@rikalabs/akter 0.1.0-alpha.1 → 0.1.0-alpha.3

package/CHANGELOG.md

@@ -1,12 +1,51 @@
 # Changelog
 
+## 0.1.0-alpha.3 (2026-10-08)
+
+The framework and CLI release together on the `alpha` and `latest` npm dist-tags; verified-main canaries use only `next`. This launch release includes the unpublished alpha.2 draft and subsequent changes. Alpha APIs and stored formats can change. Read the [upgrade notes](https://docs.akter.dev/operations/alpha-upgrades), back up the database, and stop every earlier alpha runner before starting alpha.3; mixed-alpha rolling upgrades are not established as safe.
+
+### Breaking changes and required upgrades
+
+- `QuotaExceeded` now names the hard cap a hosted organization reached: `{ organizationId, period, cap, limit, used, retryAfterMs }`, where `cap` is `compute`, `storage`, `connections` or `spend`, and `limit` and `used` are in that cap's units (compute unit-hours, decimal gigabytes of pooled managed database storage, open connections, or cents). It no longer carries `limitUnits`, `usedUnits`, `requestedUnits` or `unitsPerCommand`, because commands and reads are no longer metered. Update decoders that read those fields. It is still answered 429 and closes a WebSocket with 1008.
+- `SpendLimitExceeded`, `ConnectionLimitExceeded` and `StorageQuotaExceeded` are removed from `ActorError.reason` and from the exports of `@rikalabs/akter` and `@rikalabs/akter/client`; they existed only for the hosted edge. Match `QuotaExceeded` and its `cap` instead. A `connections` refusal is the only retryable one: `isRetryable` is true and the client retries it after `retryAfterMs` with the same command id, as it did for `ConnectionLimitExceeded`. A `spend` refusal is no longer answered 402 but 429.
+- Operator commands read `AKTER_OPERATOR_TOKEN` instead of `DURABLE_OPERATOR_TOKEN`, with no implicit alias. Set the new variable or pass `--token-env` explicitly.
+- The local inspector page and API move from `/_durable/inspector` to `/_akter/inspector`. Update bookmarks and requests; stored `durable` SQL schemas and format identifiers are unchanged.
+- Hosted source deployment uses `src/app.ts` and a platform-generated Dockerfile. The cloud API removes `ContextPath`, exports `SOURCE_ENTRY`, and refuses `source.dockerfile` rather than silently ignoring it. Update source-upload clients and declare the hosted application with `App.make`.
+- Cloud runtime activity and latency responses add `since`; absent latency percentiles are `null`, not zero. Live-only endpoints can return `NotImplemented` with multiple serving runners, and the command stream can end with `CommandStreamGap`. Update decoders and reconnection handling; unknown measurements are not zero.
+- Neki support is removed completely, including the `Database.postgres` option, topology errors, targeted sessions and DDL mode. Postgres and PGlite are the only backends. Existing Neki deployments need a separately rehearsed export/restore to ordinary Postgres, not an in-place framework upgrade.
+- Migration `0033_joined_inspection` removes the single-table `durable.*_v2` variants, including `placements_v2` and `content_sweeps_v2`. Update SQL tools to the original joined views, which already include placement; external dependencies refuse the migration without cascading. Stop every old alpha runner before upgrading. Tenant-to-authority placement conversions also require stopped old runners.
+- `@rikalabs/akter/testing` no longer publishes framework conformance, foundation, cluster and simulation harnesses or `ActorTest.cluster`, `ActorTest.simulate` and `ActorTest.simulateCluster`. App-facing `ActorTest`, database fixtures, cleanup/content sweeps, batch-law checks and fault controls remain. Application tests using the removed alpha-only harnesses need their own process-level tests; framework maintainers use the private `tooling/conformance` workspace.
+
+### Runtime reliability, routing and observability
+
+- Commands cut off by runtime shutdown, or sent while or after it closes, settle with retryable `ActorUnavailable` instead of waiting indefinitely or exposing interruption. Retry with the original command id; a receipt committed before reply loss can still be replayed.
+- Migration `0030_receipt_timing` records receipt start and commit timing on the database clock. Historical receipts keep unknown timing as `null`. Live telemetry adds bounded in-memory activity, latency, resident-actor, mailbox and connection measurements and a redacted command stream; it is not durable telemetry history or a fleet-wide aggregation.
+- Applied migrations are unchanged; `0033` retires the variants introduced by `0031` transactionally while preserving the original joined-view grants and versions.
