@rikalabs/akter 0.1.0-alpha.0

package/dist/runtime/turn/rows.d.ts

@@ -0,0 +1,43 @@
+import { SQL } from "drizzle-orm";
+import * as PostgresDrizzle from "drizzle-orm/effect-postgres";
+import { Effect, Option } from "effect";
+import { SqlClient, SqlError } from "effect/sql";
+import { type Group, type Filter, type AnyOwnedTable, type ScopedRead, type TableScope } from "../../tables/owned.ts";
+type Database = PostgresDrizzle.EffectPgDatabase;
+/** Drizzle bound to the runtime's own client, so it shares the turn connection. */
+export declare const rowsDatabase: Effect.Effect<Option.None<Database> | Option.Some<Database>, never, never>;
+/**
+ * Renders an application filter on `table` as SQL after `copyFilter` has
+ * checked and copied it, for reads the framework builds outside a turn.
+ */
+export declare const filterSql: ({ table, filter, }: {
+    readonly table: AnyOwnedTable;
+    readonly filter: Filter<AnyOwnedTable>;
+}) => SQL<unknown> | undefined;
+/**
+ * Binds owned-table reads and, when `write` is set, mutations to one turn's
+ * actor. Writes join the turn's transaction or fail; reads outside a
+ * transaction, as in a stream handler, run in their own tenant transaction.
+ * Drizzle wraps driver failures, so the inner `SqlError` is surfaced to let it
+ * decide between a retried turn and a deterministic defect. Off-turn contexts
+ * get no mutation methods at all, whatever their static type. A group query is
+ * read once per part and re-built from the framework's own client, so the
+ * caller's select object never runs.
+ */
+export declare const bindTables: (database: Option.Option<Database>, scope: TableScope, write: boolean, checked: ReadonlySet<AnyOwnedTable>) => Effect.Effect<{
+    rows: (table: AnyOwnedTable) => ScopedRead<AnyOwnedTable>;
+    group: Group;
+}, never, SqlClient.SqlClient>;
+/** How a layer registers adopted tables: its writer role, and whether the registering layer writes them. */
+export interface AdoptionStartup {
+    readonly role: string | undefined;
+    readonly writes: boolean;
+}
+/**
+ * Records which actor type owns each declared table and checks that the
+ * physical table's primary key leads with the ownership columns. A table
+ * claimed by another actor type, missing, or keyed without ownership fails
+ * startup instead of running unscoped.
+ */
+export declare const checkTables: (actor: string, tables: readonly AnyOwnedTable[], role: string | undefined, adoption: AdoptionStartup) => Effect.Effect<boolean, SqlError.SqlError, SqlClient.SqlClient>;
+export {};

package/dist/runtime/turn/rows.js

@@ -0,0 +1,592 @@
+import { PgClient } from "@effect/sql-pg";
+import { PgliteClient } from "@effect/sql-pglite";
+import { and, Column, count, entityKind, eq, getTableColumns, is, noopEncoder, Param, relationsFilterToSQL, relationsOrderToSQL, SQL, sql as fragment, StringChunk, Table, } from "drizzle-orm";
+import * as PostgresDrizzle from "drizzle-orm/effect-postgres";
+import * as PgliteDrizzle from "drizzle-orm/effect-pglite";
+import { PgSelectBase, } from "drizzle-orm/pg-core";
+import { Cause, Effect, Option, Predicate } from "effect";
+import { SqlClient, SqlError } from "effect/sql";
+import { checkAdoptedTable, checkOwnedTable, inTenant, TenantScope } from "../database/tenancy.js";
+import { checkEnforcedTable, checkWriterRole } from "../adoption/startup.js";
+import { ownerIndexExists, ownerIndexSql } from "../adoption/plan.js";
+import { routingKey as routingKeyOf } from "../storage/codec.js";
+import { OWNERSHIP, ownership, } from "../../tables/owned.js";
+/** Drizzle bound to the runtime's own client, so it shares the turn connection. */
+export const rowsDatabase = Effect.gen(function* () {
+    const pglite = yield* Effect.serviceOption(PgliteClient.PgliteClient);
+    if (Option.isSome(pglite)) {
+        const database = yield* PgliteDrizzle.makeWithDefaults().pipe(Effect.provideService(PgliteClient.PgliteClient, pglite.value));
+        return Option.some(database);
+    }
+    const postgres = yield* Effect.serviceOption(PgClient.PgClient);
+    if (Option.isNone(postgres))
+        return Option.none();
+    return Option.some(yield* PostgresDrizzle.makeWithDefaults().pipe(Effect.provideService(PgClient.PgClient, postgres.value)));
+});
+const isEntity = (value) => value instanceof Object && entityKind in value.constructor;
+const isRecord = (value) => {
+    const prototype = value === null || value === undefined ? undefined : Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+};
+const CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const reject = (message) => {
+    throw new Error(message);
+};
+const checkColumn = (info, key, write) => {
+    if (info.ownerKeys.includes(key) && (write || !info.adopted || key === info.routingKey))
+        reject(`Ownership column ${key} of ${info.name} comes from the turn, not the application`);
+    if (!info.columns.includes(key))
+        reject(`Unknown column ${key} of ${info.name}`);
+};
+/**
+ * Copies an application value into fresh primitives, dates, bytes, arrays, and
+ * plain records. Drizzle renders anything with `getSQL` as SQL, so a function,
+ * class instance, or SQL wrapper anywhere inside is rejected, and the copy
+ * means a getter cannot change the value after it was checked. Dates are
+ * structured-cloned so own properties such as `getSQL` are dropped.
