@nylorun/runtime 0.14.0-beta → 0.15.0-beta

package/dist/store/postgres/migrations/001_initial.d.ts

@@ -1,27 +0,0 @@
-import type { Migration } from "./index.js";
-/**
- * The first Postgres Tenant schema.
- *
- * - `tenant` holds the Tenant envelope (one row).
- * - Document tables keep `id text primary key, body json`. The fields typed
- *   queries filter on are stored generated columns with indexes. Ids and
- *   timestamps compared as text use `COLLATE "C"`, so ordering is by code
- *   point, like the in-memory fake, whatever the database collation.
- * - Bodies are `json`, not `jsonb`, so every string round-trips exactly as
- *   `JSON.stringify` wrote it. `jsonb` rejects the escapes `\u0000` (`22P05`)
- *   and unpaired surrogates (`\ud800`), which tool output can contain and
- *   which the in-memory store accepts. `json` stores the text
- *   verbatim and checks only its syntax. The generated columns read the body
- *   through `doc(body)`, which casts to `jsonb` after replacing those two
- *   escapes with `\ufffd`: the stored body is untouched, and only an indexed
- *   field that itself contained one (never an id, status or timestamp) would
- *   see U+FFFD. Bodies with no `\u` escape at all take the plain cast. Queries
- *   never apply `->`/`->>` to a `json` body (Postgres de-escapes the whole text
- *   and fails on the same escapes); they read generated columns.
- * - `sessions` carries the store-managed `next_event_seq` and ownership
- *   columns (`owner`, `epoch`, `owner_expires_at`), which are never in `body`.
- * - `outbox(session_id, seq, body)` holds committed, unrelayed events.
- * - Executors, principals, vault and settings keep typed columns. Vault
- *   ciphertext is `bytea` columns, never inside a JSON body.
- */
-export declare const initial: Migration;

