
     readonly userId: string
@@ -82,7 +59,6 @@ export class PgAuthSessionStore implements AuthSessionStore {
   async findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null> {
@@ -91,7 +67,6 @@ export class PgAuthSessionStore implements AuthSessionStore {
     if (
       !row ||
       row.refresh_token_hash !== null ||
-      row.audience !== params.audience ||
       row.token_hash !== params.tokenHash ||
       !isLiveSessionRow(row, params.now)
     ) {
@@ -169,7 +144,6 @@ export class PgAuthSessionStore implements AuthSessionStore {
   async renewIfValid(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
     readonly expiresAt: Date
@@ -186,7 +160,6 @@ export class PgAuthSessionStore implements AuthSessionStore {
           last_seen_at = ${params.now}
       WHERE project_id = ${params.projectId}
         AND id = ${params.id}
-        AND audience = ${params.audience}
         AND token_hash = ${params.tokenHash}
         AND refresh_token_hash IS NULL
         AND revoked_at IS NULL
@@ -228,15 +201,10 @@ export class PgAuthSessionStore implements AuthSessionStore {
   async revokeActiveForUser(params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }): Promise<readonly SessionRecord[]> {
     return runPgTransaction(this.sql, async (tx) => {
-      const locks = [authLockKey("sessions", params.projectId, params.userId)]
-      if (params.audience) {
-        locks.push(authLockKey("sessions", params.projectId, params.userId, params.audience))
-      }
-      await lockAdvisoryKeys(tx, locks)
+      await lockAdvisoryKeys(tx, [authLockKey("sessions", params.projectId, params.userId)])
       return revokeActiveSessionsForUser(tx, params)
     })
   }

package/src/auth-storage/shared.ts

@@ -1,4 +1,4 @@
-import type { AuthSessionAudience, Principal } from "@sixb/core"
+import type { Principal } from "@sixb/core"
 import type {
   CompleteAuthSessionInput,
   CreateAuthSessionInput,
@@ -442,7 +442,6 @@ export async function validateCompleteSessionInput(
   session: CompleteAuthSessionInput
 ): Promise<void> {
   const sessionId = assertNonEmpty(session.id, "Session id")
-  assertNonEmpty(session.audience, "Session audience")
   assertNonEmpty(session.tokenHash, "Session token hash")
   await assertSessionIdAvailable(sql, projectId, sessionId)
 }
@@ -468,7 +467,6 @@ export async function createSession(
   const projectId = assertNonEmpty(input.projectId, "Project id")
   const userId = assertNonEmpty(input.userId, "User id")
   const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-  const audience = assertNonEmpty(input.audience, "Session audience")
   const tokenHash = assertNonEmpty(input.tokenHash, "Session token hash")
 
   await requireUserById(sql, { projectId, id: userId })
@@ -481,7 +479,6 @@ export async function createSession(
         id,
         user_id,
         strategy_id,
-        audience,
         token_hash,
         created_at,
         expires_at,
@@ -496,7 +493,6 @@ export async function createSession(
         ${id},
         ${userId},
         ${strategyId},
-        ${audience},
         ${tokenHash},
         ${input.createdAt},
         ${input.expiresAt},
@@ -525,13 +521,10 @@ export async function revokeActiveSessionsForUser(
   params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }
 ): Promise<readonly SessionRecord[]> {
-  const rows =
-    params.audience === undefined
-      ? await sql<PgAuthSessionRow[]>`
+  const rows = await sql<PgAuthSessionRow[]>`
       SELECT *
       FROM auth_sessions
       WHERE project_id = ${params.projectId}
@@ -542,41 +535,16 @@ export async function revokeActiveSessionsForUser(
       ORDER BY created_at ASC, id ASC
       FOR UPDATE
     `
-      : await sql<PgAuthSessionRow[]>`
-      SELECT *
-      FROM auth_sessions
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND audience = ${params.audience}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.revokedAt}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
-      ORDER BY created_at ASC, id ASC
-      FOR UPDATE
-    `
 
