@sixb/sqlite 0.1.18 → 0.1.20

package/src/ai-limit-storage.ts

@@ -45,7 +45,6 @@ import type {
   UpdateAiLimitPolicyInput,
 } from "@sixb/core/storage"
 import { AiLimitStorageError, aiLimitCalendarMonth } from "@sixb/core/storage"
-import { installFreshSqliteSchema } from "./migrations"
 import {
   closeSqliteStoreConnection,
   openSqliteStoreConnection,
@@ -64,7 +63,6 @@ export class SqliteAiLimitStorage implements AiLimitStorage {
 
   constructor(options: SqliteAiLimitStorageOptions = {}) {
     this.connection = openSqliteStoreConnection(options)
-    if (this.connection.installFreshSchema) installFreshSqliteSchema(this.connection.db)
   }
 
   async createPolicy(input: CreateAiLimitPolicyInput): Promise<AiLimitPolicy> {

package/src/ai-usage-storage.ts

@@ -14,7 +14,6 @@ import {
   type SummarizeAiUsageExecutionInput,
   type SummarizeAiUsageExecutionsInput,
 } from "@sixb/core/storage"
-import { installFreshSqliteSchema } from "./migrations"
 import { isUniqueConstraintError } from "./storage-errors"
 import {
   closeSqliteStoreConnection,
@@ -34,9 +33,6 @@ export class SqliteAiUsageStorage implements AiUsageStorage {
 
   constructor(options: SqliteAiUsageStorageOptions = {}) {
     this.connection = openSqliteStoreConnection(options)
-    if (this.connection.installFreshSchema) {
-      installFreshSqliteSchema(this.connection.db)
-    }
   }
 
   async recordModelCall(input: RecordAiModelCallInput): Promise<RecordAiModelCallResult> {

package/src/auth-storage/auth-storage.ts

@@ -16,7 +16,6 @@ import type {
   UserRecord,
 } from "@sixb/core/storage"
 import { AuthStorageError } from "@sixb/core/storage"
-import { installFreshSqliteSchema } from "../migrations"
 import {
   closeSqliteStoreConnection,
   openSqliteStoreConnection,
@@ -90,10 +89,6 @@ export class SqliteAuthStorage implements AuthStorage {
     this.connection = openSqliteStoreConnection(options)
     this.db = this.connection.db
 
-    if (this.connection.installFreshSchema) {
-      installFreshSqliteSchema(this.db)
-    }
-
     this.users = new SqliteAuthUserStore(this.db)
     this.identities = new SqliteAuthUserIdentityStore(this.db)
     this.serviceAccounts = new SqliteAuthServiceAccountStore(this.db)
@@ -202,7 +197,6 @@ export class SqliteAuthStorage implements AuthStorage {
         }
 
         validateCompleteSessionInput(this.db, projectId, input.session)
-        assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience)
 
         let newUserId: string | undefined
         if (shouldCreateUser) {
@@ -340,7 +334,6 @@ export class SqliteAuthStorage implements AuthStorage {
         }
 
         validateCompleteSessionInput(this.db, projectId, input.session)
-        assertSignInSessionAudience(projectId, input.session.audience, attempt.audience)
 
         let newUserId: string | undefined
         if (shouldCreateUser) {
@@ -700,7 +693,6 @@ export class SqliteAuthStorage implements AuthStorage {
       projectId: input.projectId,
       userId: input.userId,
       strategyId: input.strategyId,
-      audience: input.session.audience,
       tokenHash: input.session.tokenHash,
       createdAt: input.session.createdAt,
       expiresAt: input.session.expiresAt,
@@ -773,21 +765,6 @@ export class SqliteAuthStorage implements AuthStorage {
   }
 }
 
-function assertSignInSessionAudience(
-  projectId: string,
-  sessionAudience: string,
-  storedAudience: string
-): void {
-  if (sessionAudience === storedAudience) {
-    return
-  }
-
-  throw new AuthStorageError(
-    "invalid_input",
-    `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`
-  )
-}
-
 function assertCompletableDeviceAuthorization(
   authorization: DeviceAuthorizationRecord,
   input: CompleteDeviceAuthorizationInput

package/src/auth-storage/magic-links.ts

@@ -1,5 +1,4 @@
 import type { Database } from "bun:sqlite"
-import { resolveAuthSessionAudience } from "@sixb/core"
 import type {
   AuthMagicLinkStore,
   CreateAuthMagicLinkInput,
@@ -28,7 +27,6 @@ export class SqliteAuthMagicLinkStore implements AuthMagicLinkStore {
       const id = assertNonEmpty(input.id, "Magic link id")
       const projectId = assertNonEmpty(input.projectId, "Project id")
       const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-      const audience = resolveAuthSessionAudience(input.audience)
       const email = normalizeEmail(input.email)
       const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash")
 
