@alma-harness/postgres 0.2.0 → 0.4.0

package/README.md

@@ -3,7 +3,7 @@
 Reference storage adapters for [Alma](https://github.com/FabioFernandesCarneiro/alma),
 with row-level security as defense in depth.
 
-> **Status: 0.2.0 on npm, pre-1.0.** The API is still moving; see the
+> **Status: 0.3.0 on npm, pre-1.0.** The API is still moving; see the
 > [roadmap](../../docs/architecture.md#12-adoption-roadmap) for where it stands.
 
 ## What it owns
@@ -23,6 +23,9 @@ with row-level security as defense in depth.
   `purgeTurnClaimsBefore` is the claims' time-based retention (spec:
   erasure-reaches-the-claims): it runs as the retention role, like the audit
   sweep, since the app role's delete is scoped and serves erasure only.
+  `purgeExpiredLeases` sweeps leases that expired before a cutoff — the
+  orphan a crashed holder leaves, since erasure keeps leases (spec:
+  close-review-part-two). Every swept column carries an index.
 - `PostgresAuditLog` — the five audit trails (spec 038), written synchronously
   and with no buffering wrapper: a buffered sink that loses its buffer on a
   crash stops writing silently, which is the failure `AuditSinkError` was typed
@@ -39,7 +42,8 @@ with row-level security as defense in depth.
   deployment not connected as a superuser — FORCE ROW LEVEL SECURITY subjects
   even the table owner to the predicate.
 - `migrateSessionStore`, `migrateMemoryStores`, `migrateSpendStore`,
-  `migrateTurnStore`, `migrateRoutineRunStore`, `migrateAuditLog` —
+  `migrateTurnStore`, `migrateRoutineRunStore`, `migrateRoutineStore`,
+  `migrateAuditLog` —
   idempotent migrations; running them is the product's choice, typically at
   startup.
 
@@ -48,6 +52,10 @@ with row-level security as defense in depth.
   the last delivery's hash for the dedupe, durable across processes. The app
   role gets no delete — a run record is retained like a trail — and
   `purgeRoutineRunsBefore` sweeps by age as the retention role.
+- `PostgresRoutineStore` — the routines themselves (spec: clock-tick), as
+  `jsonb` under the shared policy; `list` runs as `alma_scheduler`, the
+  role the tick assumes to read every scope, created by the migration.
+  Grant it to the login the tick connects as, like the other two roles.
 
 Every operation runs inside a transaction that assumes a dedicated
 non-superuser role and binds `alma.org` / `alma.uid` as transaction-local

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { SessionStore, Scope, Msg, LoadOpts, ToolTrafficExpiry, EpisodeStore, CopySurface, EpisodeInput, Episode, EpisodeQuery, EpisodeQueryResult, ErasureSelector, TombstoneResult, ErasureWatermarkStore, ProfileStore, ProfileReadOpts, Profile, FactObservation, ObserveResult, InvalidateResult, SpendStore, SpendKey, SpendTotals, AuditLog, AccessEvent, RoutingEvent, CostEvent, RecallEvent, ContextEvent, TurnStore, LeaseOpts, TurnLease, TurnKey, TurnClaim, CompletedTurn, RoutineRunStore, RoutineRun, RoutineRunOutcome } from '@alma-harness/core';
-export { AuditLog, EpisodeStore, ProfileStore, RoutineRunStore, SessionStore, SpendStore, TurnStore } from '@alma-harness/core';
+import { SessionStore, Scope, Msg, LoadOpts, ToolTrafficExpiry, EpisodeStore, CopySurface, EpisodeInput, Episode, EpisodeQuery, EpisodeQueryResult, ErasureSelector, TombstoneResult, ErasureWatermarkStore, ProfileStore, ProfileReadOpts, Profile, FactObservation, ObserveResult, InvalidateResult, SpendStore, SpendKey, SpendTotals, AuditLog, AccessEvent, RoutingEvent, CostEvent, RecallEvent, ContextEvent, TurnStore, LeaseOpts, TurnLease, TurnKey, TurnClaim, CompletedTurn, RoutineStore, Routine, StoredRoutine, RoutineRunStore, RoutineRun, RoutineRunOutcome } from '@alma-harness/core';
+export { AuditLog, EpisodeStore, ProfileStore, RoutineRunStore, RoutineStore, SessionStore, SpendStore, TurnStore, assertIso8601 } from '@alma-harness/core';
 import { Pool, PoolClient } from 'pg';
 