+- Migration `0032_authority_placement` permits `placement: "authority"`. Its existing bucket -128 encoding and transactional conversion remain logical grouping, not physical data-shard placement or authorization. Generic routing keys, bucket-range scheduling and independent coordination remain.
+- Launch support is multi-runner on one host through `Runner.socket` and `Runner.mtls`, verified with three Bun processes sharing a Postgres database. Separate hosts and hosting providers still need their own evidence, and this does not certify every feature's multi-process behavior.
+
+### First CLI release and public cloud contract
+
+- Published Effect, Effect-platform/SQL and Drizzle peers accept compatible caret ranges instead of exact versions, so plain npm installs and applications already using a compatible Effect patch can share one Effect copy. The Effect/platform/SQL cohort and its peer floors are 4.0.2; development verification uses Vitest 5.0.3. Runtime dependencies and the tested workspace catalog remain exact; Effect is not added as a private runtime dependency.
+- First release of `@rikalabs/akter-cli`, exposing the `akter` executable on Node 24+ and Bun 1.4.2+. Compiled ESM, declarations and the bundled inspector work without a Bun build on Node. The framework has no competing CLI bin; `@akter/cloud-api` stays private and ships as compiled JS and declarations at `@rikalabs/akter-cli/cloud-api`. Importing the subpath does not execute the CLI; there is no standalone cloud API npm package.
+- `akter login` defaults to `https://api.akter.dev`; use `--api-url` or `AKTER_API_URL` for a dev preview or local stack. Cloud commands include source deploys and `akter env list`, `set`, `unset` and `import`.
+- `akter logs` reads recent customer runner output for a project and environment (default `production`) or one `--deployment`, bounded by `--since` (1 to 3600 seconds, default 300, clamped by the server to the last hour) and `--limit` (1 to 200 lines per page, default 100). Recent mode reads every page and exits; `--follow` drains pages, then long-polls for up to 20 seconds, resuming from the last successful cursor after transport failures and `Unavailable` responses and stopping after six failed requests in a row. Denied, missing and unsupported requests are not retried, and Ctrl-C exits with code 130. Terminal control characters are replaced, clipped lines end in `…`, and Fly lines show stream `unknown`. See the [logs API contract](https://github.com/Rika-Labs/akter/blob/main/docs/api/07-cloud-logs.md).
+- The cloud API adds authenticated account export and deletion, organization deletion progress, optional deployment `environmentHost`, and card/Link payment-method variants. Account export excludes credentials; accepted organization deletion is not completed deletion.
+- Cloud environment `database` now reports `{ source, state }` without an engine or Neki mode. Billing schemas remove command/read allowances and meters and deprecated compatibility fields, using compute unit-hours and pooled managed database storage instead; customer-owned databases do not count toward that storage pool. Update cloud API clients to the new required fields rather than interpreting missing measurements as zero.
+
+### Repository, docs and release safety
+
+- Hosted infrastructure, API, edge, console, marketing and provider integrations moved to the private Akter Cloud repository. The public repository retains the framework, CLI, cloud API contract, derived clients and Mintlify docs. Hosted deployment, billing, onboarding and website changes since alpha.1 are platform changes, not additional npm framework guarantees.
+- Quickstart and deployment docs distinguish supported Node/Bun, embedded and server-backed scenarios from provider claims. Community contribution, security and support guidance is included.
+- Verify runs parallel shards on GitHub-hosted runners; scheduled Stress and Nightly properties workflows and lease/fencing fixtures were repaired. Releases require a successful completed Verify run for the exact tagged commit, matching framework/CLI versions and version-specific notes before publication. Tagged pre-1.0 releases also advance `latest`, while verified main canaries publish only to `next`. npm publication has read-only contents permission; GitHub Release creation is a separate job. The CLI's first publication still requires a maintainer bootstrap before OIDC-only workflow publishing.
+
 ## 0.1.0-alpha.1 (2026-10-04)
 
 The first version published by the release workflow, through npm trusted publishing with provenance. The framework code is unchanged from `0.1.0-alpha.0`.
 
