@rikalabs/akter 0.1.0-alpha.0

package/dist/runtime/database/bounded.js

@@ -0,0 +1,108 @@
+import { PgClient, PgPool } from "@effect/sql-pg";
+import { Duration, Effect, Schedule, Schema } from "effect";
+import { SqlClient, SqlError, Statement } from "effect/sql";
+import { admissionLimit, isOverloaded } from "../admission.js";
+import { ActorError } from "../../errors/actor.js";
+import { asSqlConnection } from "./connection.js";
+import { fairGate } from "./gate.js";
+/** Extra checkouts each pool holds beyond its connections before refusing further work. */
+export const POOL_WAITERS = 64;
+/** SQL-compatible overload keeps caller-facing reads retryable without exposing the internal cause. */
+export const poolRefusal = (cause) => SqlError.SqlError.make({
+    reason: SqlError.ConnectionError.make({ cause, message: "Postgres pool admission is full" }),
+});
+/** Recognizes only our pre-statement checkout refusal, never a failed statement or unknown commit. */
+export const isPoolRefusal = (cause) => SqlError.isSqlError(cause) &&
+    Schema.is(ActorError)(cause.reason.cause) &&
+    isOverloaded(cause.reason.cause);
+/** Retries a pre-statement checkout refusal for scoped startup and background work. */
+export const retryPoolRefusal = (effect) => effect.pipe(Effect.retry({
+    while: isPoolRefusal,
+    schedule: Schedule.min([Schedule.exponential("10 millis", 2), Schedule.spaced("250 millis")]),
+}));
+/** Postgres can answer COMMIT with ROLLBACK when a transaction has already aborted. */
+const commit = (connection) => Effect.flatMap(connection.executeRaw("COMMIT", []), (result) => result.command === "ROLLBACK"
+    ? Effect.fail(SqlError.SqlError.make({
+        reason: SqlError.UnknownError.make({
+            cause: new Error("COMMIT rolled back an aborted transaction"),
+            message: "PgClient: COMMIT rolled back an aborted transaction",
+            operation: "commit",
+        }),
+    }))
+    : Effect.void);
+const PgJson = Statement.custom("PgJson");
+const direct = (statement) => statement;
+/**
+ * The native Postgres client with at most 64 queued checkouts beyond its
+ * connection capacity, handing its connections out first come, first served.
+ * All SQL entry points share admission, including reservations,
+ * transactions, streams and listeners; bounding only command dispatch would
+ * leave queries and background callers able to grow the pool's waiter list.
+ * A refused checkout sent no statement.
+ *
+ * A checkout passes three stages in order: the bounded admission slot,
+ * refused at once past the limit; a first-come, first-served gate with one
+ * slot per connection, so a caller never waits behind one that asked after
+ * it, which Effect's pool allows because it hands a freed connection to
+ * whichever fiber asks next; then the pool, which therefore never has a
+ * waiter of its own. Both slots belong to the checkout's scope, or to the
+ * borrowed statement, and return with the connection, so cancellation never
+ * leaks either. A statement inside a transaction reuses its connection and
+ * takes neither.
+ *
+ * Apart from the gates it is `PgClient.make`: the same compiler, transforms,
+ * span attributes, commit check, savepoint release, JSON fragments, and
+ * notifications, which use a checkout of their own rather than the caller's
+ * transaction.
+ */
+export const boundedPool = Effect.fnUntraced(function* (options) {
+    const pool = yield* PgPool.make(options);
+    const slots = options.maxConnections ?? 10;
+    const admission = admissionLimit({ limit: slots + POOL_WAITERS, wait: Duration.zero });
+    const fair = fairGate(slots);
+    const enter = Effect.andThen(admission.take.pipe(Effect.mapError(poolRefusal)), fair.take);
+    const connection = (session) => asSqlConnection({ connection: session, send: direct });
+    const acquire = Effect.andThen(enter, Effect.map(pool.get, connection));
+    const sql = yield* SqlClient.make({
+        acquirer: acquire,
+        transactionAcquirer: Effect.andThen(enter, Effect.map(pool.reserve, connection)),
+        borrower: (use) => admission
+            .admit(fair.use(pool.use((session) => use(connection(session)))))
+            .pipe(Effect.mapError((error) => (Schema.is(ActorError)(error) ? poolRefusal(error) : error))),
+        compiler: PgClient.makeCompiler(options.transformQueryNames, options.transformJson),
+        spanAttributes: [
+            ...(options.spanAttributes === undefined ? [] : Object.entries(options.spanAttributes)),
+            ["db.system.name", "postgresql"],
+            ["db.namespace", options.database ?? options.username ?? "postgres"],
+            ["server.address", options.host ?? "localhost"],
+            ["server.port", options.port ?? 5432],
+        ],
+        transformRows: options.transformResultNames === undefined
+            ? undefined
+            : Statement.defaultTransforms(options.transformResultNames, options.transformJson).array,
+        prepareTransactionControls: true,
+        commit,
+        releaseSavepoint: (name) => `RELEASE SAVEPOINT ${name}`,
+    });
+    return Object.assign(sql, {
+        [PgClient.TypeId]: PgClient.TypeId,
+        config: options,
+        json: ((value) => Statement.fragment([PgJson(value)])),
+        listen: (channel) => Effect.andThen(enter, Effect.flatMap(pool.reserve, (session) => session.listen(channel))),
+        notify: (channel, payload) => {
+            if (new TextEncoder().encode(channel).byteLength > 63) {
+                const message = "PostgreSQL channel names must not exceed 63 UTF-8 bytes";
+                return Effect.fail(SqlError.SqlError.make({
+                    reason: SqlError.UnknownError.make({
+                        cause: new Error(message),
+                        message,
+                        operation: "notify",
+                    }),
+                }));
+            }
+            return Effect.asVoid(Effect.scoped(Effect.flatMap(acquire, (conn) => conn.executeRaw("SELECT pg_notify($1, $2)", [channel, payload]))));
+        },
+    });
+});
+/** Provides the bounded primary/off-turn client without changing its connection configuration. */
+export const boundedLayer = (options) => PgClient.layerFrom(boundedPool(options));

