@rikalabs/akter 0.1.0-alpha.0

package/dist/runtime/actors.d.ts

@@ -0,0 +1,155 @@
+import { Context, type Effect, type Scope, type Stream } from "effect";
+import type { Transport } from "./connections/transport.ts";
+import type { Holder } from "./connections/holder.ts";
+import type { ProgressMessage } from "./jobs/progress.ts";
+import type { ActorError } from "../errors/actor.ts";
+import type { RetentionGap, UnknownCursor } from "../errors/events.ts";
+import type { ActorRef, Caller } from "../identity/caller.ts";
+import type { Seed } from "./operators/seed.ts";
+import type { MintInput } from "../identity/mint.ts";
+import type { Swept } from "./storage/retention.ts";
+import type { BlobAccess, BlobScope } from "../state/blob.ts";
+import type { TableAccess, TableScope } from "../tables/owned.ts";
+import type { Executed, Outcome, Request } from "./request.ts";
+import type { FleetRequest } from "./fleet/subscribe.ts";
+import type { JobRegistration, QueryRegistration, Registration, StoredEvent, WatchResult, WorkflowStatus } from "./members.ts";
+declare const InternalActors_base: Context.ServiceClass<InternalActors, "@rikalabs/akter/runtime/actors/InternalActors", {
+    readonly register: (actor: Registration) => Effect.Effect<void, never, Scope.Scope>;
+    readonly transport: Transport;
+    /** This runner's in-process connection holder. */
+    readonly holder: Holder;
+    /** Ends the actor's activation on this runner as idle expiry would. */
+    readonly hibernate: (ref: ActorRef) => Effect.Effect<void>;
+    readonly execute: (request: Request) => Effect.Effect<Executed, ActorError>;
+    /**
+     * Whether `execute` would refuse a served command without waiting, before
+     * its request is read or decoded.
+     */
+    readonly overloaded: () => boolean;
+    /** Bounds command request processing before authentication or body parsing starts. */
+    readonly admitRequest: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | ActorError, R>;
+    /**
+     * Delivers a committed intent. The obligation was admitted by its sending
+     * turn, so external access and command-id expiry are not checked again.
+     */
+    readonly deliver: (request: Request) => Effect.Effect<Outcome, ActorError>;
+    /** Runs relay passes until no due intent remains; used by `ActorTest.advance`. */
+    readonly drainOutbox: Effect.Effect<void>;
+    /** Runs one retention sweep now; used by `ActorTest.cleanup`. */
+    readonly cleanup: Effect.Effect<Swept>;
+    /**
+     * Sweeps every tenant's unreferenced content now, whenever each was last
+     * swept, and returns how many contents it deleted; for tests.
+     */
+    readonly sweepContent: Effect.Effect<number>;
+    /**
+     * Moves the leases of this runner's running effect attempts forward and
+     * runs `jump`, with no relay pass between them; used by `ActorTest.advance`.
+     */
+    readonly extendOutboxLeases: (millis: number, jump: Effect.Effect<void>) => Effect.Effect<void>;
+    readonly registerQueries: (actor: QueryRegistration) => Effect.Effect<void, never, Scope.Scope>;
+    readonly registerJobs: (actor: JobRegistration) => Effect.Effect<void, never, Scope.Scope>;
+    /**
+     * Reads committed state. With `minVersion`, a configured replica answers
+     * only once it has replayed that commit version; otherwise the primary does.
+     */
+    readonly query: (request: Request, minVersion?: string) => Effect.Effect<Outcome, ActorError>;
+    /** The highest commit version any command sent through this runtime has returned. */
+    readonly observedVersion: () => string | undefined;
+    /** Sends one progress message to its actor's owner as an executor pool would; for tests. */
+    readonly deliverProgress: (message: ProgressMessage) => Effect.Effect<void>;
+    /** Whether the actor has a generation row, read without waking or creating it. */
+    readonly exists: (ref: ActorRef) => Effect.Effect<boolean, ActorError>;
+    /**
+     * Reads up to `limit` committed events of `tags` after an exclusive
+     * cursor, like a query, without waking the actor; an actor with no
+     * generation row fails `NotCreated` and gets none. Values are upcast to
+     * the current version of their class.
+     */
+    readonly readFeed: (ref: ActorRef, tags: ReadonlyArray<string>, after: string | undefined, limit: number) => Effect.Effect<ReadonlyArray<Omit<StoredEvent, "version"> & {
+        readonly tag: string;
+    }>, ActorError | UnknownCursor | RetentionGap>;
+    /**
