@rikalabs/akter 0.1.0-alpha.0 → 0.1.0-alpha.3

package/dist/runtime/app.d.ts

@@ -0,0 +1,65 @@
+import { type Crypto, Layer, Schema } from "effect";
+import type { SqlClient } from "effect/sql";
+import type { layer } from "./layer.ts";
+export declare const TypeId: unique symbol;
+/** What `Actors.layer` provides: the actor runtime every handler layer registers with. */
+type RuntimeServices = Layer.Success<ReturnType<typeof layer>>;
+/**
+ * Every service a hosted app's layer may require. The host builds
+ * `Actors.layer` over its own database and provides it with the SQL client and
+ * `Crypto`, so an app never constructs a runtime and a requirement outside
+ * this union is a compile error at `App.make`.
+ */
+export type AppServices = RuntimeServices | SqlClient.SqlClient | Crypto.Crypto;
+declare const AppLayerFailed_base: Schema.Class<AppLayerFailed, Schema.TaggedStruct<"AppLayerFailed", {
+    readonly cause: Schema.Defect;
+}>, import("effect/Cause").YieldableError>;
+/** Building the app's layer failed; `cause` is what the layer failed with. */
+export declare class AppLayerFailed extends AppLayerFailed_base {
+}
+/**
+ * An actor definition as an app declares it: its name, which `Actors.serve`
+ * routes by, and its declared members, which `checkWorkflows` compares with
+ * stored executions before a rollout.
+ */
+export interface AppActor {
+    readonly name: string;
+    readonly api: object;
+}
+/**
+ * A hosted app: the actor definitions to serve and one layer that registers
+ * their handlers and builds any services they need from `AppServices` alone.
+ */
+export interface App {
+    readonly [TypeId]: typeof TypeId;
+    readonly actors: ReadonlyArray<AppActor>;
+    readonly layer: Layer.Layer<never, AppLayerFailed, AppServices>;
+}
+/**
+ * Declares a hosted app, the default export of `src/app.ts`. Any handler
+ * requirement the layer leaves unprovided fails to compile here, which is why
+ * the host accepts only values this constructor branded: a layer's
+ * requirements cannot be checked at run time. A failure building the layer
+ * becomes `AppLayerFailed`, so a host that loads the app knows its error type.
+ *
+ * @example
+ * ```ts
+ * export default App.make({ actors: [Counter], layer: CounterLive })
+ * ```
+ */
+declare const make: <E = never>(app: {
+    readonly actors: ReadonlyArray<AppActor>;
+    readonly layer: Layer.Layer<never, E, AppServices>;
+}) => App;
+/**
+ * Whether `value` is an app `App.make` built: branded, with actors that each
+ * have a name and an `api` object, and a layer. A loader uses it on a module's default export before providing the
+ * layer.
+ */
+declare const is: (value: unknown) => value is App;
+/** Hosted app declaration and the loader's check of a module's default export. */
+export declare const App: {
+    make: typeof make;
+    is: typeof is;
+};
+export {};

package/dist/runtime/app.js

@@ -0,0 +1,38 @@
+import { Effect, Layer, Predicate, Schema } from "effect";
+export const TypeId = Symbol.for("@rikalabs/akter/App");
+/** Building the app's layer failed; `cause` is what the layer failed with. */
+export class AppLayerFailed extends Schema.TaggedError()("AppLayerFailed", {
+    cause: Schema.Defect(),
+}) {
+}
+const DeclaredActors = Schema.Array(Schema.Struct({ name: Schema.String, api: Schema.ObjectKeyword }));
+/**
+ * Declares a hosted app, the default export of `src/app.ts`. Any handler
+ * requirement the layer leaves unprovided fails to compile here, which is why
+ * the host accepts only values this constructor branded: a layer's
+ * requirements cannot be checked at run time. A failure building the layer
+ * becomes `AppLayerFailed`, so a host that loads the app knows its error type.
+ *
+ * @example
+ * ```ts
+ * export default App.make({ actors: [Counter], layer: CounterLive })
+ * ```
+ */
+const make = (app) => ({
+    [TypeId]: TypeId,
+    actors: [...app.actors],
+    layer: Layer.catch(app.layer, (cause) => Layer.effectDiscard(Effect.fail(AppLayerFailed.make({ cause })))),
+});
+/**
+ * Whether `value` is an app `App.make` built: branded, with actors that each
+ * have a name and an `api` object, and a layer. A loader uses it on a module's default export before providing the
+ * layer.
+ */
+const is = (value) => Predicate.hasProperty(value, TypeId) &&
+    value[TypeId] === TypeId &&
+    Predicate.hasProperty(value, "actors") &&
+    Schema.is(DeclaredActors)(value.actors) &&
+    Predicate.hasProperty(value, "layer") &&
+    Layer.isLayer(value.layer);
+/** Hosted app declaration and the loader's check of a module's default export. */
+export const App = { make, is };

