@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.4

package/src/Reconciliation.ts

@@ -0,0 +1,224 @@
+/**
+ * The reconciliation seam: what happens when the world disagrees with the
+ * declaration.
+ *
+ * `docs/guides/drive-a-plan.md` ("Install a reconciler") describes expected sets as the soft
+ * mode: going outside them is allowed, journaled, and "triggers a
+ * **reconciliation flow** — pluggable, a flow like everything else". The
+ * deviation events have been emitted since the isolated-execution lane landed
+ * (`internal/ActionPersistence.ts`, both `expectedSetDeviation` sites) and
+ * had **no consumer at all**. This is the consumer, and
+ * `PlanScheduler` is what feeds it.
+ *
+ * Pluggability is dependency injection at the owning seam, per the repository's
+ * extension doctrine — there is no hook kernel. {@link layerDefault} installs a
+ * deterministic verdict function; a model-backed reconciler is a different
+ * `Layer` and lives in the agent packages. This package has no model
+ * dependency and must not grow one.
+ *
+ * The three verdicts are exactly the vault's: **fail** the step where the
+ * deviation is genuinely wrong, **reorder** — re-plan with the discovered
+ * dependency made explicit — and **factor out** a shared step, where content
+ * addressing does the heavy lifting because identical extracted steps collapse
+ * to one key automatically.
+ *
+ * @since 0.1.0
+ */
+
+import * as Context from "effect/Context"
+import * as Effect from "effect/Effect"
+import * as Layer from "effect/Layer"
+import * as Schema from "effect/Schema"
+
+/**
+ * A journaled `flows.engine.expected-set-deviation`, resolved against the plan
+ * the scheduler is driving.
+ *
+ * @since 0.1.0
+ * @category schemas
+ */
+export const Deviation = Schema.Struct({
+  nodeId: Schema.NonEmptyString,
+  keyDigest: Schema.NonEmptyString,
+  attempt: Schema.Int,
+  /** Paths the execution touched that its declaration did not predict. */
+  paths: Schema.Array(Schema.String),
+  diffIdentity: Schema.String,
+  /**
+   * For each undeclared path, the OTHER plan node that declares it as a write
+   * — the discovered dependency, resolved by the scheduler because only it
+   * holds the plan.
+   */
+  declaredBy: Schema.Record(Schema.String, Schema.NonEmptyString),
+  /** Other nodes in this run whose deviation named exactly the same paths. */
+  alsoDeviatedBy: Schema.Array(Schema.NonEmptyString)
+})
+
+/**
+ * The value form of {@link Deviation}.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export type Deviation = typeof Deviation.Type
+
+/**
+ * A `WorkspaceSandbox.MaterializationConflict` the runtime strategy could not
+ * absorb: the delay/rebase budget is spent, or the merge itself conflicted.
+ *
+ * @since 0.1.0
+ * @category schemas
+ */
+export const Conflict = Schema.Struct({
+  nodeId: Schema.NonEmptyString,
+  keyDigest: Schema.NonEmptyString,
+  attempt: Schema.Int,
+  /** How many times the scheduler rebased before giving up. */
+  rebases: Schema.Int,
+  strategy: Schema.Literals(["delay-rebase", "stop-merge"]),
+  /** The plan nodes this one was annotated as conflicting with. */
+  conflictsWith: Schema.Array(Schema.NonEmptyString)
+})
+
+/**
+ * The value form of {@link Conflict}.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export type Conflict = typeof Conflict.Type
+
+/**
+ * What reconciliation decided.
+ *
+ * @since 0.1.0
+ * @category schemas
+ */
+export const Verdict = Schema.Union([
+  Schema.TaggedStruct("Fail", { reason: Schema.String }),
+  Schema.TaggedStruct("Reorder", { dependsOn: Schema.Array(Schema.NonEmptyString), reason: Schema.String }),
+  Schema.TaggedStruct("FactorOut", { paths: Schema.Array(Schema.String), reason: Schema.String })
+])
+
+/**
+ * The value form of {@link Verdict}.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export type Verdict = typeof Verdict.Type
+
+/**
+ * The pluggable reconciler.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export interface Service {
+  readonly onDeviation: (deviation: Deviation) => Effect.Effect<Verdict>
+  readonly onConflict: (conflict: Conflict) => Effect.Effect<Verdict>
+}
+
+/**
+ * Service tag for the reconciliation seam.
