@rikalabs/akter 0.1.0-alpha.0

package/dist/runtime/peering/transport.js

@@ -0,0 +1,175 @@
+import * as NodeSocket from "@effect/platform-node-shared/NodeSocket";
+import * as NodeSocketServer from "@effect/platform-node-shared/NodeSocketServer";
+import { constants, createPrivateKey, X509Certificate } from "node:crypto";
+import { connect, createSecureContext } from "node:tls";
+import { Clock, Context, Duration, Effect, Layer, Option, Redacted, Scope } from "effect";
+import { Runners, ShardingConfig } from "effect/cluster";
+import { RpcClient, RpcSerialization } from "effect/rpc";
+import { Socket, SocketServer } from "effect/socket";
+import { identity } from "./credentials.js";
+/**
+ * Whether a verified peer certificate belongs to the deployment `expected`
+ * names: its subject alternative names are exactly that one URI, so no
+ * extra name, Akter identity or otherwise, rides along.
+ */
+const belongs = (peer, expected) => peer?.subjectaltname === `URI:${expected}`;
+const certificates = (pem) => (pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/gu) ?? []).map((block) => new X509Certificate(block));
+const issued = (certificate, by) => certificate.checkIssued(by) && certificate.verify(by.publicKey);
+/**
+ * Checks credentials before any peer sees them and builds the TLS context
+ * that presents them, so a runner refuses to start, or keeps its previous
+ * credentials, rather than present a certificate its peers would refuse:
+ * one for another deployment, one outside its validity window, one its key
+ * does not match, or one no trusted authority issued. Session tickets are
+ * off, so every connection runs a full handshake and its peer's chain and
+ * validity are checked again rather than resumed from an earlier session.
+ */
+const prepare = (credentials, expected, now) => {
+    const authorities = certificates(credentials.ca);
+    const chain = certificates(credentials.certificate);
+    const leaf = chain[0];
+    if (authorities.length === 0 || authorities.some((authority) => !authority.ca))
+        throw new Error("Runner credentials need at least one certificate authority in ca");
+    if (leaf === undefined)
+        throw new Error("Runner credentials need a certificate");
+    if (!belongs({ subjectaltname: leaf.subjectAltName }, expected))
+        throw new Error(`Runner certificate must name only the identity ${expected}`);
+    if (now < Date.parse(leaf.validFrom) || now > Date.parse(leaf.validTo))
+        throw new Error(`Runner certificate is valid only from ${leaf.validFrom} to ${leaf.validTo}`);
+    if (!leaf.checkPrivateKey(createPrivateKey(Redacted.value(credentials.key))))
+        throw new Error("Runner key does not match its certificate");
+    for (const [index, certificate] of chain.entries()) {
+        const next = chain[index + 1];
+        if (next === undefined
+            ? !authorities.some((authority) => issued(certificate, authority))
+            : !issued(certificate, next))
+            throw new Error("Runner certificate is not issued by a certificate authority in ca");
+    }
+    return {
+        context: createSecureContext({
+            ca: credentials.ca,
+            cert: credentials.certificate,
+            key: Redacted.value(credentials.key),
+            minVersion: "TLSv1.3",
+            secureOptions: constants.SSL_OP_NO_TICKET,
+        }),
+        expires: Date.parse(leaf.validTo),
+    };
+};
+/**
+ * Whether this runner can still peer: false once its current certificate has
+ * expired, or once no credential load has succeeded for longer than the
+ * transport's `unhealthyAfter`. Readiness reports `peering` while it is false.
+ */
+export class PeerHealth extends Context.Service()("@rikalabs/akter/runtime/peering/transport/PeerHealth") {
+}
+/**
+ * Every client names the same server, so the listener picks the current
+ * credentials through its SNI callback whatever address the peer dialled.