+ */
+const copyOperand = (info, value) => {
+    if (value === null || value === undefined)
+        return value;
+    if (Predicate.isString(value) ||
+        Predicate.isNumber(value) ||
+        Predicate.isBigInt(value) ||
+        Predicate.isBoolean(value))
+        return value;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype === Date.prototype)
+        return structuredClone(value);
+    if (value instanceof Uint8Array && (prototype === Uint8Array.prototype || Buffer.isBuffer(value)))
+        return Uint8Array.from(value);
+    if (Array.isArray(value) && prototype === Array.prototype)
+        return value.map((item) => copyOperand(info, item));
+    if (!isRecord(value))
+        return reject(`Values on ${info.name} are plain data, not SQL or objects`);
+    const copy = {};
+    for (const key of Object.keys(value)) {
+        if (key === "RAW")
+            reject(`RAW filters on ${info.name} are not supported`);
+        copy[key] = copyOperand(info, value[key]);
+    }
+    return copy;
+};
+const copyValues = (info, values) => {
+    if (!isRecord(values))
+        reject(`Rows of ${info.name} are plain objects`);
+    for (const key of Object.keys(values))
+        checkColumn(info, key, true);
+    return copyOperand(info, values);
+};
+/**
+ * Copies a filter, rejecting `RAW` and reserved columns. A bare date or byte
+ * string as a column's value is refused because Drizzle reads any object there
+ * as an operator map and would match every row instead of one.
+ */
+const copyFilter = (info, filter) => {
+    if (!isRecord(filter))
+        return reject(`Filters on ${info.name} are plain objects`);
+    const copy = {};
+    for (const key of Object.keys(filter)) {
+        const value = filter[key];
+        if (key === "RAW")
+            reject(`RAW filters on ${info.name} are not supported`);
+        else if (key === "AND" || key === "OR") {
+            if (!Array.isArray(value))
+                return reject(`${key} on ${info.name} takes an array`);
+            copy[key] = value.map((item) => copyFilter(info, item));
+        }
+        else if (key === "NOT")
+            copy[key] = copyFilter(info, value);
+        else {
+            checkColumn(info, key, false);
+            const operand = copyOperand(info, value);
+            if (operand instanceof Date || operand instanceof Uint8Array)
+                reject(`Compare ${key} of ${info.name} with { eq: value }`);
+            copy[key] = operand;
+        }
+    }
+    return copy;
+};
+/**
+ * Renders an application filter on `table` as SQL after `copyFilter` has
+ * checked and copied it, for reads the framework builds outside a turn.
+ */
+export const filterSql = ({ table, filter, }) => {
+    const info = ownership(table);
+    if (info === undefined)
+        return reject("Filters apply to owned tables");
+    return relationsFilterToSQL(table, copyFilter(info, filter));
+};
+const checkOrder = (info, order) => {
+    for (const [key, direction] of Object.entries(order)) {
+        checkColumn(info, key, false);
+        if (direction !== "asc" && direction !== "desc")
+            reject(`Order on ${info.name} is "asc" or "desc"`);
+    }
+};
+/**
+ * The words Drizzle's comparison, boolean, pattern, and aggregate operators
+ * emit; any other SQL text in a group query is rejected so raw fragments
+ * cannot name other tables, subqueries, or comments.