 ## 0.1.0-alpha.0 (2026-10-04)
 
-The first published build of Akter, on the `alpha` npm dist-tag. It is an **alpha for a single runner**: run one runtime process per database, and expect APIs and stored formats to change between alphas without a migration path.
+The first published build of Akter, on the `alpha` npm dist-tag. Its release guidance was limited to one runtime process per database; that historical limit is not the current OSS launch claim above. Expect APIs and stored formats to change between alphas without a migration path.
 
 - Published as `@rikalabs/akter` with four entries: the root, `/runtime`, `/client`, and `/testing`. Compiled ES modules and type declarations; the runtime requires Bun 1.4.2 or later, and `effect`, `@effect/sql-pg`, `@effect/sql-pglite` and `drizzle-orm` are exact-version peer dependencies.
 - Built on Effect `4.0.0`.
@@ -14,6 +53,6 @@ The first published build of Akter, on the `alpha` npm dist-tag. It is an **alph
 - Keyed state with `Actor.state` migrations, actor-owned Drizzle tables (`Actor.table`), database blobs, tenant-scoped content blobs, and durable events with cursor replay.
 - One actor-shard outbox for intents, timers, and jobs (`Actor.job`, `X.toJobLayer`) with retries, cancellation, and dead letters; workflows, cron and interval schedules, and cross-actor event subscriptions.
 - Connections, streams, and broadcasts; `Actors.serve` over HTTP, WebSocket, SSE, OpenAPI, and MCP; the Promise client in `/client` with optimistic reducers, feeds, watches, and an offline command queue.
-- `Actors.layer` on Postgres or file-backed PGlite; `ActorTest`, fault injection, and the shared conformance suite in `/testing`.
+- `Actors.layer` on a Postgres database or file-backed PGlite; `ActorTest`, fault injection, and the shared conformance suite in `/testing`.
 - A served `Schema.isPattern` check appears in the OpenAPI document only when its regular expression has the `u` flag.
 - Licensed under Apache-2.0.

package/README.md

@@ -7,10 +7,10 @@ Define each part of your app once: its data, the commands it accepts, the work i
 ## Start
 
 ```sh
-bun add @rikalabs/akter@alpha effect@4.0.0 @effect/sql-pg@4.0.0 @effect/sql-pglite@4.0.0 drizzle-orm@1.0.0-rc.5-5935859
+bun add @rikalabs/akter@alpha effect @effect/sql-pg @effect/sql-pglite
 ```
 
-The runtime needs [Bun](https://bun.sh) 1.4.2 or later, or [Node.js](https://nodejs.org) 24 or later. Provide `BunCrypto` / `BunHttpServer` from `@effect/platform-bun` on Bun, or `NodeCrypto` / `NodeHttpServer` from `@effect/platform-node` on Node. Effect, its SQL drivers, and Drizzle are peer dependencies pinned to the versions the framework is tested with, so your app and the framework share one copy of each.
+The runtime needs [Bun](https://bun.sh) 1.4.2 or later, or [Node.js](https://nodejs.org) 24 or later. Provide `BunCrypto` / `BunHttpServer` from `@effect/platform-bun` on Bun, or `NodeCrypto` / `NodeHttpServer` from `@effect/platform-node` on Node. Effect, its SQL drivers, and Drizzle are shared peer dependencies with compatible caret ranges, so your app and the framework use the same peer-provided copy. Keep the generated lockfile; see the [quickstart](https://docs.akter.dev/quickstart) for both runtimes.
 