+ *
+ * @since 0.1.0
+ * @category services
+ */
+export class Reconciliation extends Context.Service<Reconciliation, Service>()("@smthrs/engine-store/Reconciliation") {}
+
+/**
+ * Names a {@link Service} implementation as a reconciler.
+ *
+ * It is the identity function: the value is checked against the interface at
+ * its definition site, which is where a wrong-shaped reconciler should be
+ * reported rather than at whichever layer eventually provides it.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export const make = (service: Service): Service => service
+
+/**
+ * Provides a {@link Service} as the {@link Reconciliation} seam, replacing the
+ * deterministic default.
+ *
+ * @since 0.1.0
+ * @category layers
+ */
+export const layer = (service: Service): Layer.Layer<Reconciliation> => Layer.succeed(Reconciliation, service)
+
+/**
+ * The deterministic default, in the vault's order of preference.
+ *
+ * 1. **Reorder** when every undeclared path is a path some *other* plan node
+ *    declares it writes. That is a real dependency the declaration missed, and
+ *    making it explicit is strictly better than failing.
+ * 2. **Factor out** when another node in the same run deviated on exactly the
+ *    same paths — two parallel steps that both ran `npm install`. No graph
+ *    surgery follows: content addressing collapses two identical extracted
+ *    steps to one key by itself, so the verdict is a record and a hint.
+ * 3. **Fail** otherwise. The default is deliberately conservative — a
+ *    deviation nobody can explain is the case the vault says is "genuinely
+ *    wrong", and guessing is what the model-backed reconciler is for.
+ *
+ * A conflict the runtime strategy could not absorb always fails here: choosing
+ * a winner between two landings is a semantic judgement this default does not
+ * have the material to make.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export const makeDefault = (): Service => ({
+  onDeviation: Effect.fn("Reconciliation.onDeviation")((deviation) => {
+    const paths = [...new Set(deviation.paths)]
+    // Own keys only: a path named `toString` must not resolve to Object.prototype.
+    const ownerOf = (path: string): string | undefined =>
+      Object.hasOwn(deviation.declaredBy, path) ? deviation.declaredBy[path] : undefined
+    const discovered = [
+      ...new Set(
+        paths
+          .map(ownerOf)
+          .filter((owner): owner is string => owner !== undefined && owner !== deviation.nodeId)
+      )
+    ]
+    if (
+      discovered.length > 0 &&
+      paths.every((path) => {
+        const owner = ownerOf(path)
+        return owner !== undefined && owner !== deviation.nodeId
+      })
+    ) {
+      return Effect.succeed<Verdict>({
+        _tag: "Reorder",
+        dependsOn: discovered,
+        reason: `${deviation.nodeId} wrote paths declared by ${discovered.join(", ")}`
+      })
+    }
+    if (deviation.alsoDeviatedBy.length > 0) {
+      return Effect.succeed<Verdict>({
+        _tag: "FactorOut",
+        paths: deviation.paths,
+        reason: `${deviation.nodeId} and ${deviation.alsoDeviatedBy.join(", ")} produced the same undeclared paths`
+      })
+    }
+    return Effect.succeed<Verdict>({
+      _tag: "Fail",
+      reason: `${deviation.nodeId} wrote ${deviation.paths.join(", ")}, which no declaration explains`
+    })
+  }),
+  onConflict: Effect.fn("Reconciliation.onConflict")((conflict) =>
+    Effect.succeed<Verdict>({
+      _tag: "Fail",
+      reason: `${conflict.nodeId} could not land after ${conflict.rebases} rebases under ${conflict.strategy}`
+    })
+  )
+})
+
+/**
+ * Installs the deterministic default reconciler.
+ *
+ * @since 0.1.0
+ * @category layers
+ */
+export const layerDefault: Layer.Layer<Reconciliation> = Layer.sync(Reconciliation, makeDefault)

package/src/ReplayOnly.ts

@@ -0,0 +1,95 @@
+/**
+ * An engine that replays recorded work and executes none.