package/dist/runtime/connections/holder.d.ts

@@ -213,9 +213,19 @@ export declare const connectionHolder: (options: HolderOptions) => Effect.Effect
     }, ActorError | OpenRejected, never>;
     deliver: (message: Deliver) => Effect.Effect<Delivered>;
     size: () => number;
+    /** The open sessions this holder holds for `tenant`: each one's actor, member and feed tags. */
+    census: (tenant: string) => {
+        ref: {
+            readonly tenant: string;
+            readonly actor: string;
+            readonly id: string;
+        };
+        member: string;
+        feed: readonly string[];
+    }[];
     /** The clock authorization and credential expiry are measured on, in epoch milliseconds. */
     now: Effect.Effect<number, never, never>;
-}, import("effect/sql/SqlError").SqlError, Crypto.Crypto | Scope.Scope | SqlClient.SqlClient>;
+}, never, Crypto.Crypto | Scope.Scope | SqlClient.SqlClient>;
 /** The holder service `connectionHolder` builds. */
 export type Holder = Effect.Success<ReturnType<typeof connectionHolder>>;
 export type { Scope };

package/dist/runtime/connections/holder.js

@@ -3,7 +3,7 @@ import { SqlClient } from "effect/sql";
 import { ActorError, ActorUnavailable, SessionEnded, Unauthorized } from "../../errors/actor.js";
 import { connectionSecret } from "../../identity/connection.js";
 import { FrameworkClock } from "../turn/admission.js";
-import { shardClients } from "../database/shards.js";
+import { locatedHere, shardRanges } from "../database/shards.js";
 import { ClientMessage, HolderItem, isWatchMember, watchedQuery, } from "./protocol.js";
 /** The largest encoded inbound frame or open params a holder accepts. */
 export const MAX_INBOUND_BYTES = 65_536;
@@ -87,7 +87,7 @@ const ended = (cause, resync, retryAfterMs) => ActorError.make({
  */
 export const connectionHolder = Effect.fnUntraced(function* (options) {
     const sql = yield* SqlClient.SqlClient;
-    const shards = yield* shardClients;
+    const located = yield* locatedHere;
     const crypto = yield* Crypto.Crypto;
     const clock = yield* FrameworkClock;
     const scope = yield* Effect.scope;
@@ -129,7 +129,7 @@ export const connectionHolder = Effect.fnUntraced(function* (options) {
     const deleteRow = (connection) => sql `DELETE FROM actor_connections WHERE routing_key = ${connection.type.routingKey(connection.ref)}
       AND tenant_id = ${connection.ref.tenant} AND actor_type = ${connection.ref.actor}
       AND actor_id = ${connection.ref.id} AND connection_id = ${connection.id}
-      AND holder_epoch = ${options.transport().epoch}`.pipe(Effect.ignore);
+      AND holder_epoch = ${options.transport().epoch}`.pipe(located, Effect.ignore);
     const release = (connection) => {
         heldBytes -= connection.outBytes + connection.inBytes + (connection.resync?.deferredBytes ?? 0);
         if (connection.resync !== undefined)
@@ -524,7 +524,7 @@ export const connectionHolder = Effect.fnUntraced(function* (options) {
     const liveness = (at) => Effect.gen(function* () {
         const transport = options.transport();
         const checked = [...held.values()].filter((connection) => connection.open);
-        const rows = (yield* Effect.forEach(shards, ({ sql, range }) => sql `
+        const rows = (yield* Effect.forEach(yield* shardRanges, (range) => sql `
         SELECT c.connection_id
         FROM generate_series(${range.first}::int, ${range.last}::int) AS b(bucket)
         CROSS JOIN LATERAL (
@@ -810,6 +810,10 @@ export const connectionHolder = Effect.fnUntraced(function* (options) {
         open,
         deliver,
         size: () => held.size,
+        /** The open sessions this holder holds for `tenant`: each one's actor, member and feed tags. */
+        census: (tenant) => [...held.values()].flatMap((connection) => connection.open && !connection.ended && connection.ref.tenant === tenant
+            ? [{ ref: connection.ref, member: connection.member, feed: connection.feed ?? [] }]
+            : []),
         /** The clock authorization and credential expiry are measured on, in epoch milliseconds. */
         now,
     };