@@ -53,20 +51,18 @@ export class SqliteAuthMagicLinkStore implements AuthMagicLinkStore {
               project_id,
               id,
               strategy_id,
-              audience,
               email,
               token_hash,
               return_to,
               created_at,
               expires_at
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
           `
           )
           .run(
             projectId,
             id,
             strategyId,
-            audience,
             email,
             tokenHash,
             input.returnTo ?? null,
@@ -85,7 +81,6 @@ export class SqliteAuthMagicLinkStore implements AuthMagicLinkStore {
         id,
         projectId,
         strategyId,
-        audience,
         email,
         tokenHash,
         returnTo: input.returnTo,

package/src/auth-storage/oidc-attempts.ts

@@ -1,5 +1,4 @@
 import type { Database } from "bun:sqlite"
-import { resolveAuthSessionAudience } from "@sixb/core"
 import type {
   AuthOidcAuthorizationAttemptStore,
   CreateOidcAuthorizationAttemptInput,
@@ -26,7 +25,6 @@ export class SqliteAuthOidcAuthorizationAttemptStore implements AuthOidcAuthoriz
       const id = assertNonEmpty(input.id, "OIDC authorization attempt id")
       const projectId = assertNonEmpty(input.projectId, "Project id")
       const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-      const audience = resolveAuthSessionAudience(input.audience)
       const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash")
       const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash")
       const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier")
@@ -46,21 +44,19 @@ export class SqliteAuthOidcAuthorizationAttemptStore implements AuthOidcAuthoriz
               project_id,
               id,
               strategy_id,
-              audience,
               state_hash,
               nonce_hash,
               code_verifier,
               return_to,
               created_at,
               expires_at
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
           `
           )
           .run(
             projectId,
             id,
             strategyId,
-            audience,
             stateHash,
             nonceHash,
             codeVerifier,
@@ -80,7 +76,6 @@ export class SqliteAuthOidcAuthorizationAttemptStore implements AuthOidcAuthoriz
         id,
         projectId,
         strategyId,
-        audience,
         stateHash,
         nonceHash,
         codeVerifier,

package/src/auth-storage/rows.ts

@@ -64,7 +64,6 @@ export interface SqliteAuthSessionRow {
   readonly id: string
   readonly user_id: string
   readonly strategy_id: string
-  readonly audience: SessionRecord["audience"]
   readonly token_hash: string
   readonly created_at: string
   readonly expires_at: string
@@ -127,7 +126,6 @@ export interface SqliteAuthMagicLinkRow {
   readonly project_id: string
   readonly id: string
   readonly strategy_id: string
-  readonly audience: MagicLinkRecord["audience"]
   readonly email: string
   readonly token_hash: string
   readonly return_to: string | null
@@ -141,7 +139,6 @@ export interface SqliteAuthOidcAttemptRow {
   readonly project_id: string
   readonly id: string
   readonly strategy_id: string
-  readonly audience: OidcAuthorizationAttemptRecord["audience"]
   readonly state_hash: string
   readonly nonce_hash: string
   readonly code_verifier: string
@@ -230,7 +227,6 @@ export function rowToSessionRecord(row: SqliteAuthSessionRow): SessionRecord {
     projectId: row.project_id,
     userId: row.user_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     tokenHash: row.token_hash,
     createdAt: new Date(row.created_at),
     expiresAt: new Date(row.expires_at),
@@ -321,7 +317,6 @@ export function rowToMagicLinkRecord(row: SqliteAuthMagicLinkRow): MagicLinkReco
     id: row.id,
     projectId: row.project_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     email: row.email,
     tokenHash: row.token_hash,
     returnTo: row.return_to ?? undefined,
@@ -339,7 +334,6 @@ export function rowToOidcAuthorizationAttemptRecord(
     id: row.id,
     projectId: row.project_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     stateHash: row.state_hash,
     nonceHash: row.nonce_hash,
     codeVerifier: row.code_verifier,

package/src/auth-storage/sessions.ts

@@ -1,5 +1,4 @@
 import type { Database } from "bun:sqlite"
-import type { AuthSessionAudience } from "@sixb/core"
 import type {
   AuthSessionStore,
   CreateAuthSessionInput,
@@ -33,38 +32,6 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
     return getSessionById(this.db, params)
   }
 