+ */
+const SERVER_NAME = "runner.akter.internal";
+/**
+ * Runner-to-runner TCP with mutual TLS 1.3. Each side presents its
+ * deployment's certificate and accepts a peer only when the peer's chain
+ * reaches a trusted authority, is within its validity window, and carries
+ * exactly this deployment's identity; a plaintext peer, a peer without a
+ * certificate, and a peer of another deployment never reach the runner's RPC
+ * handler. Credentials are reloaded every `refreshEvery`: new connections use
+ * the latest valid ones, established connections keep the session they
+ * authenticated, and credentials that fail validation are logged and
+ * ignored while the previous ones stay in use. A runner whose certificate has
+ * expired, or whose loads have failed for `unhealthyAfter`, stops reporting
+ * ready.
+ */
+export const mtls = (options) => {
+    const expected = identity(options.deployment);
+    const duration = (value, name) => {
+        const result = Duration.fromInputUnsafe(value);
+        if (!Number.isFinite(Duration.toMillis(result)) || Duration.toMillis(result) < 1)
+            throw new Error(`${name} must be finite and at least 1 millisecond`);
+        return result;
+    };
+    const refreshEvery = duration(options.refreshEvery ?? "1 minute", "refreshEvery");
+    const refreshTimeout = duration(options.refreshTimeout ?? "10 seconds", "refreshTimeout");
+    const unhealthyAfter = duration(options.unhealthyAfter ?? "5 minutes", "unhealthyAfter");
+    return Layer.effectContext(Effect.gen(function* () {
+        const load = Effect.flatMap(options.credentials, (credentials) => Effect.flatMap(Clock.currentTimeMillis, (now) => Effect.sync(() => ({ ...prepare(credentials, expected, now), loaded: now })))).pipe(Effect.timeoutOrElse({
+            duration: refreshTimeout,
+            orElse: () => Effect.die(new Error(`Runner peer credentials took longer than ${Duration.toMillis(refreshTimeout)} ms`)),
+        }));
+        let current = yield* load.pipe(Effect.orDie);
+        yield* load.pipe(Effect.tap((next) => Effect.sync(() => {
+            current = next;
+        })), Effect.catchCause((cause) => Effect.logWarning("Runner peer credentials were not reloaded; keeping the current ones", cause)), Effect.delay(refreshEvery), Effect.forever, Effect.forkScoped);
+        const health = PeerHealth.of({
+            healthy: Effect.map(Clock.currentTimeMillis, (now) => now <= current.expires && now - current.loaded <= Duration.toMillis(unhealthyAfter)),
+        });
+        const config = yield* ShardingConfig.ShardingConfig;
+        const listen = Option.orElse(config.runnerListenAddress, () => config.runnerAddress);
+        if (Option.isNone(listen))
+            return yield* Effect.die(new Error("Runner.mtls needs a runner listen address"));
+        const server = yield* NodeSocketServer.makeTls({
+            host: listen.value.host,
+            port: listen.value.port,
+            minVersion: "TLSv1.3",
+            requestCert: true,
+            rejectUnauthorized: true,
+            secureOptions: constants.SSL_OP_NO_TICKET,
+            SNICallback: (_name, done) => done(null, current.context),
+        });
+        const accepted = (socket) => socket.authorized &&
+            !socket.isSessionReused() &&
+            belongs(socket.getPeerCertificate(), expected);
+        /**
+         * Opens one connection with the credentials current at that moment.
+         * The handshake stays interruptible, so the reader's open timeout
+         * abandons a listener that never answers it, such as a plaintext peer.