package/dist/runtime/connections/streams.d.ts

@@ -45,14 +45,14 @@ export declare const streamSubscriptions: ({ registration, activations, transpor
         readonly input: string;
         readonly authorizedUntil: number;
     }) => Stream.Stream<{
+        readonly _tag: "Started";
+        readonly owner: string;
+        readonly ownerEpoch: string;
+    } | {
         readonly _tag: "Done";
     } | {
         readonly _tag: "Element";
         readonly value: string;
-    } | {
-        readonly _tag: "Started";
-        readonly owner: string;
-        readonly ownerEpoch: string;
     }, ActorError | {
         readonly _tag: "StreamFailed";
         readonly value: string;

package/dist/runtime/content/store.js

@@ -3,6 +3,7 @@ import { sha256Bytes, sha256Hasher } from "../../identity/digest.js";
 import { SqlClient } from "effect/sql";
 import { ContentTooLarge } from "../../errors/content.js";
 import { tenantRoutingKey } from "../storage/codec.js";
+import { forEachRange, withinRange } from "../database/shards.js";
 import { textArray } from "../turn/outbox.js";
 import { GRANT_LIFETIME_MS } from "./grant.js";
 /** Bytes one content may hold. */
@@ -157,9 +158,9 @@ export const tenantContent = (settings) => {
             const key = tenantRoutingKey(tenant);
             yield* row.inserted
                 ? sql `UPDATE tenant_content_chunks SET hash = ${hash}
-                WHERE routing_key = ${key} AND tenant_id = ${tenant} AND hash = ${pending}`
+              WHERE routing_key = ${key} AND tenant_id = ${tenant} AND hash = ${pending}`
                 : sql `DELETE FROM tenant_content_chunks
-                WHERE routing_key = ${key} AND tenant_id = ${tenant} AND hash = ${pending}`;
+              WHERE routing_key = ${key} AND tenant_id = ${tenant} AND hash = ${pending}`;
             return { hash, size, expiresAt: row.expiresAt };
         }));
         return yield* refOf(tenant, stored.hash, stored.size, stored.expiresAt);
@@ -233,16 +234,17 @@ export const tenantContent = (settings) => {
     const sweep = Effect.fnUntraced(function* (force) {
         const sql = yield* SqlClient.SqlClient;
         const started = yield* now;
-        const tenants = force
-            ? yield* sql `
-          SELECT routing_key::text AS routing_key, tenant_id FROM tenant_content_sweeps`
-            : yield* sql `
+        const tenants = (yield* forEachRange((range) => force
+            ? sql `
+          SELECT routing_key::text AS routing_key, tenant_id FROM tenant_content_sweeps
+          ${withinRange({ sql, range, column: "routing_key", keyword: "WHERE" })}`
+            : sql `
           UPDATE tenant_content_sweeps SET swept_at_ms = ${started}
           WHERE (routing_key, tenant_id) IN (
             SELECT routing_key, tenant_id FROM tenant_content_sweeps
-            WHERE swept_at_ms <= ${started - SWEEP_INTERVAL_MS}
+            WHERE swept_at_ms <= ${started - SWEEP_INTERVAL_MS} ${withinRange({ sql, range, column: "routing_key" })}
             LIMIT ${SWEEP_TENANTS} FOR UPDATE SKIP LOCKED)
-          RETURNING routing_key::text AS routing_key, tenant_id`;
+          RETURNING routing_key::text AS routing_key, tenant_id`)).flat();
         const [longest] = yield* sql `
       SELECT COALESCE(max(turn_ms), 0)::float8 AS turn_ms FROM actor_content_types`;
         const turnMs = longest.turn_ms;
@@ -264,10 +266,12 @@ export const tenantContent = (settings) => {
                     break;
                 const last = candidates.at(-1);
                 after = { granted: Number(last.granted_until_ms), hash: last.hash };
-                const referenced = new Set((yield* sql `
+                const referenced = new Set((yield* forEachRange((range) => sql `
             SELECT DISTINCT hash FROM actor_content_refs
-            WHERE tenant_id = ${tenant}
-              AND hash = ANY(${textArray({ sql, values: candidates.map((row) => row.hash) })})`).map((row) => row.hash));
+            WHERE tenant_id = ${tenant} ${withinRange({ sql, range, column: "routing_key" })}
+              AND hash = ANY(${textArray({ sql, values: candidates.map((row) => row.hash) })})`))
+                    .flat()
+                    .map((row) => row.hash));
                 yield* hooks.at("afterReferenceScan");
                 const unreferenced = candidates
                     .map((row) => row.hash)