package/dist/runtime/database/connection.d.ts

@@ -0,0 +1,8 @@
+import type { PgConnection } from "@effect/sql-pg";
+import { Effect } from "effect";
+import type { SqlConnection, SqlError } from "effect/sql";
+/** A leased session as a `SqlClient` connection, so the runtime's statements reach it. */
+export declare const asSqlConnection: ({ connection, send, }: {
+    readonly connection: PgConnection.PgConnection;
+    readonly send: <A>(statement: Effect.Effect<A, SqlError.SqlError>) => Effect.Effect<A, SqlError.SqlError>;
+}) => SqlConnection.Connection;

package/dist/runtime/database/connection.js

@@ -0,0 +1,18 @@
+import { Effect, Stream } from "effect";
+/** A leased session as a `SqlClient` connection, so the runtime's statements reach it. */
+export const asSqlConnection = ({ connection, send, }) => {
+    const rows = (prepare) => (sql, params, transformRows) => {
+        const found = send(Effect.map(connection.query(sql, params, prepare), (result) => result.rows));
+        return transformRows === undefined ? found : Effect.map(found, transformRows);
+    };
+    return {
+        execute: rows(true),
+        executeRaw: (sql, params) => send(connection.query(sql, params)),
+        executeStream: (sql, params, transformRows) => Stream.unwrap(Effect.as(send(Effect.void), transformRows === undefined
+            ? connection.stream(sql, params)
+            : Stream.map(connection.stream(sql, params), (row) => transformRows([row])[0]))),
+        executeValues: (sql, params) => send(connection.queryValues(sql, params)),
+        executeValuesUnprepared: (sql, params) => send(connection.queryValues(sql, params, false)),
+        executeUnprepared: rows(false),
+    };
+};

package/dist/runtime/database/coordination.d.ts

@@ -0,0 +1,19 @@
+import { PgClient } from "@effect/sql-pg";
+import { Context, Effect, Layer } from "effect";
+import { SqlClient } from "effect/sql";
+/** The deployment's unsharded authority, shared by every runner regardless of its data shard. */
+export declare const Coordination: Context.Reference<SqlClient.SqlClient | undefined>;
+/** Supplies an independent client so coordination transactions never borrow a data transaction's connection. */
+export declare const coordinationLayer: (options: PgClient.PgPoolConfig | undefined) => Layer.Layer<never, import("effect/sql/SqlError").SqlError, never>;
+/**
+ * Serializes one resource on the authoritative database until the guarded work
+ * has committed or rolled back. The row lock is the ownership fence: there is
+ * no clock-based expiry that could admit a second owner while the first writes.
+ * Row identities are retained so deleting an idle resource cannot split its lock.
+ * The local fence has its own namespace because independent clients may point
+ * to the same database and must not wait on their own authority transaction.
+ */
+export declare const coordinated: <A, E, R>({ resource, work, }: {
+    readonly resource: string;
+    readonly work: Effect.Effect<A, E, R>;
+}) => Effect.Effect<A, E | import("effect/sql/SqlError").SqlError, R | SqlClient.SqlClient>;