 ## Example
 

package/dist/actor/definition.d.ts

@@ -33,7 +33,7 @@ type Key = KeySchema | SingletonKey | undefined;
 /** Type-only key of `Placed`; no value exists at runtime. */
 export declare const PlacedType: unique symbol;
 /** Type-level record of how a definition is placed and what its ids are. */
-export interface Placed<Kind extends "tenant" | "actor" | "parent", Id> {
+export interface Placed<Kind extends "tenant" | "actor" | "authority" | "parent", Id> {
     readonly [PlacedType]?: {
         readonly kind: Kind;
         readonly id: Id;
@@ -44,13 +44,14 @@ interface ParentDefinition extends Placed<"actor" | "parent", string> {
     readonly name: string;
 }
 /**
- * Which rows share a shard: the tenant's, each actor's own, or the parent
- * actor's, whose id every child id carries.
+ * Which rows share a shard: the tenant's, each actor's own, the tenant's
+ * authority-placed actors' on the authoritative shard, or the parent actor's,
+ * whose id every child id carries.
  */
-type PlacementOption = "tenant" | "actor" | {
+type PlacementOption = "tenant" | "actor" | "authority" | {
     readonly parent: ParentDefinition;
 };
-type PlacementKind<Pl> = Pl extends "tenant" | "actor" ? Pl : "parent";
+type PlacementKind<Pl> = Pl extends "tenant" | "actor" | "authority" ? Pl : "parent";
 /** Type-only key of `DefinitionWithInternal`; no value exists at runtime. */
 export declare const InternalHandleType: unique symbol;
 /**
@@ -264,10 +265,13 @@ interface Definition<Key, Fields extends StateFields, Api extends MemberRecord,
      */
     readonly key?: Key;
     /**
-     * Which rows share a shard: the tenant (default), each actor on its own, or
-     * `{ parent: P }`, the shard of the parent actor whose id each child id
-     * carries. `P` is placed by `"actor"` or by a parent, at most four levels
-     * below an actor-placed root.
+     * Which rows share a shard: the tenant (default), each actor on its own,
+     * `"authority"`, or `{ parent: P }`, the shard of the parent actor whose id
+     * each child id carries. `P` is placed by `"actor"` or by a parent, at most
+     * four levels below an actor-placed root. `"authority"` colocates a
+     * tenant's authority-placed actors like `"tenant"`, in the one bucket every
+     * split topology keeps on the authoritative shard, for an actor whose turns
+     * read or write tables the database does not route.
      */
     readonly placement?: Pl;
     /** `Actor.state` fields and migrations; an actor without it has no state. */

package/dist/actor/descriptor.d.ts

@@ -37,7 +37,7 @@ export type KeySchema = Schema.Codec<string, string>;
 /** The declaration `Actor.make` compiles, before its type parameters are erased. */
 export interface Declaration {
     readonly key?: KeySchema | SingletonKey | undefined;
-    readonly placement?: "tenant" | "actor" | {
+    readonly placement?: "tenant" | "actor" | "authority" | {
         readonly parent: object;
     } | undefined;
     readonly state?: ActorState | undefined;

package/dist/actor/descriptor.js

@@ -45,15 +45,15 @@ const tagMatches = (api, internal) => {
 };
 const placementOf = (name, declared, singleton, createdBy) => {
     const option = declared.placement ?? "tenant";
-    if (option === "tenant" || option === "actor")
+    if (option === "tenant" || option === "actor" || option === "authority")
         return { placement: option, parent: undefined, depth: 0 };
     if (!Predicate.hasProperty(option, "parent"))
-        throw new Error(`placement is "tenant", "actor", or { parent }`);
+        throw new Error(`placement is "tenant", "actor", "authority", or { parent }`);
     const parent = descriptorOf(option.parent);
     if (parent === undefined)
         throw new Error("placement.parent takes an Actor.make definition");
-    if (parent.placement === "tenant")
-        throw new Error(`${name}'s parent ${parent.name} is tenant-placed, so its children already share its shard; place ${name} by "tenant"`);
+    if (parent.placement === "tenant" || parent.placement === "authority")
+        throw new Error(`${name}'s parent ${parent.name} is ${parent.placement}-placed, so its children already share its shard; place ${name} by "${parent.placement}"`);
     if (parent.depth + 1 > MAX_PLACEMENT_DEPTH)
         throw new Error(`${name} would be ${parent.depth + 1} levels below its root; parent placement allows ${MAX_PLACEMENT_DEPTH}`);
     if (singleton)

