@smthrs/journal 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/SqlConsensus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqlConsensus.js","sourceRoot":"","sources":["../../src/SqlConsensus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAC9D,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAC1D,OAAO,EAIL,SAAS,EACT,cAAc,EACd,SAAS,EAET,mBAAmB,EAEnB,eAAe,EAKhB,MAAM,gBAAgB,CAAA;AAGvB,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAA;AAE3D,MAAM,QAAQ,GAAG,CAAC,MAAuB,EAAY,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;AACtF,MAAM,OAAO,GAAG,CAAC,WAAmB,EAAW,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;AACpF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAW,CAAA;AACtC,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,WAAW,EAAW,CAAA;AAChD,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,WAAW,EAAW,CAAA;AAWhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAAuE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1G,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAA;IAEnC,MAAM,aAAa,GAAG,CAAC,KAAc,EAAkB,EAAE,CACvD,IAAI,cAAc,CAAC;QACjB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,kCAAkC;QAC3C,KAAK;KACN,CAAC,CAAA;IAEJ,sEAAsE;IACtE,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,KAAK,GAAG,CACZ,IAA+B,EACG,EAAE,CACpC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAErH,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAChC,GAAG,CAAU;;;uBAGM,KAAK;KACvB,CAAA;IAEH,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAC9B,GAAG,CAAA;;uBAEgB,KAAK;KACvB,CAAA;IAEH,MAAM,KAAK,GAAqB,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAC3D,KAAa,EACb,QAAiB,EACjB,KAAa,EACb,EAAE,CACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAA6B;;kBAExC,KAAK,KAAK,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,KAAK,KAAK;;;;;;;;;OASlF,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1C,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,CAAA;QACzC,OAAO,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAC,CACJ,CAAA;IAED,MAAM,QAAQ,GAAwB,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CACpE,KAAa,EACb,KAAc,EACd,WAAmB,EACnB,KAAa,EACb,EAAE,CACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAA6B;;;4BAG9B,KAAK,CAAC,MAAM;wBAChB,KAAK,CAAC,GAAG;0BACP,KAAK,CAAC,KAAK;4BACT,WAAW;8BACT,KAAK;;;;;yBAKV,KAAK;gCACE,KAAK,CAAC,MAAM;4BAChB,KAAK,CAAC,GAAG;8BACP,KAAK,CAAC,KAAK;gCACT,WAAW;;OAEpC,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAA2B,CAAA;IACvE,CAAC,CAAC,CAAC,CACJ,CAAA;IAED,MAAM,SAAS,GAAyB,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CACvE,KAAa,EACb,KAAc,EACd,KAAa,EACb,EAAE,CACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAsC;;gCAEnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,qBAAqB,KAAK;yBACtD,KAAK;gCACE,KAAK,CAAC,MAAM;4BAChB,KAAK,CAAC,GAAG;8BACP,KAAK,CAAC,KAAK;;OAElC,CAAA;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,OAAO,CAAC,GAAG,KAAK,SAAS;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAA4B,CAAA;IACjG,CAAC,CAAC,CAAC,CACJ,CAAA;IAED,MAAM,SAAS,GAAyB,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CACvE,KAAa,EACb,KAAc,EACd,KAAa,EACb,EAAE,CACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAsC;;gCAEnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,qBAAqB,KAAK;yBACtD,KAAK;gCACE,KAAK,CAAC,MAAM;4BAChB,KAAK,CAAC,GAAG;8BACP,KAAK,CAAC,KAAK;;;OAGlC,CAAA;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,OAAO,CAAC,GAAG,KAAK,SAAS;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAA4B,CAAA;IACjG,CAAC,CAAC,CAAC,CACJ,CAAA;IAED,MAAM,OAAO,GAAuB,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAa,EAAE,KAAc,EAAE,EAAE,CACnG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,CAAC,GAAG,CAAA;;;yBAGS,KAAK;gCACE,KAAK,CAAC,MAAM;4BAChB,KAAK,CAAC,GAAG;8BACP,KAAK,CAAC,KAAK;OAClC,CAAA;QACD,KAAK,CAAC,CAAC,GAAG,CAAA;;;;yBAIS,KAAK;gCACE,KAAK,CAAC,MAAM;4BAChB,KAAK,CAAC,GAAG;8BACP,KAAK,CAAC,KAAK;OAClC,CAAA;QACD,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC,CAAC,CAAC,CACJ,CAAA;IAED,MAAM,KAAK,GAAqB,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAC3D,KAAa,EACb,QAAiB,EACjB,KAAa,EACb,QAA0B,EAC1B,EAAE,CACF,MAAM,CAAC,OAAO,CAAC,GAAgD,EAAE;QAC/D,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAA;QACrD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAA6B;;;8BAG9B,QAAQ,CAAC,MAAM;0BACnB,QAAQ,CAAC,GAAG;4BACV,QAAQ,CAAC,KAAK;8BACZ,KAAK;2BACR,KAAK;kCACE,QAAQ,CAAC,aAAa,CAAC,MAAM;8BACjC,QAAQ,CAAC,aAAa,CAAC,GAAG;gCACxB,QAAQ,CAAC,aAAa,CAAC,KAAK;oCACxB,KAAK,GAAG,YAAY;;;SAG/C,CAAA;YACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAA;YAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;gBAAE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,CAAA;YAC3F,IACE,KAAK,KAAK,SAAS;gBACnB,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CAAC,MAAM;gBACrD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,aAAa,CAAC,GAAG;gBACtD,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,aAAa,CAAC,KAAK,EAClD,CAAC;gBACD,iEAAiE;gBACjE,gCAAgC;gBAChC,OAAO,QAAQ,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,OAAO,QAAQ,CAAC,YAAY,CAAC,CAAA;QAC/B,CAAC,CAAC,CAAC,CAAA;IACL,CAAC,CAAC,CACH,CAAA;IAED,MAAM,OAAO,GAAuB,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CACjE,KAAa,EACb,aAAsB,EACtB,WAAmB,EACnB,QAAiB,EACjB,KAAa,EACb,QAA0B,EAC1B,EAAE,CACF,MAAM,CAAC,OAAO,CAAC,GAAkD,EAAE;QACjE,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAA;QACrD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAA6B;;;2BAGjC,KAAK;kCACE,aAAa,CAAC,MAAM;8BACxB,aAAa,CAAC,GAAG;gCACf,aAAa,CAAC,KAAK;kCACjB,WAAW;kCACX,KAAK,GAAG,YAAY;;SAE7C,CAAA;YACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBACnB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAA6B;;2BAEpC,KAAK;kCACE,aAAa,CAAC,MAAM;8BACxB,aAAa,CAAC,GAAG;gCACf,aAAa,CAAC,KAAK;kCACjB,WAAW;SACpC,CAAA;YACD,mEAAmE;YACnE,yDAAyD;YACzD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QACjF,CAAC,CAAC,CAAC,CAAA;IACL,CAAC,CAAC,CACH,CAAA;IAED,MAAM,KAAK,GAAqB,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAa,EAAE,KAAc,EAAE,EAAE,CAC7F,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAyB;;yBAE7B,KAAK;gCACE,KAAK,CAAC,MAAM;4BAChB,KAAK,CAAC,GAAG;8BACP,KAAK,CAAC,KAAK;OAClC,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;QACpD,CAAC;IACH,CAAC,CAAC,CAAC,CACJ,CAAA;IAED,OAAO,SAAS,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AAChG,CAAC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAuE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA","sourcesContent":["/**\n * The default database-backed consensus strategy.\n *\n * This is the run store's former `flows_runs` ownership compare-and-swap\n * relocated: the owner tuple, the two-phase claim columns, claim recovery, and\n * the grant timestamp are the private schema of one strategy — the\n * `flows_consensus_leases` table — instead of a public contract on the run\n * row. The run row still mirrors the outcome, but the lease is what\n * arbitrates.