+ *
+ * `smthrs runs verify` asks what a resume under the current code would do
+ * before anything runs: which recorded steps it would serve from their
+ * durable records, and which step it would execute again because its key no
+ * longer matches one. The engine is the only thing that can answer, because a
+ * step key is derived at dispatch from the running flow's own declaration,
+ * ordinal and scope. This service turns a durable engine into that question:
+ * a dispatch served from a durable record reports `replayed`, and the first
+ * dispatch that would run an action body dies with {@link WouldExecute} before
+ * any attempt row, snapshot, boundary or body. It reports `resumes` when it
+ * would re-enter a recorded attempt that never finished (a step parked inside
+ * its body), and `would-execute` when no record matches its key at all.
+ *
+ * The death is a defect on purpose. A typed failure would enter the action's
+ * retry policy, and the default policy never gives up; a defect is never
+ * retried, so the run settles with the verdict instead of spinning on it.
+ *
+ * Run it against a copy of the store. A replay still converges the journal
+ * rows a resume would write, and the run settles `failed` on the copy.
+ *
+ * @since 1.0.0
+ */
+
+import * as Context from "effect/Context"
+import type * as Effect from "effect/Effect"
+import * as Layer from "effect/Layer"
+import * as Schema from "effect/Schema"
+
+/**
+ * One dispatch a replay-only engine saw.
+ *
+ * `stepKeyDigest` is the identity `flows_attempts` rows are keyed on, so a
+ * reader joins it to the recorded attempts directly. `action` is the declared
+ * action name. `outcome` is `replayed` for a dispatch served from a durable
+ * record (a recorded failure included), `resumes` for one that would re-enter
+ * a recorded attempt that never finished, and `would-execute` for one no
+ * record matches.
+ *
+ * @since 1.0.0
+ * @category models
+ */
+export interface Dispatch {
+  readonly runId: string
+  readonly stepKeyDigest: string
+  readonly attempt: number
+  readonly action: string
+  readonly tier: "sealed" | "compensable" | "irreversible"
+  readonly outcome: "replayed" | "resumes" | "would-execute"
+}
+
+/**
+ * Receives every dispatch a replay-only engine settles, in settlement order.
+ *
+ * @since 1.0.0
+ * @category models
+ */
+export interface Service {
+  readonly observe: (dispatch: Dispatch) => Effect.Effect<void>
+}
+
+/**
+ * Service tag. An engine composed with it in context executes no action body.
+ *
+ * @since 1.0.0
+ * @category services
+ */
+export class ReplayOnly extends Context.Service<ReplayOnly, Service>()("@smthrs/engine-store/ReplayOnly") {}
+
+/**
+ * The defect a replay-only dispatch dies with instead of executing.
+ *
+ * @since 1.0.0
+ * @category errors
+ */
+export class WouldExecute extends Schema.TaggedError<WouldExecute>()("@smthrs/engine-store/WouldExecute", {
+  runId: Schema.String,
+  stepKeyDigest: Schema.String,
+  attempt: Schema.Number,
+  action: Schema.String
+}) {
+  override get message(): string {
+    return `Action ${this.action} (step ${this.stepKeyDigest}, attempt ${this.attempt}) would execute`
+  }
+}
+
+/**
+ * Provides a replay-only engine context that reports to `observe`.
+ *
+ * @since 1.0.0
+ * @category layers
+ */
+export const layer = (observe: Service["observe"]): Layer.Layer<ReplayOnly> =>
+  Layer.succeed(ReplayOnly, ReplayOnly.of({ observe }))

package/src/Retention.ts

@@ -0,0 +1,214 @@
+/**
+ * Deleting run history that has outlived its usefulness.
+ *
+ * Nothing in the durable stores forgets on its own: a finished run keeps its
+ * row, every attempt, every journal event, and every archived frame forever.
+ * That is the right default — a run's history is the only account of what an
+ * agent did to a repository — and it is why `smithers gc` exists rather than a
+ * background sweeper. Retention is an operator decision, taken explicitly,
+ * with a dry run available before anything is deleted.
+ *
+ * This module is the public surface. The operation lives in
+ * `internal/RetentionOps.ts` beside the other modules that read this package's
+ * own tables, so `internal/` is never imported by a consumer — the same split
+ * `Errors.ts` uses. {@link retain} and {@link layer} are that operation: one
+ * bounded pass over the engine ladder, inside one `journal.transact`.