 /**
@@ -35,7 +35,9 @@ interface ScopedStoreOptions {
  * inside an aborted transaction; handing it back to the pool would give the
  * next borrower cascading errors, so it is destroyed instead of reused.
  */
-declare function inTransaction<T>(pool: Pool, role: string | null, fn: (client: PoolClient) => Promise<T>): Promise<T>;
+declare function inTransaction<T>(pool: Pool, role: string | null, fn: (client: PoolClient) => Promise<T>, 
+/** A per-transaction `statement_timeout`; the scoped path always sets one, the deployment reads may (spec: close-060-064-findings). */
+statementTimeoutMs?: number | null): Promise<T>;
 /**
  * A retention sweep in BATCHES — spec: close-review-part-two. One unbounded
  * `delete … where stamp < cutoff` on a backlog is one long transaction and a
@@ -50,6 +52,14 @@ declare function sweepBefore(pool: Pool, opts: {
     before: string;
     batch?: number;
 }): Promise<number>;
+/** The three sweeps' one preamble (spec: close-060-064-findings): the role, the cutoff, the batch. */
+declare function purgeBefore(pool: Pool, opts: {
+    table: string;
+    column: string;
+    before: string;
+    retentionRole?: string;
+    batch?: number;
+}): Promise<number>;
 
 type PostgresSessionStoreOptions = ScopedStoreOptions;
 /**
@@ -154,8 +164,6 @@ declare function rlsPolicySql(table: string, keys?: readonly ("org" | "uid")[]):
  * names, so a migration on a populated database drops and recreates its own.
  */
 declare function retentionPolicySql(table: string, retentionRole: string, name: string): string;
-/** Rejects an unparseable ISO 8601 timestamp with the value in the message, before it reaches SQL. */
-declare function assertIso8601(at: string, label?: string): string;
 /** Creates the RLS role if it does not exist, tolerating a concurrent race. */
 declare function roleBootstrapSql(role: string): string;
 /**
@@ -422,6 +430,45 @@ declare class PostgresTurnStore implements TurnStore {
     erase(scope: Scope, sessionId?: string): Promise<void>;
 }
 
+interface PostgresRoutineStoreOptions extends ScopedStoreOptions {
+    /** The role `list` assumes — the deployment actor. Default `alma_scheduler`. */
+    schedulerRole?: string;
+}
+/**
+ * Reference `RoutineStore` adapter — spec: clock-tick. Scoped writes and
+ * reads as the app role, like every store here; `list` as the scheduler
+ * role, the one cross-scope read, through the same transaction helper the
+ * sweeps use.
+ */
+declare class PostgresRoutineStore implements RoutineStore {
+    #private;
+    constructor(pool: Pool, opts?: PostgresRoutineStoreOptions);
+    register(routine: Routine & {
+        registeredAt?: string;
+    }): Promise<void>;
+    cancel(scope: Scope, routineId: string): Promise<void>;
+    get(scope: Scope, routineId: string): Promise<StoredRoutine | null>;
+    list(): Promise<StoredRoutine[]>;
+}
+
+/**
+ * Schema and migration for the routine store — spec: clock-tick. One
+ * scope-stamped table; the routine as `jsonb`, the registration stamp as a
+ * column. The app role reads and writes its own scope's rows; the tick
+ * lists EVERY scope, so it runs as a role of its own with a policy that
+ * admits all rows — the retention role's shape, for the same reason: FORCE
+ * ROW LEVEL SECURITY binds the owner too.
+ */
+declare const ROUTINES_TABLE = "alma_routines";
+/** Role the tick assumes to list every scope's routines — spec: clock-tick. */
+declare const DEFAULT_SCHEDULER_ROLE = "alma_scheduler";
+declare function routineStoreMigrationSql(role?: string, schedulerRole?: string): string;
+/** Idempotent; running it is the product's choice (typically at startup). */
+declare function migrateRoutineStore(pool: Pool, opts?: {
+    role?: string;
+    schedulerRole?: string;
+}): Promise<void>;
+
 type PostgresRoutineRunStoreOptions = ScopedStoreOptions;
 /**
  * Reference `RoutineRunStore` adapter — spec: postgres-routine-runs. Same RLS
@@ -519,6 +566,15 @@ declare function purgeTurnClaimsBefore(pool: Pool, before: string, opts?: {
     retentionRole?: string;
     batch?: number;
 }): Promise<number>;
+/**
+ * Deletes leases that expired before the cutoff — spec: close-060-064-findings.
+ * Erasure leaves leases alone (spec: close-review-part-two), and a holder that
+ * crashed never releases; this bounds the orphans, as the retention role.
+ */
+declare function purgeExpiredLeases(pool: Pool, before: string, opts?: {
+    retentionRole?: string;
+    batch?: number;
+}): Promise<number>;
 