+         */
+        const open = (address) => Effect.gen(function* () {
+            let socket;
+            let secured = false;
+            yield* Scope.addFinalizer(yield* Effect.scope, Effect.sync(() => (secured ? socket?.destroySoon() : socket?.destroy())));
+            return yield* Effect.callback((resume) => {
+                socket = connect({
+                    host: address.host,
+                    port: address.port,
+                    servername: SERVER_NAME,
+                    secureContext: current.context,
+                    rejectUnauthorized: true,
+                    checkServerIdentity: (_host, peer) => belongs(peer, expected)
+                        ? undefined
+                        : new Error(`Peer at ${address.host}:${address.port} is not a runner of ${expected}`),
+                });
+                const opened = socket;
+                const refuse = (cause) => resume(Effect.fail(Socket.SocketError.make({
+                    reason: Socket.SocketOpenError.make({ kind: "Unknown", cause }),
+                })));
+                opened.once("secureConnect", () => {
+                    if (!accepted(opened)) {
+                        opened.destroy();
+                        return refuse(new Error(`Peer at ${address.host}:${address.port} is not a runner of ${expected}`));
+                    }
+                    secured = true;
+                    resume(Effect.succeed(opened));
+                });
+                opened.once("error", refuse);
+            });
+        });
+        const serialization = yield* RpcSerialization.RpcSerialization;
+        return Context.make(SocketServer.SocketServer, SocketServer.SocketServer.of({
+            address: server.address,
+            run: (handler) => server.run((socket) => Effect.gen(function* () {
+                const connection = Option.getOrUndefined(yield* Effect.serviceOption(NodeSocket.NetSocket));
+                if (connection !== undefined && accepted(connection))
+                    return yield* handler(socket);
+                connection?.destroy();
+            })),
+        })).pipe(Context.add(Runners.RpcClientProtocol, Runners.RpcClientProtocol.of({
+            codecFor: serialization.codecFor,
+            make: Effect.fnUntraced(function* (address) {
+                const socket = yield* NodeSocket.fromDuplex(open(address), { openTimeout: 1000 });
+                return yield* RpcClient.makeProtocolSocket().pipe(Effect.provideService(Socket.Socket, socket), Effect.provideService(RpcSerialization.RpcSerialization, serialization));
+            }, Effect.orDie),
+        })), Context.add(PeerHealth, health));
+    }));
+};

package/dist/runtime/queries.d.ts

@@ -0,0 +1,18 @@
+import { Context, type Crypto, Effect } from "effect";
+import { Sharding } from "effect/cluster";
+import { SqlClient } from "effect/sql";
+import { ActorError } from "../errors/actor.ts";
+import { type InternalActors } from "./actors.ts";
+import { type Request } from "./request.ts";
+import { type QueryRegistration, type Registration } from "./members.ts";
+import type { Holder } from "./connections/holder.ts";
+export declare const committedReads: ({ registrations, queryRegistrations, services, allow, primary, replica, holder, }: {
+    readonly registrations: ReadonlyMap<string, Registration>;
+    readonly queryRegistrations: ReadonlyMap<string, QueryRegistration>;
+    readonly services: Context.Context<SqlClient.SqlClient | Crypto.Crypto | Sharding.Sharding>;
+    readonly allow: (request: Request, kind?: "command" | "query" | "stream") => Effect.Effect<void, ActorError>;
+    readonly primary: SqlClient.SqlClient;
+    readonly replica: SqlClient.SqlClient | undefined;
+    /** This runner's connection holder, where a watch parks. */
+    readonly holder: Holder;
+}) => Pick<InternalActors["Service"], "exists" | "query" | "watch" | "pollWorkflow">;

package/dist/runtime/queries.js

@@ -0,0 +1,169 @@
+import { Context, Effect, Semaphore } from "effect";
+import { Sharding } from "effect/cluster";
+import { SqlClient, SqlError } from "effect/sql";
+import { ActorError, ActorUnavailable, InvalidInput, NotCreated, Timeout } from "../errors/actor.js";
+import {} from "./actors.js";
+import { Outcome } from "./request.js";
+import {} from "./members.js";
+import { watchStream } from "./connections/watch.js";
+import { caughtUp, QueryPool } from "./database/replica.js";
+import { withTenant } from "./database/tenancy.js";
+import { replayEvents } from "./events/replay.js";
+import { decompress, routingKey } from "./storage/codec.js";
+import { accountsUsage, UsageAccounting } from "./telemetry/usage.js";
+import { decodeResult } from "./workflows/engine.js";
+/**
+ * The runtime's reads of committed rows outside any turn: whether an actor
+ * exists, a query member's answer, and a workflow execution's status. Each
+ * read runs on the caller's node without an activation, generation fence,
+ * receipt, or command id, rechecks access after it reads, and fails an
+ * unreachable database as `ActorUnavailable`.