-  if (params.audience === undefined) {
-    await sql`
-      UPDATE auth_sessions
-      SET revoked_at = ${params.revokedAt}
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.revokedAt}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
-    `
-  } else {
-    await sql`
+  await sql`
       UPDATE auth_sessions
       SET revoked_at = ${params.revokedAt}
       WHERE project_id = ${params.projectId}
         AND user_id = ${params.userId}
-        AND audience = ${params.audience}
         AND revoked_at IS NULL
         AND expires_at > ${params.revokedAt}
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
     `
-  }
 
   return rows.map((row) =>
     rowToSessionRecord({

package/src/migrations/061-terminal-action-runs.sql

@@ -0,0 +1,150 @@
+-- Actions run in the request that asks for them and record their run once, when it ends. No run
+-- is queued, running, or cancelled any more, and every run has started and finished.
+
+-- A run left running after its edits committed, as a crash between the commit and the end of the
+-- run left it, succeeded: its edits and their outbox facts are in the commit. A run that stopped
+-- during its effects keeps that phase, and records effects that never ended.
+UPDATE action_runs AS run
+SET
+  status = 'succeeded',
+  error = NULL,
+  finished_at = committed.committed_at,
+  phase = CASE WHEN run.phase = 'effects' THEN 'effects' ELSE 'commit' END,
+  effects_status = CASE
+    WHEN run.phase = 'effects' AND run.effects_status IS NULL THEN 'failed'
+    ELSE run.effects_status
+  END,
+  effects_completed_at = CASE
+    WHEN run.phase = 'effects' AND run.effects_status IS NULL THEN now()
+    ELSE run.effects_completed_at
+  END,
+  effects_error = CASE
+    WHEN run.phase = 'effects' AND run.effects_status IS NULL THEN jsonb_build_object(
+      'code', 'internal.unexpected',
+      'message', 'Abandoned: Actions now run synchronously; these effects never finished.',
+      'retryable', false,
+      'at', to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+      'details', jsonb_build_object('actionId', run.action_id, 'runId', run.id, 'phase', 'effects')
+    )
+    ELSE run.effects_error
+  END
+FROM ontology_commits AS committed
+WHERE run.status IN ('queued', 'running')
+  AND committed.origin_kind = 'action'
+  AND committed.project_id = run.project_id
+  AND committed.origin_run_id = run.id;
+
+-- Any other run left queued or running never finished, and nothing will resume it.
+UPDATE action_runs
+SET
+  status = 'failed',
+  finished_at = now(),
+  error = jsonb_build_object(
+    'code', 'internal.unexpected',
+    'message', 'Abandoned: Actions now run synchronously; this run never finished.',
+    'retryable', false,
+    'at', to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+    'details', jsonb_build_object('actionId', action_id, 'runId', id)
+  )
+WHERE status IN ('queued', 'running');
+
+-- A cancelled run failed: it keeps the failure it recorded.
+UPDATE action_runs SET status = 'failed' WHERE status = 'cancelled';
+
+-- Every failed run carries a failure. One recorded before failures were kept explains itself.
+UPDATE action_runs
+SET error = jsonb_build_object(
+  'code', 'internal.unexpected',
+  'message', 'This run failed before Sixb recorded why.',
+  'retryable', false,
+  'at', to_char(COALESCE(finished_at, now()) AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+  'details', jsonb_build_object('actionId', action_id, 'runId', id)
+)
+WHERE status = 'failed' AND error IS NULL;
+
+-- The phases `request`, `enqueue`, and `cancelled` are gone: a run that stopped in one of them
+-- never got past validation. A run starts when it was queued at the latest.
+UPDATE action_runs
+SET
+  phase = CASE
+    WHEN phase IN ('validation', 'writeback', 'edits', 'commit', 'effects') THEN phase
+    ELSE 'validation'
+  END,
+  started_at = COALESCE(started_at, queued_at),
+  finished_at = COALESCE(finished_at, now()),
+  writeback_completed_at = CASE
+    WHEN writeback_status IS NULL THEN NULL
+    ELSE COALESCE(writeback_completed_at, finished_at, now())
+  END,
+  effects_completed_at = CASE
+    WHEN effects_status IS NULL THEN NULL
+    ELSE COALESCE(effects_completed_at, finished_at, now())
+  END
+WHERE phase IS NULL
+  OR phase NOT IN ('validation', 'writeback', 'edits', 'commit', 'effects')
+  OR started_at IS NULL
+  OR finished_at IS NULL
+  OR (writeback_status IS NOT NULL AND writeback_completed_at IS NULL)
+  OR (effects_status IS NOT NULL AND effects_completed_at IS NULL);
+
+-- A failure names the phase its run ended in, and only Action codes: an enqueue failure, which no
+-- run can meet any more, reads as the unexpected error it now is.
+UPDATE action_runs
+SET error = jsonb_set(
+  CASE
+    WHEN error->>'code' = 'queue.enqueue_failed'
+      THEN error || '{"code": "internal.unexpected", "retryable": false}'::jsonb
+    ELSE error
+  END,
+  '{details,phase}',
+  to_jsonb(phase)
+)
+WHERE error IS NOT NULL
+  AND (
+    error->'details'->>'phase' IS DISTINCT FROM phase
+    OR error->>'code' = 'queue.enqueue_failed'
+  );
+
+-- The status and phase checks were unnamed. Drop exactly the two that admit the removed values.
+DO $$
+DECLARE lifecycle_constraint RECORD;
+BEGIN
+  FOR lifecycle_constraint IN
+    SELECT conname
+    FROM pg_constraint
+    WHERE conrelid = 'action_runs'::regclass
+      AND contype = 'c'
+      AND (
+        pg_get_constraintdef(oid) LIKE '%''queued''%'
+        OR pg_get_constraintdef(oid) LIKE '%''enqueue''%'
+      )
+  LOOP
+    EXECUTE format('ALTER TABLE action_runs DROP CONSTRAINT %I', lifecycle_constraint.conname);
+  END LOOP;
+END $$;
+
+-- The listing indexes ordered runs by `COALESCE(started_at, queued_at)`.
+DROP INDEX idx_action_runs_project_started;
+DROP INDEX idx_action_runs_project_action_started;
+DROP INDEX idx_action_runs_project_object_started;
+DROP INDEX idx_action_runs_project_status_started;
+
+ALTER TABLE action_runs
+  DROP COLUMN queued_at,
+  ALTER COLUMN phase SET NOT NULL,
+  ALTER COLUMN started_at SET NOT NULL,
+  ALTER COLUMN finished_at SET NOT NULL,
+  ADD CONSTRAINT action_runs_status_check CHECK (status IN ('succeeded', 'failed')),
+  ADD CONSTRAINT action_runs_phase_check CHECK (
+    phase IN ('validation', 'writeback', 'edits', 'commit', 'effects')
+  ),
+  ADD CONSTRAINT action_runs_failure_check CHECK ((status = 'failed') = (error IS NOT NULL));
+
+CREATE INDEX idx_action_runs_project_started
+  ON action_runs (project_id, started_at DESC);
+CREATE INDEX idx_action_runs_project_action_started
+  ON action_runs (project_id, action_id, started_at DESC);
+CREATE INDEX idx_action_runs_project_object_started
+  ON action_runs (project_id, object_type_id, primary_id, started_at DESC);
+CREATE INDEX idx_action_runs_project_status_started
+  ON action_runs (project_id, status, started_at DESC);