 /**
  * Schema and migration for the spend store — spec: spend-store.
@@ -550,4 +606,4 @@ declare function migrateSpendStore(pool: Pool, opts?: {
     role?: string;
 }): Promise<void>;
 
-export { AUDIT_ACCESS_TABLE, AUDIT_CONTEXT_TABLE, AUDIT_COST_TABLE, AUDIT_RECALL_TABLE, AUDIT_ROUTING_TABLE, AUDIT_TABLES, type AuditTable, DEFAULT_RETENTION_ROLE, DEFAULT_RLS_ROLE, EPISODES_TABLE, FACTS_TABLE, PostgresAuditLog, type PostgresAuditLogOptions, PostgresEpisodeStore, PostgresErasureWatermarks, type PostgresMemoryStoreOptions, PostgresProfileStore, PostgresRoutineRunStore, type PostgresRoutineRunStoreOptions, PostgresSessionStore, type PostgresSessionStoreOptions, PostgresSpendStore, type PostgresSpendStoreOptions, PostgresTurnStore, type PostgresTurnStoreOptions, ROUTINE_RUNS_TABLE, SCOPE_STATE_TABLE, SPEND_SESSIONS_TABLE, SPEND_TENANT_DAYS_TABLE, type ScopedStoreOptions, TURN_CLAIMS_TABLE, TURN_LEASES_TABLE, assertIso8601, assertRoleIdentifier, auditLogMigrationSql, grantRole, grantRoleSql, inTransaction, memoryStoreMigrationSql, migrateAuditLog, migrateMemoryStores, migrateRoutineRunStore, migrateSessionStore, migrateSpendStore, migrateTurnStore, purgeAuditBefore, purgeRoutineRunsBefore, purgeTurnClaimsBefore, retentionPolicySql, rlsPolicySql, roleBootstrapSql, routineRunStoreMigrationSql, sessionStoreMigrationSql, spendStoreMigrationSql, sweepBefore, turnStoreMigrationSql };
+export { AUDIT_ACCESS_TABLE, AUDIT_CONTEXT_TABLE, AUDIT_COST_TABLE, AUDIT_RECALL_TABLE, AUDIT_ROUTING_TABLE, AUDIT_TABLES, type AuditTable, DEFAULT_RETENTION_ROLE, DEFAULT_RLS_ROLE, DEFAULT_SCHEDULER_ROLE, EPISODES_TABLE, FACTS_TABLE, PostgresAuditLog, type PostgresAuditLogOptions, PostgresEpisodeStore, PostgresErasureWatermarks, type PostgresMemoryStoreOptions, PostgresProfileStore, PostgresRoutineRunStore, type PostgresRoutineRunStoreOptions, PostgresRoutineStore, type PostgresRoutineStoreOptions, PostgresSessionStore, type PostgresSessionStoreOptions, PostgresSpendStore, type PostgresSpendStoreOptions, PostgresTurnStore, type PostgresTurnStoreOptions, ROUTINES_TABLE, ROUTINE_RUNS_TABLE, SCOPE_STATE_TABLE, SPEND_SESSIONS_TABLE, SPEND_TENANT_DAYS_TABLE, type ScopedStoreOptions, TURN_CLAIMS_TABLE, TURN_LEASES_TABLE, assertRoleIdentifier, auditLogMigrationSql, grantRole, grantRoleSql, inTransaction, memoryStoreMigrationSql, migrateAuditLog, migrateMemoryStores, migrateRoutineRunStore, migrateRoutineStore, migrateSessionStore, migrateSpendStore, migrateTurnStore, purgeAuditBefore, purgeBefore, purgeExpiredLeases, purgeRoutineRunsBefore, purgeTurnClaimsBefore, retentionPolicySql, rlsPolicySql, roleBootstrapSql, routineRunStoreMigrationSql, routineStoreMigrationSql, sessionStoreMigrationSql, spendStoreMigrationSql, sweepBefore, turnStoreMigrationSql };