+     * Subscribes to a stream member on the actor's owner: `request.command`
+     * is the member and `request.payload` its encoded input. Elements arrive
+     * encoded; a declared failure fails with its encoding.
+     */
+    readonly subscribe: (request: Request) => Stream.Stream<string, ActorError | {
+        readonly failure: string;
+    }>;
+    /**
+     * Watches a query declared `watch: true`: `request.command` is the query
+     * and `request.payload` its encoded input. The effect opens the watch at
+     * this runner's holder, which authorizes it with `kind: "watch"`, and
+     * fails `NotCreated` for an actor no command has created. The stream
+     * starts with the current result, then sends the newest result after each
+     * commit that wrote something the last run read, skipping intermediate
+     * results and results equal to the last one. A declared failure fails it
+     * with its encoding. `minVersion` is a commit version the first result
+     * reflects at least, and `expiresAt` the credential's expiry in epoch
+     * milliseconds, which ends the watch with `Unauthorized`.
+     */
+    readonly watch: (request: Request, options: {
+        readonly minVersion: string | undefined;
+        readonly expiresAt: number | undefined;
+    }) => Effect.Effect<Stream.Stream<WatchResult, ActorError | {
+        readonly failure: string;
+    }>, ActorError>;
+    /**
+     * Subscribes to a fleet view for the caller's tenant: the effect
+     * authorizes it with `kind: "fleet"` and fails `RunnerAtCapacity` past
+     * the view's subscriptions on this runner. The stream starts with the
+     * current page, `{ asOf, stale, rows }` encoded as a watch result, then
+     * sends a page each time the view's state changed and its page differs;
+     * it ends `Unauthorized` once reauthorization is refused or the
+     * credential expires.
+     */
+    readonly fleet: (request: FleetRequest) => Effect.Effect<Stream.Stream<WatchResult, ActorError>, ActorError>;
+    /** The fleet views this runtime registered, by name. */
+    readonly fleetViews: ReadonlySet<string>;
+    /**
+     * Reads one execution's status like a query: `request.command` is the
+     * workflow member, `request.payload` the execution id.
+     */
+    readonly pollWorkflow: (request: Request) => Effect.Effect<WorkflowStatus | undefined, ActorError>;
+    readonly mintActorId: Effect.Effect<string>;
+    /** Derives the id a parent turn mints for a child actor. */
+    readonly mintChildId: (input: MintInput) => Effect.Effect<string>;
+    /** The deployment's command retry window: every id's `expiresAt - issuedAt`. */
+    readonly retryWindowMs: number;
+    /** The database clock in epoch milliseconds, the only clock command ids are checked against. */
+    readonly databaseNow: Effect.Effect<number, ActorError>;
+    /** A fresh command id issued at the database clock, as `Actors.mintCommandId` returns. */
+    readonly mintCommandId: Effect.Effect<string, ActorError>;
+    /**
+     * Binds owned-table capabilities to the calling fiber's turn or query.
+     * Writable access requires the turn transaction and never opens its own.
+     */
+    readonly tables: (scope: TableScope, write: boolean) => Effect.Effect<TableAccess>;
+    /** The Cluster shard that places `ref`'s activation, as stored in runner shard locks. */
+    readonly shardId: (ref: ActorRef) => Effect.Effect<string>;
+    /** Binds blob capabilities the same way; writable access requires the turn transaction. */
+    readonly blobs: (scope: BlobScope, write: boolean) => Effect.Effect<BlobAccess>;
+    /** Which layers of an actor type this process registered. */
+    readonly registered: (actor: string) => {
+        readonly commands: boolean;
+        readonly queries: boolean;
+    };
+    /** The blob names a registered actor type declares, for test inspection. */
+    readonly declaredBlobs: (actor: string) => ReadonlyArray<string>;
+    /**
+     * Starts the actor `ref` from `seed` in one transaction, staging its
+     * pending work as `caller`; dies, writing nothing, when the seed is of
+     * another type, names an effect the actor does not register, or the
+     * actor already exists.
+     */
+    readonly seed: (request: {
+        readonly ref: ActorRef;
+        readonly caller: Caller;
+        readonly seed: Seed;
+    }) => Effect.Effect<void>;
+}>;
+/** Runtime-only capabilities; package entry points export only Actors. */
+export declare class InternalActors extends InternalActors_base {
+}
+export {};

