@rikalabs/akter 0.1.0-alpha.0

package/dist/runtime/jobs/isolation.d.ts

@@ -0,0 +1,20 @@
+import { PgClient } from "@effect/sql-pg";
+import { PgliteClient } from "@effect/sql-pglite";
+import { Context, Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { ContentStore } from "../../handles/content.ts";
+/**
+ * Makes a job layer unassignable when its executors or its build need a
+ * SQL client or the content store, since a capability captured at build time
+ * would reach executors.
+ */
+export type NoDatabase<R> = [
+    Extract<R, SqlClient.SqlClient | PgClient.PgClient | PgliteClient.PgliteClient | ContentStore>
+] extends [never] ? unknown : {
+    readonly "Executors have no database capability": never;
+};
+/**
+ * Runs an executor attempt in its layer's build context without the SQL
+ * client or the content store, even when that layer was built where they are provided.
+ */
+export declare const withoutDatabase: (services: Context.Context<never>) => <A, E>(attempt: Effect.Effect<A, E>) => Effect.Effect<A, E>;

package/dist/runtime/jobs/isolation.js

@@ -0,0 +1,10 @@
+import { PgClient } from "@effect/sql-pg";
+import { PgliteClient } from "@effect/sql-pglite";
+import { Context, Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { ContentStore } from "../../handles/content.js";
+/**
+ * Runs an executor attempt in its layer's build context without the SQL
+ * client or the content store, even when that layer was built where they are provided.
+ */
+export const withoutDatabase = (services) => (attempt) => attempt.pipe(Effect.updateContext(() => Context.omit(SqlClient.SqlClient, PgClient.PgClient, PgliteClient.PgliteClient, ContentStore)(services)));

package/dist/runtime/jobs/progress.d.ts

@@ -0,0 +1,95 @@
+import { Context, Effect } from "effect";
+import type { ActorRef } from "../../identity/caller.ts";
+/** An encoded frame is at most this many bytes. */
+export declare const MAX_PROGRESS_BYTES = 4096;
+/** How long closing an attempt's progress waits on the sink before settling without it. */
+export declare const PROGRESS_CLOSE_WAIT_MS = 100;
+/** Progress messages one runner's executor pool sends per second at most. */
+export declare const RUNNER_PROGRESS_PER_SECOND = 2000;
+/** One progress frame on its way from an executor attempt to the owner. */
+export interface ProgressMessage {
+    readonly ref: ActorRef;
+    readonly jobId: string;
+    readonly job: string;
+    /** The attempt number of the job, from 1. */
+    readonly attempt: number;
+    /** Per attempt, from 1; counts the attempt's accepted `progress` calls. */
+    readonly seq: number;
+    /** The attempt's lease deadline on the database clock, as last claimed or renewed. */
+    readonly leaseUntil: number;
+    readonly frame: Uint8Array;
+}
+/** Sent after a job's terminal settle commits; no attempt of it reports again. */
+export interface ProgressClosed {
+    readonly ref: ActorRef;
+    readonly jobId: string;
+    readonly attempt: number;
+}
+declare const ProgressSink_base: Context.ServiceClass<ProgressSink, "@rikalabs/akter/runtime/jobs/progress/ProgressSink", {
+    readonly wants: (actor: string, job: string) => boolean;
+    readonly send: (message: ProgressMessage) => Effect.Effect<void>;
+    readonly closed: (message: ProgressClosed) => Effect.Effect<void>;
+}>;
+/**
+ * Where an executor pool sends progress. Sends are fire-and-forget: there is
+ * no acknowledgment or resend, and a lost message is a lost frame. Without a
+ * sink, or for a job `wants` rejects, the pool sends nothing.
+ */
+export declare class ProgressSink extends ProgressSink_base {
+}
+/**
+ * Sees every message a runner's pool sends before the runtime delivers it;
+ * `false` drops it. Tests record and drop progress here, between the pool and
+ * the owner.
+ */
+export declare const ProgressTap: Context.Reference<{
+    readonly send: (message: ProgressMessage) => Effect.Effect<boolean>;
+    readonly closed: (message: ProgressClosed) => Effect.Effect<boolean>;
+}>;
+/** One attempt's progress slot: latest wins, sent at most once per `everyMs`. */
+interface ProgressSlot {
+    /** False once nothing more will be sent, so a caller can skip encoding frames. */
+    readonly active: () => boolean;
+    /** Replaces the pending frame; ignored once closed. */
+    readonly offer: (frame: Uint8Array) => Effect.Effect<void>;
+    /**
+     * Ignores every later offer, then sends the pending frame, borrowing a
+     * token when none is free. It never fails with the sink and waits on it
+     * only briefly.