package/dist/index.js

@@ -2,6 +2,7 @@
 import { assertWellFormed, scopePath as scopePath2 } from "@alma-harness/core";
 
 // src/schema.ts
+import { assertIso8601 } from "@alma-harness/core";
 var DEFAULT_RLS_ROLE = "alma_app";
 var DEFAULT_RETENTION_ROLE = "alma_retention";
 var IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
@@ -45,12 +46,6 @@ create policy ${name} on ${table}
   to ${retentionRole}
   using (true);`;
 }
-function assertIso8601(at, label = "timestamp") {
-  if (Number.isNaN(Date.parse(at))) {
-    throw new Error(`invalid ISO 8601 ${label}: ${JSON.stringify(at)}`);
-  }
-  return at;
-}
 function roleBootstrapSql(role) {
   assertRoleIdentifier(role);
   return `
@@ -129,12 +124,15 @@ function resolveStatementTimeout(opts) {
   }
   return ms;
 }
-async function inTransaction(pool, role, fn) {
+async function inTransaction(pool, role, fn, statementTimeoutMs) {
   const client = await pool.connect();
   let rollbackFailed;
   try {
     await client.query("begin");
     if (role !== null) await client.query(`set local role ${role}`);
+    if (statementTimeoutMs !== void 0) {
+      await client.query(`select set_config('statement_timeout', $1, true)`, [statementTimeoutMs === null ? "0" : String(statementTimeoutMs)]);
+    }
     const result = await fn(client);
     await client.query("commit");
     return result;
@@ -157,7 +155,7 @@ async function sweepBefore(pool, opts) {
     const removed = await inTransaction(pool, opts.role, async (client) => {
       const { rowCount } = await client.query(
         `delete from ${opts.table}
-         where ctid = any(array(select ctid from ${opts.table} where ${opts.column} < $1::timestamptz limit $2))`,
+         where ctid = any(array(select ctid from ${opts.table} where ${opts.column} < $1::timestamptz order by ${opts.column} limit $2))`,
         [opts.before, batch]
       );
       return rowCount ?? 0;
@@ -166,6 +164,12 @@ async function sweepBefore(pool, opts) {
     if (removed < batch) return total;
   }
 }
+async function purgeBefore(pool, opts) {
+  const role = opts.retentionRole ?? DEFAULT_RETENTION_ROLE;
+  assertRoleIdentifier(role);
+  assertIso8601(opts.before);
+  return sweepBefore(pool, { role, table: opts.table, column: opts.column, before: opts.before, ...opts.batch !== void 0 ? { batch: opts.batch } : {} });
+}
 async function inScope(pool, role, scope, fn, statementTimeoutMs = DEFAULT_STATEMENT_TIMEOUT_MS) {
   scopePath(scope);
   return inTransaction(pool, role, async (client) => {
@@ -1160,6 +1164,9 @@ create index if not exists alma_audit_access_turn
 create index if not exists alma_audit_access_recent
   on ${AUDIT_ACCESS_TABLE} (org, uid, at desc);
 