+ *
+ * {@link collect} is the host-facing pass `smithers gc` runs, and it is a
+ * facade over the same guard. A project keeps its history in two files — the
+ * control plane's database and the engine's — and a sweep of one without the
+ * other leaves half of a deleted run behind, so the pass takes the database as
+ * a service and runs once per file. Which runs it may delete is
+ * {@link RetentionOps.lineagePrelude}'s answer, not a second guard written
+ * here: a run stays whenever a live run stands above or below it, over BOTH
+ * relations that make one run the parent of another — the `flows_run_parents`
+ * edge a spawned child records, and the `parent_run_id` column a trampoline
+ * lineage is chained through.
+ *
+ * Only terminal runs are ever considered. A `pending`, `running`, or
+ * `suspended` row belongs to work that can still resume.
+ *
+ * @since 1.0.0
+ */
+
+import * as Dialect from "@smthrs/database/Dialect"
+import * as DurableWriter from "@smthrs/database/DurableWriter"
+import * as Effect from "effect/Effect"
+import * as SqlClient from "effect/unstable/sql/SqlClient"
+import type { SqlError } from "effect/unstable/sql/SqlError"
+import * as RetentionOps from "./internal/RetentionOps.ts"
+
+export {
+  defaultLimit,
+  layer,
+  make,
+  type RetainOptions,
+  type RetainReport,
+  Retention,
+  RetentionError,
+  RetentionErrorCode,
+  type RunScopedTable,
+  /**
+   * Every table a deleted run leaves rows in. One inventory serves this pass
+   * and {@link Service.retain}, so neither can leak what the other deletes.
+   *
+   * @category constants
+   * @since 1.0.0
+   */
+  runScopedTables,
+  type Service,
+  terminalStatuses
+} from "./internal/RetentionOps.ts"
+
+/**
+ * What one retention pass would delete, or did.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export interface Report {
+  readonly database: string
+  /** The threshold, as an epoch millisecond value. */
+  readonly olderThanMs: number
+  readonly runs: ReadonlyArray<string>
+  /** Rows deleted per table; empty under a dry run. */
+  readonly deleted: Readonly<Record<string, number>>
+  readonly dryRun: boolean
+}
+
+/**
+ * Arguments accepted by {@link collect}.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export interface Options {
+  /** Delete terminal runs that finished strictly before this epoch millisecond. */
+  readonly olderThanMs: number
+  readonly dryRun?: boolean | undefined
+  /** A label for the report; the host's database path. */
+  readonly database?: string | undefined
+  /** Largest number of runs considered by this pass. Defaults to 1,000. */
+  readonly limit?: number | undefined
+  /** Runs retained by a host's cross-store ancestry, in addition to local live roots. */
+  readonly pins?: ReadonlyArray<string> | undefined
+}
+
+/** Whether a table exists in the connected database. */
+const hasTable = (table: string): Effect.Effect<boolean, SqlError, SqlClient.SqlClient> =>
+  Effect.gen(function*() {
+    const sql = yield* SqlClient.SqlClient
+    const rows = yield* Dialect.tables(sql).pipe(Effect.map((rows) => rows.filter((row) => row.name === table)))
+    return rows.length > 0
+  })
+
+/**
+ * The runs one pass would delete, oldest first, each with the run it names as
+ * its parent.
+ *
+ * The same candidate query `retain` runs: children before parents, so a
+ * trampoline lineage longer than the bound still loses a run every pass, and
+ * a run is excluded whenever a live run stands above or below it. Downward,
+ * deleting a parent whose child is still running would break the
+ * `parent_run_id` foreign key and drop the live child's edges with the
+ * `flows_run_parents_gc` trigger. Upward, a parked parent still reads a
+ * settled child's result out of its run row through `agent/await`, and it can
+ * be parked for longer than the threshold before it ever asks.
+ */
+const eligibleCandidates = (
+  olderThanMs: number,
+  limit: number | undefined,
+  pins?: ReadonlyArray<string>
+): Effect.Effect<ReadonlyArray<RetentionOps.Candidate>, SqlError, SqlClient.SqlClient> =>
+  Effect.gen(function*() {
+    const sql = yield* SqlClient.SqlClient
+    if (!(yield* hasTable("flows_runs"))) return []
+    // The engine's edge table is absent from the control-plane database, which
+    // migrates the run store and the journal and nothing else. The prelude
+    // drops that half of the walk there and keeps the `parent_run_id` half, so
+    // one guard covers both files.