+     */
+    readonly close: Effect.Effect<void>;
+}
+/**
+ * A runner's progress pool. It holds one slot per running attempt and a
+ * runner-wide token bucket; a frame that finds no token stays in its slot,
+ * where newer frames replace it, until one is free. A closing slot's last
+ * frame borrows a token instead of waiting, so the debt delays later sends and
+ * the runner still averages `perSecond`. The bucket refills at `perSecond` up
+ * to a burst of one second's worth. Closing waits on the sink at most
+ * `PROGRESS_CLOSE_WAIT_MS`; a final frame still sending then finishes on its
+ * own. Closing sends the last frame even if a send was interrupted, and the
+ * closed message follows that attempt's last flush. Only jobs that could
+ * have opened a slot are closed, and an attempt that ends without a terminal
+ * settle keeps no flush (`forget`).
+ */
+export declare const progressPool: (options?: {
+    readonly perSecond?: number;
+} | undefined) => Effect.Effect<{
+    open: (attempt: {
+        readonly ref: ActorRef;
+        readonly jobId: string;
+        readonly job: string;
+        readonly attempt: number;
+        readonly everyMs: number | undefined;
+        readonly leaseUntil: () => number;
+    }) => Effect.Effect<ProgressSlot, never, never>;
+    closed: (attempt: {
+        readonly ref: ActorRef;
+        readonly jobId: string;
+        readonly job: string;
+        readonly attempt: number;
+        readonly everyMs: number | undefined;
+    }) => Effect.Effect<void, never, never>;
+    forget: (jobId: string) => Effect.Effect<boolean, never, never>;
+}, never, import("effect/Scope").Scope>;
+export {};

package/dist/runtime/jobs/progress.js

@@ -0,0 +1,144 @@
+import { Clock, Context, Effect, Fiber, Option, Queue } from "effect";
+/** An encoded frame is at most this many bytes. */
+export const MAX_PROGRESS_BYTES = 4096;
+/** How long closing an attempt's progress waits on the sink before settling without it. */
+export const PROGRESS_CLOSE_WAIT_MS = 100;
+/** Progress messages one runner's executor pool sends per second at most. */
+export const RUNNER_PROGRESS_PER_SECOND = 2000;
+/**
+ * Where an executor pool sends progress. Sends are fire-and-forget: there is
+ * no acknowledgment or resend, and a lost message is a lost frame. Without a
+ * sink, or for a job `wants` rejects, the pool sends nothing.
+ */
+export class ProgressSink extends Context.Service()("@rikalabs/akter/runtime/jobs/progress/ProgressSink") {
+}
+/**
+ * Sees every message a runner's pool sends before the runtime delivers it;
+ * `false` drops it. Tests record and drop progress here, between the pool and
+ * the owner.
+ */
+export const ProgressTap = Context.Reference("@rikalabs/akter/runtime/jobs/progress/ProgressTap", {
+    defaultValue: () => ({ send: () => Effect.succeed(true), closed: () => Effect.succeed(true) }),
+});
+const closedSlot = {
+    active: () => false,
+    offer: () => Effect.void,
+    close: Effect.void,
+};
+/**
+ * A runner's progress pool. It holds one slot per running attempt and a
+ * runner-wide token bucket; a frame that finds no token stays in its slot,
+ * where newer frames replace it, until one is free. A closing slot's last
+ * frame borrows a token instead of waiting, so the debt delays later sends and
+ * the runner still averages `perSecond`. The bucket refills at `perSecond` up
+ * to a burst of one second's worth. Closing waits on the sink at most
+ * `PROGRESS_CLOSE_WAIT_MS`; a final frame still sending then finishes on its
+ * own. Closing sends the last frame even if a send was interrupted, and the
+ * closed message follows that attempt's last flush. Only jobs that could
+ * have opened a slot are closed, and an attempt that ends without a terminal
+ * settle keeps no flush (`forget`).