package/dist/runtime/database/bounded.d.ts

@@ -1,5 +1,6 @@
 import { PgClient } from "@effect/sql-pg";
-import { Effect } from "effect";
+import type { PgConnection } from "@effect/sql-pg";
+import { Effect, Scope } from "effect";
 import { SqlClient, SqlError, Statement } from "effect/sql";
 /** Extra checkouts each pool holds beyond its connections before refusing further work. */
 export declare const POOL_WAITERS = 64;
@@ -16,28 +17,13 @@ export declare const retryPoolRefusal: <A, E, R>(effect: Effect.Effect<A, E, R>)
  * transactions, streams and listeners; bounding only command dispatch would
  * leave queries and background callers able to grow the pool's waiter list.
  * A refused checkout sent no statement.
- *
- * A checkout passes three stages in order: the bounded admission slot,
- * refused at once past the limit; a first-come, first-served gate with one
- * slot per connection, so a caller never waits behind one that asked after
- * it, which Effect's pool allows because it hands a freed connection to
- * whichever fiber asks next; then the pool, which therefore never has a
- * waiter of its own. Both slots belong to the checkout's scope, or to the
- * borrowed statement, and return with the connection, so cancellation never
- * leaks either. A statement inside a transaction reuses its connection and
- * takes neither.
- *
- * Apart from the gates it is `PgClient.make`: the same compiler, transforms,
- * span attributes, commit check, savepoint release, JSON fragments, and
- * notifications, which use a checkout of their own rather than the caller's
- * transaction.
  */
 export declare const boundedPool: (options: PgClient.PgPoolConfig) => Effect.Effect<SqlClient.SqlClient & {
     "~@effect/sql-pg/PgClient": "~@effect/sql-pg/PgClient";
     config: PgClient.PgPoolConfig;
     json: (value: unknown) => Statement.Fragment;
-    listen: (channel: string) => Effect.Effect<import("effect/Queue").Dequeue<import("@effect/sql-pg/PgConnection").Notification, SqlError.SqlError>, SqlError.SqlError, import("effect/Scope").Scope>;
+    listen: (channel: string) => Effect.Effect<import("effect/Queue").Dequeue<PgConnection.Notification, SqlError.SqlError>, SqlError.SqlError, Scope.Scope>;
     notify: (channel: string, payload: string) => Effect.Effect<void, SqlError.SqlError, never>;
-}, SqlError.SqlError, import("effect/reactivity/Reactivity").Reactivity | import("effect/Scope").Scope>;
+}, SqlError.SqlError, import("effect/reactivity/Reactivity").Reactivity | Scope.Scope>;
 /** Provides the bounded primary/off-turn client without changing its connection configuration. */
 export declare const boundedLayer: (options: PgClient.PgPoolConfig) => import("effect/Layer").Layer<PgClient.PgClient | SqlClient.SqlClient, SqlError.SqlError, never>;