package/dist/client/calls.js

@@ -92,7 +92,7 @@ const retryDelay = (retry, clock) => (attempted) => Effect.gen(function* () {
     return yield* Match.value(failure.reason).pipe(Match.tags({
         ActorUnavailable: () => retryAfterOf(failure),
         RunnerAtCapacity: () => retryAfterOf(failure),
-        ConnectionLimitExceeded: () => retryAfterOf(failure),
+        QuotaExceeded: (reason) => reason.cap === "connections" ? retryAfterOf(failure) : Effect.succeedNone,
         MailboxFull: () => retryAfterOf(failure),
         Timeout: () => Effect.asSome(jittered(50)),
         TransportError: (reason) => !reason.retryable

package/dist/client/index.d.ts

@@ -12,6 +12,6 @@ export { fleetClient } from "./fleet.ts";
 export type { FleetClient, FleetSubscribeOptions, FleetViewClient } from "./fleet.ts";
 export type { FleetFilter, FleetPage, FleetRow } from "../tables/fleet.ts";
 export type { Failure } from "./transport.ts";
-export { ActorError, ActorUnavailable, CommandConflict, CommandExpired, InvalidCommandId, InvalidInput, MailboxFull, NotCreated, RunnerAtCapacity, QuotaExceeded, SpendLimitExceeded, ConnectionLimitExceeded, StorageQuotaExceeded, SessionEnded, Timeout, TransportError, Unauthorized, } from "../errors/actor.ts";
+export { ActorError, ActorUnavailable, CommandConflict, CommandExpired, InvalidCommandId, InvalidInput, MailboxFull, NotCreated, RunnerAtCapacity, QuotaExceeded, SessionEnded, Timeout, TransportError, Unauthorized, } from "../errors/actor.ts";
 export { RetentionGap, UnknownCursor } from "../errors/events.ts";
 export { Inspection };

package/dist/client/index.js

@@ -1,6 +1,6 @@
 import * as Inspection from "../protocol/inspection.js";
 export { Offline, OfflineStoreError } from "./offline/store.js";
 export { fleetClient } from "./fleet.js";
-export { ActorError, ActorUnavailable, CommandConflict, CommandExpired, InvalidCommandId, InvalidInput, MailboxFull, NotCreated, RunnerAtCapacity, QuotaExceeded, SpendLimitExceeded, ConnectionLimitExceeded, StorageQuotaExceeded, SessionEnded, Timeout, TransportError, Unauthorized, } from "../errors/actor.js";
+export { ActorError, ActorUnavailable, CommandConflict, CommandExpired, InvalidCommandId, InvalidInput, MailboxFull, NotCreated, RunnerAtCapacity, QuotaExceeded, SessionEnded, Timeout, TransportError, Unauthorized, } from "../errors/actor.js";
 export { RetentionGap, UnknownCursor } from "../errors/events.js";
 export { Inspection };