\n *\n * Commit-time admission (R3) is exact: `guard` is a plain SELECT that joins\n * the caller's open write transaction — `DurableWriter` serializes write\n * transactions, so no reclaim can commit between the guard read and the\n * statements beside it — and every mutating operation runs through\n * `DurableWriter.write`, joining an enclosing transaction as a savepoint.\n * Prior art: Temporal's shard `rangeID` check\n * (`reference/temporal/service/history/shard/context_impl.go`,\n * `renewRangeLocked`).\n *\n * Governing design: `packages/smithers/flows/journal/docs/concepts/owner-fence.md`.\n *\n * @since 1.0.0\n */\n\nimport * as Dialect from \"@smthrs/database/Dialect\"\nimport { DurableWriter } from \"@smthrs/database/DurableWriter\"\nimport * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as SqlClient from \"effect/unstable/sql/SqlClient\"\nimport {\n  type ActivateOutcome,\n  type Claimed,\n  type ClaimOutcome,\n  Consensus,\n  ConsensusError,\n  fenceLost,\n  type HeartbeatOutcome,\n  heartbeatStaleAfter,\n  type LivenessEvidence,\n  matchesEvidence,\n  type RecoverOutcome,\n  type Rejected,\n  type RejectionReason,\n  type Service\n} from \"./Consensus.ts\"\nimport type { OwnerId } from \"./OwnerId.ts\"\n\nconst staleAfterMs = Duration.toMillis(heartbeatStaleAfter)\n\nconst rejected = (reason: RejectionReason): Rejected => ({ _tag: \"Rejected\", reason })\nconst claimed = (grantedAtMs: number): Claimed => ({ _tag: \"Claimed\", grantedAtMs })\nconst lost = { _tag: \"Lost\" } as const\nconst activated = { _tag: \"Activated\" } as const\nconst recovered = { _tag: \"Recovered\" } as const\n\ninterface LeaseRow {\n  readonly owner_host_id: string | null\n  readonly owner_pid: number | null\n  readonly owner_nonce: string | null\n  readonly claim_host_id: string | null\n  readonly claim_pid: number | null\n  readonly claim_nonce: string | null\n}\n\n/**\n * Constructs the database-backed strategy over the context's SQL client and\n * durable writer.\n *\n * @since 1.0.0\n * @category constructors\n */\nexport const make: Effect.Effect<Service, never, DurableWriter | SqlClient.SqlClient> = Effect.gen(function*() {\n  const sql = yield* Effect.service(SqlClient.SqlClient)\n  const writer = yield* DurableWriter\n\n  const strategyError = (cause: unknown): ConsensusError =>\n    new ConsensusError({\n      code: \"persistence_failed\",\n      message: \"consensus lease operation failed\",\n      cause\n    })\n\n  // The original cause is preserved through the wrapper so an enclosing\n  // `DurableWriter.write`'s retry classification still sees a transient\n  // conflict raised by a savepoint-nested lease statement.\n  const write = <A>(\n    body: Effect.Effect<A, unknown>\n  ): Effect.Effect<A, ConsensusError> =>\n    writer.write(body).pipe(Effect.mapError((cause) => cause instanceof ConsensusError ? cause : strategyError(cause)))\n\n  const leaseOf = (runId: string) =>\n    sql<LeaseRow>`\n      SELECT owner_host_id, owner_pid, owner_nonce, claim_host_id, claim_pid, claim_nonce\n      FROM flows_consensus_leases\n      WHERE run_id = ${runId}\n    `\n\n  const prune = (runId: string) =>\n    sql`\n      DELETE FROM flows_consensus_leases\n      WHERE run_id = ${runId} AND owner_host_id IS NULL AND claim_host_id IS NULL\n    `\n\n  const claim: Service[\"claim\"] = Effect.fn(\"Consensus.claim\")((\n    runId: string,\n    claimant: OwnerId,\n    nowMs: number\n  ) =>\n    write(Effect.gen(function*() {\n      const rows = yield* sql<{ readonly run_id: string }>`\n        INSERT INTO flows_consensus_leases (run_id, claim_host_id, claim_pid, claim_nonce, claimed_at_ms)\n        VALUES (${runId}, ${claimant.hostId}, ${claimant.pid}, ${claimant.nonce}, ${nowMs})\n        ON CONFLICT (run_id) DO UPDATE SET\n          claim_host_id = excluded.claim_host_id,\n          claim_pid = excluded.claim_pid,\n          claim_nonce = excluded.claim_nonce,\n          claimed_at_ms = excluded.claimed_at_ms\n        WHERE flows_consensus_leases.claim_host_id IS NULL\n          AND flows_consensus_leases.owner_host_id IS NULL\n        RETURNING run_id\n      `\n      if (rows.length > 0) return claimed(nowMs)\n      // The upsert only misses on a conflicting row, so the lease exists and\n      // holds a claim, an owner, or both.\n      const lease = (yield* leaseOf(runId))[0]!\n      return lease.claim_host_id !== null ? rejected(\"already_claimed\") : rejected(\"owner_held\")\n    }))\n  )\n\n  const activate: Service[\"activate\"] = Effect.fn(\"Consensus.activate\")((\n    runId: string,\n    owner: OwnerId,\n    grantedAtMs: number,\n    nowMs: number\n  ) =>\n    write(Effect.gen(function*() {\n      const rows = yield* sql<{ readonly run_id: string }>`\n        UPDATE flows_consensus_leases\n        SET\n          owner_host_id = ${owner.hostId},\n          owner_pid = ${owner.pid},\n          owner_nonce = ${owner.nonce},\n          granted_at_ms = ${grantedAtMs},\n          heartbeat_at_ms = ${nowMs},\n          claim_host_id = NULL,\n          claim_pid = NULL,\n          claim_nonce = NULL,\n          claimed_at_ms = NULL\n        WHERE run_id = ${runId}\n          AND claim_host_id = ${owner.hostId}\n          AND claim_pid = ${owner.pid}\n          AND claim_nonce = ${owner.nonce}\n          AND claimed_at_ms = ${grantedAtMs}\n        RETURNING run_id\n      `\n      return (rows.length > 0 ? activated : lost) satisfies ActivateOutcome\n    }))\n  )\n\n  const heartbeat: Service[\"heartbeat\"] = Effect.fn(\"Consensus.heartbeat\")((\n    runId: string,\n    owner: OwnerId,\n    nowMs: number\n  ) =>\n    write(Effect.gen(function*() {\n      // Monotonic: a pulse delayed past a newer one from the same owner never\n      // moves the lease backwards and never makes a live run look stale.\n      const rows = yield* sql<{ readonly heartbeat_at_ms: number }>`\n        UPDATE flows_consensus_leases\n        SET heartbeat_at_ms = ${Dialect.greatest(sql)}(heartbeat_at_ms, ${nowMs})\n        WHERE run_id = ${runId}\n          AND owner_host_id = ${owner.hostId}\n          AND owner_pid = ${owner.pid}\n          AND owner_nonce = ${owner.nonce}\n        RETURNING heartbeat_at_ms\n      `\n      const row = rows[0]\n      return (row === undefined\n        ? lost\n        : { _tag: \"Renewed\", heartbeatAtMs: Number(row.heartbeat_at_ms) }) satisfies HeartbeatOutcome\n    }))\n  )\n\n  const reconfirm: Service[\"reconfirm\"] = Effect.fn(\"Consensus.reconfirm\")((\n    runId: string,\n    owner: OwnerId,\n    nowMs: number\n  ) =>\n    write(Effect.gen(function*() {\n      // A pending steal has already reserved the lease, even before activation.\n      // Compare both owner and claim in the same update as the renewal.