+ */
+const OPERATOR_TEXT = /^(?:\s+|[(),*=<>!~@&|]+|and|or|not|in|is|null|like|ilike|between|asc|desc|nulls|first|last|distinct|true|false|count|sum|avg|min|max|lower|upper|coalesce)*$/i;
+const GROUP = {
+    name: "a group query",
+    schema: undefined,
+    table: "",
+    columns: [],
+    primaryKey: [],
+    owner: undefined,
+    adopted: false,
+    access: "read",
+    ownerKeys: [],
+    ownerColumns: [],
+    routingKey: undefined,
+    tenantKey: "",
+    actorKey: "",
+    tenantKind: "text",
+    actorKind: "text",
+    placement: undefined,
+};
+/**
+ * Rebuilds a group query's expressions from values read once, so what was
+ * checked is exactly what renders: getters, proxies, and hidden `getSQL`
+ * members on the caller's objects never reach Drizzle. Columns resolve to the
+ * real columns of the query's owned tables, text must be operator words with
+ * balanced parentheses (the scope predicate is parenthesized beside it), and
+ * parameters carry copied plain data. A decoder only maps result values in
+ * JavaScript, so it is rebound rather than trusted; a column decoder resolves
+ * like any other column.
+ */
+const groupRebuilder = (tables) => {
+    const column = (node) => {
+        const table = node.table;
+        const name = node.name;
+        if (!tables.includes(table))
+            return reject("Group queries reference columns of the tables they select from or join");
+        if (ownership(table).ownerColumns.includes(name))
+            return reject("Group queries do not read or filter ownership columns");
+        const real = Object.values(getTableColumns(table)).find((candidate) => candidate.name === name);
+        return real ?? reject(`Unknown column ${name}`);
+    };
+    const expression = (root) => {
+        let depth = 0;
+        const walk = (node) => {
+            if (node === undefined)
+                return undefined;
+            if (Array.isArray(node))
+                return node.map(walk);
+            if (is(node, StringChunk)) {
+                const text = String(node.value);
+                if (!OPERATOR_TEXT.test(text))
+                    reject(`Group queries support Drizzle operators, not raw SQL: ${text}`);
+                for (const character of text) {
+                    if (character === "(")
+                        depth += 1;
+                    else if (character === ")")
+                        depth -= 1;
+                    if (depth < 0)
+                        reject("Group query expressions must balance their parentheses");
+                }
+                return new StringChunk(text);
+            }
+            if (is(node, SQL.Aliased)) {
+                const alias = String(node.fieldAlias);
+                return new SQL.Aliased(walk(node.sql), alias);
+            }
+            if (is(node, SQL)) {
+                const decoder = node.decoder;
+                const rebuilt = new SQL(walk([...node.queryChunks]));
+                rebuilt.decoder = is(decoder, Column)
+                    ? column(decoder)
+                    : { mapFromDriverValue: decoder.mapFromDriverValue.bind(decoder) };
+                return rebuilt;
+            }
+            if (is(node, Column))
+                return column(node);
+            if (is(node, Param)) {
+                const encoder = node.encoder;
+                const value = copyOperand(GROUP, node.value);
+                if (encoder === noopEncoder)
+                    return new Param(value);
+                if (is(encoder, Column))
+                    return new Param(value, column(encoder));
+                return reject("Group query parameters are plain values");
+            }
+            if (isEntity(node))
+                return reject("Group queries cannot reference tables, subqueries, names, or placeholders");
+            return copyOperand(GROUP, node);
+        };
+        const rebuilt = walk(root);
+        if (depth !== 0)
+            reject("Group query expressions must balance their parentheses");
+        return rebuilt;
+    };
+    const selection = (fields) => {
+        if (is(fields, Column))
+            return column(fields);
+        if (is(fields, SQL) || is(fields, SQL.Aliased))
+            return expression(fields);
+        if (isEntity(fields) || !isRecord(fields))
+            return reject("Group queries select columns and Drizzle expressions");
+        const copy = {};
+        for (const key of Object.keys(fields))
+            copy[key] = selection(fields[key]);
+        return copy;
+    };
+    return { expression, selection };
+};
+/**
+ * Binds owned-table reads and, when `write` is set, mutations to one turn's
+ * actor. Writes join the turn's transaction or fail; reads outside a
+ * transaction, as in a stream handler, run in their own tenant transaction.