-  async getActiveByUserId(params: {
-    readonly projectId: string
-    readonly userId: string
-    readonly audience: AuthSessionAudience
-    readonly now: Date
-  }): Promise<SessionRecord | null> {
-    const row = this.db
-      .query(
-        `
-        SELECT *
-        FROM auth_sessions
-        WHERE project_id = ?
-          AND user_id = ?
-          AND audience = ?
-          AND revoked_at IS NULL
-          AND expires_at > ?
-          AND (absolute_expires_at IS NULL OR absolute_expires_at > ?)
-        ORDER BY created_at DESC, id DESC
-        LIMIT 1
-      `
-      )
-      .get(
-        params.projectId,
-        params.userId,
-        params.audience,
-        toIso(params.now),
-        toIso(params.now)
-      ) as SqliteAuthSessionRow | null
-
-    return row ? rowToSessionRecord(row) : null
-  }
-
   async listActiveByUserId(params: {
     readonly projectId: string
     readonly userId: string
@@ -96,7 +63,6 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
   async findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null> {
@@ -105,7 +71,6 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
     if (
       !row ||
       row.refresh_token_hash !== null ||
-      row.audience !== params.audience ||
       row.token_hash !== params.tokenHash ||
       !isLiveSessionRow(row, params.now)
     ) {
@@ -190,7 +155,6 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
   async renewIfValid(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
     readonly expiresAt: Date
@@ -209,7 +173,6 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
               last_seen_at = ?
           WHERE project_id = ?
             AND id = ?
-            AND audience = ?
             AND token_hash = ?
             AND refresh_token_hash IS NULL
             AND revoked_at IS NULL
@@ -217,17 +180,7 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
             AND (absolute_expires_at IS NULL OR absolute_expires_at > ?)
         `
         )
-        .run(
-          expiresAt,
-          expiresAt,
-          now,
-          params.projectId,
-          params.id,
-          params.audience,
-          params.tokenHash,
-          now,
-          now
-        )
+        .run(expiresAt, expiresAt, now, params.projectId, params.id, params.tokenHash, now, now)
 
       return result.changes === 0 ? null : getSessionById(this.db, params)
     })
@@ -269,7 +222,6 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
   async revokeActiveForUser(params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }): Promise<readonly SessionRecord[]> {
     return runImmediateTransaction(this.db, () => revokeActiveSessionsForUser(this.db, params))

package/src/auth-storage/shared.ts

@@ -1,5 +1,4 @@
 import type { Database } from "bun:sqlite"
-import type { AuthSessionAudience } from "@sixb/core"
 import type {
   CompleteAuthSessionInput,
   CreateAuthSessionInput,
@@ -385,7 +384,6 @@ export function validateCompleteSessionInput(
   session: CompleteAuthSessionInput
 ): void {
   const sessionId = assertNonEmpty(session.id, "Session id")
-  assertNonEmpty(session.audience, "Session audience")
   assertNonEmpty(session.tokenHash, "Session token hash")
   assertSessionIdAvailable(db, projectId, sessionId)
 }
@@ -407,7 +405,6 @@ export function createSession(
   const projectId = assertNonEmpty(input.projectId, "Project id")
   const userId = assertNonEmpty(input.userId, "User id")
   const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-  const audience = assertNonEmpty(input.audience, "Session audience")
   const tokenHash = assertNonEmpty(input.tokenHash, "Session token hash")
 