+create index if not exists alma_audit_access_at
+  on ${AUDIT_ACCESS_TABLE} (at);
+
 create table if not exists ${AUDIT_ROUTING_TABLE} (
   id             uuid        not null default gen_random_uuid(),
   org            text        not null,
@@ -1179,6 +1186,9 @@ create table if not exists ${AUDIT_ROUTING_TABLE} (
 create index if not exists alma_audit_routing_turn
   on ${AUDIT_ROUTING_TABLE} (org, uid, turn_id);
 
+create index if not exists alma_audit_routing_at
+  on ${AUDIT_ROUTING_TABLE} (at);
+
 create table if not exists ${AUDIT_COST_TABLE} (
   id                        uuid             not null default gen_random_uuid(),
   org                       text             not null,
@@ -1206,6 +1216,9 @@ create index if not exists alma_audit_cost_turn
 create index if not exists alma_audit_cost_recent
   on ${AUDIT_COST_TABLE} (org, uid, at desc);
 
+create index if not exists alma_audit_cost_at
+  on ${AUDIT_COST_TABLE} (at);
+
 create table if not exists ${AUDIT_RECALL_TABLE} (
   id               uuid        not null default gen_random_uuid(),
   org              text        not null,
@@ -1228,6 +1241,9 @@ create table if not exists ${AUDIT_RECALL_TABLE} (
 create index if not exists alma_audit_recall_turn
   on ${AUDIT_RECALL_TABLE} (org, uid, turn_id);
 
+create index if not exists alma_audit_recall_at
+  on ${AUDIT_RECALL_TABLE} (at);
+
 create table if not exists ${AUDIT_CONTEXT_TABLE} (
   id                    uuid        not null default gen_random_uuid(),
   org                   text        not null,
@@ -1257,6 +1273,9 @@ create table if not exists ${AUDIT_CONTEXT_TABLE} (
 
 create index if not exists alma_audit_context_turn
   on ${AUDIT_CONTEXT_TABLE} (org, uid, turn_id);
+
+create index if not exists alma_audit_context_at
+  on ${AUDIT_CONTEXT_TABLE} (at);
 ${AUDIT_TABLES.map((t) => rlsPolicySql(t)).join("")}
 ${roleBootstrapSql(role)}
 ${roleBootstrapSql(retentionRole)}
@@ -1291,8 +1310,6 @@ async function migrateAuditLog(pool, opts = {}) {
   await pool.query(auditLogMigrationSql(opts.role, opts.retentionRole));
 }
 async function purgeAuditBefore(pool, windows, opts = {}) {
-  const retentionRole = opts.retentionRole ?? DEFAULT_RETENTION_ROLE;
-  assertRoleIdentifier(retentionRole);
   for (const table of AUDIT_TABLES) {
     const before = windows[table];
     if (before !== void 0) assertIso8601(before, `timestamp for ${table}`);
@@ -1301,7 +1318,7 @@ async function purgeAuditBefore(pool, windows, opts = {}) {
   for (const table of AUDIT_TABLES) {
     const before = windows[table];
     if (before === void 0) continue;
-    purged[table] = await sweepBefore(pool, { role: retentionRole, table, column: "at", before, ...opts.batch !== void 0 ? { batch: opts.batch } : {} });
+    purged[table] = await purgeBefore(pool, { table, column: "at", before, ...opts });
   }
   return purged;
 }
@@ -1502,9 +1519,10 @@ grant select, insert, update, delete
   on ${TURN_LEASES_TABLE}, ${TURN_CLAIMS_TABLE}
   to ${role};
 ${retentionPolicySql(TURN_CLAIMS_TABLE, retentionRole, "alma_turn_claims_retention")}
+${retentionPolicySql(TURN_LEASES_TABLE, retentionRole, "alma_turn_leases_retention")}
 
