@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/sandbox/types.d.ts

@@ -4,7 +4,8 @@
  */
 import type { SandboxNetworkPreset } from "@nylorun/core/define";
 export type SandboxBackendName = "virtual";
-export type SandboxIsolation = "process";
+/** What separates a sandbox from its host: the Runtime process, or a container boundary. */
+export type SandboxIsolation = "process" | "container";
 export interface SandboxProbe {
     readonly name: SandboxBackendName;
     readonly available: boolean;
@@ -24,7 +25,8 @@ export interface ResolvedNetwork {
 export interface SandboxSpec {
     /** Stable backend name for this sandbox; unique per Runtime scope and session. */
     readonly key: string;
-    readonly image: string;
+    /** OCI image reference; undefined means the backend's default. */
+    readonly image?: string;
     readonly cpus: number;
     readonly memoryMiB: number;
     readonly network: ResolvedNetwork;
@@ -43,6 +45,10 @@ export interface ExecResult {
     readonly timedOut: boolean;
 }
 export interface SandboxHandle {
+    /** The directory tools run in and resolve relative paths against. Default: `/workspace`. */
+    readonly workspace?: string;
+    /** The backend had to create the sandbox afresh, so files from an earlier run are gone. */
+    readonly created?: boolean;
     exec(request: ExecRequest, signal: AbortSignal): Promise<ExecResult>;
     /** Returns undefined when the file does not exist. */
     readFile(path: string): Promise<string | undefined>;

package/dist/store/postgres/connect.d.ts

@@ -9,17 +9,33 @@ export interface PostgresClientOptions {
     connectTimeoutSeconds?: number;
     /** `application_name` on every connection. Default `nylorun-runtime`. */
     applicationName?: string;
+    /**
+     * `statement_timeout`: a statement running or waiting for a lock longer fails. Default
+     * 60 s; 0 turns it off. Migrations lift it (`lockMigrations` in `migrate.ts`).
+     */
+    statementTimeoutMs?: number;
+    /**
+     * `idle_in_transaction_session_timeout`: a transaction left idle this long is ended and its
+     * connection closed, releasing its locks. Default 60 s; 0 turns it off.
+     */
+    idleInTransactionTimeoutMs?: number;
 }
 /**
- * Opens a connection pool for Session Stores and the Tenant catalog. One pool
- * serves every Tenant schema of a Host; stores never end it, so the caller
- * calls `client.end()` at shutdown. This module and its siblings are the only
- * code that imports the Postgres driver (seam rule 3).
+ * Opens a connection pool on the Tenant's database, for its Session Store and the Tenant
+ * bootstrap (`tenant.ts`). Stores never end it, so the caller calls `client.end()` at
+ * shutdown. This module and its siblings are the only code that imports the Postgres driver
+ * and Drizzle (seam rule 3, `scripts/check-boundaries.mjs`); Drizzle runs on this pool
+ * (`db.ts`).
  *
- * Statements are not prepared (`prepare: false`). Every statement names its
- * Tenant's schema, so the same query is a different statement per Tenant, and
- * named prepared statements would pile up on every pooled connection with the
- * number of Tenants a Host serves. Unnamed statements still go in one round
- * trip; the queries are simple enough that re-planning them costs little.
+ * Statements are prepared: one database holds one Tenant in fixed schemas, so every statement
+ * is the same for the whole pool (session-store.md §2).
+ *
+ * The pool serves every request of the Host, so a statement or transaction that hangs must
+ * not hold a connection forever: both are bounded by default.
  */
 export declare function createPostgresClient(url: string, options?: PostgresClientOptions): PostgresClient;
+/**
+ * Throws, naming the setting, when Postgres cannot run the stream relay: logical decoding
+ * needs `wal_level = logical` (a restart) and a role allowed to replicate.
+ */
+export declare function assertLogicalReplication(sql: Sql): Promise<void>;