   assertSessionIdAvailable(db, projectId, id)
@@ -419,7 +416,6 @@ export function createSession(
       id,
       user_id,
       strategy_id,
-      audience,
       token_hash,
       created_at,
       expires_at,
@@ -429,14 +425,13 @@ export function createSession(
       client_name,
       access_expires_at,
       refresh_token_hash
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `
   ).run(
     projectId,
     id,
     userId,
     strategyId,
-    audience,
     tokenHash,
     toIso(input.createdAt),
     toIso(input.expiresAt),
@@ -463,20 +458,10 @@ export function revokeActiveSessionsForUser(
   params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }
 ): readonly ReturnType<typeof rowToSessionRecord>[] {
   const revokedAt = toIso(params.revokedAt)
-  const audienceCondition = params.audience === undefined ? "" : "AND audience = ?"
-  const selectArgs =
-    params.audience === undefined
-      ? [params.projectId, params.userId, revokedAt, revokedAt]
-      : [params.projectId, params.userId, params.audience, revokedAt, revokedAt]
-  const updateArgs =
-    params.audience === undefined
-      ? [revokedAt, params.projectId, params.userId, revokedAt, revokedAt]
-      : [revokedAt, params.projectId, params.userId, params.audience, revokedAt, revokedAt]
   const rows = db
     .query(
       `
@@ -484,14 +469,13 @@ export function revokeActiveSessionsForUser(
       FROM auth_sessions
       WHERE project_id = ?
         AND user_id = ?
-        ${audienceCondition}
         AND revoked_at IS NULL
         AND expires_at > ?
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ?)
       ORDER BY created_at ASC, id ASC
     `
     )
-    .all(...selectArgs) as SqliteAuthSessionRow[]
+    .all(params.projectId, params.userId, revokedAt, revokedAt) as SqliteAuthSessionRow[]
 
   db.query(
     `
@@ -499,12 +483,11 @@ export function revokeActiveSessionsForUser(
     SET revoked_at = ?
     WHERE project_id = ?
       AND user_id = ?
-      ${audienceCondition}
       AND revoked_at IS NULL
       AND expires_at > ?
       AND (absolute_expires_at IS NULL OR absolute_expires_at > ?)
   `
-  ).run(...updateArgs)
+  ).run(revokedAt, params.projectId, params.userId, revokedAt, revokedAt)
 
   return rows.map((row) =>
     rowToSessionRecord({

package/src/index.ts

@@ -41,11 +41,7 @@ import { SqliteConnectorConnectionStorage } from "./connector-connection-storage
 import { SqliteExecutionStorage } from "./execution-storage"
 import { SqliteFileDownloadGrantStorage } from "./file-download-grant-storage"
 import { SqliteFileUploadSessionStorage } from "./file-upload-session-storage"
-import {
-  createSqliteStorageMigrators,
-  installFreshSqliteSchema,
-  sqliteStoragePath,
-} from "./migrations"
+import { createSqliteStorageMigrators, sqliteStoragePath } from "./migrations"
 import { SqliteObjectStorage } from "./objects"
 import { SqliteOntologyStorage, type SqliteOntologyTransactionContext } from "./ontology-storage"
 import { SqlitePipelineRunStorage } from "./pipeline-run-storage"
@@ -127,10 +123,6 @@ export class SqliteStorage implements MigrationCapableStorage {
       this.readConnection = this.connection
     }
 
-    if (this.connection.installFreshSchema) {
-      installFreshSqliteSchema(this.connection.db)
-    }
-
     const stores = createSqliteStores(this.connection, {
       runOntologyOperation: async (run) => run(),
       transactionContext: null,
@@ -256,7 +248,6 @@ export class SqliteStorage implements MigrationCapableStorage {
         {
           db: this.connection.db,
           ownsConnection: false,
-          installFreshSchema: false,
         },
         {
           runOntologyOperation: async (run) => run(),