+    return yield* RetentionOps.candidatesOf(sql, {
+      cutoffMs: olderThanMs,
+      inclusive: false,
+      parentEdges: yield* hasTable("flows_run_parents"),
+      pins,
+      limit: RetentionOps.normalizeLimit(limit)
+    })
+  })
+
+/**
+ * The terminal runs one pass would delete, oldest first.
+ *
+ * @category getters
+ * @since 1.0.0
+ */
+export const eligible = (
+  olderThanMs: number,
+  limit = RetentionOps.defaultLimit
+): Effect.Effect<ReadonlyArray<string>, SqlError, SqlClient.SqlClient> =>
+  Effect.map(
+    eligibleCandidates(olderThanMs, limit),
+    (candidates) => candidates.map((candidate) => candidate.runId)
+  )
+
+/**
+ * Runs one retention pass.
+ *
+ * The deletion itself is {@link RetentionOps.deleteRuns}, the same one
+ * {@link Service.retain} runs, so this pass cannot hold a shorter table list
+ * than that one and cannot delete run rows in an order the self-referential
+ * `parent_run_id` foreign key refuses. A handoff parent always sorts before
+ * its successor, so deleting in age order broke as soon as one lineage
+ * straddled a chunk boundary, and it broke AFTER the dependent rows of every
+ * eligible run were already gone. `assumeLadder: false` because this pass also
+ * runs against the control plane's database, which composed fewer stores.
+ *
+ * Eligibility and deletion share one retryable transaction: another writer
+ * cannot attach a live parent between the lineage scan and deletion. A busy
+ * retry recomputes eligibility rather than replaying an old candidate list.
+ * One transaction, for the reason `retain` opens one: a pass that removed a
+ * run's history and then refused on its row would have destroyed what it could
+ * not put back, and a workspace whose next pass refuses the same way can never
+ * be collected again.
+ *
+ * Under `dryRun` nothing is written and `deleted` is empty: the report names
+ * exactly the runs a real pass would remove, which is what makes
+ * `smithers gc --dry-run` worth trusting.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export const collect = (
+  options: Options
+): Effect.Effect<Report, SqlError | RetentionOps.RetentionError, SqlClient.SqlClient> =>
+  Effect.gen(function*() {
+    const sql = yield* SqlClient.SqlClient
+    const dryRun = options.dryRun === true
+    const pass = Effect.gen(function*() {
+      const candidates = yield* eligibleCandidates(options.olderThanMs, options.limit, options.pins)
+      return yield* RetentionOps.deleteRuns(sql, candidates, {
+        dryRun,
+        assumeLadder: false
+      })
+    })
+    const removed = yield* (dryRun ? sql.withTransaction(pass) : DurableWriter.make(sql).write(pass).pipe(
+      Effect.catchIf(
+        (cause): cause is DurableWriter.DatabaseError => cause instanceof DurableWriter.DatabaseError,
+        (cause) =>
+          Effect.fail(
+            new RetentionOps.RetentionError({
+              code: "delete_failed",
+              message: "retention transaction failed; no history was deleted",
+              cause
+            })
+          )
+      )
+    ))
+    return {
+      database: options.database ?? "",
+      olderThanMs: options.olderThanMs,
+      runs: removed.runIds,
+      deleted: dryRun ? {} : removed.deleted,
+      dryRun
+    }
+  })

package/src/RunCatalogRead.ts

@@ -0,0 +1,27 @@
+/**
+ * The workspace run catalog read.
+ *
+ * `@smthrs/sync` serves a workspace subscription over a `RunCatalog`, and its
+ * own implementations are static or in-process. This is the durable source a
+ * `RunCatalog.makePolling` catalog reads, so a follower learns of a run
+ * another engine created.
+ *
+ * The operation lives in `internal/RunCatalogOps.ts`, beside the other
+ * modules that read this package's own tables; this module is the public
+ * surface, so `internal/` is never imported by a consumer.