package/dist/store/postgres/connect.js

@@ -1,25 +1,42 @@
 import postgres, {} from "postgres";
 /**
- * Opens a connection pool for Session Stores and the Tenant catalog. One pool
- * serves every Tenant schema of a Host; stores never end it, so the caller
- * calls `client.end()` at shutdown. This module and its siblings are the only
- * code that imports the Postgres driver (seam rule 3).
+ * Opens a connection pool on the Tenant's database, for its Session Store and the Tenant
+ * bootstrap (`tenant.ts`). Stores never end it, so the caller calls `client.end()` at
+ * shutdown. This module and its siblings are the only code that imports the Postgres driver
+ * and Drizzle (seam rule 3, `scripts/check-boundaries.mjs`); Drizzle runs on this pool
+ * (`db.ts`).
  *
- * Statements are not prepared (`prepare: false`). Every statement names its
- * Tenant's schema, so the same query is a different statement per Tenant, and
- * named prepared statements would pile up on every pooled connection with the
- * number of Tenants a Host serves. Unnamed statements still go in one round
- * trip; the queries are simple enough that re-planning them costs little.
+ * Statements are prepared: one database holds one Tenant in fixed schemas, so every statement
+ * is the same for the whole pool (session-store.md §2).
+ *
+ * The pool serves every request of the Host, so a statement or transaction that hangs must
+ * not hold a connection forever: both are bounded by default.
  */
 export function createPostgresClient(url, options = {}) {
     return postgres(url, {
         max: options.max ?? 10,
         idle_timeout: options.idleTimeoutSeconds ?? 30,
         connect_timeout: options.connectTimeoutSeconds ?? 10,
-        prepare: false,
         onnotice: () => { },
         connection: {
             application_name: options.applicationName ?? "nylorun-runtime",
+            statement_timeout: options.statementTimeoutMs ?? 60_000,
+            idle_in_transaction_session_timeout: options.idleInTransactionTimeoutMs ?? 60_000,
         },
     });
 }
+/**
+ * Throws, naming the setting, when Postgres cannot run the stream relay: logical decoding
+ * needs `wal_level = logical` (a restart) and a role allowed to replicate.
+ */
+export async function assertLogicalReplication(sql) {
+    const [row] = await sql `
+    SELECT current_setting('wal_level') AS wal_level,
+           (SELECT rolreplication OR rolsuper FROM pg_roles WHERE rolname = current_user) AS replicates`;
+    if (row?.wal_level !== "logical")
+        throw new Error(`Postgres has wal_level = ${row?.wal_level ?? "unknown"}; the stream relay needs logical replication. ` +
+            "Set wal_level = logical and restart Postgres (`nylorun start` does this for the local stack; " +
+            "on a managed Postgres, turn on its logical replication option). See DEPLOYMENT.md.");
+    if (!row.replicates)
+        throw new Error("The Runtime's Postgres role cannot replicate: grant it REPLICATION (ALTER ROLE … REPLICATION). See DEPLOYMENT.md.");
+}

package/dist/store/postgres/db.d.ts

@@ -0,0 +1,16 @@
+import { type PostgresJsDatabase, type PostgresJsQueryResultHKT } from "drizzle-orm/postgres-js";
+import type { PgDatabase } from "drizzle-orm/pg-core";
+import type { Sql } from "postgres";
+export type Database = PostgresJsDatabase<Record<string, never>>;
+/** A database or one of its transactions: anything a query can run on. */
+export type Queryable = PgDatabase<PostgresJsQueryResultHKT, Record<string, never>>;
+/** A transaction of `Database` (`db.transaction`). */
+export type Transaction = Parameters<Parameters<Database["transaction"]>[0]>[0];
+/** The Drizzle database on `sql`. */
+export declare function database(sql: Sql): Database;
+/**
+ * The driver's error behind a Drizzle query error. Drizzle wraps every failed query in a
+ * `DrizzleQueryError` whose message holds the query and its parameters (secrets among them);
+ * the store surfaces the postgres.js error with its SQLSTATE `code`, as callers expect.
+ */
+export declare function driverError(error: unknown): unknown;

package/dist/store/postgres/db.js

@@ -0,0 +1,28 @@
+/**
+ * Drizzle on the Tenant database's pool (session-store.md §3): `drizzle-orm/postgres-js` over
+ * the postgres.js pool `connect.ts` opens, with the snake_case column names `schema.ts`
+ * defines. One Drizzle instance per pool.
+ *
+ * Drizzle hands timestamps to its own column types: on the pool it is given, postgres.js stops
+ * parsing date and time values, so a raw query on that pool reads a `timestamptz` as text.
+ */
+import { DrizzleQueryError } from "drizzle-orm";
+import { drizzle, } from "drizzle-orm/postgres-js";
+const databases = new WeakMap();
+/** The Drizzle database on `sql`. */
+export function database(sql) {
+    let db = databases.get(sql);
+    if (!db) {
+        db = drizzle({ client: sql, casing: "snake_case" });
+        databases.set(sql, db);
+    }
+    return db;
+}
+/**
+ * The driver's error behind a Drizzle query error. Drizzle wraps every failed query in a
+ * `DrizzleQueryError` whose message holds the query and its parameters (secrets among them);
+ * the store surfaces the postgres.js error with its SQLSTATE `code`, as callers expect.
+ */
+export function driverError(error) {
+    return error instanceof DrizzleQueryError && error.cause !== undefined ? error.cause : error;
+}