package/dist/runtime/database/coordination.js

@@ -0,0 +1,72 @@
+import { PgClient } from "@effect/sql-pg";
+import { Context, Effect, Layer } from "effect";
+import { Reactivity } from "effect/reactivity";
+import { Migrator, SqlClient } from "effect/sql";
+import { boundedPool } from "./bounded.js";
+import { NekiTurnSessions } from "./neki/session.js";
+import { MigrationBarrier, MigrationBoundary, withMigrationCoordination, } from "./neki/migrations.js";
+/** The deployment's unsharded authority, shared by every runner regardless of its data shard. */
+export const Coordination = Context.Reference("@rikalabs/akter/runtime/database/coordination/Coordination", { defaultValue: () => undefined });
+/** Creates the transaction-owned coordination rows on the authoritative database. */
+const prepareCoordination = Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    yield* sql `CREATE TABLE IF NOT EXISTS actor_coordination (
+    resource text PRIMARY KEY
+  )`;
+});
+/** Fixed, existence-guarded bootstrap steps can be replayed after any interrupted propagation. */
+const prepareNekiCoordination = Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    const connection = yield* sql.reserve;
+    const barrier = yield* MigrationBarrier;
+    const boundary = yield* MigrationBoundary;
+    for (const [name, ddl] of [
+        [
+            "history",
+            "CREATE TABLE IF NOT EXISTS actor_coordination_migrations (migration_id integer PRIMARY KEY, created_at timestamptz NOT NULL DEFAULT now(), name text NOT NULL)",
+        ],
+        ["resources", "CREATE TABLE IF NOT EXISTS actor_coordination (resource text PRIMARY KEY)"],
+    ]) {
+        yield* barrier(connection);
+        yield* sql.unsafe(ddl);
+        yield* boundary(`coordination:${name}:ddl`);
+        yield* barrier(connection);
+        yield* boundary(`coordination:${name}:propagated`);
+    }
+    yield* sql `INSERT INTO actor_coordination_migrations (migration_id, name)
+    VALUES (1, 'coordination') ON CONFLICT (migration_id) DO NOTHING`;
+    yield* boundary("coordination:recorded");
+});
+/** Supplies an independent client so coordination transactions never borrow a data transaction's connection. */
+export const coordinationLayer = (options) => Layer.effect(Coordination, Effect.gen(function* () {
+    if (options === undefined)
+        return undefined;
+    const sql = yield* boundedPool(options);
+    const neki = yield* NekiTurnSessions;
+    yield* withMigrationCoordination(neki
+        ? prepareNekiCoordination
+        : Migrator.make({})({
+            table: "actor_coordination_migrations",
+            loader: Migrator.fromRecord({ "0001_coordination": prepareCoordination }),
+        })).pipe(Effect.provideService(SqlClient.SqlClient, sql), Effect.orDie);
+    return sql;
+})).pipe(Layer.provide(Reactivity.layer));
+/**
+ * Serializes one resource on the authoritative database until the guarded work
+ * has committed or rolled back. The row lock is the ownership fence: there is
+ * no clock-based expiry that could admit a second owner while the first writes.
+ * Row identities are retained so deleting an idle resource cannot split its lock.
+ * The local fence has its own namespace because independent clients may point
+ * to the same database and must not wait on their own authority transaction.
+ */
+export const coordinated = ({ resource, work, }) => Effect.gen(function* () {
+    const data = yield* SqlClient.SqlClient;
+    const sql = (yield* Coordination) ?? data;
+    const guarded = sql === data
+        ? work
+        : data.withTransaction(data `INSERT INTO actor_coordination (resource) VALUES (${`local/${resource}`})
+        ON CONFLICT (resource) DO UPDATE SET resource = EXCLUDED.resource`.pipe(Effect.andThen(work), Effect.tap(() => sql `SELECT 1`)));
+    const alive = sql `SELECT 1`.pipe(Effect.andThen(Effect.sleep("200 millis")), Effect.forever);
+    return yield* sql.withTransaction(sql `INSERT INTO actor_coordination (resource) VALUES (${resource})
+        ON CONFLICT (resource) DO UPDATE SET resource = EXCLUDED.resource`.pipe(Effect.andThen(sql === data ? guarded : Effect.raceFirst(guarded, alive))));
+});