+ * Drizzle wraps driver failures, so the inner `SqlError` is surfaced to let it
+ * decide between a retried turn and a deterministic defect. Off-turn contexts
+ * get no mutation methods at all, whatever their static type. A group query is
+ * read once per part and re-built from the framework's own client, so the
+ * caller's select object never runs.
+ */
+export const bindTables = Effect.fnUntraced(function* (database, scope, write, checked) {
+    const sql = yield* SqlClient.SqlClient;
+    const connection = yield* Effect.serviceOption(sql.transactionService);
+    const { role } = yield* TenantScope;
+    if (write && Option.isNone(connection))
+        return yield* Effect.die(new Error("Owned rows need the turn transaction"));
+    const db = Option.getOrUndefined(database);
+    const run = (build) => Effect.andThen(scope.guard, () => Option.isNone(database)
+        ? Effect.die(new Error("Owned tables need a PgClient or PgliteClient database"))
+        : Effect.suspend(build).pipe((effect) => Option.isSome(connection)
+            ? Effect.provideService(effect, sql.transactionService, connection.value)
+            : inTenant({ sql, role, tenant: scope.ref.tenant })(effect), Effect.catch((error) => {
+            const wrapped = Predicate.hasProperty(error, "cause") ? error.cause : undefined;
+            const cause = Cause.isCause(wrapped) ? Cause.squash(wrapped) : wrapped;
+            return Effect.die(SqlError.isSqlError(cause) ? cause : error);
+        })));
+    const { ref } = scope;
+    const routingKey = routingKeyOf({ ref, placement: scope.placement });
+    const ownerOf = (info) => {
+        const owner = { [info.tenantKey]: ref.tenant, [info.actorKey]: ref.id };
+        if (info.routingKey === undefined)
+            return owner;
+        return { ...owner, [info.routingKey]: routingKey };
+    };
+    /**
+     * Off-turn contexts and read-adopted tables get no mutation methods at all,
+     * whatever their static type.
+     */
+    const rows = (table) => {
+        const info = ownership(table);
+        const check = () => {
+            if (info === undefined || !scope.tables.includes(table))
+                reject(`${info?.name ?? "This table"} is not an owned table of ${ref.actor}`);
+            if (info.tenantKind === "uuid" && !CANONICAL_UUID.test(ref.tenant))
+                reject(`${info.name} maps a uuid tenant column, and tenant ${ref.tenant} is not a lowercase uuid`);
+            if (info.actorKind === "uuid" && !CANONICAL_UUID.test(ref.id))
+                reject(`${info.name} maps a uuid actor column, and actor id ${ref.id} is not a lowercase uuid`);
+            return info;
+        };
+        const columns = getTableColumns(table);
+        const where = (filter) => {
+            const info = check();
+            const copy = filter === undefined ? {} : copyFilter(info, filter);
+            return and(info.routingKey === undefined ? undefined : eq(columns[info.routingKey], routingKey), eq(columns[info.tenantKey], ref.tenant), eq(columns[info.actorKey], ref.id), relationsFilterToSQL(table, copy));
+        };
+        const fields = () => Object.fromEntries(check().columns.map((key) => [key, columns[key]]));
+        const order = (orderBy) => {
+            if (orderBy === undefined)
+                return [];
+            checkOrder(check(), orderBy);
+            const sql = relationsOrderToSQL(table, orderBy);
+            return sql === undefined ? [] : [sql];
+        };
+        const list = (options) => {
+            const query = db
+                .select(fields())
+                .from(table)
+                .where(where(options.where))
+                .orderBy(...order(options.orderBy))
+                .$dynamic();
+            const limited = options.limit === undefined ? query : query.limit(options.limit);
+            return options.offset === undefined ? limited : limited.offset(options.offset);
+        };
+        const prepare = (values) => {
+            const info = check();
+            const list = Array.isArray(values) ? values : [values];
+            const owner = ownerOf(info);
+            return {
+                info,
+                list: list.map((value) => ({ ...copyValues(info, value), ...owner })),
+            };
+        };
+        const wrote = Effect.sync(() => scope.wrote?.(check().name));
+        const filtered = (mutation) => ({
+            where: (filter) => run(() => mutation(filter)).pipe(Effect.tap(() => wrote), Effect.asVoid),
+        });
+        const read = {
+            one: (options = {}) => run(() => list({ ...options, limit: 1 })).pipe(Effect.map((found) => Option.fromNullishOr(found[0]))),