package/dist/store/postgres/drizzle/0000_foundation.sql

@@ -0,0 +1,22 @@
+-- Custom SQL (drizzle-kit does not model it): the two schemas and `nylorun.doc(body)`, which
+-- the generated columns of the baseline (0001) read. Its snapshot declares the schemas, so
+-- the baseline does not create them again.
+--
+-- doc(body) casts a `json` body to `jsonb` for the generated columns. `jsonb` rejects the
+-- escapes \u0000 and unpaired surrogates, which `json` keeps verbatim: they are replaced with
+-- \ufffd first (the stored body is untouched). A body with no \u escape takes the plain cast.
+CREATE SCHEMA IF NOT EXISTS nylorun;
+--> statement-breakpoint
+CREATE SCHEMA nylorun_streams;
+--> statement-breakpoint
+CREATE FUNCTION nylorun.doc(body json) RETURNS jsonb
+LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS $$
+      SELECT CASE WHEN strpos(body::text, '\u') = 0 THEN body::jsonb
+        ELSE regexp_replace(
+          body::text,
+          '(?<!\\)((?:\\\\)*)\\u(0000|[dD][89a-fA-F][0-9a-fA-F]{2})',
+          '\1\\ufffd',
+          'g'
+        )::jsonb
+      END
+    $$;