\n      const rows = yield* sql<{ readonly heartbeat_at_ms: number }>`\n        UPDATE flows_consensus_leases\n        SET heartbeat_at_ms = ${Dialect.greatest(sql)}(heartbeat_at_ms, ${nowMs})\n        WHERE run_id = ${runId}\n          AND owner_host_id = ${owner.hostId}\n          AND owner_pid = ${owner.pid}\n          AND owner_nonce = ${owner.nonce}\n          AND claim_host_id IS NULL\n        RETURNING heartbeat_at_ms\n      `\n      const row = rows[0]\n      return (row === undefined\n        ? lost\n        : { _tag: \"Renewed\", heartbeatAtMs: Number(row.heartbeat_at_ms) }) satisfies HeartbeatOutcome\n    }))\n  )\n\n  const release: Service[\"release\"] = Effect.fn(\"Consensus.release\")((runId: string, owner: OwnerId) =>\n    write(Effect.gen(function*() {\n      yield* sql`\n        UPDATE flows_consensus_leases\n        SET claim_host_id = NULL, claim_pid = NULL, claim_nonce = NULL, claimed_at_ms = NULL\n        WHERE run_id = ${runId}\n          AND claim_host_id = ${owner.hostId}\n          AND claim_pid = ${owner.pid}\n          AND claim_nonce = ${owner.nonce}\n      `\n      yield* sql`\n        UPDATE flows_consensus_leases\n        SET owner_host_id = NULL, owner_pid = NULL, owner_nonce = NULL,\n          granted_at_ms = NULL, heartbeat_at_ms = NULL\n        WHERE run_id = ${runId}\n          AND owner_host_id = ${owner.hostId}\n          AND owner_pid = ${owner.pid}\n          AND owner_nonce = ${owner.nonce}\n      `\n      yield* prune(runId)\n    }))\n  )\n\n  const steal: Service[\"steal\"] = Effect.fn(\"Consensus.steal\")((\n    runId: string,\n    claimant: OwnerId,\n    nowMs: number,\n    evidence: LivenessEvidence\n  ) =>\n    Effect.suspend((): Effect.Effect<ClaimOutcome, ConsensusError> => {\n      if (!matchesEvidence(evidence.expectedOwner, claimant, nowMs, evidence)) {\n        return Effect.succeed(rejected(\"evidence_invalid\"))\n      }\n      return write(Effect.gen(function*() {\n        const rows = yield* sql<{ readonly run_id: string }>`\n          UPDATE flows_consensus_leases\n          SET\n            claim_host_id = ${claimant.hostId},\n            claim_pid = ${claimant.pid},\n            claim_nonce = ${claimant.nonce},\n            claimed_at_ms = ${nowMs}\n          WHERE run_id = ${runId}\n            AND owner_host_id = ${evidence.expectedOwner.hostId}\n            AND owner_pid = ${evidence.expectedOwner.pid}\n            AND owner_nonce = ${evidence.expectedOwner.nonce}\n            AND heartbeat_at_ms < ${nowMs - staleAfterMs}\n            AND claim_host_id IS NULL\n          RETURNING run_id\n        `\n        if (rows.length > 0) return claimed(nowMs)\n        const lease = (yield* leaseOf(runId))[0]\n        if (lease !== undefined && lease.claim_host_id !== null) return rejected(\"already_claimed\")\n        if (\n          lease === undefined ||\n          lease.owner_host_id !== evidence.expectedOwner.hostId ||\n          Number(lease.owner_pid) !== evidence.expectedOwner.pid ||\n          lease.owner_nonce !== evidence.expectedOwner.nonce\n        ) {\n          // A run nobody owns, or one owned by somebody else, has no owner\n          // this evidence could disprove.