package/dist/errors/actor.d.ts

@@ -107,52 +107,22 @@ export declare class RunnerAtCapacity extends RunnerAtCapacity_base {
 declare const QuotaExceeded_base: Schema.Class<QuotaExceeded, Schema.TaggedStruct<"QuotaExceeded", {
     readonly organizationId: Schema.String;
     readonly period: Schema.String;
-    readonly limitUnits: Schema.Finite;
-    readonly usedUnits: Schema.Finite;
-    readonly requestedUnits: Schema.Finite;
-    readonly unitsPerCommand: Schema.Int;
+    readonly cap: Schema.Literals<readonly ["compute", "storage", "connections", "spend"]>;
+    readonly limit: Schema.Finite;
+    readonly used: Schema.Finite;
     readonly retryAfterMs: Schema.Finite;
 }>, import("effect/Cause").YieldableError>;
 /**
- * The hosted organization's period usage would exceed its plan's hard quota.
- * `limitUnits`, `usedUnits` and `requestedUnits` are usage units, where one
- * command weighs `unitsPerCommand`, so a reader states them as commands
- * without knowing the weights.
+ * The hosted organization reached one of its plan's hard caps. `cap` names it,
+ * and `limit` and `used` are in that cap's units: cents for `spend`, open
+ * connections for `connections`, compute unit-hours this period for
+ * `compute`, and decimal gigabytes of pooled managed database storage for
+ * `storage`. A `connections` refusal clears as connections close, so it is
+ * retryable with the same command id after `retryAfterMs`; the others hold
+ * until usage drops, the period resets or the plan changes.
  */
 export declare class QuotaExceeded extends QuotaExceeded_base {
 }
-declare const SpendLimitExceeded_base: Schema.Class<SpendLimitExceeded, Schema.TaggedStruct<"SpendLimitExceeded", {
-    readonly organizationId: Schema.String;
-    readonly period: Schema.String;
-    readonly limitCents: Schema.Finite;
-    readonly projectedCents: Schema.Finite;
-}>, import("effect/Cause").YieldableError>;
-/** The hosted organization's estimated period cost would exceed its spend limit. */
-export declare class SpendLimitExceeded extends SpendLimitExceeded_base {
-}
-declare const ConnectionLimitExceeded_base: Schema.Class<ConnectionLimitExceeded, Schema.TaggedStruct<"ConnectionLimitExceeded", {
-    readonly organizationId: Schema.String;
-    readonly kind: Schema.Literals<readonly ["socket", "sse"]>;
-    readonly limit: Schema.Finite;
-    readonly open: Schema.Finite;
-}>, import("effect/Cause").YieldableError>;
-/** The hosted organization already holds its plan's allowed concurrent connections. */
-export declare class ConnectionLimitExceeded extends ConnectionLimitExceeded_base {
-}
-declare const StorageQuotaExceeded_base: Schema.Class<StorageQuotaExceeded, Schema.TaggedStruct<"StorageQuotaExceeded", {
-    readonly organizationId: Schema.String;
-    readonly deployment: Schema.String;
-    readonly tenant: Schema.String;
-    readonly limitBytes: Schema.Finite;
-    readonly usedBytes: Schema.Finite;
-}>, import("effect/Cause").YieldableError>;
-/**
- * A Free tenant's latest storage sample is at or over its plan's included
- * bytes. Waiting for the next period does not lift it; the tenant must hold
- * less data before new commands are admitted, so it carries no retry time.
- */
-export declare class StorageQuotaExceeded extends StorageQuotaExceeded_base {
-}
 declare const SessionEnded_base: Schema.Class<SessionEnded, Schema.TaggedStruct<"SessionEnded", {
     readonly cause: Schema.Literals<readonly ["ClientClosed", "ServerClosed", "SlowConsumer", "HolderShutdown", "HolderLost", "OwnerLost", "ActivationEnded", "ActorUnavailable", "Defect", "Terminated"]>;
     readonly resync: Schema.Boolean;
@@ -166,11 +136,11 @@ export declare class SessionEnded extends SessionEnded_base {
     get isRetryable(): boolean;
 }
 /** Every reason an `ActorError` carries. */
-export declare const Reason: Schema.Union<readonly [typeof CommandConflict, typeof CommandExpired, typeof InvalidCommandId, typeof Unauthorized, typeof ActorUnavailable, typeof Timeout, typeof NotCreated, typeof MailboxFull, typeof RunnerAtCapacity, typeof QuotaExceeded, typeof SpendLimitExceeded, typeof ConnectionLimitExceeded, typeof StorageQuotaExceeded, typeof SessionEnded, typeof InvalidInput, typeof TransportError]>;
+export declare const Reason: Schema.Union<readonly [typeof CommandConflict, typeof CommandExpired, typeof InvalidCommandId, typeof Unauthorized, typeof ActorUnavailable, typeof Timeout, typeof NotCreated, typeof MailboxFull, typeof RunnerAtCapacity, typeof QuotaExceeded, typeof SessionEnded, typeof InvalidInput, typeof TransportError]>;
 /** One `Reason` value. */
 export type Reason = typeof Reason.Type;
 declare const ActorError_base: Schema.Class<ActorError, Schema.TaggedStruct<"ActorError", {
-    readonly reason: Schema.Union<readonly [typeof CommandConflict, typeof CommandExpired, typeof InvalidCommandId, typeof Unauthorized, typeof ActorUnavailable, typeof Timeout, typeof NotCreated, typeof MailboxFull, typeof RunnerAtCapacity, typeof QuotaExceeded, typeof SpendLimitExceeded, typeof ConnectionLimitExceeded, typeof StorageQuotaExceeded, typeof SessionEnded, typeof InvalidInput, typeof TransportError]>;
+    readonly reason: Schema.Union<readonly [typeof CommandConflict, typeof CommandExpired, typeof InvalidCommandId, typeof Unauthorized, typeof ActorUnavailable, typeof Timeout, typeof NotCreated, typeof MailboxFull, typeof RunnerAtCapacity, typeof QuotaExceeded, typeof SessionEnded, typeof InvalidInput, typeof TransportError]>;
 }>, import("effect/Cause").YieldableError>;
 /**
  * The runtime's own failure for a call: `reason` says which. Declared command