 grant select, delete
-  on ${TURN_CLAIMS_TABLE}
+  on ${TURN_CLAIMS_TABLE}, ${TURN_LEASES_TABLE}
   to ${retentionRole};
 `;
 }
@@ -1512,10 +1530,10 @@ async function migrateTurnStore(pool, opts = {}) {
   await pool.query(turnStoreMigrationSql(opts.role, opts.retentionRole));
 }
 async function purgeTurnClaimsBefore(pool, before, opts = {}) {
-  const role = opts.retentionRole ?? DEFAULT_RETENTION_ROLE;
-  assertRoleIdentifier(role);
-  assertIso8601(before);
-  return sweepBefore(pool, { role, table: TURN_CLAIMS_TABLE, column: "created_at", before, ...opts.batch !== void 0 ? { batch: opts.batch } : {} });
+  return purgeBefore(pool, { table: TURN_CLAIMS_TABLE, column: "created_at", before, ...opts });
+}
+async function purgeExpiredLeases(pool, before, opts = {}) {
+  return purgeBefore(pool, { table: TURN_LEASES_TABLE, column: "expires_at", before, ...opts });
 }
 
 // src/turn-store.ts
@@ -1660,6 +1678,103 @@ function assertLeaseOpts(opts) {
   }
 }
 
+// src/routine-store-schema.ts
+var ROUTINES_TABLE = "alma_routines";
+var DEFAULT_SCHEDULER_ROLE = "alma_scheduler";
+function routineStoreMigrationSql(role = DEFAULT_RLS_ROLE, schedulerRole = DEFAULT_SCHEDULER_ROLE) {
+  assertRoleIdentifier(role);
+  assertRoleIdentifier(schedulerRole);
+  return `
+create table if not exists ${ROUTINES_TABLE} (
+  org           text        not null,
+  uid           text        not null,
+  routine_id    text        not null,
+  routine       jsonb       not null,
+  registered_at timestamptz not null default now(),
+  primary key (org, uid, routine_id)
+);
+${rlsPolicySql(ROUTINES_TABLE)}
+${roleBootstrapSql(role)}
+${roleBootstrapSql(schedulerRole)}
+grant select, insert, update, delete
+  on ${ROUTINES_TABLE}
+  to ${role};
+
+drop policy if exists alma_routines_schedule on ${ROUTINES_TABLE};
+create policy alma_routines_schedule on ${ROUTINES_TABLE}
+  for select
+  to ${schedulerRole}
+  using (true);
+
+grant select
+  on ${ROUTINES_TABLE}
+  to ${schedulerRole};
+`;
+}
+async function migrateRoutineStore(pool, opts = {}) {
+  await pool.query(routineStoreMigrationSql(opts.role, opts.schedulerRole));
+}
+
+// src/routine-store.ts
+var PostgresRoutineStore = class {
+  #pool;
+  #role;
+  #schedulerRole;
+  #timeoutMs;
+  constructor(pool, opts = {}) {
+    this.#pool = pool;
+    this.#role = resolveRlsRole(opts);
+    this.#schedulerRole = opts.schedulerRole ?? DEFAULT_SCHEDULER_ROLE;
+    assertRoleIdentifier(this.#schedulerRole);
+    this.#timeoutMs = resolveStatementTimeout(opts);
+  }
+  async register(routine) {
+    const { registeredAt, ...plain } = routine;
+    if (registeredAt !== void 0) assertIso8601(registeredAt, "registeredAt");
+    await this.#inScope(routine.scope, async (client) => {
+      await client.query(
+        `insert into ${ROUTINES_TABLE} (org, uid, routine_id, routine, registered_at)
+         values ($1, $2, $3, $4::jsonb, coalesce($5::timestamptz, now()))
+         on conflict (org, uid, routine_id) do update set routine = excluded.routine`,
+        [routine.scope.org, routine.scope.uid, routine.id, JSON.stringify(plain), registeredAt ?? null]
+      );
+    });
+  }
+  async cancel(scope, routineId) {
+    await this.#inScope(scope, async (client) => {
+      await client.query(
+        `delete from ${ROUTINES_TABLE} where org = $1 and uid = $2 and routine_id = $3`,
+        [scope.org, scope.uid, routineId]
+      );
+    });
+  }
+  async get(scope, routineId) {
+    return this.#inScope(scope, async (client) => {
+      const { rows } = await client.query(
+        `select routine, registered_at from ${ROUTINES_TABLE}
+         where org = $1 and uid = $2 and routine_id = $3`,
+        [scope.org, scope.uid, routineId]
+      );
+      return rows[0] === void 0 ? null : toStored(rows[0]);
+    });
+  }
+  async list() {
+    return inTransaction(this.#pool, this.#schedulerRole, async (client) => {
+      const { rows } = await client.query(
+        `select routine, registered_at from ${ROUTINES_TABLE} order by org, uid, routine_id`
+      );
+      return rows.map(toStored);
+    }, this.#timeoutMs);
+  }
+  /** Shared RLS binding — see `scoped.ts`. */
+  async #inScope(scope, fn) {
+    return inScope(this.#pool, this.#role, scope, fn, this.#timeoutMs);
+  }
+};
+function toStored(row) {
+  return { ...row.routine, registeredAt: row.registered_at.toISOString() };
+}
+
 // src/routine-run-store.ts
 import { scopePath as scopePath5 } from "@alma-harness/core";
 