\n          return rejected(\"evidence_invalid\")\n        }\n        return rejected(\"owner_live\")\n      }))\n    })\n  )\n\n  const recover: Service[\"recover\"] = Effect.fn(\"Consensus.recover\")((\n    runId: string,\n    staleClaimant: OwnerId,\n    grantedAtMs: number,\n    observer: OwnerId,\n    nowMs: number,\n    evidence: LivenessEvidence\n  ) =>\n    Effect.suspend((): Effect.Effect<RecoverOutcome, ConsensusError> => {\n      if (!matchesEvidence(staleClaimant, observer, nowMs, evidence)) {\n        return Effect.succeed(rejected(\"evidence_invalid\"))\n      }\n      return write(Effect.gen(function*() {\n        const rows = yield* sql<{ readonly run_id: string }>`\n          UPDATE flows_consensus_leases\n          SET claim_host_id = NULL, claim_pid = NULL, claim_nonce = NULL, claimed_at_ms = NULL\n          WHERE run_id = ${runId}\n            AND claim_host_id = ${staleClaimant.hostId}\n            AND claim_pid = ${staleClaimant.pid}\n            AND claim_nonce = ${staleClaimant.nonce}\n            AND claimed_at_ms = ${grantedAtMs}\n            AND claimed_at_ms < ${nowMs - staleAfterMs}\n          RETURNING run_id\n        `\n        if (rows.length > 0) {\n          yield* prune(runId)\n          return recovered\n        }\n        const matches = yield* sql<{ readonly run_id: string }>`\n          SELECT run_id FROM flows_consensus_leases\n          WHERE run_id = ${runId}\n            AND claim_host_id = ${staleClaimant.hostId}\n            AND claim_pid = ${staleClaimant.pid}\n            AND claim_nonce = ${staleClaimant.nonce}\n            AND claimed_at_ms = ${grantedAtMs}\n        `\n        // The exact claim survived the compare-and-swap only because it is\n        // not yet stale; anything else means the claim moved on.\n        return matches.length > 0 ? rejected(\"claim_fresh\") : rejected(\"claim_changed\")\n      }))\n    })\n  )\n\n  const guard: Service[\"guard\"] = Effect.fn(\"Consensus.guard\")((runId: string, owner: OwnerId) =>\n    write(Effect.gen(function*() {\n      const held = yield* sql<{ readonly ok: number }>`\n        SELECT 1 AS ok FROM flows_consensus_leases\n        WHERE run_id = ${runId}\n          AND owner_host_id = ${owner.hostId}\n          AND owner_pid = ${owner.pid}\n          AND owner_nonce = ${owner.nonce}\n      `\n      if (held.length === 0) {\n        return yield* Effect.fail(fenceLost(runId, owner))\n      }\n    }))\n  )\n\n  return Consensus.of({ claim, activate, heartbeat, reconfirm, release, steal, recover, guard })\n})\n\n/**\n * Provides the database-backed strategy.\n *\n * @since 1.0.0\n * @category layers\n */\nexport const layer: Layer.Layer<Consensus, never, DurableWriter | SqlClient.SqlClient> = Layer.effect(Consensus, make)\n"]}

package/dist/esm/SqlJournal.d.ts

@@ -0,0 +1,173 @@
+/**
+ * SQLite-backed logical journal with durable and lossy channels.
+ *
+ * Lossy telemetry events remain optimistic until the single scoped writer
+ * commits them, so a process crash can lose accepted-but-unwritten telemetry.
+ * Lifecycle events use `emitDurable` and return after commit, except inside
+ * `transact`, where their savepoint completes before the outer commit.
+ *
+ * Governing design: `packages/smithers/flows/journal/docs/concepts/two-channels.md`.
+ * Prior-art decision: `packages/smithers/flows/sync/docs/concepts/replay-then-follow.md`.
+ *
+ * The replay-then-follow stream follows Effect's `EventJournal` and OpenCode's
+ * upstream event stream design. The bounded send queue deliberately deviates
+ * from their synchronous durable writes by reserving a provisional per-run
+ * sequence before admission. Both channels finalize canonical order at commit.
+ * SQLite retry and transaction behavior comes through `@smthrs/database`.
