@akterjs/effect 0.0.0-stage → 0.1.0

package/dist/host/actor/actor-records.sql.d.mts

@@ -0,0 +1,29 @@
+import { StateUnreadableError } from "../../contract/state/state-unreadable.errors.mjs";
+import "../../runtime/akter.layer.mjs";
+import { HostedActor } from "../../contract/actor/actor.contract.mjs";
+import { AppliedMigration } from "../migration/migration-plan.pure.mjs";
+import { ReservedObject } from "./reserved-names.pure.mjs";
+import { Effect } from "effect";
+import { SqlClient, SqlError } from "effect/sql";
+interface AppliedRow extends AppliedMigration {
+  readonly at: number;
+}
+interface Recording {
+  readonly row: AppliedRow;
+  readonly sql: SqlClient.SqlClient;
+}
+interface Upgrading {
+  readonly actor: HostedActor;
+  readonly sql: SqlClient.SqlClient;
+}
+type Rows<Row> = Effect.Effect<readonly Row[], SqlError.SqlError>;
+type Write = Effect.Effect<void, SqlError.SqlError>;
+declare const appliedMigrations: (sql: SqlClient.SqlClient) => Rows<AppliedMigration>;
+declare const recordMigration: ({ row, sql }: Recording) => Write;
+interface Reserving {
+  readonly prefixes: readonly string[];
+  readonly sql: SqlClient.SqlClient;
+}
+declare const reservedObjects: ({ prefixes, sql }: Reserving) => Rows<ReservedObject>;
+declare const upgradeStoredState: (args_0: Upgrading) => Effect.Effect<void, SqlError.SqlError | StateUnreadableError, never>;
+export { appliedMigrations, recordMigration, reservedObjects, upgradeStoredState };

package/dist/host/actor/actor-records.sql.mjs

@@ -0,0 +1,26 @@
+import { Array, Effect, Option, String } from "effect";
+// src/host/actor/actor-records.sql.ts
+const appliedMigrations = (sql) => sql`SELECT version, hash FROM akter_migrations ORDER BY version`;
+const recordMigration = ({ row, sql }) => Effect.asVoid(sql`INSERT INTO akter_migrations (version, hash, applied_at) VALUES (${row.version}, ${row.hash}, ${row.at})`);
+const reservedObjects = ({ prefixes, sql }) => {
+	const lowered = Array.map(prefixes, String.toLowerCase);
+	const reserved = (name) => Array.some(lowered, (prefix) => String.startsWith(prefix)(String.toLowerCase(name)));
+	return Effect.map(sql`SELECT type, name, tbl_name AS owner, coalesce(sql, '') AS definition FROM sqlite_master ORDER BY type, name`, Array.filter((object) => reserved(object.name) || reserved(object.owner)));
+};
+const storedState = (sql) => sql`SELECT value FROM akter_state WHERE id = 1`;
+const replaceState = ({ sql, value }) => Effect.asVoid(sql`UPDATE akter_state SET value = ${value} WHERE id = 1`);
+const upgradeStoredState = Effect.fnUntraced(function* upgradeStoredState({ actor, sql }) {
+	const rows = yield* storedState(sql);
+	const upgraded = yield* Option.match(Array.head(rows), {
+		onNone: () => Effect.succeedNone,
+		onSome: (row) => actor.upgradeState(row.value)
+	});
+	yield* Option.match(upgraded, {
+		onNone: () => Effect.void,
+		onSome: (value) => replaceState({
+			sql,
+			value
+		})
+	});
+});
+export { appliedMigrations, recordMigration, reservedObjects, upgradeStoredState };

package/dist/host/actor/reserved-name.errors.d.mts

@@ -0,0 +1,10 @@
+import { Schema } from "effect";
+declare const ReservedNameError_base: Schema.Class<ReservedNameError, Schema.TaggedStruct<"ReservedNameError", {
+  readonly actor: Schema.String;
+  readonly table: Schema.String;
+  readonly version: Schema.Int;
+}>, import("effect/Cause").YieldableError & {
+  readonly brand: unique symbol;
+}>;
+export declare class ReservedNameError extends ReservedNameError_base {}
+export {};

package/dist/host/actor/reserved-name.errors.mjs

@@ -0,0 +1,8 @@
+import { Schema } from "effect";
+// src/host/actor/reserved-name.errors.ts
+var ReservedNameError = class extends Schema.TaggedError()("ReservedNameError", {
+	actor: Schema.String,
+	table: Schema.String,
+	version: Schema.Int
+}) {};
+export { ReservedNameError };

package/dist/host/actor/reserved-names.pure.d.mts

@@ -0,0 +1,15 @@
+import { ReservedNameError } from "./reserved-name.errors.mjs";
+import { Effect } from "effect";
+interface ReservedObject {
+  readonly definition: string;
+  readonly name: string;
+  readonly type: string;
+}
+interface ReservedChange {
+  readonly actor: string;
+  readonly after: readonly ReservedObject[];
+  readonly before: readonly ReservedObject[];
+  readonly version: number;
+}
+declare const checkReserved: ({ actor, after, before, version }: ReservedChange) => Effect.Effect<void, ReservedNameError>;
+export { type ReservedObject, checkReserved };

package/dist/host/actor/reserved-names.pure.mjs

@@ -0,0 +1,20 @@
+import { ReservedNameError } from "./reserved-name.errors.mjs";
+import { Array, Effect, Option } from "effect";
+// src/host/actor/reserved-names.pure.ts
+const describeObject = (object) => `${object.type} ${object.name} ${object.definition}`;
+const missingFrom = (objects, others) => {
+	const kept = