@nylorun/runtime 0.17.0-beta → 0.19.1-beta

package/dist/reads/access.d.ts

@@ -0,0 +1,4 @@
+import type { AuthScope, TenantContext } from "../tenant/context.js";
+import type { ReadAccess } from "./types.js";
+export declare function readAccess(scope: AuthScope): ReadAccess;
+export declare function readStoreOf(ctx: TenantContext): import("./types.js").ReadStore;

package/dist/reads/access.js

@@ -0,0 +1,12 @@
+import { accessOf } from "../tenant/auth.js";
+import { fail } from "../tenant/http.js";
+export function readAccess(scope) {
+    const access = accessOf(scope);
+    return {
+        ...(access ? { owner: access.owner } : {}),
+        ...(access?.agents ? { agents: [...access.agents] } : {}),
+    };
+}
+export function readStoreOf(ctx) {
+    return ctx.reads ?? fail(503, "Session reads are unavailable", { code: "reads_unavailable" });
+}

package/dist/reads/cursor.d.ts

@@ -0,0 +1,11 @@
+/** Cursors carry position, not authority. Authorization is reapplied at every read. */
+export declare function readCursor(tenant: string, route: string, filters: Record<string, unknown>): {
+    encode: (key: (string | null)[]) => string;
+    decode(value: string | undefined): (string | null)[] | undefined;
+};
+/** Page cursors also resume SSE. SSE accepts the filter captured by the history page. */
+export declare function historyCursor(tenant: string, sessionId: string, agent?: string): {
+    encode: (eventCursor: string) => string;
+    decode(value: string | undefined): string | undefined;
+};
+export declare function historyResume(tenant: string, sessionId: string, value: string | undefined): string | undefined;

package/dist/reads/cursor.js

@@ -0,0 +1,80 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { decodeCursor } from "../record/index.js";
+import { fail } from "../tenant/http.js";
+const schema = z
+    .object({
+    version: z.literal(1),
+    binding: z.string(),
+    key: z.array(z.string().nullable()).max(3),
+})
+    .strict();
+/** Cursors carry position, not authority. Authorization is reapplied at every read. */
+export function readCursor(tenant, route, filters) {
+    const binding = createHash("sha256")
+        .update(JSON.stringify([
+        tenant,
+        route,
+        Object.entries(filters).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)),
+    ]))
+        .digest("hex");
+    return {
+        encode: (key) => Buffer.from(JSON.stringify({ version: 1, binding, key })).toString("base64url"),
+        decode(value) {
+            if (value === undefined)
+                return undefined;
+            if (value.length > 4096 || !/^[A-Za-z0-9_-]+$/.test(value))
+                return fail(400, "Invalid cursor", { code: "cursor_invalid" });
+            let parsed;
+            try {
+                parsed = schema.safeParse(JSON.parse(Buffer.from(value, "base64url").toString("utf8")));
+            }
+            catch {
+                return fail(400, "Invalid cursor", { code: "cursor_invalid" });
+            }
+            if (!parsed.success)
+                return fail(400, "Invalid cursor", { code: "cursor_invalid" });
+            if (parsed.data.binding !== binding)
+                return fail(400, "Cursor belongs to another query", { code: "cursor_mismatch" });
+            return parsed.data.key;
+        },
+    };
+}
+/** Page cursors also resume SSE. SSE accepts the filter captured by the history page. */
+export function historyCursor(tenant, sessionId, agent) {
+    const codec = readCursor(tenant, "history", { sessionId, agent });
+    return {
+        encode: (eventCursor) => "h1." + codec.encode([eventCursor, agent ?? null]),
+        decode(value) {
+            if (value === undefined)
+                return undefined;
+            if (!value.startsWith("h1."))
+                return fail(400, "Invalid history page cursor", { code: "cursor_invalid" });
+            const key = codec.decode(value.slice(3));
+            if (!key || key.length !== 2 || key[0] === null || key[1] !== (agent ?? null))
+                return fail(400, "Invalid history page cursor", { code: "cursor_invalid" });
+            try {
+                if (!Number.isSafeInteger(decodeCursor(sessionId, key[0])))
+                    throw new Error("Invalid cursor");
+            }
+            catch {
+                return fail(400, "Invalid history page cursor", { code: "cursor_invalid" });
+            }
+            return key[0];
+        },
+    };
+}
+export function historyResume(tenant, sessionId, value) {
+    if (!value?.startsWith("h1."))
+        return value;
+    let parsed;
+    try {
+        parsed = schema.safeParse(JSON.parse(Buffer.from(value.slice(3), "base64url").toString("utf8")));
+    }
+    catch {
+        return fail(400, "Invalid history cursor", { code: "cursor_invalid" });
+    }
+    if (!parsed.success || parsed.data.key.length !== 2)
+        return fail(400, "Invalid history cursor", { code: "cursor_invalid" });
+    return historyCursor(tenant, sessionId, parsed.data.key[1] ?? undefined).decode(value);
+}

package/dist/reads/types.d.ts

@@ -0,0 +1,25 @@
+import type { ModelCallExportPage, ModelCallsPage, SandboxPage, SessionManifestView, SessionPage, SessionListItem, SessionUsageTotals } from "@nylorun/core/contracts";
+export type ReadAccess = {
+    owner?: string;
+    agents?: readonly string[];
+};
+export type SessionFilters = {
+    agentId?: string;
+    status?: SessionListItem["status"];
+    sandboxId?: string;
+    ownerUserId?: string;
+};
+export type PageOptions = {
+    limit: number;
+    cursor?: string;
+};
+/** Public projections only. No execution-state methods or mutable transactions. */
+export interface ReadStore {
+    sessions(filters: SessionFilters, page: PageOptions, access: ReadAccess): Promise<SessionPage>;
+    manifest(id: string, access: ReadAccess): Promise<SessionManifestView>;
+    usage(id: string, turnId: string | undefined, access: ReadAccess): Promise<SessionUsageTotals>;
+    modelCalls(id: string, turnId: string | undefined, page: PageOptions, access: ReadAccess): Promise<ModelCallsPage>;
+    exportModel(after: string | undefined, limit: number): Promise<ModelCallExportPage>;
+    sandboxes(labels: Record<string, string>, page: PageOptions, access: ReadAccess, grants?: readonly string[]): Promise<SandboxPage>;
+    close(): Promise<void>;
+}

package/dist/reads/types.js

@@ -0,0 +1 @@
+export {};

package/dist/sandbox/manager.d.ts

@@ -11,6 +11,10 @@
  * past their timeout and marks records of compute this process no longer holds as stopped
  * (after a restart); `reconcile` removes workspaces whose owner is gone. `sweep` does both, the
  * reconcile once per process, as the Tenant sweep does in core's process.
+ *
+ * A session's skills (track R2 M4) are mounted on its workspace, read-only under
+ * `/skills/<name>/`, before the first call that opens it (`skills.ts`); their bytes come
+ * through the `definitionFile` port.
  */
 import type { EventPayload } from "@nylorun/core/contracts";
 import { type AgentManifest, type CapabilityManifest, type SandboxToolName } from "@nylorun/core/define";
@@ -61,6 +65,12 @@ export interface SandboxManagerOptions {
     readonly preference: string | undefined;
     /** Delete sandboxes on close (the Runtime's store does not outlive the process). */
     readonly ephemeral: boolean;
+    /**
+     * A definition file's bytes by `sha256:<hex>`, for the skills a session's workspace mounts:
+     * the Tenant's Object store in core's process, core's answer in a harness (for the run that
+     * made the call, `session.claim`). Without it no skills are mounted.
+     */
+    readonly definitionFile?: (sha256: string, session: SandboxSessionRef) => Promise<Uint8Array>;
     /** Writes a session event (in core, in its own transaction; in a harness, as a claim). */
     readonly emit: <T extends SandboxEventType>(sessionId: string, turnId: string | null, type: T, payload: EventPayload<T>, meta: SandboxEventMeta) => void | Promise<void>;
 }
@@ -135,6 +145,12 @@ export declare class SandboxManager {
     private prepare;
     private execute;
     private executeOpen;
+    /**
+     * Mounts the session's skills the workspace does not hold as they are: on a handle just opened
+     * all of them, later only those another session brought or changed. A failed outcome when
+     * one cannot be mounted; nothing is marked mounted then, so the next call tries again.
+     */
+    private mountSkills;
     private open;
     private stop;
     private record;

package/dist/sandbox/manager.js

@@ -2,6 +2,7 @@ import { SANDBOX_WORKSPACE, } from "@nylorun/core/define";
 import { sandboxWorkspaceKey, sessionWorkspaceKey, workspacePrefix, } from "./records.js";
 import { DEFAULT_SANDBOX_CPUS, DEFAULT_SANDBOX_IMAGE, describeNetwork, idleMsOf, memoryMiBOf, resolveNetwork, } from "./policy.js";
 import { parseSandboxPreference, reportSelection, selectSandboxBackend, } from "./select.js";
+import { mountSkill, sandboxSkillsOf, skillSignature } from "./skills.js";
 import { resolveSandboxPath, runSandboxTool, } from "./tools.js";
 import { SandboxFileTooLargeError, } from "./types.js";
 export { sandboxCapabilityOf } from "./capability.js";
@@ -191,6 +192,9 @@ export class SandboxManager {
                         };
                     }
                 }
+                const unmounted = await this.mountSkills(live, live.handle, session, signal);
+                if (unmounted)
+                    return unmounted;
                 return await use(live.handle, live);
             }
             finally {
@@ -236,6 +240,7 @@ export class SandboxManager {
                 active: 0,
                 lastUsedAt: Date.now(),
                 tail: Promise.resolve(),
+                skills: new Map(),
             };
             this.live.set(key, live);
         }
@@ -272,6 +277,9 @@ export class SandboxManager {
                 };
             }
         }
+        const unmounted = await this.mountSkills(live, live.handle, session, signal);
+        if (unmounted)
+            return unmounted;
         const started = Date.now();
         let report = {};
         try {
@@ -300,6 +308,36 @@ export class SandboxManager {
             };
         }
     }
+    /**
+     * Mounts the session's skills the workspace does not hold as they are: on a handle just opened
+     * all of them, later only those another session brought or changed. A failed outcome when
+     * one cannot be mounted; nothing is marked mounted then, so the next call tries again.
+     */
+    async mountSkills(live, handle, session, signal) {
+        const read = this.options.definitionFile;
+        if (!read)
+            return undefined;
+        for (const [name, files] of sandboxSkillsOf(session.manifest)) {
+            const signature = skillSignature(files);
+            if (live.skills.get(name) === signature)
+                continue;
+            try {
+                await mountSkill(handle, name, files, (sha256) => read(sha256, session), signal);
+            }
+            catch (error) {
+                if (signal.aborted)
+                    throw error;
+                live.skills.delete(name);
+                return {
+                    kind: "failed",
+                    code: "sandbox.skills_unavailable",
+                    message: `The files of skill '${name}' could not be put in the sandbox: ${error instanceof Error ? error.message : String(error)}`,
+                };
+            }
+            live.skills.set(name, signature);
+        }
+        return undefined;
+    }
     async open(live, session, spec) {
         const existing = await this.options.records.get(spec.key);
         const payload = {
@@ -311,6 +349,8 @@ export class SandboxManager {
         const creating = await this.record(spec.key, live, session.id, spec.image, "creating", existing);
         await this.options.emit(session.id, session.activeTurnId, "sandbox.state", { state: "creating", ...payload, ...(existing ? { reattach: true } : {}) }, { record: creating, ...claimOf(session) });
         const handle = await live.backend.open(spec);
+        // A handle opened afresh holds no skills this manager knows of.
+        live.skills.clear();
         const running = await this.record(spec.key, live, session.id, spec.image, "running", existing);
         await this.options.emit(session.id, session.activeTurnId, "sandbox.state", {
             state: "running",

package/dist/sandbox/session-sandbox.js

@@ -2,7 +2,8 @@
  * Gives a session the sandbox chosen when it was opened. An agent session's pinned manifest is
  * its definition plus the `nylorun.sandbox` capability (the six built-in tools, the sandbox
  * instructions and the resolved spec) and the `nylorun.artifacts` capability (`save_artifact`),
- * also added to each agent it uses as a tool, so the tree shares one spec. The definition in the
+ * also added to each agent it uses as a tool, so the tree shares one spec. The sandbox's
+ * instructions name the agent's skills' folders (`/skills/<name>/`). The definition in the
  * registry never changes.
  */
 import { AgentManifestSchema } from "@nylorun/core/contracts";
@@ -14,6 +15,10 @@ function isAgentManifest(value) {
         value.kind !== "workflow" &&
         Array.isArray(value.capabilities));
 }
+/** The names of the agent's own skills. */
+function skillNamesOf(manifest) {
+    return manifest.capabilities.flatMap((capability) => Object.keys(capability.skills ?? {})).sort();
+}
 function addCapability(manifest, spec) {
     const capabilities = manifest.capabilities.map((capability) => capability.tools === undefined
         ? capability
@@ -31,8 +36,13 @@ function addCapability(manifest, spec) {
         });
     return {
         ...manifest,
-        // With a sandbox comes `save_artifact`, so files the agent makes reach the user (F8.1).
-        capabilities: [...capabilities, sandboxCapabilityManifest(spec), artifactsCapabilityManifest()],
+        // With a sandbox comes `save_artifact`, so files the agent makes reach the user (F8.1). The
+        // sandbox's instructions name where the agent's skills are (R2 M4).
+        capabilities: [
+            ...capabilities,
+            sandboxCapabilityManifest(spec, { skills: skillNamesOf(manifest) }),
+            artifactsCapabilityManifest(),
+        ],
     };
 }
 /** The agent's manifest with the sandbox capability added, or why it cannot take one. */

package/dist/sandbox/skills.d.ts

@@ -0,0 +1,13 @@
+import { type AgentManifest } from "@nylorun/core/define";
+import type { SandboxHandle } from "./types.js";
+/** A skill's files, by path in its folder, as `sha256:<hex>`. */
+export type SkillFiles = Readonly<Record<string, string>>;
+/** The skills of the agent and the agents it uses as tools; the first of a name wins. */
+export declare function sandboxSkillsOf(manifest: AgentManifest | undefined, into?: Map<string, Readonly<Record<string, string>>>): Map<string, SkillFiles>;
+/** What a mounted skill holds, to tell whether a workspace has these files already. */
+export declare function skillSignature(files: SkillFiles): string;
+/**
+ * Writes one skill's files to `/skills/<name>/` of the sandbox, replacing what was there, and
+ * makes them read-only. `read` gives a file's bytes by `sha256:<hex>`.
+ */
+export declare function mountSkill(handle: SandboxHandle, name: string, files: SkillFiles, read: (sha256: string) => Promise<Uint8Array>, signal: AbortSignal): Promise<void>;

package/dist/sandbox/skills.js

@@ -0,0 +1,46 @@
+/**
+ * A sandbox's skills (track R2 M4): each skill of the session's agent, and of the agents it uses
+ * as tools (they share its sandbox), gets its files under `/skills/<name>/`, read-only, so the
+ * model can read them and run their scripts with bash. The SandboxManager mounts them on a
+ * workspace before the first call of a session's run that opens it, and again when a session
+ * with other skills uses it; the bytes come from the Tenant's definition files.
+ */
+import { posix } from "node:path";
+import { SKILLS_MOUNT } from "@nylorun/core/define";
+import { canonical } from "../store/canonical.js";
+import { quote } from "./tools.js";
+/** The skills of the agent and the agents it uses as tools; the first of a name wins. */
+export function sandboxSkillsOf(manifest, into = new Map()) {
+    for (const capability of manifest?.capabilities ?? []) {
+        for (const skill of Object.values(capability.skills ?? {}))
+            if (!into.has(skill.name))
+                into.set(skill.name, skill.files);
+        for (const tool of capability.tools ?? [])
+            if (tool.agent !== undefined && !("kind" in tool.agent))
+                sandboxSkillsOf(tool.agent, into);
+    }
+    return into;
+}
+/** What a mounted skill holds, to tell whether a workspace has these files already. */
+export function skillSignature(files) {
+    return canonical(files);
+}
+/**
+ * Writes one skill's files to `/skills/<name>/` of the sandbox, replacing what was there, and
+ * makes them read-only. `read` gives a file's bytes by `sha256:<hex>`.
+ */
+export async function mountSkill(handle, name, files, read, signal) {
+    const root = `${SKILLS_MOUNT}/${name}`;
+    const exec = async (command) => {
+        const result = await handle.exec({ command, cwd: "/", timeoutMs: 60_000 }, signal);
+        if (result.exitCode !== 0)
+            throw new Error(`${command.slice(0, 120)} failed: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
+    };
+    const directories = new Set([root]);
+    for (const path of Object.keys(files))
+        directories.add(posix.dirname(posix.join(root, path)));
+    await exec(`if [ -e ${quote(root)} ]; then chmod -R u+w ${quote(root)} && rm -rf ${quote(root)}; fi && mkdir -p ${[...directories].map(quote).join(" ")}`);
+    for (const [path, sha256] of Object.entries(files))
+        await handle.writeFile(posix.join(root, path), await read(sha256));
+    await exec(`chmod -R a-w ${quote(root)}`);
+}

package/dist/sandbox/types.d.ts

@@ -64,8 +64,8 @@ export interface SandboxHandle {
      * directory. Stops after `maxEntries + 1` files (`truncated`). For the turn-end export (F8.2).
      */
     listFiles?(dir: string, maxEntries: number): Promise<SandboxListing | undefined>;
-    /** Parent directories must already exist. */
-    writeFile(path: string, content: string): Promise<void>;
+    /** Text is written as UTF-8, bytes as they are. Parent directories must already exist. */
+    writeFile(path: string, content: string | Uint8Array): Promise<void>;
     /** Release compute; files persist. */
     stop(): Promise<void>;
 }

package/dist/store/ownership.d.ts

@@ -17,3 +17,12 @@ export declare function isOwnershipLost(error: unknown): error is OwnershipLostE
  * before `fn` runs, so nothing is written.
  */
 export declare function ownedTx<T, S extends SessionDoc = SessionDoc>(store: SessionStore, sessionId: string, epoch: number, fn: (t: Tx, session: StoredSession<S>) => Promise<T>): Promise<T>;
+/**
+ * `putPrincipal` on an id that holds another role (protocol 8): rotating a key never changes
+ * what it reaches, so an application key and a management key cannot share a name.
+ */
+export declare class PrincipalRoleConflict extends Error {
+    readonly id: string;
+    readonly code = "principal.role_conflict";
+    constructor(id: string);
+}

package/dist/store/ownership.js

@@ -31,3 +31,16 @@ export function isOwnershipLost(error) {
 export function ownedTx(store, sessionId, epoch, fn) {
     return store.tx(async (t) => fn(t, await t.assertEpoch(sessionId, epoch)));
 }
+/**
+ * `putPrincipal` on an id that holds another role (protocol 8): rotating a key never changes
+ * what it reaches, so an application key and a management key cannot share a name.
+ */
+export class PrincipalRoleConflict extends Error {
+    id;
+    code = "principal.role_conflict";
+    constructor(id) {
+        super(`Key ${id} holds another role`);
+        this.id = id;
+        this.name = "PrincipalRoleConflict";
+    }
+}

package/dist/store/postgres/connect.d.ts

@@ -39,3 +39,5 @@ export declare function createPostgresClient(url: string, options?: PostgresClie
  * needs `wal_level = logical` (a restart) and a role allowed to replicate.
  */
 export declare function assertLogicalReplication(sql: Sql): Promise<void>;
+/** Separate, bounded pool for read projections; inherits the Tenant connection credentials. */
+export declare function createPostgresReadClient(source: PostgresClient): PostgresClient;

package/dist/store/postgres/connect.js

@@ -40,3 +40,32 @@ export async function assertLogicalReplication(sql) {
     if (!row.replicates)
         throw new Error("The Runtime's Postgres role cannot replicate: grant it REPLICATION (ALTER ROLE … REPLICATION). See DEPLOYMENT.md.");
 }
+/** Separate, bounded pool for read projections; inherits the Tenant connection credentials. */
+export function createPostgresReadClient(source) {
+    const options = {
+        host: source.options.host.length === 1
+            ? source.options.host[0]
+            : source.options.host
+                .map((host, i) => `${host}:${source.options.port[i] ?? source.options.port[0]}`)
+                .join(","),
+        port: source.options.port[0],
+        database: source.options.database,
+        username: source.options.user,
+        pass: source.options.pass ?? "",
+        ssl: source.options.ssl,
+        path: source.options.path,
+        max: 4,
+        idle_timeout: 30,
+        connect_timeout: 2,
+        onnotice() { },
+        connection: {
+            ...source.options.connection,
+            application_name: "nylorun-reads",
+            statement_timeout: 2000,
+            idle_in_transaction_session_timeout: 2000,
+            default_transaction_read_only: true,
+        },
+    };
+    const pool = postgres(options);
+    return pool;
+}

package/dist/store/postgres/drizzle/0011_key_roles.sql

@@ -0,0 +1,3 @@
+-- Key roles (protocol 8): Studio's derived key reaches both the Runtime API and the
+-- Management API. Every other principal stays an application key.
+UPDATE "nylorun"."principals" SET "role" = 'studio' WHERE "id" = 'studio';

package/dist/store/postgres/drizzle/0012_session_reads.sql

@@ -0,0 +1,8 @@
+ALTER TABLE "nylorun"."model_usage" ADD COLUMN "tokens_reported" boolean;--> statement-breakpoint
+ALTER TABLE "nylorun"."model_usage" ADD COLUMN "cost_known" boolean;--> statement-breakpoint
+ALTER TABLE "nylorun"."model_usage" ADD COLUMN "txid" "xid8" DEFAULT pg_current_xact_id() NOT NULL;--> statement-breakpoint
+ALTER TABLE "nylorun"."sessions" ADD COLUMN "created_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "nylorun"."sessions" ALTER COLUMN "created_at" SET DEFAULT now();--> statement-breakpoint
+CREATE INDEX "model_usage_session" ON "nylorun"."model_usage" USING btree ("session_id","created_at","id");--> statement-breakpoint
+CREATE INDEX "model_usage_export" ON "nylorun"."model_usage" USING btree ("txid","id");--> statement-breakpoint
+CREATE INDEX "sessions_created" ON "nylorun"."sessions" USING btree ("created_at" DESC NULLS LAST,"id" DESC NULLS FIRST);

package/dist/store/postgres/drizzle/0013_definition_files.sql

@@ -0,0 +1,16 @@
+CREATE TABLE "nylorun"."definition_file_uses" (
+	"agent_id" text COLLATE "C" NOT NULL,
+	"manifest_hash" text COLLATE "C" NOT NULL,
+	"sha256" text COLLATE "C" NOT NULL,
+	CONSTRAINT "definition_file_uses_pkey" PRIMARY KEY("agent_id","manifest_hash","sha256")
+);
+--> statement-breakpoint
+CREATE TABLE "nylorun"."definition_files" (
+	"sha256" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"kind" text NOT NULL,
+	"size" bigint NOT NULL,
+	"content_type" text,
+	"created_at" text COLLATE "C" NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "definition_file_uses_sha256" ON "nylorun"."definition_file_uses" USING btree ("sha256");

package/dist/store/postgres/drizzle/0014_action_endpoints_removed.sql

@@ -0,0 +1,2 @@
+DROP TABLE "nylorun"."actions" CASCADE;--> statement-breakpoint
+DROP TABLE "nylorun"."endpoints" CASCADE;

package/dist/store/postgres/drizzle/meta/_journal.json

@@ -78,6 +78,34 @@
       "when": 1791107553412,
       "tag": "0010_oss_auth_removals",
       "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "7",
+      "when": 1791196553461,
+      "tag": "0011_key_roles",
+      "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "7",
+      "when": 1791209959436,
+      "tag": "0012_session_reads",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "7",
+      "when": 1791214258298,
+      "tag": "0013_definition_files",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "7",
+      "when": 1791218903443,
+      "tag": "0014_action_endpoints_removed",
+      "breakpoints": true
     }
   ]
 }

package/dist/store/postgres/reads.d.ts

@@ -0,0 +1,3 @@
+import type { ReadStore } from "../../reads/types.js";
+import { type PostgresClient } from "./connect.js";
+export declare function createPostgresReadStore(source: PostgresClient, tenantId: string): ReadStore;