package/dist/store/postgres/migrations/001_initial.js

@@ -1,196 +0,0 @@
-/**
- * The first Postgres Tenant schema.
- *
- * - `tenant` holds the Tenant envelope (one row).
- * - Document tables keep `id text primary key, body json`. The fields typed
- *   queries filter on are stored generated columns with indexes. Ids and
- *   timestamps compared as text use `COLLATE "C"`, so ordering is by code
- *   point, like the in-memory fake, whatever the database collation.
- * - Bodies are `json`, not `jsonb`, so every string round-trips exactly as
- *   `JSON.stringify` wrote it. `jsonb` rejects the escapes `\u0000` (`22P05`)
- *   and unpaired surrogates (`\ud800`), which tool output can contain and
- *   which the in-memory store accepts. `json` stores the text
- *   verbatim and checks only its syntax. The generated columns read the body
- *   through `doc(body)`, which casts to `jsonb` after replacing those two
- *   escapes with `\ufffd`: the stored body is untouched, and only an indexed
- *   field that itself contained one (never an id, status or timestamp) would
- *   see U+FFFD. Bodies with no `\u` escape at all take the plain cast. Queries
- *   never apply `->`/`->>` to a `json` body (Postgres de-escapes the whole text
- *   and fails on the same escapes); they read generated columns.
- * - `sessions` carries the store-managed `next_event_seq` and ownership
- *   columns (`owner`, `epoch`, `owner_expires_at`), which are never in `body`.
- * - `outbox(session_id, seq, body)` holds committed, unrelayed events.
- * - Executors, principals, vault and settings keep typed columns. Vault
- *   ciphertext is `bytea` columns, never inside a JSON body.
- */
-export const initial = {
-    version: 1,
-    name: "initial",
-    up: (s) => `
-    CREATE FUNCTION ${s}.doc(body json) RETURNS jsonb
-    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS $$
-      SELECT CASE WHEN strpos(body::text, '\\u') = 0 THEN body::jsonb
-        ELSE regexp_replace(
-          body::text,
-          '(?<!\\\\)((?:\\\\\\\\)*)\\\\u(0000|[dD][89a-fA-F][0-9a-fA-F]{2})',
-          '\\1\\\\ufffd',
-          'g'
-        )::jsonb
-      END
-    $$;
-
-    CREATE TABLE ${s}.tenant (
-      id text COLLATE "C" PRIMARY KEY,
-      name text NOT NULL,
-      created_at text NOT NULL,
-      updated_at text NOT NULL,
-      schema_version integer NOT NULL,
-      singleton boolean NOT NULL DEFAULT true UNIQUE CHECK (singleton)
-    );
-
-    CREATE TABLE ${s}.definitions (
-      id text COLLATE "C" PRIMARY KEY,
-      body json NOT NULL
-    );
-
-    CREATE TABLE ${s}.sessions (
-      id text COLLATE "C" PRIMARY KEY,
-      body json NOT NULL,
-      status text GENERATED ALWAYS AS (${s}.doc(body)->>'status') STORED,
-      agent_id text GENERATED ALWAYS AS (${s}.doc(body)->>'agentId') STORED,
-      stream_incarnation text GENERATED ALWAYS AS (${s}.doc(body)->>'streamIncarnation') STORED,
-      next_event_seq bigint NOT NULL DEFAULT 0,
-      owner text,
-      epoch bigint NOT NULL DEFAULT 0,
-      owner_expires_at timestamptz
-    );
-    CREATE INDEX sessions_status ON ${s}.sessions (status, owner_expires_at);
-    CREATE INDEX sessions_agent ON ${s}.sessions (agent_id);
-
-    CREATE TABLE ${s}.commands (
-      id text COLLATE "C" PRIMARY KEY,
-      body json NOT NULL
-    );
-
-    CREATE TABLE ${s}.checkpoints (
-      id text COLLATE "C" PRIMARY KEY,
-      body json NOT NULL
-    );
-
-    CREATE TABLE ${s}.effects (
-      id text COLLATE "C" PRIMARY KEY,
-      body json NOT NULL,
-      session_id text GENERATED ALWAYS AS (${s}.doc(body)->'request'->>'sessionId') STORED,
-      turn_id text GENERATED ALWAYS AS (${s}.doc(body)->'request'->>'turnId') STORED,
-      kind text GENERATED ALWAYS AS (${s}.doc(body)->'request'->>'kind') STORED,
-      status text GENERATED ALWAYS AS (${s}.doc(body)->>'status') STORED
-    );
-    CREATE INDEX effects_session ON ${s}.effects (session_id, turn_id, status);
-    CREATE INDEX effects_status ON ${s}.effects (status, kind);
-
-    CREATE TABLE ${s}.actions (
-      id text COLLATE "C" PRIMARY KEY,
-      body json NOT NULL,
-      session_id text GENERATED ALWAYS AS (${s}.doc(body)->>'sessionId') STORED,
-      turn_id text GENERATED ALWAYS AS (${s}.doc(body)->>'turnId') STORED,
-      agent_id text GENERATED ALWAYS AS (${s}.doc(body)->>'agentId') STORED,
-      status text GENERATED ALWAYS AS (${s}.doc(body)->>'status') STORED,
-      kind text GENERATED ALWAYS AS (${s}.doc(body)->>'kind') STORED,
-      lease_expires_at text GENERATED ALWAYS AS (${s}.doc(body)->>'leaseExpiresAt') STORED
-    );
-    CREATE INDEX actions_session ON ${s}.actions (session_id, turn_id, status);
-    CREATE INDEX actions_agent ON ${s}.actions (agent_id, status);
-    CREATE INDEX actions_status ON ${s}.actions (status, kind);
-    CREATE INDEX actions_lease ON ${s}.actions (status, lease_expires_at);
-
-    CREATE TABLE ${s}.sandboxes (
-      id text COLLATE "C" PRIMARY KEY,
-      body json NOT NULL
-    );
-
-    CREATE TABLE ${s}.links (
-      id text COLLATE "C" PRIMARY KEY,
-      body json NOT NULL,
-      workflow_session_id text GENERATED ALWAYS AS (${s}.doc(body)->>'workflowSessionId') STORED
-    );
-    CREATE INDEX links_workflow ON ${s}.links (workflow_session_id);
-
-    CREATE TABLE ${s}.outbox (
-      session_id text COLLATE "C" NOT NULL,
-      seq bigint NOT NULL,
-      body json NOT NULL,
-      created_at text COLLATE "C" GENERATED ALWAYS AS (${s}.doc(body)->>'createdAt') STORED,
-      PRIMARY KEY (session_id, seq)
-    );
-
-    CREATE TABLE ${s}.executors (
-      agent_id text COLLATE "C" PRIMARY KEY,
-      token_hash text NOT NULL UNIQUE,
-      implementation_version text NOT NULL,
-      manifest_hash text,
-      principal_id text,
-      created_at text NOT NULL,
-      updated_at text NOT NULL
-    );
-
-    CREATE TABLE ${s}.principals (
-      id text COLLATE "C" PRIMARY KEY,
-      role text NOT NULL,
-      token_hash text NOT NULL UNIQUE,
-      idempotency_key text,
-      created_at text NOT NULL
-    );
-
-    CREATE TABLE ${s}.vaults (
-      id text COLLATE "C" PRIMARY KEY,
-      name text NOT NULL,
-      owner_user_id text NOT NULL,
-      metadata_json text,
-      created_at text COLLATE "C" NOT NULL,
-      scope text NOT NULL DEFAULT 'user' CHECK (scope IN ('user', 'host'))
-    );
-    CREATE INDEX vaults_owner ON ${s}.vaults (owner_user_id, created_at, id);
-    CREATE UNIQUE INDEX vaults_one_host ON ${s}.vaults (scope) WHERE scope = 'host';
-
-    CREATE TABLE ${s}.vault_credentials (
-      id text COLLATE "C" PRIMARY KEY,
-      vault_id text NOT NULL REFERENCES ${s}.vaults (id) ON DELETE CASCADE,
-      name text NOT NULL,
-      type text NOT NULL,
-      binding_json text NOT NULL,
-      expires_at text,
-      created_at text COLLATE "C" NOT NULL,
-      rotated_at text,
-      kek_id text NOT NULL,
-      nonce bytea NOT NULL,
-      ciphertext bytea NOT NULL,
-      wrapped_dek bytea NOT NULL
-    );
-    CREATE INDEX vault_credentials_vault ON ${s}.vault_credentials (vault_id, created_at, id);
-
-    CREATE TABLE ${s}.vault_audit (
-      ord bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-      id text NOT NULL UNIQUE,
-      at text NOT NULL,
-      actor text NOT NULL,
-      action text NOT NULL,
-      vault_id text,
-      credential_id text,
-      session_id text,
-      target text,
-      outcome text NOT NULL
-    );
-    CREATE INDEX vault_audit_vault ON ${s}.vault_audit (vault_id, ord);
-
-    CREATE TABLE ${s}.vault_idempotency (
-      id text PRIMARY KEY,
-      body_hash text NOT NULL,
-      response text NOT NULL
-    );
-
-    CREATE TABLE ${s}.tenant_settings (
-      key text PRIMARY KEY,
-      value text NOT NULL
-    );
-  `,
-};

package/dist/store/postgres/migrations/002_session_owner.d.ts

@@ -1,6 +0,0 @@
-import type { Migration } from "./index.js";
-/**
- * The session owner (`ownerUserId`) as a stored generated column with an index, so a request
- * acting for a subject lists only that subject's sessions. Not the lease column `owner`.
- */
-export declare const sessionOwner: Migration;

package/dist/store/postgres/migrations/002_session_owner.js

@@ -1,13 +0,0 @@
-/**
- * The session owner (`ownerUserId`) as a stored generated column with an index, so a request
- * acting for a subject lists only that subject's sessions. Not the lease column `owner`.
- */
-export const sessionOwner = {
-    version: 2,
-    name: "session_owner",
-    up: (s) => `
-    ALTER TABLE ${s}.sessions
-      ADD COLUMN owner_user_id text GENERATED ALWAYS AS (${s}.doc(body)->>'ownerUserId') STORED;
-    CREATE INDEX sessions_owner_user ON ${s}.sessions (owner_user_id);
-  `,
-};

package/dist/store/postgres/migrations/003_subject_tokens.d.ts

@@ -1,8 +0,0 @@
-import type { Migration } from "./index.js";
-/**
- * Subject tokens (Host feature `subject-tokens`): the Tenant's signing keys (private halves
- * sealed with the vault KEK, like credentials), each subject's revocation epoch, each
- * subject's turn bucket. Counting a subject's sessions by status uses the owner index of
- * migration 2; a second index on status would be written on every session transition.
- */
-export declare const subjectTokens: Migration;

package/dist/store/postgres/migrations/003_subject_tokens.js

@@ -1,42 +0,0 @@
-/**
- * Subject tokens (Host feature `subject-tokens`): the Tenant's signing keys (private halves
- * sealed with the vault KEK, like credentials), each subject's revocation epoch, each
- * subject's turn bucket. Counting a subject's sessions by status uses the owner index of
- * migration 2; a second index on status would be written on every session transition.
- */
-export const subjectTokens = {
-    version: 3,
-    name: "subject_tokens",
-    up: (s) => `
-    CREATE TABLE ${s}.signing_keys (
-      id text COLLATE "C" PRIMARY KEY,
-      state text NOT NULL CHECK (state IN ('standby', 'current', 'previous', 'revoked')),
-      alg text NOT NULL CHECK (alg = 'ES256'),
-      public_jwk text NOT NULL,
-      kek_id text NOT NULL,
-      nonce bytea NOT NULL,
-      ciphertext bytea NOT NULL,
-      wrapped_dek bytea NOT NULL,
-      created_at text NOT NULL,
-      activated_at text,
-      retired_at text,
-      revoked_at text
-    );
-    CREATE UNIQUE INDEX signing_keys_one_standby ON ${s}.signing_keys (state) WHERE state = 'standby';
-    CREATE UNIQUE INDEX signing_keys_one_current ON ${s}.signing_keys (state) WHERE state = 'current';
-    CREATE UNIQUE INDEX signing_keys_one_previous ON ${s}.signing_keys (state) WHERE state = 'previous';
-
-    CREATE TABLE ${s}.subject_epochs (
-      subject text COLLATE "C" PRIMARY KEY,
-      epoch bigint NOT NULL,
-      revoked_at text NOT NULL
-    );
-
-    CREATE TABLE ${s}.subject_usage (
-      subject text COLLATE "C" PRIMARY KEY,
-      turn_tokens double precision NOT NULL,
-      refilled_at text NOT NULL
-    );
-
-  `,
-};

package/dist/store/postgres/migrations/004_publishable_keys.d.ts

@@ -1,6 +0,0 @@
-import type { Migration } from "./index.js";
-/**
- * Publishable keys (Host feature `browser-access`): public by design, so stored as they are,
- * with the origins a browser may use each from.
- */
-export declare const publishableKeys: Migration;

package/dist/store/postgres/migrations/004_publishable_keys.js

@@ -1,18 +0,0 @@
-/**
- * Publishable keys (Host feature `browser-access`): public by design, so stored as they are,
- * with the origins a browser may use each from.
- */
-export const publishableKeys = {
-    version: 4,
-    name: "publishable_keys",
-    up: (s) => `
-    CREATE TABLE ${s}.publishable_keys (
-      id text COLLATE "C" PRIMARY KEY,
-      key text COLLATE "C" NOT NULL UNIQUE,
-      name text NOT NULL UNIQUE,
-      origins_json text NOT NULL,
-      created_at text NOT NULL,
-      revoked_at text
-    );
-  `,
-};

package/dist/store/postgres/migrations/005_action_endpoints.d.ts

@@ -1,6 +0,0 @@
-import type { Migration } from "./index.js";
-/**
- * Action endpoints: where the Runtime delivers each agent's Actions over HTTP, with the health
- * recent deliveries report, and the deadline of an Action being delivered.
- */
-export declare const actionEndpoints: Migration;

package/dist/store/postgres/migrations/005_action_endpoints.js

@@ -1,32 +0,0 @@
-/**
- * Action endpoints: where the Runtime delivers each agent's Actions over HTTP, with the health
- * recent deliveries report, and the deadline of an Action being delivered.
- */
-export const actionEndpoints = {
-    version: 5,
-    name: "action_endpoints",
-    up: (s) => `
-    CREATE TABLE ${s}.endpoints (
-      agent_id text COLLATE "C" PRIMARY KEY,
-      url text NOT NULL,
-      implementation_version text NOT NULL,
-      manifest_hash text,
-      timeout_ms integer NOT NULL,
-      max_concurrent integer NOT NULL,
-      principal_id text,
-      last_delivery_at text,
-      last_success_at text,
-      last_error_code text,
-      last_error_message text,
-      consecutive_failures integer NOT NULL DEFAULT 0,
-      served_implementation_version text,
-      served_manifest_hash text,
-      created_at text NOT NULL,
-      updated_at text NOT NULL
-    );
-
-    ALTER TABLE ${s}.actions
-      ADD COLUMN deadline_at text GENERATED ALWAYS AS (${s}.doc(body)->>'deadlineAt') STORED;
-    CREATE INDEX actions_deadline ON ${s}.actions (status, deadline_at);
-  `,
-};