package/dist/runtime/database/bounded.js

@@ -1,5 +1,5 @@
 import { PgClient, PgPool } from "@effect/sql-pg";
-import { Duration, Effect, Schedule, Schema } from "effect";
+import { Duration, Effect, Schedule, Schema, Scope } from "effect";
 import { SqlClient, SqlError, Statement } from "effect/sql";
 import { admissionLimit, isOverloaded } from "../admission.js";
 import { ActorError } from "../../errors/actor.js";
@@ -33,13 +33,6 @@ const commit = (connection) => Effect.flatMap(connection.executeRaw("COMMIT", []
 const PgJson = Statement.custom("PgJson");
 const direct = (statement) => statement;
 /**
- * The native Postgres client with at most 64 queued checkouts beyond its
- * connection capacity, handing its connections out first come, first served.
- * All SQL entry points share admission, including reservations,
- * transactions, streams and listeners; bounding only command dispatch would
- * leave queries and background callers able to grow the pool's waiter list.
- * A refused checkout sent no statement.
- *
  * A checkout passes three stages in order: the bounded admission slot,
  * refused at once past the limit; a first-come, first-served gate with one
  * slot per connection, so a caller never waits behind one that asked after
@@ -47,28 +40,38 @@ const direct = (statement) => statement;
  * whichever fiber asks next; then the pool, which therefore never has a
  * waiter of its own. Both slots belong to the checkout's scope, or to the
  * borrowed statement, and return with the connection, so cancellation never
- * leaks either. A statement inside a transaction reuses its connection and
- * takes neither.
- *
- * Apart from the gates it is `PgClient.make`: the same compiler, transforms,
- * span attributes, commit check, savepoint release, JSON fragments, and
- * notifications, which use a checkout of their own rather than the caller's
- * transaction.
+ * leaks either.
  */
-export const boundedPool = Effect.fnUntraced(function* (options) {
+const boundedSessions = Effect.fnUntraced(function* (options) {
     const pool = yield* PgPool.make(options);
     const slots = options.maxConnections ?? 10;
     const admission = admissionLimit({ limit: slots + POOL_WAITERS, wait: Duration.zero });
     const fair = fairGate(slots);
     const enter = Effect.andThen(admission.take.pipe(Effect.mapError(poolRefusal)), fair.take);
     const connection = (session) => asSqlConnection({ connection: session, send: direct });
-    const acquire = Effect.andThen(enter, Effect.map(pool.get, connection));
-    const sql = yield* SqlClient.make({
-        acquirer: acquire,
-        transactionAcquirer: Effect.andThen(enter, Effect.map(pool.reserve, connection)),
-        borrower: (use) => admission
+    return {
+        acquire: Effect.andThen(enter, Effect.map(pool.get, connection)),
+        reserve: Effect.andThen(enter, Effect.map(pool.reserve, connection)),
+        borrow: (use) => admission
             .admit(fair.use(pool.use((session) => use(connection(session)))))
             .pipe(Effect.mapError((error) => (Schema.is(ActorError)(error) ? poolRefusal(error) : error))),
+        listen: (channel) => Effect.andThen(enter, Effect.flatMap(pool.reserve, (session) => session.listen(channel))),
+    };
+});
+/**
+ * `PgClient.make` over `sessions`: the same compiler, transforms, span
+ * attributes, commit check, savepoint release, JSON fragments, and
+ * notifications, which use a checkout of their own rather than the caller's
+ * transaction. `sessions` is read at each checkout, so one client can reach
+ * a different pool per caller. A statement inside a transaction reuses its
+ * connection and takes no checkout.
+ */
+const clientOver = Effect.fnUntraced(function* (options, sessions) {
+    const acquire = Effect.flatMap(sessions, (pool) => pool.acquire);
+    const sql = yield* SqlClient.make({
+        acquirer: acquire,
+        transactionAcquirer: Effect.flatMap(sessions, (pool) => pool.reserve),
+        borrower: (use) => Effect.flatMap(sessions, (pool) => pool.borrow(use)),
         compiler: PgClient.makeCompiler(options.transformQueryNames, options.transformJson),
         spanAttributes: [
             ...(options.spanAttributes === undefined ? [] : Object.entries(options.spanAttributes)),
@@ -88,7 +91,7 @@ export const boundedPool = Effect.fnUntraced(function* (options) {
         [PgClient.TypeId]: PgClient.TypeId,
         config: options,
         json: ((value) => Statement.fragment([PgJson(value)])),
-        listen: (channel) => Effect.andThen(enter, Effect.flatMap(pool.reserve, (session) => session.listen(channel))),
+        listen: (channel) => Effect.flatMap(sessions, (pool) => pool.listen(channel)),
         notify: (channel, payload) => {
             if (new TextEncoder().encode(channel).byteLength > 63) {
                 const message = "PostgreSQL channel names must not exceed 63 UTF-8 bytes";
@@ -104,5 +107,16 @@ export const boundedPool = Effect.fnUntraced(function* (options) {
         },
     });
 });
+/**
+ * The native Postgres client with at most 64 queued checkouts beyond its
+ * connection capacity, handing its connections out first come, first served.
+ * All SQL entry points share admission, including reservations,
+ * transactions, streams and listeners; bounding only command dispatch would
+ * leave queries and background callers able to grow the pool's waiter list.
+ * A refused checkout sent no statement.
+ */
+export const boundedPool = Effect.fnUntraced(function* (options) {
+    return yield* clientOver(options, Effect.succeed(yield* boundedSessions(options)));
+});
 /** Provides the bounded primary/off-turn client without changing its connection configuration. */
 export const boundedLayer = (options) => PgClient.layerFrom(boundedPool(options));