package/dist/runtime/database/flock.d.ts

@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+/**
+ * Tries to take an exclusive, non-blocking `flock` on `path` for the scope and
+ * answers whether it did; a file already locked answers false and registers
+ * nothing. The lock belongs to the open descriptor, so the kernel drops it when
+ * the holder dies, SIGKILL included, and a second descriptor in this process is
+ * refused like another process's. The file and its directory are created first;
+ * the lock is on the open file, not its bytes.
+ */
+export declare const flockExclusive: (path: string) => Effect.Effect<boolean, never, import("effect/Scope").Scope>;

package/dist/runtime/database/flock.js

@@ -0,0 +1,60 @@
+import { Effect } from "effect";
+const LOCK_EX = 2;
+const LOCK_NB = 4;
+const O_RDWR = 2;
+/** Keeps a child process from inheriting the lock descriptor, which would outlive this process. */
+const O_CLOEXEC = process.platform === "darwin" ? 0x1000000 : 0o2000000;
+const library = process.platform === "darwin" ? "libc.dylib" : "libc.so.6";
+/** Bun reaches libc through `bun:ffi`, imported here so no other runtime ever resolves that specifier. */
+const loadBun = () => import("bun:ffi").then(({ dlopen, FFIType }) => {
+    const { symbols } = dlopen(library, {
+        open: { args: [FFIType.cstring, FFIType.i32], returns: FFIType.i32 },
+        flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+        close: { args: [FFIType.i32], returns: FFIType.i32 },
+    });
+    return {
+        open: (path) => symbols.open(new TextEncoder().encode(`${path}\0`), O_RDWR | O_CLOEXEC),
+        lock: (fd) => symbols.flock(fd, LOCK_EX | LOCK_NB) === 0,
+        close: (fd) => void symbols.close(fd),
+    };
+});
+/** Node has no built-in `flock`, so it calls the same three libc functions through koffi's prebuilt native binding. */
+const loadNode = () => import("koffi").then(({ default: koffi }) => {
+    const libc = koffi.load(library);
+    const open = libc.func("int open(const char *path, int flags)");
+    const flock = libc.func("int flock(int fd, int operation)");
+    const close = libc.func("int close(int fd)");
+    return {
+        open: (path) => open(path, O_RDWR | O_CLOEXEC),
+        lock: (fd) => flock(fd, LOCK_EX | LOCK_NB) === 0,
+        close: (fd) => void close(fd),
+    };
+});
+let libc;
+const loadLibc = () => (libc ??= (process.versions.bun === undefined ? loadNode() : loadBun()).catch((cause) => {
+    libc = undefined;
+    throw cause;
+}));
+/**
+ * Tries to take an exclusive, non-blocking `flock` on `path` for the scope and
+ * answers whether it did; a file already locked answers false and registers
+ * nothing. The lock belongs to the open descriptor, so the kernel drops it when
+ * the holder dies, SIGKILL included, and a second descriptor in this process is
+ * refused like another process's. The file and its directory are created first;
+ * the lock is on the open file, not its bytes.
+ */
+export const flockExclusive = (path) => Effect.acquireRelease(Effect.gen(function* () {
+    if (process.platform !== "linux" && process.platform !== "darwin")
+        return yield* Effect.die(new Error(`A file-backed PGlite database needs flock, which ${process.platform} lacks`));
+    const { open, lock, close } = yield* Effect.tryPromise(loadLibc).pipe(Effect.orDie);
+    yield* Effect.promise(() => import("node:fs/promises").then(({ mkdir, open }) => mkdir(path.slice(0, path.lastIndexOf("/")), { recursive: true })
+        .then(() => open(path, "a"))
+        .then((handle) => handle.close())));
+    const fd = open(path);
+    if (fd < 0)
+        return yield* Effect.die(new Error(`Cannot open the lock file ${path}`));
+    if (lock(fd))
+        return { fd, close };
+    close(fd);
+    return undefined;
+}), (held) => Effect.sync(() => held?.close(held.fd))).pipe(Effect.map((held) => held !== undefined));