package/dist/store/postgres/drizzle/0001_baseline.sql

@@ -0,0 +1,255 @@
+CREATE TABLE "nylorun"."actions" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"body" json NOT NULL,
+	"session_id" text GENERATED ALWAYS AS (nylorun.doc(body)->>'sessionId') STORED,
+	"turn_id" text GENERATED ALWAYS AS (nylorun.doc(body)->>'turnId') STORED,
+	"agent_id" text GENERATED ALWAYS AS (nylorun.doc(body)->>'agentId') STORED,
+	"status" text GENERATED ALWAYS AS (nylorun.doc(body)->>'status') STORED,
+	"kind" text GENERATED ALWAYS AS (nylorun.doc(body)->>'kind') STORED,
+	"deadline_at" text GENERATED ALWAYS AS (nylorun.doc(body)->>'deadlineAt') STORED
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."commands" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"body" json NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."definitions" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"body" json NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."effects" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"body" json NOT NULL,
+	"session_id" text GENERATED ALWAYS AS (nylorun.doc(body)->'request'->>'sessionId') STORED,
+	"turn_id" text GENERATED ALWAYS AS (nylorun.doc(body)->'request'->>'turnId') STORED,
+	"kind" text GENERATED ALWAYS AS (nylorun.doc(body)->'request'->>'kind') STORED,
+	"status" text GENERATED ALWAYS AS (nylorun.doc(body)->>'status') STORED
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."endpoints" (
+	"agent_id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"url" text NOT NULL,
+	"implementation_version" text NOT NULL,
+	"manifest_hash" text,
+	"timeout_ms" integer NOT NULL,
+	"max_concurrent" integer NOT NULL,
+	"principal_id" text,
+	"last_delivery_at" text,
+	"last_success_at" text,
+	"last_error_code" text,
+	"last_error_message" text,
+	"consecutive_failures" integer DEFAULT 0 NOT NULL,
+	"served_implementation_version" text,
+	"served_manifest_hash" text,
+	"created_at" text NOT NULL,
+	"updated_at" text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."links" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"body" json NOT NULL,
+	"workflow_session_id" text GENERATED ALWAYS AS (nylorun.doc(body)->>'workflowSessionId') STORED
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."model_budgets" (
+	"scope" text NOT NULL,
+	"scope_id" text COLLATE "C" NOT NULL,
+	"period" text,
+	"limit_usd" double precision,
+	"limit_tokens" bigint,
+	"updated_at" text NOT NULL,
+	CONSTRAINT "model_budgets_pkey" PRIMARY KEY("scope","scope_id")
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."model_usage" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"effect_key" text COLLATE "C" NOT NULL,
+	"session_id" text COLLATE "C" NOT NULL,
+	"turn_id" text COLLATE "C" NOT NULL,
+	"agent_id" text COLLATE "C" NOT NULL,
+	"provider" text,
+	"model" text,
+	"input_tokens" integer NOT NULL,
+	"output_tokens" integer NOT NULL,
+	"total_tokens" integer NOT NULL,
+	"cached_tokens" integer NOT NULL,
+	"cache_write_tokens" integer NOT NULL,
+	"reasoning_tokens" integer NOT NULL,
+	"cost_usd" double precision NOT NULL,
+	"duplicate" boolean NOT NULL,
+	"created_at" text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."principals" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"role" text NOT NULL,
+	"token_hash" text NOT NULL,
+	"idempotency_key" text,
+	"created_at" text NOT NULL,
+	CONSTRAINT "principals_token_hash_key" UNIQUE("token_hash")
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."publishable_keys" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"key" text COLLATE "C" NOT NULL,
+	"name" text NOT NULL,
+	"origins_json" text NOT NULL,
+	"created_at" text NOT NULL,
+	"revoked_at" text,
+	CONSTRAINT "publishable_keys_key_key" UNIQUE("key"),
+	CONSTRAINT "publishable_keys_name_key" UNIQUE("name")
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun_streams"."relay_slots" (
+	"slot_name" text PRIMARY KEY NOT NULL,
+	"reconcile_pending" boolean NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."sandboxes" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"body" json NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun_streams"."session_events" (
+	"session_id" text COLLATE "C" NOT NULL,
+	"seq" bigint NOT NULL,
+	"generation" integer NOT NULL,
+	"type" text NOT NULL,
+	"body" json NOT NULL,
+	"committed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "session_events_pkey" PRIMARY KEY("session_id","seq")
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun_streams"."session_log_heads" (
+	"session_id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"generation" integer NOT NULL,
+	"head" bigint DEFAULT 0 NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."sessions" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"body" json NOT NULL,
+	"status" text GENERATED ALWAYS AS (nylorun.doc(body)->>'status') STORED,
+	"agent_id" text GENERATED ALWAYS AS (nylorun.doc(body)->>'agentId') STORED,
+	"owner" text,
+	"epoch" bigint DEFAULT 0 NOT NULL,
+	"owner_expires_at" timestamp with time zone,
+	"owner_user_id" text GENERATED ALWAYS AS (nylorun.doc(body)->>'ownerUserId') STORED
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."signing_keys" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"state" text NOT NULL,
+	"alg" text NOT NULL,
+	"public_jwk" text NOT NULL,
+	"kek_id" text NOT NULL,
+	"nonce" "bytea" NOT NULL,
+	"ciphertext" "bytea" NOT NULL,
+	"wrapped_dek" "bytea" NOT NULL,