package/dist/errors/actor.js

@@ -120,48 +120,21 @@ export class MailboxFull extends Schema.TaggedError()("MailboxFull", {}) {
 export class RunnerAtCapacity extends Schema.TaggedError()("RunnerAtCapacity", {}) {
 }
 /**
- * The hosted organization's period usage would exceed its plan's hard quota.
- * `limitUnits`, `usedUnits` and `requestedUnits` are usage units, where one
- * command weighs `unitsPerCommand`, so a reader states them as commands
- * without knowing the weights.
+ * The hosted organization reached one of its plan's hard caps. `cap` names it,
+ * and `limit` and `used` are in that cap's units: cents for `spend`, open
+ * connections for `connections`, compute unit-hours this period for
+ * `compute`, and decimal gigabytes of pooled managed database storage for
+ * `storage`. A `connections` refusal clears as connections close, so it is
+ * retryable with the same command id after `retryAfterMs`; the others hold
+ * until usage drops, the period resets or the plan changes.
  */
 export class QuotaExceeded extends Schema.TaggedError()("QuotaExceeded", {
     organizationId: Schema.String,
     period: Schema.String,
-    limitUnits: Schema.Finite,
-    usedUnits: Schema.Finite,
-    requestedUnits: Schema.Finite,
-    unitsPerCommand: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
-    retryAfterMs: Schema.Finite,
-}) {
-}
-/** The hosted organization's estimated period cost would exceed its spend limit. */
-export class SpendLimitExceeded extends Schema.TaggedError()("SpendLimitExceeded", {
-    organizationId: Schema.String,
-    period: Schema.String,
-    limitCents: Schema.Finite,
-    projectedCents: Schema.Finite,
-}) {
-}
-/** The hosted organization already holds its plan's allowed concurrent connections. */
-export class ConnectionLimitExceeded extends Schema.TaggedError()("ConnectionLimitExceeded", {
-    organizationId: Schema.String,
-    kind: Schema.Literals(["socket", "sse"]),
+    cap: Schema.Literals(["compute", "storage", "connections", "spend"]),
     limit: Schema.Finite,
-    open: Schema.Finite,
-}) {
-}
-/**
- * A Free tenant's latest storage sample is at or over its plan's included
- * bytes. Waiting for the next period does not lift it; the tenant must hold
- * less data before new commands are admitted, so it carries no retry time.
- */
-export class StorageQuotaExceeded extends Schema.TaggedError()("StorageQuotaExceeded", {
-    organizationId: Schema.String,
-    deployment: Schema.String,
-    tenant: Schema.String,
-    limitBytes: Schema.Finite,
-    usedBytes: Schema.Finite,
+    used: Schema.Finite,
+    retryAfterMs: Schema.Finite,
 }) {
 }
 const RETRYABLE_SESSION_ENDS = new Set([
@@ -208,9 +181,6 @@ export const Reason = Schema.Union([
     MailboxFull,
     RunnerAtCapacity,
     QuotaExceeded,
-    SpendLimitExceeded,
-    ConnectionLimitExceeded,
-    StorageQuotaExceeded,
     SessionEnded,
     InvalidInput,
     TransportError,
@@ -226,6 +196,8 @@ export class ActorError extends Schema.TaggedError()("ActorError", { reason: Rea
             return this.reason.isRetryable;
         if (Schema.is(Unauthorized)(this.reason))
             return this.reason.code === "reauthorization_unavailable";
+        if (Schema.is(QuotaExceeded)(this.reason))
+            return this.reason.cap === "connections";
         if (isTransportError(this.reason))
             return this.reason.retryable;
         return isRetryableReason(this.reason);
@@ -255,12 +227,11 @@ export class ActorError extends Schema.TaggedError()("ActorError", { reason: Rea
     }
 }
 const isTransportError = Schema.is(TransportError);
-const isRetryableReason = Schema.is(Schema.Union([ActorUnavailable, Timeout, MailboxFull, RunnerAtCapacity, ConnectionLimitExceeded]));
+const isRetryableReason = Schema.is(Schema.Union([ActorUnavailable, Timeout, MailboxFull, RunnerAtCapacity]));
 const NOMINAL_RETRY_AFTER = {
     ActorUnavailable: 250,
     RunnerAtCapacity: 1_000,
     MailboxFull: 100,
-    ConnectionLimitExceeded: 1_000,
 };
 const jittered = new WeakMap();
 /** Fixes `retryAfter` to a server's already-jittered value, as a client rebuilds a served envelope. */