package/dist/store/postgres/migrations/006_drop_executors.d.ts

@@ -1,11 +0,0 @@
-import type { Migration } from "./index.js";
-/**
- * Protocol 3 removes executors: Actions are only delivered to Action endpoints.
- *
- * An Action an executor had claimed becomes `delivering` with a deadline that has already
- * passed, so the next sweep applies the delivery loss rule to it (`delivery.ts` `loseAction`):
- * a tool becomes `uncertain` with its `action.uncertain` event, and a hook, `fn` or `verify` is
- * delivered again. Open Actions lose the executor-only `claimId` and `leaseExpiresAt`; settled
- * ones are never delivered again and keep them.
- */
-export declare const dropExecutors: Migration;

package/dist/store/postgres/migrations/006_drop_executors.js

@@ -1,32 +0,0 @@
-/**
- * Protocol 3 removes executors: Actions are only delivered to Action endpoints.
- *
- * An Action an executor had claimed becomes `delivering` with a deadline that has already
- * passed, so the next sweep applies the delivery loss rule to it (`delivery.ts` `loseAction`):
- * a tool becomes `uncertain` with its `action.uncertain` event, and a hook, `fn` or `verify` is
- * delivered again. Open Actions lose the executor-only `claimId` and `leaseExpiresAt`; settled
- * ones are never delivered again and keep them.
- */
-export const dropExecutors = {
-    version: 6,
-    name: "drop_executors",
-    up: (s) => `
-    DROP INDEX ${s}.actions_lease;
-    ALTER TABLE ${s}.actions DROP COLUMN lease_expires_at;
-
-    UPDATE ${s}.actions
-      SET body = (
-        ${s}.doc(body) - 'claimId' - 'leaseExpiresAt'
-          || jsonb_build_object(
-            'status', 'delivering',
-            'deadlineAt', to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
-          )
-      )::json
-      WHERE status = 'claimed';
-    UPDATE ${s}.actions
-      SET body = (${s}.doc(body) - 'claimId' - 'leaseExpiresAt')::json
-      WHERE status IN ('pending', 'delivering');
-
-    DROP TABLE ${s}.executors;
-  `,
-};

package/dist/store/postgres/migrations/007_event_time.d.ts

@@ -1,7 +0,0 @@
-import type { Migration } from "./index.js";
-/**
- * Protocol 4 puts events on the `nylorun.event/2` envelope, where `createdAt` is `time`. The
- * outbox's `created_at` (its age, for relay lag) is generated from either, so rows written
- * before the upgrade keep theirs.
- */
-export declare const eventTime: Migration;

package/dist/store/postgres/migrations/007_event_time.js

@@ -1,14 +0,0 @@
-/**
- * Protocol 4 puts events on the `nylorun.event/2` envelope, where `createdAt` is `time`. The
- * outbox's `created_at` (its age, for relay lag) is generated from either, so rows written
- * before the upgrade keep theirs.
- */
-export const eventTime = {
-    version: 7,
-    name: "event_time",
-    up: (s) => `
-    ALTER TABLE ${s}.outbox DROP COLUMN created_at;
-    ALTER TABLE ${s}.outbox ADD COLUMN created_at text COLLATE "C"
-      GENERATED ALWAYS AS (coalesce(${s}.doc(body)->>'time', ${s}.doc(body)->>'createdAt')) STORED;
-  `,
-};

package/dist/store/postgres/migrations/008_durable_streams.d.ts

@@ -1,13 +0,0 @@
-import type { Migration } from "./index.js";
-/**
- * Durable Streams v1 (Durable Streams §18.1): session events move from the Tenant's outbox to
- * the shared record (`nylorun_streams`), and stream names lose their incarnation.
- *
- * **A fresh start for session data.** A Tenant that has sessions loses them, with their
- * commands, checkpoints, effects, Actions, links, outbox and turn buckets, as a
- * sessions-scope reset does; settings, agents, Action endpoints, keys, policy and vaults stay.
- * It moves to basin generation 1, and generation 0 (the basin holding the old streams) is
- * retired, so the Runtime deletes it when the Tenant opens. A Tenant without sessions stays at
- * generation 0: its basin holds no session stream it could collide with.
- */
-export declare const durableStreams: Migration;

package/dist/store/postgres/migrations/008_durable_streams.js

@@ -1,35 +0,0 @@
-/**
- * Durable Streams v1 (Durable Streams §18.1): session events move from the Tenant's outbox to
- * the shared record (`nylorun_streams`), and stream names lose their incarnation.
- *
- * **A fresh start for session data.** A Tenant that has sessions loses them, with their
- * commands, checkpoints, effects, Actions, links, outbox and turn buckets, as a
- * sessions-scope reset does; settings, agents, Action endpoints, keys, policy and vaults stay.
- * It moves to basin generation 1, and generation 0 (the basin holding the old streams) is
- * retired, so the Runtime deletes it when the Tenant opens. A Tenant without sessions stays at
- * generation 0: its basin holds no session stream it could collide with.
- */
-export const durableStreams = {
-    version: 8,
-    name: "durable_streams",
-    up: (s) => `
-    ALTER TABLE ${s}.tenant
-      ADD COLUMN basin_generation integer NOT NULL DEFAULT 0,
-      ADD COLUMN retired_generations integer[] NOT NULL DEFAULT '{}';
-    UPDATE ${s}.tenant SET basin_generation = 1, retired_generations = '{0}'
-      WHERE EXISTS (SELECT 1 FROM ${s}.sessions);
-
-    DELETE FROM ${s}.links;
-    DELETE FROM ${s}.actions;
-    DELETE FROM ${s}.effects;
-    DELETE FROM ${s}.checkpoints;
-    DELETE FROM ${s}.commands;
-    DELETE FROM ${s}.sessions;
-    DELETE FROM ${s}.subject_usage;
-    DROP TABLE ${s}.outbox;
-
-    ALTER TABLE ${s}.sessions
-      DROP COLUMN stream_incarnation,
-      DROP COLUMN next_event_seq;
-  `,
-};

package/dist/store/postgres/migrations/index.d.ts

@@ -1,53 +0,0 @@
-/**
- * Forward-only, numbered migrations of one Tenant schema (architecture §14.6).
- *
- * Each schema records what it has applied in `<schema>.schema_version`, one
- * row per migration; its version is the highest row. Migrating runs every
- * missing step in order, in the caller's transaction, under a transaction-level
- * advisory lock on the schema so two processes never migrate the same schema
- * at once. A schema newer than the Runtime is never touched: migrating it
- * throws a `schema-too-new` quarantine and the Tenant is quarantined.
- *
- * Adding a migration: append `NNN_name.ts` with the next version to
- * `MIGRATIONS`. Never edit or reorder an applied migration.
- */
-import type { Sql, TransactionSql } from "postgres";
-export interface Migration {
-    /** 1, 2, 3, … without gaps. */
-    version: number;
-    name: string;
-    /** DDL for the quoted schema name `s` (for example `"tenant_tn_…"`). */
-    up(s: string): string;
-}
-export declare const MIGRATIONS: readonly Migration[];
-/** The schema version this Runtime writes and expects. */
-export declare const POSTGRES_SCHEMA_VERSION: number;
-/** Checks that versions run 1, 2, 3, … Throws otherwise. */
-export declare function assertMigrations(migrations: readonly Migration[]): void;
-/**
- * Takes the schema's migration lock until the transaction ends. Waiting for it, and the
- * migrations or deletion done under it, may outlast the pool's statement timeout: it is lifted
- * for the transaction, since a migration that times out would quarantine the Tenant.
- */
-export declare function lockSchema(tx: TransactionSql, schema: string): Promise<void>;
-export declare function schemaExists(sql: Sql | TransactionSql, schema: string): Promise<boolean>;
-/**
- * The schema's version: 0 when it exists without a `schema_version` table,
- * undefined when the schema does not exist.
- */
-export declare function readSchemaVersion(sql: Sql | TransactionSql, schema: string): Promise<number | undefined>;
-/**
- * Creates the schema when missing and applies every missing migration, inside
- * `tx`. Call `lockSchema` first when other processes may migrate concurrently
- * (`migrateSchema` does). Throws a `schema-too-new` `QuarantineError` when the
- * schema is ahead of `migrations`.
- */
-export declare function migrateSchemaInTx(tx: TransactionSql, schema: string, migrations?: readonly Migration[]): Promise<{
-    from: number;
-    to: number;
-}>;
-/** `migrateSchemaInTx` in its own transaction, under the schema's migration lock. */
-export declare function migrateSchema(sql: Sql, schema: string, migrations?: readonly Migration[]): Promise<{
-    from: number;
-    to: number;
-}>;