+	"created_at" text NOT NULL,
+	"activated_at" text,
+	"retired_at" text,
+	"revoked_at" text,
+	CONSTRAINT "signing_keys_state_check" CHECK (state IN ('standby', 'current', 'previous', 'revoked')),
+	CONSTRAINT "signing_keys_alg_check" CHECK (alg = 'ES256')
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."subject_epochs" (
+	"subject" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"epoch" bigint NOT NULL,
+	"revoked_at" text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."subject_usage" (
+	"subject" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"turn_tokens" double precision NOT NULL,
+	"refilled_at" text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."tenant" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"name" text NOT NULL,
+	"created_at" text NOT NULL,
+	"updated_at" text NOT NULL,
+	"schema_version" integer NOT NULL,
+	"singleton" boolean DEFAULT true NOT NULL,
+	"basin_generation" integer DEFAULT 0 NOT NULL,
+	"retired_generations" integer[] DEFAULT '{}' NOT NULL,
+	CONSTRAINT "tenant_singleton_key" UNIQUE("singleton"),
+	CONSTRAINT "tenant_singleton_check" CHECK (singleton)
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."tenant_settings" (
+	"key" text PRIMARY KEY NOT NULL,
+	"value" text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."vault_audit" (
+	"ord" bigint PRIMARY KEY GENERATED ALWAYS AS IDENTITY (sequence name "nylorun"."vault_audit_ord_seq" INCREMENT BY 1 MINVALUE 1 MAXVALUE 9223372036854775807 START WITH 1 CACHE 1),
+	"id" text NOT NULL,
+	"at" text NOT NULL,
+	"actor" text NOT NULL,
+	"action" text NOT NULL,
+	"vault_id" text,
+	"credential_id" text,
+	"session_id" text,
+	"target" text,
+	"outcome" text NOT NULL,
+	CONSTRAINT "vault_audit_id_key" UNIQUE("id")
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."vault_credentials" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"vault_id" text NOT NULL,
+	"name" text NOT NULL,
+	"type" text NOT NULL,
+	"binding_json" text NOT NULL,
+	"expires_at" text,
+	"created_at" text COLLATE "C" NOT NULL,
+	"rotated_at" text,
+	"kek_id" text NOT NULL,
+	"nonce" "bytea" NOT NULL,
+	"ciphertext" "bytea" NOT NULL,
+	"wrapped_dek" "bytea" NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."vault_idempotency" (
+	"id" text PRIMARY KEY NOT NULL,
+	"body_hash" text NOT NULL,
+	"response" text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."vaults" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"name" text NOT NULL,
+	"owner_user_id" text NOT NULL,
+	"metadata_json" text,
+	"created_at" text COLLATE "C" NOT NULL,
+	"scope" text DEFAULT 'user' NOT NULL,
+	CONSTRAINT "vaults_scope_check" CHECK (scope IN ('user', 'host'))
+);
+--> statement-breakpoint
+ALTER TABLE "nylorun"."vault_credentials" ADD CONSTRAINT "vault_credentials_vault_id_fkey" FOREIGN KEY ("vault_id") REFERENCES "nylorun"."vaults"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "actions_session" ON "nylorun"."actions" USING btree ("session_id","turn_id","status");--> statement-breakpoint
+CREATE INDEX "actions_agent" ON "nylorun"."actions" USING btree ("agent_id","status");--> statement-breakpoint
+CREATE INDEX "actions_status" ON "nylorun"."actions" USING btree ("status","kind");--> statement-breakpoint
+CREATE INDEX "actions_deadline" ON "nylorun"."actions" USING btree ("status","deadline_at");--> statement-breakpoint
+CREATE INDEX "effects_session" ON "nylorun"."effects" USING btree ("session_id","turn_id","status");--> statement-breakpoint
+CREATE INDEX "effects_status" ON "nylorun"."effects" USING btree ("status","kind");--> statement-breakpoint
+CREATE INDEX "links_workflow" ON "nylorun"."links" USING btree ("workflow_session_id");--> statement-breakpoint
+CREATE INDEX "model_usage_effect" ON "nylorun"."model_usage" USING btree ("effect_key");--> statement-breakpoint
+CREATE INDEX "model_usage_agent" ON "nylorun"."model_usage" USING btree ("agent_id","created_at");--> statement-breakpoint
+CREATE INDEX "model_usage_turn" ON "nylorun"."model_usage" USING btree ("turn_id");--> statement-breakpoint
+CREATE INDEX "model_usage_created" ON "nylorun"."model_usage" USING btree ("created_at");--> statement-breakpoint
+CREATE INDEX "sessions_status" ON "nylorun"."sessions" USING btree ("status","owner_expires_at");--> statement-breakpoint
+CREATE INDEX "sessions_agent" ON "nylorun"."sessions" USING btree ("agent_id");--> statement-breakpoint
+CREATE INDEX "sessions_owner_user" ON "nylorun"."sessions" USING btree ("owner_user_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "signing_keys_one_standby" ON "nylorun"."signing_keys" USING btree ("state") WHERE state = 'standby';--> statement-breakpoint
+CREATE UNIQUE INDEX "signing_keys_one_current" ON "nylorun"."signing_keys" USING btree ("state") WHERE state = 'current';--> statement-breakpoint
+CREATE UNIQUE INDEX "signing_keys_one_previous" ON "nylorun"."signing_keys" USING btree ("state") WHERE state = 'previous';--> statement-breakpoint
+CREATE INDEX "vault_audit_vault" ON "nylorun"."vault_audit" USING btree ("vault_id","ord");--> statement-breakpoint
+CREATE INDEX "vault_credentials_vault" ON "nylorun"."vault_credentials" USING btree ("vault_id","created_at","id");--> statement-breakpoint
+CREATE INDEX "vaults_owner" ON "nylorun"."vaults" USING btree ("owner_user_id","created_at","id");--> statement-breakpoint
+CREATE UNIQUE INDEX "vaults_one_host" ON "nylorun"."vaults" USING btree ("scope") WHERE scope = 'host';