+ *
+ * @since 0.1.0
+ */
+import { DurableWriter } from "@smthrs/database/DurableWriter";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Scope from "effect/Scope";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+import { Consensus } from "./Consensus.ts";
+import { Journal, JournalError, type OverflowPolicy, type Service } from "./Journal.ts";
+import { RunId, type Seq } from "./JournalEvent.ts";
+import * as Redaction from "./Redaction.ts";
+/**
+ * Automatic checkpoint-and-compact policy for the SQL journal.
+ *
+ * Disabled unless set on {@link SqlJournalOptions}. Once a run's committed
+ * entry count reaches `entryThreshold`, the journal asks `capture` for the
+ * caller's replay state at the run's durable tail, writes it as a checkpoint
+ * at that sequence, and compacts the entries strictly below it.
+ *
+ * Both channels run the policy after their allocation permit is free. Lossy
+ * commits fork scoped maintenance so the sole queue consumer keeps draining;
+ * durable emits await their attempt. `flush` awaits registered maintenance.
+ * `capture` may read or emit without blocking unrelated allocation. A capture is interrupted
+ * after 30 seconds so caller code cannot wedge journal admission indefinitely.
+ *
+ * A failed or refused attempt (a live stream behind the boundary, a capture
+ * failure) is logged at warning, damped for `entryThreshold`
+ * further committed entries, and never surfaced to the emit that triggered
+ * it.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface CompactionPolicy {
+    readonly entryThreshold: number;
+    readonly capture: (runId: RunId, upTo: Seq) => Effect.Effect<unknown, unknown>;
+}
+/**
+ * SQL journal queue and batching options.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface SqlJournalOptions {
+    /**
+     * Bound on the number of ENTRIES held in two places at once: the lossy
+     * admission queue, where `overflow` decides what happens when it is full,
+     * and the sliding `changes` buffer, where a slow subscriber silently loses
+     * the entries that fall out of it.
+     *
+     * It bounds entries, not bytes. Set {@link SqlJournalOptions.maxEntryBytes}
+     * to bound the size of one entry as well; with it unset a handful of very
+     * large payloads is still the memory bill.
+     */
+    readonly capacity: number;
+    /** Policy applied when the lossy admission queue is full. */
+    readonly overflow: OverflowPolicy;
+    /** Entries the queued writer commits per transaction. */
+    readonly batchSize?: number | undefined;
+    /**
+     * Upper bound on the in-process source-event index, the map that answers
+     * producer idempotency from memory.
+     *
+     * The index is a cache, never the authority, and a MISS costs a receipt, not
+     * correctness. On a miss for an explicit producer sequence the entry is
+     * admitted optimistically without any read: `emitLossy` returns `Accepted`
+     * where a resident entry would have returned `Duplicate`, and the insert
+     * collapses onto the committed row through the unique index
+     * `(run_id, source_id, source_seq)` rather than doubling it. A CHANGED retry
+     * behind an evicted entry therefore surfaces `idempotency_conflict` from
+     * `flush`, not from the emit. See `admitFromIndex` for why the read is gone:
+     * `emitLossy` is called from inside other write transactions, and the
+     * pre-admission SELECT deadlocked `@smthrs/agent`'s exit flush against the
+     * engine's own writer, measured at over 120 s versus about half a second
+     * without it.
+     *
+     * Bounding the cache keeps startup decode and resident memory O(bound) rather
+     * than O(total events ever written), mirroring Temporal's refusal to hold
+     * unbounded history in a shard (`service/history`). The separate
+     * sequence-floor maps start empty and grow only with runs and producers this
+     * layer instance touches; they are lazy, not governed by this bound.
+     *
+     * Idempotency compares canonical persisted JSON after redaction. Two inputs
+     * that redact to the same value are therefore the same event, and JSON's
+     * encoding intentionally treats `NaN` and `null` as the same `null` value.
+     */
+    readonly sourceEventCache?: number | undefined;
+    /**
+     * Largest single entry the journal admits, measured in UTF-8 bytes of the
+     * encoded `payload` plus `meta`.