package/src/migrations/062-drop-auth-audience.sql

@@ -0,0 +1,19 @@
+-- A project has one browser app, so sessions, magic links and sign-in attempts no longer name the
+-- one they belong to. Atlas's browser sessions end here: their cookie is no longer read. Native
+-- sessions carried Atlas's name only because the column needed a value, so they stay.
+UPDATE auth_sessions
+SET revoked_at = now()
+WHERE audience = 'atlas'
+  AND refresh_token_hash IS NULL
+  AND revoked_at IS NULL;
+
+-- Dropping the column drops the two indexes that name it.
+ALTER TABLE auth_sessions DROP COLUMN audience;
+CREATE INDEX idx_auth_sessions_user_active
+  ON auth_sessions (project_id, user_id, expires_at DESC, created_at DESC, id DESC)
+  WHERE revoked_at IS NULL;
+CREATE INDEX idx_auth_sessions_user_created
+  ON auth_sessions (project_id, user_id, created_at DESC, id DESC);
+
+ALTER TABLE auth_magic_links DROP COLUMN audience;
+ALTER TABLE auth_oidc_authorization_attempts DROP COLUMN audience;

package/src/migrations.ts

@@ -431,6 +431,8 @@ export const postgresStorageMigrations = defineMigrations<PostgresMigrationConte
     pgSql("058-reranking-model-kind", rerankingModelKindSql),
     pgSql("059-file-download-grants", fileDownloadGrantsSql),
     pgSql("060-drained-source-versions", drainedSourceVersionsSql),
+    pgSql("061-terminal-action-runs", terminalActionRunsSql),
+    pgSql("062-drop-auth-audience", dropAuthAudienceSql),
   ],
 })
 
@@ -459,3 +461,5 @@ import fileDownloadGrantsSql from "./migrations/059-file-download-grants.sql" wi
 import drainedSourceVersionsSql from "./migrations/060-drained-source-versions.sql" with {
   type: "text",
 }
+import terminalActionRunsSql from "./migrations/061-terminal-action-runs.sql" with { type: "text" }
+import dropAuthAudienceSql from "./migrations/062-drop-auth-audience.sql" with { type: "text" }