package/dist/runtime/database/gate.d.ts

@@ -0,0 +1,26 @@
+import { Effect } from "effect";
+import type { Scope } from "effect";
+/**
+ * A first-come, first-served gate of `permits` slots. A slot freed while
+ * fibers wait goes straight to the oldest waiter, never back into the free
+ * count.
+ *
+ * Effect's `Pool` and `Semaphore` free a slot and then schedule the waiter
+ * they wake. A fiber that asks in between, typically the one that just freed
+ * the slot and loops for its next statement, takes the slot first, and the
+ * woken waiter queues again at the back. Under steady load the same holders
+ * keep the slots and a waiter waits for as long as the load lasts. Putting
+ * this gate in front of a pool, with as many slots as the pool has
+ * connections, means the pool never has a waiter to pass over.
+ *
+ * A waiter interrupted after it was handed a slot passes the slot on, so an
+ * interrupt never leaks one.
+ */
+export declare const fairGate: (permits: number) => {
+    /** Holds one slot until the enclosing scope closes, waiting behind every earlier caller. */
+    take: Effect.Effect<void, never, Scope.Scope>;
+    /** Holds one slot while `effect` runs, waiting behind every earlier caller. */
+    use: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+    /** Callers waiting for a slot now. */
+    waiting: () => number;
+};

package/dist/runtime/database/gate.js

@@ -0,0 +1,54 @@
+import { Effect } from "effect";
+/**
+ * A first-come, first-served gate of `permits` slots. A slot freed while
+ * fibers wait goes straight to the oldest waiter, never back into the free
+ * count.
+ *
+ * Effect's `Pool` and `Semaphore` free a slot and then schedule the waiter
+ * they wake. A fiber that asks in between, typically the one that just freed
+ * the slot and loops for its next statement, takes the slot first, and the
+ * woken waiter queues again at the back. Under steady load the same holders
+ * keep the slots and a waiter waits for as long as the load lasts. Putting
+ * this gate in front of a pool, with as many slots as the pool has
+ * connections, means the pool never has a waiter to pass over.
+ *
+ * A waiter interrupted after it was handed a slot passes the slot on, so an
+ * interrupt never leaks one.
+ */
+export const fairGate = (permits) => {
+    let free = permits;
+    const waiters = new Set();
+    const release = Effect.sync(() => {
+        const next = waiters.values().next();
+        if (next.done === true) {
+            free += 1;
+            return;
+        }
+        waiters.delete(next.value);
+        next.value.granted = true;
+        next.value.resume();
+    });
+    const enter = (restore) => Effect.suspend(() => {
+        if (free > 0) {
+            free -= 1;
+            return Effect.void;
+        }
+        let waiter;
+        return restore(Effect.callback((resume) => {
+            const queued = { granted: false, resume: () => resume(Effect.void) };
+            waiter = queued;
+            waiters.add(queued);
+            return Effect.sync(() => {
+                waiters.delete(queued);
+            });
+        })).pipe(Effect.onInterrupt(() => (waiter?.granted === true ? release : Effect.void)));
+    });
+    return {
+        /** Holds one slot until the enclosing scope closes, waiting behind every earlier caller. */
+        take: Effect.uninterruptibleMask((restore) => Effect.andThen(enter(restore), Effect.addFinalizer(() => release))),
+        /** Holds one slot while `effect` runs, waiting behind every earlier caller. */
+        use: (effect) => Effect.uninterruptibleMask((restore) => Effect.andThen(enter(restore), restore(effect).pipe(Effect.ensuring(release)))),
+        /** Callers waiting for a slot now. */
+        waiting: () => waiters.size,
+    };
+};

package/dist/runtime/database/keepalive.d.ts

@@ -0,0 +1,11 @@
+import { Redacted } from "effect";
+/**
+ * Server-side probes let idle backends release a vanished runner's sessions
+ * and locks instead of waiting for the operating system's long defaults.
+ * Callers can tune the probes or restore the operating system's defaults.
+ */
+export declare const withKeepalives: <A extends {
+    readonly url?: Redacted.Redacted<string> | undefined;
+    readonly startupParameters?: Readonly<Record<string, string>> | undefined;
+    readonly startupOptions?: string | undefined;
+}>(config: A) => A;