+ */
+/** Watch reruns one runner runs at once; another waits for a place. */
+const WATCH_RERUNS = 64;
+export const committedReads = ({ registrations, queryRegistrations, services, allow, primary, replica, holder, }) => {
+    const reruns = Semaphore.makeUnsafe(WATCH_RERUNS);
+    const queryPool = Context.get(services, QueryPool);
+    const usage = Context.getUnsafe(services, UsageAccounting);
+    const accounting = accountsUsage(usage) ? usage : undefined;
+    const exists = Effect.fnUntraced(function* (ref) {
+        const registration = registrations.get(ref.actor);
+        if (registration === undefined)
+            return yield* ActorError.make({
+                reason: ActorUnavailable.make({ cause: new Error("Actor not registered") }),
+            });
+        const sql = yield* SqlClient.SqlClient;
+        const rows = yield* sql `
+          SELECT 1 FROM actor_generations
+          WHERE routing_key = ${routingKey({ ref, placement: registration.placement })}
+            AND tenant_id = ${ref.tenant} AND actor_type = ${ref.actor} AND actor_id = ${ref.id}`.pipe(withTenant(ref.tenant));
+        return rows.length > 0;
+    }, Effect.provideContext(services), Effect.catchIf(SqlError.isSqlError, (cause) => Effect.fail(ActorError.make({ reason: ActorUnavailable.make({ cause }) }))));
+    /**
+     * A query's answer. A watch's rerun passes `reads` and skips both access
+     * checks, because its session was authorized at open and is reauthorized
+     * on its bound; the recorder fills `reads`.
+     */
+    const query = Effect.fnUntraced(function* (request, minVersion, reads) {
+        const registration = queryRegistrations.get(request.ref.actor);
+        const query = registration?.queries.get(request.command);
+        if (registration === undefined || query === undefined)
+            return yield* ActorError.make({
+                reason: ActorUnavailable.make({ cause: new Error("Query not registered") }),
+            });
+        if (reads === undefined)
+            yield* allow(request, "query");
+        const key = routingKey({ ref: request.ref, placement: registration.placement });
+        const read = (client) => Effect.gen(function* () {
+            const rows = yield* client `
+              SELECT event_sequence::text AS head, NULL AS key, NULL::bytea AS value
+              FROM actor_generations
+              WHERE routing_key = ${key} AND tenant_id = ${request.ref.tenant}
+                AND actor_type = ${request.ref.actor} AND actor_id = ${request.ref.id}
+              UNION ALL
+              SELECT NULL, key, value
+              FROM actor_state
+              WHERE routing_key = ${key} AND tenant_id = ${request.ref.tenant}
+                AND actor_type = ${request.ref.actor} AND actor_id = ${request.ref.id}`;
+            let head;
+            const state = [];
+            for (const row of rows)
+                if (row.head !== null)
+                    head = row.head;
+                else
+                    state.push([row.key, decompress(row.value)]);
+            if (head === undefined)
+                state.length = 0;
+            const cursor = head ?? "0";
+            const outcome = yield* query.run(request, state, cursor, (tag, after, limit) => replayEvents(request.ref, key, [tag], after, BigInt(cursor), limit).pipe(Effect.catchIf(SqlError.isSqlError, Effect.die), Effect.provideService(SqlClient.SqlClient, client), Effect.provideContext(services)), reads);
+            if (Outcome.guards.Defect(outcome) && SqlError.isSqlError(outcome.cause))
+                return yield* outcome.cause;
+            return outcome;
+        }).pipe(withTenant(request.ref.tenant), Effect.provideService(SqlClient.SqlClient, client));
+        const owned = registration.tables.length > 0 || registration.blobs.length > 0;
+        const local = owned ? primary : (queryPool ?? primary);
+        const outcome = yield* Effect.gen(function* () {
+            if (owned || replica === undefined)
+                return yield* read(local);
+            if (minVersion !== undefined) {
+                const ready = yield* caughtUp(replica, minVersion).pipe(Effect.catchIf(SqlError.isSqlError, () => Effect.succeed(false)));
+                if (!ready)
+                    return yield* read(local);
+            }
+            return yield* read(replica).pipe(Effect.catchIf(SqlError.isSqlError, () => read(local)));
+        }).pipe(Effect.timeoutOrElse({
+            duration: registration.timeoutMs,
+            orElse: () => Effect.fail(ActorError.make({ reason: Timeout.make({ commandId: request.commandId }) })),
+        }));
+        if (reads === undefined) {
+            yield* allow(request, "query");