+     *
+     * Unset by default, which means unbounded: `capacity` bounds how MANY entries
+     * the admission queue and the `changes` buffer hold, never how large one is,
+     * so without this a handful of multi-megabyte payloads is the memory bill,
+     * and every one of them is replayed to each sync subscriber and time-travel
+     * consumer on every read. Set it where the journal is fed by untrusted or
+     * unbounded producers.
+     *
+     * The bound is checked after encoding and BEFORE any sequence is allocated or
+     * anything is queued, so a refused entry costs no sequence and leaves no gap.
+     * An entry over the bound fails `invalid_event`.
+     */
+    readonly maxEntryBytes?: number | undefined;
+    /**
+     * Scrub applied to every `payload` and `meta` before it is encoded for
+     * persistence.
+     *
+     * Journal rows are permanent and are replayed verbatim to sync subscribers
+     * and time-travel consumers, so a credential that reaches `payload_json` is
+     * a durable, broadly readable leak. Redaction therefore defaults to
+     * `Redaction.make()`; pass `Redaction.makeNoop()` to persist payloads
+     * verbatim by choice.
+     */
+    readonly redact?: Redaction.Redactor | undefined;
+    /**
+     * Automatic checkpoint-and-compact policy. Off by default: without it the
+     * journal never deletes an entry, and checkpointing stays a caller-driven
+     * `checkpoint` / `compact` call.
+     */
+    readonly compaction?: CompactionPolicy | undefined;
+}
+/**
+ * Constructs the SQL journal over the context's SQL client, durable writer,
+ * and consensus strategy.
+ *
+ * `emitLossy` validates and admits telemetry to the non-blocking queue;
+ * `emitDurable` allocates and commits inside the database transaction, fenced
+ * through `Consensus.guard` in that same transaction.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export declare const make: (options: SqlJournalOptions) => Effect.Effect<Service, JournalError, Consensus | DurableWriter | SqlClient.SqlClient | Scope.Scope>;
+/**
+ * Provides the SQL journal over an explicitly injected consensus strategy.
+ *
+ * The strategy in context arbitrates the owner fence: `emitDurable`,
+ * `checkpoint`, and `compact` join its `guard` inside their write
+ * transaction. Provide the SAME strategy instance to every service that must
+ * agree on ownership — `RunStore.layerWith` in particular — because
+ * `Consensus.layerLocal` keeps its leases per layer build.
+ *
+ * @category layers
+ * @since 1.0.0
+ */
+export declare const layerWith: (options: SqlJournalOptions) => Layer.Layer<Journal, JournalError, Consensus | DurableWriter | SqlClient.SqlClient>;
+/**
+ * Provides the SQL journal fenced by the database-backed strategy,
+ * `SqlConsensus`, over the same client. Use {@link layerWith} to inject a
+ * different strategy.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: (options: SqlJournalOptions) => Layer.Layer<Journal, JournalError, DurableWriter | SqlClient.SqlClient>;
+//# sourceMappingURL=SqlJournal.d.ts.map

package/dist/esm/SqlJournal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqlJournal.d.ts","sourceRoot":"","sources":["../../src/SqlJournal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAA8B,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAI1F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAOrC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAGrC,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,OAAO,EASL,OAAO,EACP,YAAY,EAGZ,KAAK,cAAc,EACnB,KAAK,OAAO,EAEb,MAAM,cAAc,CAAA;AACrB,OAAO,EAKL,KAAK,EACL,KAAK,GAAG,EAGT,MAAM,mBAAmB,CAAA;AAK1B,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAM3C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;CAC/E;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3C;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAA;CACnD;AA+WD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,IAAI,GACf,SAAS,iBAAiB,KACzB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAqlEjG,CAAA;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,GACpB,SAAS,iBAAiB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC,SAAS,CAC/C,CAAA;AAEtC;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,GAChB,SAAS,iBAAiB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,GAAG,SAAS,CAAC,SAAS,CACb,CAAA"}