package/dist/store/postgres/drizzle/0002_stream_relay.sql

@@ -0,0 +1,4 @@
+-- Custom SQL (drizzle-kit does not model publications): the publication the stream relay
+-- subscribes to (Durable Streams §7). Only inserts: the record is append-only.
+CREATE PUBLICATION nylorun_stream_relay
+  FOR TABLE nylorun_streams.session_events WITH (publish = 'insert');

package/dist/store/postgres/drizzle/0003_tool_crossings.sql

@@ -0,0 +1,9 @@
+CREATE TABLE "nylorun"."tool_crossings" (
+	"key" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"hash" text NOT NULL,
+	"started_at" text COLLATE "C" NOT NULL,
+	"settled_at" text COLLATE "C",
+	"answer" json
+);
+--> statement-breakpoint
+CREATE INDEX "tool_crossings_settled" ON "nylorun"."tool_crossings" USING btree ("settled_at");

package/dist/store/postgres/drizzle/meta/_journal.json

@@ -0,0 +1,34 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1790943952307,
+      "tag": "0000_foundation",
+      "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1790943980707,
+      "tag": "0001_baseline",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1790943989041,
+      "tag": "0002_stream_relay",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1790956444115,
+      "tag": "0003_tool_crossings",
+      "breakpoints": true
+    }
+  ]
+}

package/dist/store/postgres/migrate.d.ts

@@ -0,0 +1,68 @@
+import type { Sql } from "postgres";
+import { type Queryable, type Transaction } from "./db.js";
+/** Where the migrations are, next to this module (`src/` in development, `dist/` built). */
+export declare const MIGRATIONS_FOLDER: string;
+/** The journal of applied migrations: `nylorun.__drizzle_migrations`. */
+export declare const MIGRATIONS_SCHEMA = "nylorun";
+export declare const MIGRATIONS_TABLE = "__drizzle_migrations";
+/**
+ * What schemas were called when one database held several Tenants (`"tenant_<id>"`). A
+ * database that still has one was written by an older Runtime and is refused.
+ */
+export declare const OLD_TENANT_SCHEMA_PREFIX = "tenant_";
+export interface Migration {
+    /** The journal tag, `0001_baseline`. */
+    tag: string;
+    /** SHA-256 of the SQL file, as Drizzle records it. */
+    hash: string;
+    /** The journal's `when` (ms), recorded as `created_at`. */
+    when: number;
+    /** The file's statements, split at `--> statement-breakpoint`. */
+    statements: readonly string[];
+}
+/** The migrations this Runtime ships, in order. */
+export declare function shippedMigrations(): readonly Migration[];
+/** The schema version this Runtime writes and expects: the number of shipped migrations. */
+export declare function expectedSchemaVersion(): number;
+/**
+ * Lifts `statement_timeout` for the transaction and takes the database's migration lock
+ * until it ends. Waiting for the lock, and the migrations done under it, may outlast the
+ * pool's statement timeout; a migration that timed out would fail the Host's readiness.
+ */
+export declare function lockMigrations(tx: Transaction): Promise<void>;
+/**
+ * Throws `database-layout-old` when the database was written by an older Runtime: one that
+ * kept several Tenants in one database (`tenant_<id>` schemas, a record keyed by Tenant), or a
+ * pre-release build of one Tenant per database whose hand-written migrations recorded
+ * themselves in `schema_version` tables.
+ */
+export declare function assertCurrentLayout(q: Queryable): Promise<void>;
+/**
+ * The database's schema version: the number of migrations its journal records, or undefined
+ * when it has no journal (a database never migrated).
+ */
+export declare function readSchemaVersion(q: Queryable): Promise<number | undefined>;
+/**
+ * Applies every migration of `migrations` the journal does not record, in `tx`. Take
+ * `lockMigrations` first (`migrateDatabase` does). Throws `schema-too-new` when the journal
+ * records a migration `migrations` does not have, and `migration-failed` when Postgres
+ * rejects a migration.
+ */
+export declare function applyMigrations(tx: Transaction, migrations?: readonly Migration[]): Promise<{
+    from: number;
+    to: number;
+}>;
+/**
+ * Refuses an old layout and applies the missing migrations, in one transaction under the
+ * migration lock. For tests and tools; the Host migrates through `openTenantDatabase`.
+ */
+export declare function migrateDatabase(pool: Sql, migrations?: readonly Migration[]): Promise<{
+    from: number;
+    to: number;
+}>;
+/**
+ * Whether Postgres rejected a statement (a SQLSTATE), rather than the connection or the
+ * server failing (classes 08, 53, 57, and the driver's own connection errors). Only the
+ * first says something about the Tenant's database.
+ */
+export declare function isStatementError(error: unknown): boolean;