+            if (accounting !== undefined && !Outcome.guards.Defect(outcome))
+                yield* accounting.read({
+                    ref: request.ref,
+                    requestToken: request.usageToken,
+                    watch: false,
+                    sql: primary,
+                });
+        }
+        return outcome;
+    }, Effect.provideContext(services), Effect.catchIf(SqlError.isSqlError, (cause) => Effect.fail(ActorError.make({ reason: ActorUnavailable.make({ cause }) }))));
+    return {
+        exists,
+        query: (request, minVersion) => query(request, minVersion),
+        watch: (request, { minVersion, expiresAt }) => Effect.gen(function* () {
+            const registration = registrations.get(request.ref.actor);
+            const watched = queryRegistrations.get(request.ref.actor)?.queries.get(request.command);
+            if (registration === undefined || watched === undefined)
+                return yield* ActorError.make({
+                    reason: ActorUnavailable.make({ cause: new Error("Query not registered") }),
+                });
+            if (!watched.watch)
+                return yield* ActorError.make({ reason: InvalidInput.make({ code: "not_watchable" }) });
+            if (!(yield* exists(request.ref)))
+                return yield* ActorError.make({ reason: NotCreated.make({}) });
+            const rerun = (version, reads) => reruns.withPermit(Effect.suspend(() => query(request, version(), reads)));
+            const { usageToken } = request;
+            let counted = false;
+            return yield* watchStream({
+                holder,
+                request,
+                minIntervalMs: registration.policy.watch.minIntervalMs,
+                reconcileMs: registration.policy.watch.reconcileMs,
+                minVersion,
+                expiresAt,
+                rerun: accounting === undefined || usageToken === undefined
+                    ? rerun
+                    : (version, reads) => rerun(version, reads).pipe(Effect.tap((outcome) => counted || Outcome.guards.Defect(outcome)
+                        ? Effect.void
+                        : allow(request, "query").pipe(Effect.andThen(accounting.read({
+                            ref: request.ref,
+                            requestToken: usageToken,
+                            watch: true,
+                            sql: primary,
+                        })), Effect.tap(() => Effect.sync(() => void (counted = true))), Effect.catchIf(SqlError.isSqlError, (cause) => Effect.fail(ActorError.make({ reason: ActorUnavailable.make({ cause }) })))))),
+            });
+        }),
+        pollWorkflow: Effect.fnUntraced(function* (request) {
+            const registration = registrations.get(request.ref.actor) ?? queryRegistrations.get(request.ref.actor);
+            if (registration === undefined)
+                return yield* ActorError.make({
+                    reason: ActorUnavailable.make({ cause: new Error("Actor not registered") }),
+                });
+            yield* allow(request);
+            const sql = yield* SqlClient.SqlClient;
+            const [row] = yield* sql `
+          SELECT status, result FROM actor_workflow_executions
+          WHERE routing_key = ${routingKey({ ref: request.ref, placement: registration.placement })}
+            AND execution_id = ${request.payload} AND tenant_id = ${request.ref.tenant}
+            AND actor_type = ${request.ref.actor} AND actor_id = ${request.ref.id}
+            AND workflow = ${request.command}`.pipe(withTenant(request.ref.tenant));
+            yield* allow(request);
+            if (row === undefined)
+                return undefined;
+            return {
+                finished: row.status === "finished",
+                result: row.result === null ? undefined : yield* decodeResult(row.result),
+            };
+        }, Effect.provideContext(services), Effect.catchIf(SqlError.isSqlError, (cause) => Effect.fail(ActorError.make({ reason: ActorUnavailable.make({ cause }) })))),
+    };
+};

package/dist/runtime/readiness.d.ts

@@ -0,0 +1,36 @@
+import { Context, Crypto, Effect } from "effect";
+import { Sharding } from "effect/cluster";
+import { SqlClient } from "effect/sql";
+/**
+ * Builds the runtime's readiness answer, returned as `serving`: not ready
+ * while routing is shut down, assigned shards are not acquired, a mutual TLS
+ * transport can no longer peer, or nothing is registered, otherwise ready
+ * when storage answers. PGlite always answers from the layer's own lifetime, since
+ * a single connection held by a turn would make a probe report unready;
+ * Postgres storage answers are reused for at most a second; public runner
+ * registration snapshots are checked on each probe.