+ *
+ * @since 0.1.0
+ */
+
+export {
+  defaultLimit,
+  layer,
+  type ListOptions,
+  make,
+  RunCatalogError,
+  RunCatalogErrorCode,
+  RunCatalogRead,
+  type Service
+} from "./internal/RunCatalogOps.ts"
+
+export { Filters, type ListRunsOptions, maximumPageSize, type RunPage } from "./internal/RunListing.ts"

package/src/RunChangeFeed.ts

@@ -0,0 +1,125 @@
+/**
+ * Coalesced execution catch-up with permanent deletion evidence.
+ *
+ * @since 1.0.0
+ */
+
+import { RunStoreError } from "@smthrs/run-store/RunStore"
+import { Context, Effect, Layer, Schema } from "effect"
+import * as SqlClient from "effect/unstable/sql/SqlClient"
+import type { Position } from "./ExecutionSnapshot.ts"
+import * as Read from "./internal/ExecutionSnapshotRead.ts"
+
+/**
+ * A live-row change or retained tombstone.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export interface Change extends Position {
+  readonly runId: string
+  readonly deleted: boolean
+}
+/**
+ * One catch-up page at an engine watermark.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export interface Page extends Position {
+  readonly changes: ReadonlyArray<Change>
+  /** Resume here, including across gaps from coalesced changes. */
+  readonly nextRevision: number
+  readonly hasMore: boolean
+}
+/**
+ * Bounded state-feed operations.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export interface Service {
+  readonly current: Effect.Effect<Position, RunStoreError>
+  readonly changesSince: (options: Position & { readonly limit: number }) => Effect.Effect<Page, RunStoreError>
+}
+/**
+ * Durable change-feed service.
+ *
+ * @category services
+ * @since 1.0.0
+ */
+export class RunChangeFeed extends Context.Service<RunChangeFeed, Service>()("@smthrs/engine-store/RunChangeFeed") {}
+/**
+ * Maximum change-feed page size.
+ *
+ * @category constants
+ * @since 1.0.0
+ */
+export const maximumPageSize = 1000
+const Options = Schema.Struct({
+  source: Read.Source,
+  revision: Read.Natural,
+  limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: maximumPageSize }))
+})
+const ChangeRow = Schema.Struct({ run_id: Read.Identifier, revision: Read.Natural, deleted: Schema.Literals([0, 1]) })
+
+/**
+ * Constructs the feed without polling or retention timers.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export const make = (): Effect.Effect<Service, never, SqlClient.SqlClient> =>
+  Effect.gen(function*() {
+    const sql = yield* SqlClient.SqlClient
+    return {
+      current: Read.boundary("RunChangeFeed.current", Read.position(sql)),
+      changesSince: (options) =>
+        Read.boundary(
+          "RunChangeFeed.changesSince",
+          Effect.gen(function*() {
+            const input = yield* Read.decode(Options, options)
+            return yield* Read.transaction(
+              sql,
+              Effect.gen(function*() {
+                const at = yield* Read.position(sql)
+                if (input.source !== at.source || input.revision > at.revision) {
+                  return yield* Effect.fail(
+                    new RunStoreError({
+                      method: "RunChangeFeed.changesSince",
+                      code: "invalid_run",
+                      message: "change cursor requires an explicit source rebuild",
+                      cause: { requested: input, observed: at }
+                    })
+                  )
+                }
+                const rows = yield* sql`SELECT run_id, revision, deleted FROM flows_run_changes
+          WHERE revision > ${input.revision} AND revision <= ${at.revision}
+          ORDER BY revision LIMIT ${input.limit + 1}`
+                const decoded = yield* Effect.forEach(rows, (row) => Read.decode(ChangeRow, row))
+                const changes = decoded.slice(0, input.limit).map((row) => ({
+                  runId: row.run_id,
+                  source: at.source,
+                  revision: row.revision,
+                  deleted: row.deleted === 1
+                }))
+                const hasMore = decoded.length > input.limit
+                return {
+                  ...at,
+                  changes,
+                  hasMore,
+                  nextRevision: hasMore ? changes[changes.length - 1]!.revision : at.revision
+                }
+              })
+            )
+          })
+        )
+    }
+  })
+/**
+ * Provides the SQL feed.
+ *
+ * @category layers
+ * @since 1.0.0
+ */
+export const layer: Layer.Layer<RunChangeFeed, never, SqlClient.SqlClient> = Layer.effect(RunChangeFeed)(make())