package/dist/runtime/actors.js

@@ -0,0 +1,4 @@
+import { Context } from "effect";
+/** Runtime-only capabilities; package entry points export only Actors. */
+export class InternalActors extends Context.Service()("@rikalabs/akter/runtime/actors/InternalActors") {
+}

package/dist/runtime/admission.d.ts

@@ -0,0 +1,34 @@
+import { Duration, Effect, type Scope } from "effect";
+import { ActorError } from "../errors/actor.ts";
+/**
+ * The cause of an `ActorUnavailable` that refused a command before it reached
+ * any queue: the runner could not admit it within its admission wait, or the
+ * actor's activation already held its limit of waiting commands. Nothing of
+ * the command ran.
+ */
+export declare const overloaded: (queue: "runner" | "activation") => ActorError;
+/** Whether `error` is a refusal for overload, which a delivery never retries in place. */
+export declare const isOverloaded: (error: ActorError) => boolean;
+/**
+ * Admits at most `limit` effects at once. The next `limit` callers wait for a
+ * slot in arrival order, each for at most `wait`; a caller past them, or one
+ * whose wait runs out, is refused with `ActorUnavailable`. Work past what the
+ * runner can serve therefore waits in its callers' retries instead of in the
+ * runner's mailboxes and pool queues, while a burst shorter than `wait` is
+ * absorbed rather than refused. A refusal happens before the effect starts, so
+ * a refused command never reaches admission, a mailbox, or a turn.
+ *
+ * A slot freed while callers wait goes straight to the oldest, never back to
+ * the free count, so a newcomer cannot overtake a waiter. A waiter whose wait
+ * ends after it was handed a slot passes the slot on, so a slot is never lost.
+ */
+export declare const admissionLimit: ({ limit, wait, }: {
+    readonly limit: number;
+    readonly wait: Duration.Duration;
+}) => {
+    /** Whether the next caller would be refused without waiting. */
+    full: () => boolean;
+    /** Holds a slot until its scope closes, including after the acquiring fiber stops waiting. */
+    take: Effect.Effect<void, ActorError, Scope.Scope>;
+    admit: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | ActorError, R>;
+};

package/dist/runtime/admission.js

@@ -0,0 +1,72 @@
+import { Duration, Effect, Schema } from "effect";
+import { ActorError, ActorUnavailable } from "../errors/actor.js";
+/**
+ * The cause of an `ActorUnavailable` that refused a command before it reached
+ * any queue: the runner could not admit it within its admission wait, or the
+ * actor's activation already held its limit of waiting commands. Nothing of
+ * the command ran.
+ */
+export const overloaded = (queue) => ActorError.make({
+    reason: ActorUnavailable.make({
+        overloaded: true,
+        cause: new Error(queue === "runner"
+            ? "The runner holds its limit of commands in flight"
+            : "The activation holds its limit of waiting commands"),
+    }),
+});
+/** Whether `error` is a refusal for overload, which a delivery never retries in place. */
+export const isOverloaded = (error) => Schema.is(ActorUnavailable)(error.reason) && error.reason.overloaded === true;
+/**
+ * Admits at most `limit` effects at once. The next `limit` callers wait for a
+ * slot in arrival order, each for at most `wait`; a caller past them, or one
+ * whose wait runs out, is refused with `ActorUnavailable`. Work past what the
+ * runner can serve therefore waits in its callers' retries instead of in the
+ * runner's mailboxes and pool queues, while a burst shorter than `wait` is
+ * absorbed rather than refused. A refusal happens before the effect starts, so
+ * a refused command never reaches admission, a mailbox, or a turn.
+ *
+ * A slot freed while callers wait goes straight to the oldest, never back to
+ * the free count, so a newcomer cannot overtake a waiter. A waiter whose wait
+ * ends after it was handed a slot passes the slot on, so a slot is never lost.
+ */
+export const admissionLimit = ({ limit, wait, }) => {
+    let free = limit;
+    const waiters = new Set();
+    const release = Effect.sync(() => {
+        const next = waiters.values().next();
+        if (next.done === true) {
+            free += 1;
+            return;
+        }
+        waiters.delete(next.value);
+        next.value.granted = true;
+        next.value.resume();
+    });
+    const enter = (restore) => Effect.suspend(() => {
+        if (free > 0) {
+            free -= 1;
+            return Effect.void;
+        }
+        if (Duration.isZero(wait) || waiters.size >= limit)
+            return Effect.fail(overloaded("runner"));
+        let waiter;
+        return restore(Effect.callback((resume) => {
+            const queued = { granted: false, resume: () => resume(Effect.void) };
+            waiter = queued;
+            waiters.add(queued);
+            return Effect.sync(() => {
+                waiters.delete(queued);
+            });
+        }).pipe(Effect.onInterrupt(() => (waiter?.granted === true ? release : Effect.void)), Effect.timeoutOrElse({
+            duration: wait,
+            orElse: () => Effect.fail(overloaded("runner")),
+        })));
+    });
+    return {
+        /** Whether the next caller would be refused without waiting. */
+        full: () => free === 0 && (Duration.isZero(wait) || waiters.size >= limit),
+        /** Holds a slot until its scope closes, including after the acquiring fiber stops waiting. */
+        take: Effect.uninterruptibleMask((restore) => Effect.andThen(enter(restore), Effect.addFinalizer(() => release))),
+        admit: (effect) => Effect.uninterruptibleMask((restore) => Effect.andThen(enter(restore), restore(effect).pipe(Effect.ensuring(release)))),
+    };
+};