package/dist/store/postgres/migrations/index.js

@@ -1,96 +0,0 @@
-import { quarantine } from "../../../tenant/quarantine.js";
-import { quoteIdentifier, tenantIdFromSchema } from "../names.js";
-import { initial } from "./001_initial.js";
-import { sessionOwner } from "./002_session_owner.js";
-import { subjectTokens } from "./003_subject_tokens.js";
-import { publishableKeys } from "./004_publishable_keys.js";
-import { actionEndpoints } from "./005_action_endpoints.js";
-import { dropExecutors } from "./006_drop_executors.js";
-import { eventTime } from "./007_event_time.js";
-import { durableStreams } from "./008_durable_streams.js";
-export const MIGRATIONS = [
-    initial,
-    sessionOwner,
-    subjectTokens,
-    publishableKeys,
-    actionEndpoints,
-    dropExecutors,
-    eventTime,
-    durableStreams,
-];
-/** The schema version this Runtime writes and expects. */
-export const POSTGRES_SCHEMA_VERSION = MIGRATIONS.at(-1).version;
-/** Checks that versions run 1, 2, 3, … Throws otherwise. */
-export function assertMigrations(migrations) {
-    migrations.forEach((migration, index) => {
-        if (migration.version !== index + 1)
-            throw new Error(`Migration ${migration.name} has version ${migration.version}, expected ${index + 1}`);
-    });
-}
-/**
- * Takes the schema's migration lock until the transaction ends. Waiting for it, and the
- * migrations or deletion done under it, may outlast the pool's statement timeout: it is lifted
- * for the transaction, since a migration that times out would quarantine the Tenant.
- */
-export async function lockSchema(tx, schema) {
-    await tx `SET LOCAL statement_timeout = 0`;
-    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${`nylorun.schema:${schema}`}, 0))`;
-}
-export async function schemaExists(sql, schema) {
-    const rows = await sql `SELECT 1 FROM pg_namespace WHERE nspname = ${schema}`;
-    return rows.length > 0;
-}
-/**
- * The schema's version: 0 when it exists without a `schema_version` table,
- * undefined when the schema does not exist.
- */
-export async function readSchemaVersion(sql, schema) {
-    const [row] = await sql `
-    SELECT
-      EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${schema}) AS has_schema,
-      to_regclass(${`${quoteIdentifier(schema)}.schema_version`}) IS NOT NULL AS has_table`;
-    if (!row.has_schema)
-        return undefined;
-    if (!row.has_table)
-        return 0;
-    const [version] = await sql `
-    SELECT max(version)::int AS version FROM ${sql(`${schema}.schema_version`)}`;
-    return version?.version ?? 0;
-}
-/**
- * Creates the schema when missing and applies every missing migration, inside
- * `tx`. Call `lockSchema` first when other processes may migrate concurrently
- * (`migrateSchema` does). Throws a `schema-too-new` `QuarantineError` when the
- * schema is ahead of `migrations`.
- */
-export async function migrateSchemaInTx(tx, schema, migrations = MIGRATIONS) {
-    assertMigrations(migrations);
-    const s = quoteIdentifier(schema);
-    const latest = migrations.length;
-    await tx.unsafe(`
-    CREATE SCHEMA IF NOT EXISTS ${s};
-    CREATE TABLE IF NOT EXISTS ${s}.schema_version (
-      version integer PRIMARY KEY,
-      name text NOT NULL,
-      applied_at timestamptz NOT NULL DEFAULT now()
-    );`);
-    const from = (await readSchemaVersion(tx, schema)) ?? 0;
-    if (from > latest)
-        throw quarantine("schema-too-new", `Tenant schema version ${from} is newer than this Runtime's ${latest}`, { tenantId: tenantIdFromSchema(schema) ?? schema });
-    for (const migration of migrations.slice(from)) {
-        await tx.unsafe(migration.up(s));
-        await tx `INSERT INTO ${tx(`${schema}.schema_version`)} (version, name)
-             VALUES (${migration.version}, ${migration.name})`;
-    }
-    if (from < latest)
-        await tx `UPDATE ${tx(`${schema}.tenant`)} SET schema_version = ${latest}`;
-    return { from, to: latest };
-}
-/** `migrateSchemaInTx` in its own transaction, under the schema's migration lock. */
-export async function migrateSchema(sql, schema, migrations = MIGRATIONS) {
-    const result = await sql.begin(async (tx) => {
-        await lockSchema(tx, schema);
-        return { result: await migrateSchemaInTx(tx, schema, migrations) };
-    });
-    return result.result;
-}