+ */
+export const progressPool = Effect.fnUntraced(function* (options) {
+    const sink = Option.getOrUndefined(yield* Effect.serviceOption(ProgressSink));
+    const scope = yield* Effect.scope;
+    const perSecond = options?.perSecond ?? RUNNER_PROGRESS_PER_SECOND;
+    let tokens = perSecond;
+    let refilledAt = yield* Clock.currentTimeMillis;
+    const refill = Effect.map(Clock.currentTimeMillis, (now) => {
+        tokens = Math.min(perSecond, tokens + ((now - refilledAt) * perSecond) / 1000);
+        refilledAt = now;
+    });
+    /** Takes a token if one is free, or always when `borrow` is set, going into debt. */
+    const take = (borrow) => Effect.map(refill, () => {
+        if (tokens < 1 && !borrow)
+            return false;
+        tokens -= 1;
+        return true;
+    });
+    const awaitBriefly = (fiber) => Fiber.await(fiber).pipe(Effect.timeoutOption(PROGRESS_CLOSE_WAIT_MS), Effect.asVoid);
+    const detached = (effect) => effect.pipe(Effect.ignoreCause, Effect.forkIn(scope), Effect.tap(awaitBriefly));
+    const flushes = new Map();
+    const token = Effect.gen(function* () {
+        while (!(yield* take(false)))
+            yield* Effect.sleep(Math.ceil(((1 - tokens) * 1000) / perSecond));
+    });
+    const open = Effect.fnUntraced(function* (attempt) {
+        if (sink === undefined ||
+            attempt.everyMs === undefined ||
+            !sink.wants(attempt.ref.actor, attempt.job))
+            return closedSlot;
+        const everyMs = attempt.everyMs;
+        const signal = yield* Queue.sliding(1);
+        let seq = 0;
+        let closed = false;
+        let pending;
+        let inflight;
+        let sentAt;
+        const send = (frame) => sink
+            .send({
+            ref: attempt.ref,
+            jobId: attempt.jobId,
+            job: attempt.job,
+            attempt: attempt.attempt,
+            seq: frame.seq,
+            leaseUntil: attempt.leaseUntil(),
+            frame: frame.frame,
+        })
+            .pipe(Effect.ignoreCause);
+        const sender = yield* Effect.gen(function* () {
+            while (true) {
+                yield* Queue.take(signal);
+                if (sentAt !== undefined) {
+                    const wait = sentAt + everyMs - (yield* Clock.currentTimeMillis);
+                    if (wait > 0)
+                        yield* Effect.sleep(wait);
+                }
+                if (pending === undefined)
+                    continue;
+                yield* token;
+                const next = pending;
+                pending = undefined;
+                sentAt = yield* Clock.currentTimeMillis;
+                inflight = next;
+                yield* send(next);
+                inflight = undefined;
+            }
+        }).pipe(Effect.forkIn(scope));
+        return {
+            active: () => !closed,
+            offer: (frame) => Effect.suspend(() => {
+                if (closed)
+                    return Effect.void;
+                seq += 1;
+                pending = { seq, frame };
+                return Queue.offer(signal, undefined).pipe(Effect.asVoid);
+            }),
+            close: Effect.suspend(() => {
+                if (closed)
+                    return Effect.void;
+                closed = true;
+                return Fiber.interrupt(sender).pipe(Effect.andThen(Effect.suspend(() => {
+                    const last = pending ?? inflight;
+                    pending = undefined;
+                    inflight = undefined;
+                    if (last === undefined)
+                        return Effect.void;
+                    return Effect.andThen(take(true), send(last));
+                })), detached, Effect.map((flush) => {
+                    flushes.set(attempt.jobId, flush);
+                }));
+            }),
+        };
+    });
+    const closed = (attempt) => Effect.suspend(() => {
+        const flush = flushes.get(attempt.jobId);
+        flushes.delete(attempt.jobId);
+        if (sink === undefined ||
+            attempt.everyMs === undefined ||
+            !sink.wants(attempt.ref.actor, attempt.job))
+            return Effect.void;
+        return (flush === undefined ? Effect.void : awaitBriefly(flush)).pipe(Effect.andThen(sink.closed({ ref: attempt.ref, jobId: attempt.jobId, attempt: attempt.attempt })), detached, Effect.asVoid);
+    });
+    const forget = (jobId) => Effect.sync(() => flushes.delete(jobId));
+    return { open, closed, forget };
+});

package/dist/runtime/layer.d.ts

@@ -0,0 +1,260 @@
+import { PgClient } from "@effect/sql-pg";
+import { Crypto, Duration, Effect, Layer } from "effect";
+import { SqlClient, SqlError } from "effect/sql";
+import { Actors } from "../handles/actors.ts";
+import { InternalActors } from "./actors.ts";
+import type { AccessRequest } from "../policies/access.ts";
+import { pglite } from "./database/pglite.ts";
+import { DefectLog } from "./telemetry/defects.ts";
+import { OperatorRuntime } from "./operators/repair.ts";
+import { TelemetrySampler } from "./telemetry/sampler.ts";
+import { TurnConnections } from "./turn/pipeline.ts";
+import { ContentStore } from "../handles/content.ts";
+import { type GrantKey } from "./content/grant.ts";
+import { RuntimeControl } from "./drain.ts";
+import type { AnyFleetView } from "../tables/fleet.ts";
+/** Configuration for `Actors.layer`: authorization, actor and effect layers, timing, retention, and row-level security. */
+export interface Options {
+    /**
+     * The global authorization hook, asked about every external request beside
+     * the actor's own `access` policy; when both exist both must allow. With
+     * neither, `System` callers are allowed and `User` and `Anonymous` callers,
+     * which only arrive through `Actor.serve` or the client, are denied. Hooks
+     * should deny kinds they do not know.