package/dist/runtime/database/keepalive.js

@@ -0,0 +1,22 @@
+import { Redacted } from "effect";
+/**
+ * Server-side probes let idle backends release a vanished runner's sessions
+ * and locks instead of waiting for the operating system's long defaults.
+ * Callers can tune the probes or restore the operating system's defaults.
+ */
+export const withKeepalives = (config) => {
+    const url = config.url === undefined ? undefined : Redacted.value(config.url);
+    const options = config.startupOptions ??
+        (url !== undefined && URL.canParse(url) ? new URL(url).searchParams.get("options") : null) ??
+        "";
+    const named = new Set(Object.keys(config.startupParameters ?? {}).map((key) => key.toLowerCase()));
+    const defaults = Object.entries({
+        tcp_keepalives_idle: "5",
+        tcp_keepalives_interval: "2",
+        tcp_keepalives_count: "3",
+    })
+        .filter(([key]) => !named.has(key))
+        .map(([key, value]) => `-c ${key}=${value}`)
+        .join(" ");
+    return { ...config, startupOptions: `${defaults} ${options}`.trim() };
+};

package/dist/runtime/database/migrations.d.ts

@@ -0,0 +1,177 @@
+import { Effect } from "effect";
+import { Migrator, SqlClient } from "effect/sql";
+/** Every framework migration by id, applied in order above the latest applied id. */
+export declare const migrations: {
+    "0001_foundation": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    "0002_creation": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Every framework row carries its routing key, leading the primary key so a shard index can
+     * place it; state is opaque bytea.
+     *
+     * Placement and its encoding decide every row's routing key, so a change would fork each
+     * existing actor into a second identity.
+     */
+    "0003_routing_state": Effect.Effect<undefined, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Every intent and timer lives on its sender's shard. `bucket` is the top eight bits of
+     * `routing_key`, so the relay probes `(bucket, due_at_ms)` and never reads actors with
+     * nothing due.
+     */
+    "0004_outbox": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Application tables come from drizzle-kit; the framework only records which actor type owns
+     * each one, so a second owner cannot read its rows.
+     */
+    "0005_tables": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Events share the actor's routing key and commit with its turn. The sequence counter lives
+     * on the fenced generation row, so a pruned stream never reissues a cursor.
+     */
+    "0006_events": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * An effect is an outbox row whose executor runs when it is due. On success or exhaustion it
+     * becomes an intent to its route, so the route is delivered like any intent, with the effect
+     * id as its command id. `ambiguous` records whether the last attempt's outcome is unknown.
+     *
+     * Exhausted effects stay visible to operators after their row settles.
+     */
+    "0008_effects": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Blob entries are chunked bytea beside the actor's other rows: `append` adds a chunk
+     * without rewriting earlier ones, and `compact` folds them into chunk 0.
+     */
+    "0009_blobs": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Cleanup reads each actor type's oldest receipts and events by age, and keeps a receipt
+     * while an outbox row with its id can still be redelivered; these indexes keep every cleanup
+     * batch a range read.
+     */
+    "0010_retention": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Claims and backoff move `due_at_ms`, so `scheduled_at_ms` keeps the time a row first
+     * became due. `kind` follows `bucket` in the due index so intent scans never read effect
+     * rows waiting for an executor, and the reverse.
+     */
+    "0011_relay": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Workflow executions, their recorded steps, and the manifests deployments accepted. Every
+     * execution and step row lives on its owner's shard; a step row is written pending before
+     * its work starts and settled once.
+     */
+    "0012_workflows": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * The placement join keeps every view from being automatically updatable, so writes fail
+     * without triggers or rules to maintain.
+     *
+     * The catalog is how a tool checks which view versions a database has.
+     */
+    "0013_inspection_views": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * A connection's session lives beside the actor's rows; its socket and buffers live at the
+     * holder runner named by `holder` and `holder_epoch`.
+     */
+    "0014_connections": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    "0015_effect_control": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * An attempt can end an effect before its retries run out, as when its route rejects the
+     * result. `final_failure` records that, with the outcome, so a dead letter that fails to
+     * commit is retried without another provider call.
+     */
+    "0016_final_effect_failures": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Subscriptions fan out on the source's shard after commit: one row per (source,
+     * subscription, subscriber), routed rows with subscriber_id = ''. The tag summary makes the
+     * publisher's probe a key lookup per emitted tag, and the subscriber's cursor, on its own
+     * shard, deduplicates every delivery after its receipt is pruned. The due index leads with