package/src/migrations/060-terminal-action-runs.sql

@@ -0,0 +1,149 @@
+-- Actions run in the request that asks for them and record their run once, when it ends. No run
+-- is queued, running, or cancelled any more, and every run has started and finished. SQLite cannot
+-- alter a CHECK constraint, so the table is rebuilt.
+CREATE TABLE action_runs_v2 (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  execution_id TEXT NOT NULL,
+  action_id TEXT NOT NULL,
+  subject_kind TEXT NOT NULL CHECK (subject_kind IN ('none', 'object')),
+  object_type_id TEXT,
+  primary_id TEXT,
+  status TEXT NOT NULL CHECK (status IN ('succeeded', 'failed')),
+  phase TEXT NOT NULL CHECK (phase IN ('validation', 'writeback', 'edits', 'commit', 'effects')),
+  started_at TEXT NOT NULL,
+  finished_at TEXT NOT NULL,
+  params TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  writeback_status TEXT CHECK (writeback_status IS NULL OR writeback_status IN ('succeeded', 'failed')),
+  writeback_completed_at TEXT,
+  writeback_result TEXT,
+  writeback_error TEXT CHECK (writeback_error IS NULL OR json_valid(writeback_error)),
+  effects_status TEXT CHECK (effects_status IS NULL OR effects_status IN ('succeeded', 'failed')),
+  effects_completed_at TEXT,
+  effects_error TEXT CHECK (effects_error IS NULL OR json_valid(effects_error)),
+  error TEXT CHECK (error IS NULL OR json_valid(error)),
+  CHECK (
+    (subject_kind = 'none' AND object_type_id IS NULL AND primary_id IS NULL)
+    OR (subject_kind = 'object' AND object_type_id IS NOT NULL AND primary_id IS NOT NULL)
+  ),
+  CHECK ((status = 'failed') = (error IS NOT NULL)),
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, execution_id)
+);
+
+INSERT INTO action_runs_v2 (
+  project_id, id, execution_id, action_id, subject_kind, object_type_id, primary_id, status,
+  phase, started_at, finished_at, params, idempotency_key, writeback_status,
+  writeback_completed_at, writeback_result, writeback_error, effects_status,
+  effects_completed_at, effects_error, error
+)
+SELECT
+  project_id, id, execution_id, action_id, subject_kind, object_type_id, primary_id,
+  migrated_status, migrated_phase,
+  -- A run starts when it was queued at the latest.
+  COALESCE(started_at, queued_at),
+  migrated_finished_at,
+  params, idempotency_key, writeback_status,
+  CASE
+    WHEN writeback_status IS NULL THEN NULL
+    ELSE COALESCE(writeback_completed_at, migrated_finished_at)
+  END,
+  writeback_result, writeback_error,
+  CASE WHEN effects_abandoned THEN 'failed' ELSE effects_status END,
+  CASE
+    WHEN effects_abandoned THEN migrated_at
+    WHEN effects_status IS NULL THEN NULL
+    ELSE COALESCE(effects_completed_at, migrated_finished_at)
+  END,
+  CASE
+    WHEN effects_abandoned THEN json_object(
+      'code', 'internal.unexpected',
+      'message', 'Abandoned: Actions now run synchronously; these effects never finished.',
+      'retryable', json('false'),
+      'at', migrated_at,
+      'details', json_object('actionId', action_id, 'runId', id, 'phase', 'effects')
+    )
+    ELSE effects_error
+  END,
+  -- A failure names the phase its run ended in.
+  CASE
+    WHEN migrated_error IS NULL THEN NULL
+    WHEN json_extract(migrated_error, '$.details.phase') IS migrated_phase THEN migrated_error
+    ELSE json_set(migrated_error, '$.details.phase', migrated_phase)
+  END
+FROM (
+  SELECT
+    *,
+    CASE
+      WHEN status = 'succeeded' OR edits_committed THEN 'succeeded'
+      ELSE 'failed'
+    END AS migrated_status,
+    CASE
+      WHEN edits_committed THEN CASE WHEN phase = 'effects' THEN 'effects' ELSE 'commit' END
+      -- The phases `request`, `enqueue`, and `cancelled` are gone: a run that stopped in one of
+      -- them never got past validation.
+      WHEN phase IN ('validation', 'writeback', 'edits', 'commit', 'effects') THEN phase
+      ELSE 'validation'
+    END AS migrated_phase,
+    CASE
+      WHEN edits_committed THEN committed_at
+      WHEN status IN ('queued', 'running') THEN migrated_at
+      ELSE COALESCE(finished_at, migrated_at)
+    END AS migrated_finished_at,
+    edits_committed AND phase = 'effects' AND effects_status IS NULL AS effects_abandoned,
+    CASE
+      WHEN edits_committed THEN NULL
+      WHEN status IN ('queued', 'running') THEN json_object(
+        'code', 'internal.unexpected',
+        'message', 'Abandoned: Actions now run synchronously; this run never finished.',
+        'retryable', json('false'),
+        'at', migrated_at,
+        'details', json_object('actionId', action_id, 'runId', id)
+      )
+      -- Every failed run carries a failure. One recorded before failures were kept explains
+      -- itself.
+      WHEN status IN ('failed', 'cancelled') AND error IS NULL THEN json_object(
+        'code', 'internal.unexpected',
+        'message', 'This run failed before Sixb recorded why.',
+        'retryable', json('false'),
+        'at', COALESCE(finished_at, migrated_at),
+        'details', json_object('actionId', action_id, 'runId', id)
+      )
+      -- An enqueue failure, which no run can meet any more, reads as the unexpected error it
+      -- now is.
+      WHEN json_extract(error, '$.code') = 'queue.enqueue_failed'
+        THEN json_set(error, '$.code', 'internal.unexpected', '$.retryable', json('false'))
+      ELSE error
+    END AS migrated_error
+  FROM (
+    SELECT
+      run.*,
+      committed.committed_at,
+      strftime('%Y-%m-%dT%H:%M:%fZ', 'now') AS migrated_at,
+      -- A run left running after its edits committed, as a crash between the commit and the end
+      -- of the run left it, succeeded: its edits and their outbox facts are in the commit. A run
+      -- that stopped during its effects keeps that phase, and records effects that never ended.
+      -- Any other run left queued or running never finished, and nothing will resume it. A
+      -- cancelled run failed, and keeps the failure it recorded.
+      run.status IN ('queued', 'running') AND committed.committed_at IS NOT NULL
+        AS edits_committed
+    FROM action_runs AS run
+    LEFT JOIN ontology_commits AS committed
+      ON committed.origin_kind = 'action'
+      AND committed.project_id = run.project_id
+      AND committed.origin_run_id = run.id
+  )
+);
+
+DROP TABLE action_runs;
+ALTER TABLE action_runs_v2 RENAME TO action_runs;
+
+CREATE INDEX idx_action_runs_project_started
+  ON action_runs(project_id, started_at DESC);
+CREATE INDEX idx_action_runs_project_action_started
+  ON action_runs(project_id, action_id, started_at DESC);
+CREATE INDEX idx_action_runs_project_object_started
+  ON action_runs(project_id, object_type_id, primary_id, started_at DESC);
+CREATE INDEX idx_action_runs_project_status_started
+  ON action_runs(project_id, status, started_at DESC);