+     */
+    readonly authorize?: (request: AccessRequest) => Effect.Effect<boolean>;
+    readonly retryWindowMs?: number;
+    /**
+     * Activations this runner keeps in memory at once. A command that needs a
+     * new activation past the limit fails `RunnerAtCapacity` and is retried
+     * until an idle actor hibernates or the delivery timeout passes. Default
+     * 10,000, which bounds runner memory; raise it with the memory you give the
+     * process.
+     */
+    readonly maxResidentActors?: number;
+    /**
+     * How this runner refuses external commands it cannot serve promptly. A
+     * refused command gets `ActorUnavailable` with a `retryAfter` before any of
+     * it runs, so load past capacity waits in callers' retries under the same
+     * command id instead of in this runner's queues.
+     */
+    readonly admission?: {
+        /** External commands worked on at once, from admission to reply. Default 64. */
+        readonly concurrency?: number;
+        /**
+         * How long a command past `concurrency` waits for a slot, in arrival
+         * order, before it is refused; at most `concurrency` commands wait.
+         * Default 100 milliseconds.
+         */
+        readonly wait?: Duration.Input;
+        /**
+         * Served command requests processed at once, including authentication and
+         * body parsing. The next is refused before either starts. Shared across
+         * this runtime's serve layers. Default 64.
+         */
+        readonly requests?: number;
+    };
+    /** The outbox relay of this runner; every default equals the single-runner M1 behaviour. */
+    readonly relay?: {
+        /** Durable polling interval, jittered by ±10% per wait. Default 1 second. */
+        readonly poll?: Duration.Input;
+        /** Intent rows one claim takes at most. Default 256. */
+        readonly passLimit?: number;
+        /** Intents delivered at once. Default 16. */
+        readonly deliveryConcurrency?: number;
+        /**
+         * How long a claimed intent stays out of every runner's scans. Default:
+         * the largest `commandTimeout + lockWait` of the registered actor types,
+         * plus 5 seconds.
+         */
+        readonly claimLease?: Duration.Input;
+        /** Cap on intent and subscription redelivery backoff. Default 256 seconds. */
+        readonly maxBackoff?: Duration.Input;
+        /**
+         * Subscription deliveries in flight at once, separate from intent
+         * slots; feed expansions and control registrations each get as many.
+         * Default 16.
+         */
+        readonly subscriptionConcurrency?: number;
+        /** Matching events one claimed subscription row delivers before it settles. Default 16. */
+        readonly subscriptionBatch?: number;
+    };
+    /** Telemetry this runner keeps beside the spans and metrics it reports. */
+    readonly observability?: {
+        /** Defect spans the runner keeps for `durable defects list`, newest last. Default 1,000. */
+        readonly defects?: number;
+        /**
+         * How often one runner of the deployment samples the database gauges
+         * (outbox rows, relay lag, stuck rows, subscription lag, pinned events).
+         * Default 15 seconds.
+         */
+        readonly sampleEvery?: Duration.Input;
+    };
+    /**
+     * How long this runtime keeps writing event and effect payload versions
+     * without refreshing its writer rows; it refreshes every half window and
+     * refuses new turns once a window passes without a refresh, so
+     * `durable payloads clear` can tell when no turn still writes an old
+     * version. Default 2 minutes, at least 1 second.