+ */
+export declare const servingReadiness: (args_0: {
+    readonly sharding: Sharding.Sharding["Service"];
+    readonly services: Context.Context<SqlClient.SqlClient | Crypto.Crypto | Sharding.Sharding>;
+    readonly registrations: ReadonlyMap<string, unknown>;
+    readonly queryRegistrations: ReadonlyMap<string, unknown>;
+    readonly jobRegistrations: ReadonlyMap<string, unknown>;
+}) => Effect.Effect<{
+    serving: Effect.Effect<{
+        readonly ready: false;
+        readonly reason: "routing";
+    } | {
+        readonly ready: false;
+        readonly reason: "unregistered";
+    } | {
+        readonly ready: false;
+        readonly reason: "storage";
+    } | {
+        readonly ready: false;
+        readonly reason: "peering";
+    } | {
+        readonly reason?: undefined;
+        readonly ready: true;
+    }, never, never>;
+}, never, never>;

package/dist/runtime/readiness.js

@@ -0,0 +1,44 @@
+import { Context, Crypto, Effect, Option } from "effect";
+import { PgliteClient } from "@effect/sql-pglite";
+import { Sharding } from "effect/cluster";
+import { SqlClient } from "effect/sql";
+import { PeerHealth } from "./peering/transport.js";
+import { RunnerReadiness } from "./runner.js";
+/** How long readiness waits for the database before it reports storage unavailable. */
+const READINESS_STORAGE_TIMEOUT = "2 seconds";
+/** How long readiness reuses its last storage answer. */
+const READINESS_CACHE = "1 second";
+/**
+ * Builds the runtime's readiness answer, returned as `serving`: not ready
+ * while routing is shut down, assigned shards are not acquired, a mutual TLS
+ * transport can no longer peer, or nothing is registered, otherwise ready
+ * when storage answers. PGlite always answers from the layer's own lifetime, since
+ * a single connection held by a turn would make a probe report unready;
+ * Postgres storage answers are reused for at most a second; public runner
+ * registration snapshots are checked on each probe.
+ */
+export const servingReadiness = Effect.fnUntraced(function* ({ sharding, services, registrations, queryRegistrations, jobRegistrations, }) {
+    const embedded = Option.isSome(yield* Effect.serviceOption(PgliteClient.PgliteClient));
+    const runner = yield* Effect.serviceOption(RunnerReadiness);
+    const peering = yield* Effect.serviceOption(PeerHealth);
+    const storage = embedded
+        ? Effect.succeed(true)
+        : yield* Effect.gen(function* () {
+            const sql = yield* SqlClient.SqlClient;
+            return yield* sql `SELECT 1`.pipe(Effect.timeoutOption(READINESS_STORAGE_TIMEOUT), Effect.map(Option.isSome), Effect.orElseSucceed(() => false));
+        }).pipe(Effect.provideContext(services), Effect.cachedWithTTL(READINESS_CACHE));
+    const serving = Effect.gen(function* () {
+        if (yield* sharding.isShutdown)
+            return { ready: false, reason: "routing" };
+        if (registrations.size + queryRegistrations.size + jobRegistrations.size === 0)
+            return { ready: false, reason: "unregistered" };
+        if (!(yield* storage))
+            return { ready: false, reason: "storage" };
+        if (Option.isSome(peering) && !(yield* peering.value.healthy))
+            return { ready: false, reason: "peering" };
+        if (Option.isSome(runner) && !(yield* runner.value.acquired(sharding)))
+            return { ready: false, reason: "routing" };
+        return { ready: true };
+    });
+    return { serving };
+});

package/dist/runtime/registration.d.ts

@@ -0,0 +1,58 @@
+import { Context, Crypto, Effect } from "effect";
+import { Sharding } from "effect/cluster";