package/src/migrations/061-drop-auth-audience.sql

@@ -0,0 +1,16 @@
+-- A project has one browser app, so sessions, magic links and sign-in attempts no longer name the
+-- one they belong to. Atlas's browser sessions end here: their cookie is no longer read. Native
+-- sessions carried Atlas's name only because the column needed a value, so they stay.
+UPDATE auth_sessions
+SET revoked_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+WHERE audience = 'atlas'
+  AND refresh_token_hash IS NULL
+  AND revoked_at IS NULL;
+
+DROP INDEX idx_auth_sessions_user_active;
+ALTER TABLE auth_sessions DROP COLUMN audience;
+CREATE INDEX idx_auth_sessions_user_active
+  ON auth_sessions(project_id, user_id, revoked_at, expires_at);
+
+ALTER TABLE auth_magic_links DROP COLUMN audience;
+ALTER TABLE auth_oidc_authorization_attempts DROP COLUMN audience;

package/src/migrations.ts

@@ -271,6 +271,8 @@ export const sqliteStorageMigrations = defineMigrations({
     sqliteSql("057-reranking-model-kind", rerankingModelKindSql),
     sqliteSql("058-file-download-grants", fileDownloadGrantsSql),
     sqliteSql("059-drained-source-versions", drainedSourceVersionsSql),
+    sqliteSql("060-terminal-action-runs", terminalActionRunsSql),
+    sqliteSql("061-drop-auth-audience", dropAuthAudienceSql),
   ],
 })
 
@@ -296,6 +298,26 @@ export function sqliteStep(
   return step<Database>(id, up, options)
 }
 
+// Replaying every migration costs a few hundred milliseconds, and in-memory databases are made
+// often (each test's storage, for one). The schema is built once per process and each new database
+// starts as a copy of it.
+let freshSchema: Uint8Array | undefined
+
+/** A new in-memory database holding the current schema, as replaying every migration leaves it. */
+export function freshSqliteDatabase(): Database {
+  if (!freshSchema) {
+    const template = new Database(":memory:")
+    try {
+      template.run("PRAGMA foreign_keys = ON")
+      installFreshSqliteSchema(template)
+      freshSchema = template.serialize()
+    } finally {
+      template.close()
+    }
+  }
+  return Database.deserialize(freshSchema)
+}
+
 export function installFreshSqliteSchema(db: Database): void {
   for (const migration of sqliteStorageMigrations.steps) {
     const installed = migration.up(db)
@@ -597,3 +619,5 @@ import fileDownloadGrantsSql from "./migrations/058-file-download-grants.sql" wi
 import drainedSourceVersionsSql from "./migrations/059-drained-source-versions.sql" with {
   type: "text",
 }
+import terminalActionRunsSql from "./migrations/060-terminal-action-runs.sql" with { type: "text" }
+import dropAuthAudienceSql from "./migrations/061-drop-auth-audience.sql" with { type: "text" }