package/dist/runtime/database/coordination.d.ts

@@ -1,8 +1,14 @@
 import { PgClient } from "@effect/sql-pg";
-import { Context, Effect, Layer } from "effect";
+import { Context, Effect, Layer, type Scope } from "effect";
 import { SqlClient } from "effect/sql";
-/** The deployment's unsharded authority, shared by every runner regardless of its data shard. */
+/** The deployment's coordination database, shared by every runner. */
 export declare const Coordination: Context.Reference<SqlClient.SqlClient | undefined>;
+/** Deployment registries belong to the data database. */
+export declare const registry: Context.Service<SqlClient.SqlClient, SqlClient.SqlClient>;
+/** The client deployment-wide locks are taken on: the designated coordination pool, else `registry`. */
+export declare const authority: Effect.Effect<SqlClient.SqlClient, never, SqlClient.SqlClient>;
+/** Holds startup coordination before even the history table is created, on one leased session. */
+export declare const withMigrationCoordination: <A, E>(effect: Effect.Effect<A, E, SqlClient.SqlClient | Scope.Scope>) => Effect.Effect<A, E | import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
 /** Supplies an independent client so coordination transactions never borrow a data transaction's connection. */
 export declare const coordinationLayer: (options: PgClient.PgPoolConfig | undefined) => Layer.Layer<never, import("effect/sql/SqlError").SqlError, never>;
 /**
@@ -12,8 +18,11 @@ export declare const coordinationLayer: (options: PgClient.PgPoolConfig | undefi
  * Row identities are retained so deleting an idle resource cannot split its lock.
  * The local fence has its own namespace because independent clients may point
  * to the same database and must not wait on their own authority transaction.
+ * Work that writes no actor data, such as accepting a deployment, passes
+ * `writesData: false` and holds no data transaction.
  */
-export declare const coordinated: <A, E, R>({ resource, work, }: {
+export declare const coordinated: <A, E, R>({ resource, work, writesData, }: {
     readonly resource: string;
     readonly work: Effect.Effect<A, E, R>;
+    readonly writesData?: boolean;
 }) => Effect.Effect<A, E | import("effect/sql/SqlError").SqlError, R | SqlClient.SqlClient>;