+            all: (options = {}) => run(() => list(options)),
+            count: (options = {}) => run(() => db
+                .select({ rows: count() })
+                .from(table)
+                .where(where(options.where))
+                .pipe(Effect.map((found) => found[0]?.rows ?? 0))),
+        };
+        if (!write || info?.access === "read")
+            return read;
+        return {
+            ...read,
+            insert: (values) => run(() => {
+                const { list } = prepare(values);
+                return list.length === 0 ? Effect.void : db.insert(table).values(list);
+            }).pipe(Effect.tap(() => wrote), Effect.asVoid),
+            upsert: (values) => run(() => {
+                const { info, list } = prepare(values);
+                if (list.length === 0)
+                    return Effect.void;
+                const target = (info.adopted ? info.primaryKey : [...OWNERSHIP, ...info.primaryKey]).map((key) => columns[key]);
+                const set = Object.fromEntries([...new Set(list.flatMap((value) => Object.keys(value)))].flatMap((key) => info.primaryKey.includes(key) || (info.ownerKeys.includes(key) && !info.adopted)
+                    ? []
+                    : [[key, fragment `excluded.${fragment.identifier(columns[key].name)}`]]));
+                const insert = db.insert(table).values(list);
+                if (!info.adopted)
+                    return Object.keys(set).length === 0
+                        ? insert.onConflictDoNothing({ target })
+                        : insert.onConflictDoUpdate({ target, set });
+                delete set[info.tenantKey];
+                delete set[info.actorKey];
+                const first = columns[info.primaryKey[0]];
+                const applied = insert
+                    .onConflictDoUpdate({
+                    target,
+                    set: Object.keys(set).length === 0
+                        ? { [info.primaryKey[0]]: fragment `excluded.${fragment.identifier(first.name)}` }
+                        : set,
+                    setWhere: and(eq(columns[info.tenantKey], ref.tenant), eq(columns[info.actorKey], ref.id)),
+                })
+                    .returning({ key: first });
+                return applied.pipe(Effect.flatMap((written) => written.length === list.length
+                    ? Effect.void
+                    : Effect.die(new Error(`An upsert of ${info.name} reached a primary key that belongs to another actor`))));
+            }).pipe(Effect.tap(() => wrote), Effect.asVoid),
+            update: (values) => filtered((filter) => {
+                const copy = copyValues(check(), values);
+                if (Object.keys(copy).length === 0)
+                    reject(`An update of ${check().name} sets at least one column`);
+                return db.update(table).set(copy).where(where(filter));
+            }),
+            delete: () => filtered((filter) => db.delete(table).where(where(filter))),
+        };
+    };
+    const inGroup = (table) => {
+        const columns = getTableColumns(table);
+        const info = ownership(table);
+        return and(eq(columns[info.routingKey], routingKey), eq(columns[info.tenantKey], ref.tenant));
+    };
+    const ownedTable = (table) => {
+        if (!is(table, Table) || !checked.has(table))
+            return reject("Group queries read tables registered by an actor type, not aliases or subqueries");
+        if (ownership(table).access === "read")
+            return reject("Group queries cannot read a table adopted for reading only");
+        return table;
+    };
+    const bound = (value) => {
+        if (value === undefined)
+            return undefined;
+        if (!Predicate.isNumber(value))
+            return reject("Group query limits are numbers");
+        return value;
+    };
+    const group = (build) => run(() => {
+        const query = build({
+            select: db.select.bind(db),
+            selectDistinct: db.selectDistinct.bind(db),
+        });
+        if (!is(query, PgSelectBase))
+            return reject("A group query is a Drizzle select");
+        const config = {
+            ...query.config,
+        };
+        if ((config.withList?.length ?? 0) > 0)
+            reject("Group queries cannot use WITH");
+        if (config.setOperators.length > 0)
+            reject("Group queries cannot use set operators");
+        if (config.lockingClause !== undefined)
+            reject("Group queries are read-only and take no locks");
+        if (config.comment !== undefined)