package/dist/index.d.ts

@@ -134,7 +134,7 @@ export { ContentRef } from "./identity/content.ts";
 export type { ContentEntry } from "./identity/content.ts";
 export type { Access, AccessRequest } from "./policies/access.ts";
 export type { Policy } from "./policies/command.ts";
-export { ActorError, ActorUnavailable, CommandConflict, CommandExpired, InvalidCommandId, InvalidInput, Unauthorized, Timeout, NotCreated, MailboxFull, RunnerAtCapacity, QuotaExceeded, SpendLimitExceeded, ConnectionLimitExceeded, StorageQuotaExceeded, SessionEnded, } from "./errors/actor.ts";
+export { ActorError, ActorUnavailable, CommandConflict, CommandExpired, InvalidCommandId, InvalidInput, Unauthorized, Timeout, NotCreated, MailboxFull, RunnerAtCapacity, QuotaExceeded, SessionEnded, } from "./errors/actor.ts";
 export { RetentionGap, UnknownCursor } from "./errors/events.ts";
 export { ContentTooLarge, InvalidContentRef } from "./errors/content.ts";
 export { ActivityOutcomeUnknown, InvalidExecutionId, InvalidExecutionKey, } from "./errors/workflow.ts";

package/dist/index.js

@@ -89,7 +89,7 @@ export { Intent } from "./handles/intents.js";
 export { Content, ContentStore } from "./handles/content.js";
 export { ActorRef, Anonymous, Caller, CurrentCaller, Tenant, User, System, Principal, } from "./identity/caller.js";
 export { ContentRef } from "./identity/content.js";
-export { ActorError, ActorUnavailable, CommandConflict, CommandExpired, InvalidCommandId, InvalidInput, Unauthorized, Timeout, NotCreated, MailboxFull, RunnerAtCapacity, QuotaExceeded, SpendLimitExceeded, ConnectionLimitExceeded, StorageQuotaExceeded, SessionEnded, } from "./errors/actor.js";
+export { ActorError, ActorUnavailable, CommandConflict, CommandExpired, InvalidCommandId, InvalidInput, Unauthorized, Timeout, NotCreated, MailboxFull, RunnerAtCapacity, QuotaExceeded, SessionEnded, } from "./errors/actor.js";
 export { RetentionGap, UnknownCursor } from "./errors/events.js";
 export { ContentTooLarge, InvalidContentRef } from "./errors/content.js";
 export { ActivityOutcomeUnknown, InvalidExecutionId, InvalidExecutionKey, } from "./errors/workflow.js";