+     * `subscriber_type` so a runner never scans types it doesn't register.
+     *
+     * The routed declarations of the deployment, by source type: a runner that serves a source
+     * must register every subscriber type routing from it, because the publishing turn creates
+     * the routed rows.
+     */
+    "0017_subscriptions": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Every tenant row admits only the tenant its transaction names. The table owner and
+     * superusers are exempt, so nothing changes until a deployment runs its turns and views as a
+     * role that is neither.
+     */
+    "0018_rls": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Content is stored once per tenant on the tenant's routing key; actors hold references on
+     * their own shard. Nothing counts references and no key points from a reference or a chunk
+     * to a content row: the sweep finds unreferenced content by scanning references, and grants
+     * gate it.
+     *
+     * Grants name the database they were issued by, so a key shared with another deployment
+     * never makes its grants valid here.
+     *
+     * Every tenant that ever uploaded, and when its content was last swept.
+     *
+     * A query reads references and chunks as the tenant role when row-level security is on;
+     * uploads, grants, and the sweep keep the exempt connecting role.
+     *
+     * The longest turn of each actor type that declares content, which the sweep waits out; it
+     * only grows, so a runner still on an earlier deploy with longer turns stays covered.
+     *
+     * The sweep join shows how far each tenant's collection lags, and keeps the view from being
+     * automatically updatable.
+     */
+    "0020_content_blobs": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Stored events and effect payloads carry the version of their class's migration chain they
+     * were written at; readers upcast from it. A settled effect row becomes its route intent and
+     * goes back to 0. The two tables let startup refuse a deploy that would strand a stored
+     * version: `actor_payload_versions` records each version some runtime has written, and
+     * `actor_payload_writers` is each runtime's heartbeat per version it writes, which a clear
+     * waits out before it scans. Nothing written before it has a recorded version, so a database
+     * that already holds events or effect rows is refused rather than guessed at.
+     *
+     * Columns are added at the end, which a view version allows.
+     */
+    "0021_payload_versions": Effect.Effect<undefined, Migrator.MigrationError | import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * A parent-placed type routes through its parent type's placement, so the parent is part of
+     * the record a later build must match.
+     */
+    "0022_parent_placement": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Every authorized operator action, and every authenticated one refused by scope. A repair
+     * writes its row in its own transaction, on the target actor's routing key, so the two
+     * commit together on one shard; a tenant-wide action uses the tenant's routing key. Rows are
+     * never pruned.
+     *
+     * The join keeps the view read-only, as every other `durable` view is.
+     */
+    "0023_operator_audit": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    "0024_adoption": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Per-view state of the fleet maintainer: its source, the hash of the
+     * definition that built its rows, its status, and how far it has applied
+     * the change feed. Framework state without a tenant, like `actor_tables`,
+     * so it carries no policy and no `durable` view.
+     */
+    "0025_fleet": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    /**
+     * Staged external work is named a job everywhere it is stored: the outbox kind, keyed-job
+     * timer keys, dead-letter columns, payload-version kinds, and the inspection views. Rows keep
+     * their ids, attempts, ambiguity, and cancellation marks, so a job in flight settles under the
+     * same id. Dropping the renamed views drops any grants on them.
+     *
+     * A subscription change lowers a tag count in place and deletes a count it
+     * lowered to 0 before its transaction commits, so a summary row may hold 0
+     * only inside that transaction.
+     */
+    "0026_jobs": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    "0027_coordination": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+    "0029_runner_configuration": Effect.Effect<void, import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+};
+/**
+ * Runs `record` like `Migrator`, but first refuses a database where a
+ * registered id below the latest applied one was never applied: `Migrator`
+ * would skip it forever, leaving its tables missing. The check runs again
+ * after the migrations because a concurrent runner with fewer migrations can
+ * commit a higher id between the first check and the migration lock.
+ */
+export declare const migrator: <E>(record: Record<string, Effect.Effect<void, E, SqlClient.SqlClient>>) => Effect.Effect<readonly (readonly [id: number, name: string])[], Migrator.MigrationError | import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+/** Applies every framework migration not yet recorded in `actor_migrations`, refusing a database that skipped one. */
+export declare const migrate: Effect.Effect<readonly (readonly [id: number, name: string])[], Migrator.MigrationError | import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;