+            reject("Group queries take no SQL comments");
+        if (config.distinct !== undefined && config.distinct !== false && config.distinct !== true)
+            reject("Group queries support selectDistinct, not DISTINCT ON");
+        const from = ownedTable(config.table);
+        const joins = [...(config.joins ?? [])].map((join) => {
+            const joinType = join.joinType;
+            const lateral = join.lateral;
+            if ((joinType !== "inner" && joinType !== "left") || lateral === true)
+                reject("Group queries support inner and left joins");
+            return { joinType, table: ownedTable(join.table), on: join.on };
+        });
+        const rebuild = groupRebuilder([from, ...joins.map((join) => join.table)]);
+        const fields = rebuild.selection(config.fields);
+        const where = rebuild.expression(config.where);
+        const having = rebuild.expression(config.having);
+        const orderBy = rebuild.expression([...(config.orderBy ?? [])]);
+        const groupBy = rebuild.expression([...(config.groupBy ?? [])]);
+        const limit = bound(config.limit);
+        const offset = bound(config.offset);
+        let fresh = (config.distinct === true ? db.selectDistinct(fields) : db.select(fields))
+            .from(from)
+            .$dynamic();
+        for (const join of joins) {
+            const on = and(rebuild.expression(join.on), inGroup(join.table));
+            fresh =
+                join.joinType === "inner"
+                    ? fresh.innerJoin(join.table, on)
+                    : fresh.leftJoin(join.table, on);
+        }
+        fresh = fresh.where(and(inGroup(from), where));
+        if (groupBy.length > 0)
+            fresh = fresh.groupBy(...groupBy);
+        if (having !== undefined)
+            fresh = fresh.having(having);
+        if (orderBy.length > 0)
+            fresh = fresh.orderBy(...orderBy);
+        if (limit !== undefined)
+            fresh = fresh.limit(limit);
+        if (offset !== undefined)
+            fresh = fresh.offset(offset);
+        const rows = fresh;
+        return rows;
+    });
+    return { rows, group };
+});
+/**
+ * Refuses an adopted table whose physical state does not match its
+ * declaration: a writable one needs its `actor_adoptions` row (which
+ * `durable adopt observe` writes) with the declared type and columns and a
+ * bigint `routing_key`; every adopted table needs mapped columns of a mappable
+ * type and an index that leads with them. Each message names the fix.
+ */
+const checkAdoptedDeclaration = Effect.fnUntraced(function* ({ actor, table, info, schema, role, adoption, }) {
+    const sql = yield* SqlClient.SqlClient;
+    const columns = getTableColumns(table);
+    const tenantColumn = columns[info.tenantKey].name;
+    const actorColumn = columns[info.actorKey].name;
+    const refuse = (message) => Effect.die(new Error(`Adopted table ${info.name} ${message}`));
+    const physical = yield* sql `
+    SELECT a.attname AS name, t.typname AS type FROM pg_attribute a
+    JOIN pg_class c ON c.oid = a.attrelid JOIN pg_namespace n ON n.oid = c.relnamespace
+    JOIN pg_type t ON t.oid = a.atttypid
+    WHERE n.nspname = ${schema} AND c.relname = ${info.table} AND a.attnum > 0 AND NOT a.attisdropped`;
+    if (physical.length === 0)
+        return yield* refuse("does not exist");
+    for (const [column, kind] of [
+        [tenantColumn, info.tenantKind],
+        [actorColumn, info.actorKind],
+    ]) {
+        const found = physical.find((candidate) => candidate.name === column);
+        if (found === undefined)
+            return yield* refuse(`has no column ${column}`);
+        if ((found.type === "uuid") !== (kind === "uuid") ||
+            !["text", "varchar", "uuid"].includes(found.type))
+            return yield* refuse(`maps ${column}, which is ${found.type}, not the declared ${kind} column`);
+    }
+    let enforcement;
+    if (info.access === "write") {
+        const [recorded] = yield* sql `SELECT actor_type, tenant_column, actor_column, mode, writer_role, allowed_roles
+      FROM actor_adoptions WHERE table_schema = ${schema} AND table_name = ${info.table}`;
+        if (recorded === undefined)
+            return yield* refuse(`has no adoption record; run durable adopt observe ${info.table} before serving it`);
+        if (recorded.actor_type !== actor)
+            return yield* refuse(`is adopted by actor ${recorded.actor_type}, not ${actor}`);
+        if (recorded.tenant_column !== tenantColumn || recorded.actor_column !== actorColumn)