+import { SqlClient, SqlError } from "effect/sql";
+import type { ActorError } from "../errors/actor.ts";
+import type { JobRegistration, QueryRegistration, Registration } from "./members.ts";
+import type { InternalActors } from "./actors.ts";
+import type { PayloadDeclaration } from "../members/payload.ts";
+import type { AnyOwnedTable } from "../tables/owned.ts";
+import type { HeldActorType } from "./connections/holder.ts";
+import type { Owner } from "./connections/owner.ts";
+import type { Authorize } from "./connections/streams.ts";
+import type { Transport } from "./connections/transport.ts";
+import type { tenantContent } from "./content/store.ts";
+import type { TurnGate } from "./drain.ts";
+import { registerActor } from "./entity/register.ts";
+import type { SubscriptionRelay } from "./subscriptions/relay.ts";
+import { DefectLog } from "./telemetry/defects.ts";
+import { FrameworkClock } from "./turn/admission.ts";
+import { OutboxRuntime } from "./turn/outbox.ts";
+/**
+ * Registers actor, query, and job layers with the runtime. Each
+ * registration is refused unless its placement, tables, content, workflows,
+ * payload versions, and routed subscriptions agree with the database and the
+ * runtime's configuration; an accepted one is recorded for the relay, the
+ * connection holder, and the sweeps, and forgotten when its layer's scope
+ * closes.
+ */
+export declare const actorRegistration: ({ registrations, queryRegistrations, jobRegistrations, residency, diagnostics, owners, heldTypes, heldType, sweepsWorkflows, checked, services, frameworkClock, content, retryWindowMs, tableRole, adoptionRole, enforcedTypes, writerDeclarations, refreshPayloadWriters, subscriptions, transport, authorize, gate, writable, defectLog, outbox, }: {
+    readonly registrations: Map<string, Registration>;
+    readonly queryRegistrations: Map<string, QueryRegistration>;
+    readonly jobRegistrations: Map<string, JobRegistration>;
+    readonly residency: Map<string, (entityId: string) => boolean>;
+    /** Each actor type's view of its activations, for a delivery that timed out. */
+    readonly diagnostics: Map<string, Pick<Effect.Success<ReturnType<typeof registerActor>>, "diagnose" | "restarting">>;
+    readonly owners: Map<string, Owner>;
+    readonly heldTypes: Map<string, HeldActorType>;
+    readonly heldType: (registration: Registration) => HeldActorType;
+    readonly sweepsWorkflows: Set<string>;
+    readonly checked: Set<AnyOwnedTable>;
+    readonly services: Context.Context<SqlClient.SqlClient | Crypto.Crypto | Sharding.Sharding>;
+    readonly frameworkClock: (typeof FrameworkClock)["Service"];
+    readonly content: ReturnType<typeof tenantContent> | undefined;
+    readonly retryWindowMs: number;
+    readonly tableRole: string | undefined;
+    /** The writer role of enforced adopted tables, when the runtime has one. */
+    readonly adoptionRole: string | undefined;
+    /** Actor types whose turns take the writer role; filled as each type registers. */
+    readonly enforcedTypes: Set<string>;
+    readonly writerDeclarations: Array<PayloadDeclaration>;
+    readonly refreshPayloadWriters: Effect.Effect<void, SqlError.SqlError>;
+    readonly subscriptions: SubscriptionRelay;
+    readonly transport: Transport;
+    readonly authorize: Authorize;
+    readonly gate: TurnGate;
+    readonly writable: Effect.Effect<void, ActorError>;
+    readonly defectLog: DefectLog["Service"];
+    readonly outbox: (typeof OutboxRuntime)["Service"];
+}) => Pick<InternalActors["Service"], "register" | "registerQueries" | "registerJobs">;