package/dist/runtime/adoption/backfill.d.ts

@@ -0,0 +1,27 @@
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { AdoptionRefused } from "./target.ts";
+/** What a backfill did for one table. */
+export interface BackfillResult {
+    readonly table: string;
+    /** Rows given a `routing_key`. */
+    readonly filled: number;
+    /** Full passes over the table; the last one found nothing left to fill. */
+    readonly passes: number;
+}
+/**
+ * Fills `routing_key` of every row of each observed table of `actors`, in
+ * primary-key batches that are each their own transaction, with the runtime's
+ * own `routingKey` and the type's placement so a row's key equals the key of
+ * an actor that writes it. Nothing is stored between batches: a killed run
+ * starts again and finds only the rows still without a key. Rows written by
+ * legacy code meanwhile carry none, so it repeats until a pass fills nothing.
+ * A table with a NULL or empty mapped column is refused and its rows listed,
+ * because no actor owns them.
+ */
+export declare const backfillAdoption: (actors: readonly WeakKey[], options: {
+    readonly only?: string | undefined;
+    readonly batch?: number | undefined;
+}) => Effect.Effect<BackfillResult[], AdoptionRefused | import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+/** One line per table: how many rows were filled and how many passes it took. */
+export declare const formatBackfill: (result: BackfillResult) => string;