+     */
+    readonly payloadWriterWindow?: Duration.Input;
+    /**
+     * Shared content (`Actor.content`). Required when an actor type declares
+     * content or code uploads it.
+     */
+    readonly content?: {
+        /**
+         * Grant keys. The first signs; every listed key verifies. To rotate, put
+         * the new key first, keep the old one listed for one grant lifetime (an
+         * hour), then remove it.
+         */
+        readonly keys: ReadonlyArray<GrantKey>;
+        /** How long unreferenced content is kept after its last grant expires. Default 24 hours. */
+        readonly grace?: Duration.Input;
+        /**
+         * The most any two shards' database clocks may differ; attaches demand
+         * this much remaining grant validity and the sweep waits it out. Default 60 seconds.
+         */
+        readonly skew?: Duration.Input;
+    };
+    /** The job executor pool of this runner. */
+    readonly executors?: {
+        /** Job attempts running at once. Default 64. */
+        readonly concurrency?: number;
+        /** An attempt's claim, renewed every third of it; at least 3 seconds. Default 60 seconds. */
+        readonly lease?: Duration.Input;
+        /**
+         * How often a running attempt checks whether a turn on another runner
+         * cancelled its job; at least 1 second, at most a third of the lease.
+         * Default a third of the lease. A cancellation committed on the attempt's
+         * own runner reaches it at once.
+         */
+        readonly cancelCheck?: Duration.Input;
+    };
+    /**
+     * Opt-in row-level security. Command turns and queries run as `role` with
+     * the `durable.tenant` setting of the actor they serve, so the
+     * `durable_tenant` policies admit no other tenant's rows. The role must not
+     * be a superuser or bypass row-level security, this login must be able to
+     * `SET ROLE` to it, and it must read and write every framework and owned
+     * table. Every `durable` inspection view must belong to a separate
+     * view-owner role that the policies bind and that `role` is not a member
+     * of. The runtime refuses to start otherwise. Framework work that spans tenants, such as the relay,
+     * executors, and retention, keeps the connecting role, which the policies exempt.
+     */
+    readonly rowLevelSecurity?: {
+        readonly role: string;
+    };
+    /**
+     * The writer role of enforced adopted tables. A turn of an actor type that
+     * owns one runs as `role`, which the table's guard trigger admits and every
+     * other login is refused, so it needs read and write on every framework and
+     * owned table and must own none of them. This login must be able to `SET
+     * ROLE` to it. Set together with `rowLevelSecurity`, both must name the same
+     * role, because a turn takes one role. The runtime refuses to start an
+     * enforced table without it.
+     */
+    readonly adoption?: {
+        readonly role: string;
+    };
+    /**
+     * The fleet views this runtime maintains and serves. They need Postgres with
+     * `wal_level=logical`, a login with `REPLICATION`, and `durable fleet setup`;
+     * startup refuses otherwise, and PGlite refuses any view. One runner at a
+     * time maintains them, off the turn path.
+     */
+    readonly fleet?: ReadonlyArray<AnyFleetView>;
+}
+/**
+ * Builds the runtime: migrates and checks the database, registers every actor,
+ * effect, query, and subscription layer, and starts the relay and background
+ * sweeps. The returned layer provides `RuntimeControl`, and fails to build when
+ * the schema or declared payloads are incompatible.
+ *
+ * Constraints the wiring keeps:
+ * - Turns run through the drain gate, so a drain refuses new turns and
+ *   interrupts the rest. The runtime scope, not the caller, owns an in-flight
+ *   turn: interrupting a waiter never cancels it.
+ * - Commands are direct, so Cluster keeps no messages and the receipt is the
+ *   only admission record; a restarted activation or lost runner drops the
+ *   uncommitted attempt, the handle retries with the same command id, and the
+ *   receipt replays anything that committed. Durable intents use the
+ *   actor-shard outbox. Retries wait from the error's own `retryAfter`, bounded
+ *   in total by the delivery timeout.
+ * - Intents are admitted by their sending turn, so internal delivery skips the
+ *   external access and expiry checks: revocation stops new commands, not
+ *   committed obligations. A draining runner admits no new external work. Only
+ *   the relay presents a mint proof or delivers a subscription envelope.
+ * - A turn runs only in a resident activation. After a capacity rejection with
+ *   none resident, the latest attempt was not admitted, though an earlier one
+ *   may have committed.