+            return yield* refuse(`was adopted with columns (${recorded.tenant_column}, ${recorded.actor_column}) but declares (${tenantColumn}, ${actorColumn}); run durable adopt observe ${info.table} again`);
+        if (recorded.mode === "enforce")
+            enforcement = { writerRole: recorded.writer_role, allowedRoles: recorded.allowed_roles };
+        const routing = physical.find((candidate) => candidate.name === "routing_key");
+        if (routing?.type !== "int8")
+            return yield* refuse(`has no bigint routing_key; run durable adopt observe ${info.table}`);
+    }
+    const target = {
+        schema,
+        table: info.table,
+        access: info.access,
+        tenantColumn,
+        actorColumn,
+    };
+    if (!(yield* ownerIndexExists(target)))
+        return yield* refuse(`needs an index that leads with its owner columns: ${ownerIndexSql(target)}`);
+    if (role !== undefined)
+        yield* checkAdoptedTable(schema, info.table, role, info.access === "write");
+    if (enforcement === undefined || !adoption.writes)
+        return enforcement !== undefined;
+    if (role !== undefined && role !== enforcement.writerRole)
+        return yield* refuse(`is enforced for writer role ${enforcement.writerRole}, but row-level security takes ${role}; both options must name the same role`);
+    yield* checkEnforcedTable({
+        target: { schema, table: info.table, tenantColumn, actorColumn, actor },
+        ...enforcement,
+        runtimeRole: adoption.role,
+        refuse,
+    });
+    return true;
+});
+/**
+ * Records which actor type owns each declared table and checks that the
+ * physical table's primary key leads with the ownership columns. A table
+ * claimed by another actor type, missing, or keyed without ownership fails
+ * startup instead of running unscoped.
+ */
+export const checkTables = Effect.fnUntraced(function* (actor, tables, role, adoption) {
+    const sql = yield* SqlClient.SqlClient;
+    const guarded = [];
+    let enforced = false;
+    for (const table of tables) {
+        const info = ownership(table);
+        const schema = info.schema ?? (yield* sql `SELECT current_schema() AS schema`)[0].schema;
+        guarded.push({ schema, table: info.table });
+        if (info.adopted) {
+            const isEnforced = yield* checkAdoptedDeclaration({
+                actor,
+                table,
+                info,
+                schema,
+                role,
+                adoption,
+            });
+            if (isEnforced && adoption.writes)
+                enforced = true;
+            yield* sql `INSERT INTO actor_tables (table_schema, table_name, actor_type)
+        VALUES (${schema}, ${info.table}, ${actor}) ON CONFLICT DO NOTHING`;
+            const [claimed] = yield* sql `
+        SELECT actor_type FROM actor_tables WHERE table_schema = ${schema} AND table_name = ${info.table}`;
+            if (claimed?.actor_type !== actor)
+                return yield* Effect.die(new Error(`Table ${info.name} is owned by actor ${claimed?.actor_type}, not ${actor}`));
+            continue;
+        }
+        const key = yield* sql `
+      SELECT a.attname AS name FROM pg_index i
+      JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = ANY(i.indkey)
+      WHERE i.indisprimary AND i.indrelid = (
+        SELECT c.oid FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+        WHERE n.nspname = ${schema} AND c.relname = ${info.table})
+      ORDER BY array_position(i.indkey::int2[], a.attnum)`;
+        const columns = getTableColumns(table);
+        const expected = [...OWNERSHIP, ...info.primaryKey.map((column) => columns[column].name)];
+        if (key.map(({ name }) => name).join() !== expected.join())
+            return yield* Effect.die(new Error(`Owned table ${info.name} needs primary key (${expected.join(", ")}); apply its drizzle-kit migration`));
+        if (role !== undefined)
+            yield* checkOwnedTable(schema, info.table, role);
+        yield* sql `INSERT INTO actor_tables (table_schema, table_name, actor_type)
+      VALUES (${schema}, ${info.table}, ${actor}) ON CONFLICT DO NOTHING`;
+        const [recorded] = yield* sql `
+      SELECT actor_type FROM actor_tables WHERE table_schema = ${schema} AND table_name = ${info.table}`;
+        if (recorded?.actor_type !== actor)
+            return yield* Effect.die(new Error(`Table ${info.name} is owned by actor ${recorded?.actor_type}, not ${actor}`));
+    }
+    if (!enforced)
+        return false;
+    yield* checkWriterRole({
+        role: adoption.role,
+        tables: guarded,
+        refuse: (message) => Effect.die(new Error(`Adoption writer role: ${message}`)),
+    });
+    return true;
+});