package/dist/runtime/adoption/backfill.js

@@ -0,0 +1,144 @@
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { ActorRef } from "../../identity/caller.js";
+import { routingKey } from "../storage/codec.js";
+import { quotedTable } from "./plan.js";
+import { AdoptionRefused, adoptionTargets, qualifiedName } from "./target.js";
+const identifier = (name) => `"${name.replaceAll('"', '""')}"`;
+const literal = (value) => `'${value.replaceAll("'", "''")}'`;
+const UNOWNED_SAMPLE = 20;
+/**
+ * Fills `routing_key` of every row of each observed table of `actors`, in
+ * primary-key batches that are each their own transaction, with the runtime's
+ * own `routingKey` and the type's placement so a row's key equals the key of
+ * an actor that writes it. Nothing is stored between batches: a killed run
+ * starts again and finds only the rows still without a key. Rows written by
+ * legacy code meanwhile carry none, so it repeats until a pass fills nothing.
+ * A table with a NULL or empty mapped column is refused and its rows listed,
+ * because no actor owns them.
+ */
+export const backfillAdoption = Effect.fnUntraced(function* (actors, options) {
+    const batch = options.batch ?? 1000;
+    if (!Number.isInteger(batch) || batch < 1)
+        return yield* AdoptionRefused.make({ message: "--batch is a positive integer" });
+    const results = [];
+    for (const target of yield* adoptionTargets(actors, options.only)) {
+        if (target.access === "read") {
+            if (options.only !== undefined)
+                return yield* AdoptionRefused.make({
+                    message: `${qualifiedName(target)} is adopted for reading only and has no routing_key`,
+                });
+            continue;
+        }
+        results.push(yield* backfillTable(target, batch));
+    }
+    return results;
+});
+const backfillTable = Effect.fnUntraced(function* (target, batch) {
+    const sql = yield* SqlClient.SqlClient;
+    const name = qualifiedName(target);
+    const [adoption] = yield* sql `
+    SELECT mode, actor_type FROM actor_adoptions
+    WHERE table_schema = ${target.schema} AND table_name = ${target.table}`;
+    if (adoption === undefined)
+        return yield* AdoptionRefused.make({
+            message: `${name} is not observed; run durable adopt observe ${target.table} first`,
+        });
+    if (adoption.mode === "enforce")
+        return yield* AdoptionRefused.make({
+            message: `${name} is enforced, so every row already has a routing_key`,
+        });
+    const table = quotedTable(target);
+    const tenant = identifier(target.tenantColumn);
+    const actor = identifier(target.actorColumn);
+    const keys = target.primaryKey.map(identifier);
+    const owned = `${tenant} IS NOT NULL AND ${actor} IS NOT NULL AND ${tenant}::text <> '' AND ${actor}::text <> ''`;
+    const unowned = yield* sql.unsafe(`SELECT ${keys.map((key, index) => `${key}::text AS k${index}`).join(", ")}
+     FROM ${table} WHERE NOT (${owned}) ORDER BY ${keys.join(", ")} LIMIT ${UNOWNED_SAMPLE}`);
+    if (unowned.length > 0)
+        return yield* AdoptionRefused.make({
+            message: `${name} has rows whose ${target.tenantColumn} or ${target.actorColumn} is NULL or empty, so no actor owns them; fix them first. First rows by primary key (${target.primaryKey.join(", ")}): ${unowned
+                .map((row) => `(${Object.values(row).join(", ")})`)
+                .join(" ")}`,
+        });
+    const types = yield* sql `
+    SELECT a.attname AS name, format_type(a.atttypid, a.atttypmod) AS type
+    FROM pg_attribute a JOIN pg_class c ON c.oid = a.attrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname = ${target.schema} AND c.relname = ${target.table}
+      AND a.attname IN ${sql.in([...target.primaryKey, target.tenantColumn, target.actorColumn])}`;
+    const typeOf = (column) => types.find((type) => type.name === column).type;
+    const keyTypes = target.primaryKey.map(typeOf);
+    const tenantType = typeOf(target.tenantColumn);
+    const actorType = typeOf(target.actorColumn);
+    let filled = 0;
+    let passes = 0;
+    for (;;) {
+        passes += 1;
+        let cursor;
+        let passFilled = 0;
+        for (;;) {
+            const after = cursor === undefined
+                ? ""
+                : `AND (${keys.join(", ")}) > (${cursor.map((value, index) => `${literal(value)}::${keyTypes[index]}`).join(", ")})`;
+            const rows = yield* sql.unsafe(`SELECT ${tenant}::text AS tenant, ${actor}::text AS actor,
+           ${keys.map((key, index) => `${key}::text AS k${index}`).join(", ")}
+         FROM ${table} WHERE routing_key IS NULL AND ${owned} ${after}
+         ORDER BY ${keys.join(", ")} LIMIT ${batch}`);
+            if (rows.length === 0)
+                break;
+            const values = yield* Effect.forEach(rows, (row) => Effect.try({
+                try: () => routingKey({
+                    ref: ActorRef.make({
+                        tenant: row["tenant"],
+                        actor: target.actor,
+                        id: row["actor"],
+                    }),
+                    placement: target.placement,
+                }),
+                catch: (cause) => AdoptionRefused.make({
+                    message: `${name} row ${target.primaryKey.map((_, index) => row[`k${index}`]).join(", ")}: ${cause instanceof Error ? cause.message : String(cause)}`,
+                }),
+            }));
+            const parameters = rows.flatMap((row, index) => [
+                row["tenant"],
+                row["actor"],
+                ...target.primaryKey.map((_, key) => row[`k${key}`]),
+                values[index].toString(),
+            ]);
+            const width = 3 + target.primaryKey.length;
+            const tuples = rows
+                .map((_, index) => {
+                const base = index * width;
+                const cast = [
+                    `$${base + 1}::${tenantType}`,
+                    `$${base + 2}::${actorType}`,
+                    ...keyTypes.map((type, key) => `$${base + 3 + key}::${type}`),
+                    `$${base + width}::bigint`,
+                ];
+                return `(${cast.join(", ")})`;
+            })
+                .join(", ");
+            const match = [
+                `t.${tenant} = v.tenant`,
+                `t.${actor} = v.actor`,
+                ...keys.map((key, index) => `t.${key} = v.k${index}`),
+            ].join(" AND ");
+            const updated = yield* Effect.gen(function* () {
+                yield* sql `SELECT set_config('durable.backfill', 'on', true)`;
+                return yield* sql.unsafe(`WITH changed AS (
+             UPDATE ${table} AS t SET routing_key = v.routing_key
+             FROM (VALUES ${tuples}) AS v (tenant, actor, ${keys.map((_, index) => `k${index}`).join(", ")}, routing_key)
+             WHERE ${match} AND t.routing_key IS NULL RETURNING 1)
+           SELECT count(*)::text AS n FROM changed`, parameters);
+            }).pipe(sql.withTransaction);
+            passFilled += Number(updated[0].n);
+            cursor = target.primaryKey.map((_, index) => rows[rows.length - 1][`k${index}`]);
+        }
+        filled += passFilled;
+        if (passFilled === 0)
+            return { table: name, filled, passes };
+    }
+});
+/** One line per table: how many rows were filled and how many passes it took. */
+export const formatBackfill = (result) => `${result.table}: filled routing_key on ${result.filled} rows in ${result.passes} pass${result.passes === 1 ? "" : "es"}`;