+ * - Queries and feeds read committed rows on the caller's node without an
+ *   activation, generation fence, receipt, or command id. State and events are
+ *   read against one event head so they describe one moment; a replica answers
+ *   only once it has replayed the caller's commit version, else the primary
+ *   does. Types with owned tables or blobs read their state on the primary,
+ *   one server per query. No `statement_timeout` bounds query reads;
+ *   interrupting one past `commandTimeout` cancels its statement on the server.
+ *   Access is rechecked after the handler, so a result is released only to a
+ *   caller still allowed. A failed replay read is unavailability, not a defect.
+ * - Effect progress is fire-and-forget to the performing actor's connection
+ *   entity: no retry, no acknowledgment, and a lost message is a lost frame.
+ *   Each effect's last frame is awaited so its close never overtakes it.
+ * - Payload versions this runtime writes are recorded and heartbeat before a
+ *   type takes any shard, refreshed one at a time with the time taken before
+ *   the statement is sent, so the gate's window can only end early.
+ * - Content grants are bound to the database's deployment id. The content
+ *   sweep waits out the longest turn that may attach content across every
+ *   runner, and each tenant is swept at most once an hour.
+ * - Exactly one runner of the deployment runs the telemetry sampler; runtimes
+ *   sharing one Sharding in a process share its one sampler.
+ * - Readiness on PGlite always answers from the layer's own lifetime, since a
+ *   single connection held by a turn would make a probe report unready; on
+ *   Postgres the database answers at most once a second.
+ * - PGlite keeps runner bookkeeping in memory because SqlRunnerStorage would
+ *   reserve its single connection for the layer's lifetime. Postgres uses
+ *   advisory locks, held by a live session, so no second runner can take a
+ *   shard while its holder runs.
+ * - An unreachable database fails a read as `ActorUnavailable`, which callers
+ *   retry like any delivery failure; it is not a defect.
+ */
+export declare const layer: (options?: Options) => Layer.Layer<Actors | ContentStore | DefectLog | InternalActors | OperatorRuntime | RuntimeControl | TelemetrySampler, import("effect/sql/Migrator").MigrationError | SqlError.SqlError, Crypto.Crypto | SqlClient.SqlClient>;
+/** Database layers for `Actors.layer`: `postgres` for real deployments, `pglite` for embedded and test use. */
+export declare const Database: {
+    /**
+     * A runner holds three primary pools, plus optional replica and coordination
+     * pools. Turns lease sessions from the turn pool, `maxConnections` (default
+     * 50): a command holds one session until its transaction ends, so a pool
+     * smaller than the commands in flight queues callers behind
+     * it. Queries read from the query pool, `queryConnections` (default 10),
+     * except those of types with owned tables or blobs. Command admission,
+     * receipt replays, the relay, migrations, and cluster storage use the
+     * off-turn pool, `offTurnConnections` (default 10), unless `coordination`
+     * moves Cluster storage and deployment locks to an independent unsharded
+     * primary. All runners must designate the same authority. Every pool opens
+     * connections only as load needs them, refuses checkouts past its
+     * connections plus a bounded waiter allowance, and hands its connections out
+     * first come, first served. Keep the sum across runners below the server's
+     * `max_connections`.
+     *
+     * `replica` is this runner's nearest streaming replica of the same primary.
+     * Queries read there once it has replayed the commit version their caller
+     * last saw, and read the primary when it is behind or fails. Its pool
+     * (`maxConnections` default 10) opens connections only as queries need them.
+     * Every pool requests server TCP keepalives at 5 seconds idle, 2 seconds
+     * between probes, and 3 probes. `startupParameters` overrides these defaults
+     * independently on the primary and replica configurations.
+     *
+     * Registers a `regclass` codec because the pinned driver lacks one and the
+     * migrator needs it on restart; remove once Effect #8309 lands.
+     */
+    postgres: (options: Omit<PgClient.PgPoolConfig, "types"> & {
+        readonly offTurnConnections?: number;
+        readonly queryConnections?: number;
+        readonly neki?: boolean;
+        readonly replica?: Omit<PgClient.PgPoolConfig, "types"> | undefined;
+        /** An unsharded primary shared by every runner; owns coordination rows and Cluster and fleet locks. */
+        readonly coordination?: Omit<PgClient.PgPoolConfig, "types"> | undefined;
+    }) => Layer.Layer<PgClient.PgClient | SqlClient.SqlClient | TurnConnections, SqlError.SqlError, never>;
+    pglite: typeof pglite;
+};