package/dist/runtime/database/coordination.js

@@ -3,10 +3,12 @@ import { Context, Effect, Layer } from "effect";
 import { Reactivity } from "effect/reactivity";
 import { Migrator, SqlClient } from "effect/sql";
 import { boundedPool } from "./bounded.js";
-import { NekiTurnSessions } from "./neki/session.js";
-import { MigrationBarrier, MigrationBoundary, withMigrationCoordination, } from "./neki/migrations.js";
-/** The deployment's unsharded authority, shared by every runner regardless of its data shard. */
+/** The deployment's coordination database, shared by every runner. */
 export const Coordination = Context.Reference("@rikalabs/akter/runtime/database/coordination/Coordination", { defaultValue: () => undefined });
+/** Deployment registries belong to the data database. */
+export const registry = SqlClient.SqlClient;
+/** The client deployment-wide locks are taken on: the designated coordination pool, else `registry`. */
+export const authority = Coordination.pipe(Effect.filterOrElse((designated) => designated !== undefined, () => registry));
 /** Creates the transaction-owned coordination rows on the authoritative database. */
 const prepareCoordination = Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
@@ -14,41 +16,30 @@ const prepareCoordination = Effect.gen(function* () {
     resource text PRIMARY KEY
   )`;
 });
-/** Fixed, existence-guarded bootstrap steps can be replayed after any interrupted propagation. */
-const prepareNekiCoordination = Effect.gen(function* () {
-    const sql = yield* SqlClient.SqlClient;
-    const connection = yield* sql.reserve;
-    const barrier = yield* MigrationBarrier;
-    const boundary = yield* MigrationBoundary;
-    for (const [name, ddl] of [
-        [
-            "history",
-            "CREATE TABLE IF NOT EXISTS actor_coordination_migrations (migration_id integer PRIMARY KEY, created_at timestamptz NOT NULL DEFAULT now(), name text NOT NULL)",
-        ],
-        ["resources", "CREATE TABLE IF NOT EXISTS actor_coordination (resource text PRIMARY KEY)"],
-    ]) {
-        yield* barrier(connection);
-        yield* sql.unsafe(ddl);
-        yield* boundary(`coordination:${name}:ddl`);
-        yield* barrier(connection);
-        yield* boundary(`coordination:${name}:propagated`);
-    }
-    yield* sql `INSERT INTO actor_coordination_migrations (migration_id, name)
-    VALUES (1, 'coordination') ON CONFLICT (migration_id) DO NOTHING`;
-    yield* boundary("coordination:recorded");
-});
+/** Holds startup coordination before even the history table is created, on one leased session. */
+export const withMigrationCoordination = (effect) => Effect.scoped(Effect.gen(function* () {
+    const source = yield* SqlClient.SqlClient;
+    const connection = yield* source.reserve;
+    yield* Effect.acquireRelease(connection.execute("SELECT pg_advisory_lock(1935764837, 487)", [], undefined), () => connection
+        .execute("SELECT pg_advisory_unlock(1935764837, 487)", [], undefined)
+        .pipe(Effect.orDie));
+    const reactivity = yield* Reactivity.make;
+    const client = yield* SqlClient.make({
+        acquirer: Effect.succeed(connection),
+        compiler: PgClient.makeCompiler(),
+        spanAttributes: [],
+    }).pipe(Effect.provideService(Reactivity.Reactivity, reactivity));
+    return yield* Effect.provideService(effect, SqlClient.SqlClient, client);
+}));
 /** Supplies an independent client so coordination transactions never borrow a data transaction's connection. */
 export const coordinationLayer = (options) => Layer.effect(Coordination, Effect.gen(function* () {
     if (options === undefined)
         return undefined;
     const sql = yield* boundedPool(options);
-    const neki = yield* NekiTurnSessions;
-    yield* withMigrationCoordination(neki
-        ? prepareNekiCoordination
-        : Migrator.make({})({
-            table: "actor_coordination_migrations",
-            loader: Migrator.fromRecord({ "0001_coordination": prepareCoordination }),
-        })).pipe(Effect.provideService(SqlClient.SqlClient, sql), Effect.orDie);
+    yield* withMigrationCoordination(Migrator.make({})({
+        table: "actor_coordination_migrations",
+        loader: Migrator.fromRecord({ "0001_coordination": prepareCoordination }),
+    })).pipe(Effect.provideService(SqlClient.SqlClient, sql), Effect.orDie);
     return sql;
 })).pipe(Layer.provide(Reactivity.layer));
 /**
@@ -58,11 +49,13 @@ export const coordinationLayer = (options) => Layer.effect(Coordination, Effect.
  * Row identities are retained so deleting an idle resource cannot split its lock.
  * The local fence has its own namespace because independent clients may point
  * to the same database and must not wait on their own authority transaction.
+ * Work that writes no actor data, such as accepting a deployment, passes
+ * `writesData: false` and holds no data transaction.
  */
-export const coordinated = ({ resource, work, }) => Effect.gen(function* () {
+export const coordinated = ({ resource, work, writesData = true, }) => Effect.gen(function* () {
     const data = yield* SqlClient.SqlClient;
-    const sql = (yield* Coordination) ?? data;
-    const guarded = sql === data
+    const sql = yield* authority;
+    const guarded = sql === data || !writesData
         ? work
         : data.withTransaction(data `INSERT INTO actor_coordination (resource) VALUES (${`local/${resource}`})
         ON CONFLICT (resource) DO UPDATE SET resource = EXCLUDED.resource`.pipe(Effect.andThen(work), Effect.tap(() => sql `SELECT 1`)));