package/dist/runtime/adoption/enforce.d.ts

@@ -0,0 +1,55 @@
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { AdoptionRefused, type AdoptionTarget } from "./target.ts";
+/** The default window a table must have been observed and quiet for before it is enforced. */
+export declare const DEFAULT_QUIET_MS: number;
+/** The grantees holding a write privilege on `target`, with the privilege, as the catalog records them. */
+export declare const writeGrants: (target: Pick<AdoptionTarget, "schema" | "table">) => Effect.Effect<readonly {
+    grantee: string;
+    privilege: string;
+}[], import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+/** The trigger arguments the guard is installed with, in the order `actor_adoption_guard()` reads them. */
+export declare const guardArguments: ({ target, writerRole, allowedRoles, }: {
+    readonly target: Pick<AdoptionTarget, "tenantColumn" | "actorColumn" | "actor">;
+    readonly writerRole: string;
+    readonly allowedRoles: ReadonlyArray<string>;
+}) => string[];
+/** What `enforce` did for one table. */
+export interface EnforceResult {
+    readonly table: string;
+    readonly writerRole: string;
+    readonly allowedRoles: ReadonlyArray<string>;
+    /** Privileges taken away, which `release` gives back. */
+    readonly revoked: number;
+}
+/**
+ * Enforces each named adopted table of `actors`, in one transaction under a
+ * `lock_timeout`. Nothing changes unless every check passes: the table has
+ * been observed for the whole quiet window, no legacy write outside `allow`
+ * roles fell inside it, no login wrote both in and out of turns, every row
+ * has its `routing_key` and owner columns, the owner is a role no login can
+ * act as, no other login can take the writer role, and no cascade reaches the
+ * table. It then revokes write privileges from every role but the writer and
+ * the allowed ones, adds the constraint that keeps `routing_key` and the
+ * mapped columns filled, and installs the guard triggers, always enabled.
+ */
+export declare const enforceAdoption: (actors: readonly WeakKey[], options: {
+    readonly only: string;
+    readonly writerRole: string;
+    readonly allowedRoles?: ReadonlyArray<string> | undefined;
+    readonly quietMs?: number | undefined;
+    readonly lockTimeoutMs?: number | undefined;
+    readonly nowMs: number;
+}) => Effect.Effect<EnforceResult[], AdoptionRefused | import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+/**
+ * Returns `only` from enforced to observed: drops the guard and the
+ * constraint that legacy writers, which supply no `routing_key`, would
+ * violate, gives back the privileges `enforce` recorded, and reinstalls the
+ * plain observing triggers. It never removes `routing_key` or the record.
+ */
+export declare const releaseAdoption: (actors: readonly WeakKey[], options: {
+    readonly only: string;
+    readonly lockTimeoutMs?: number | undefined;
+}) => Effect.Effect<string[], AdoptionRefused | import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+/** One line per enforced table. */
+export declare const formatEnforce: (result: EnforceResult) => string;