@@ -1690,6 +1805,9 @@ create table if not exists ${ROUTINE_RUNS_TABLE} (
 
 create index if not exists alma_routine_runs_recent
   on ${ROUTINE_RUNS_TABLE} (org, uid, routine_id, started_at desc);
+
+create index if not exists alma_routine_runs_started
+  on ${ROUTINE_RUNS_TABLE} (started_at);
 ${rlsPolicySql(ROUTINE_RUNS_TABLE)}
 ${roleBootstrapSql(role)}
 ${roleBootstrapSql(retentionRole)}
@@ -1707,10 +1825,7 @@ async function migrateRoutineRunStore(pool, opts = {}) {
   await pool.query(routineRunStoreMigrationSql(opts.role, opts.retentionRole));
 }
 async function purgeRoutineRunsBefore(pool, before, opts = {}) {
-  const role = opts.retentionRole ?? DEFAULT_RETENTION_ROLE;
-  assertRoleIdentifier(role);
-  assertIso8601(before);
-  return sweepBefore(pool, { role, table: ROUTINE_RUNS_TABLE, column: "started_at", before, ...opts.batch !== void 0 ? { batch: opts.batch } : {} });
+  return purgeBefore(pool, { table: ROUTINE_RUNS_TABLE, column: "started_at", before, ...opts });
 }
 
 // src/routine-run-store.ts
@@ -1827,6 +1942,7 @@ export {
   AUDIT_TABLES,
   DEFAULT_RETENTION_ROLE,
   DEFAULT_RLS_ROLE,
+  DEFAULT_SCHEDULER_ROLE,
   EPISODES_TABLE,
   FACTS_TABLE,
   PostgresAuditLog,
@@ -1834,9 +1950,11 @@ export {
   PostgresErasureWatermarks,
   PostgresProfileStore,
   PostgresRoutineRunStore,
+  PostgresRoutineStore,
   PostgresSessionStore,
   PostgresSpendStore,
   PostgresTurnStore,
+  ROUTINES_TABLE,
   ROUTINE_RUNS_TABLE,
   SCOPE_STATE_TABLE,
   SPEND_SESSIONS_TABLE,
@@ -1853,16 +1971,20 @@ export {
   migrateAuditLog,
   migrateMemoryStores,
   migrateRoutineRunStore,
+  migrateRoutineStore,
   migrateSessionStore,
   migrateSpendStore,
   migrateTurnStore,
   purgeAuditBefore,
+  purgeBefore,
+  purgeExpiredLeases,
   purgeRoutineRunsBefore,
   purgeTurnClaimsBefore,
   retentionPolicySql,
   rlsPolicySql,
   roleBootstrapSql,
   routineRunStoreMigrationSql,
+  routineStoreMigrationSql,
   sessionStoreMigrationSql,
   spendStoreMigrationSql,
   sweepBefore,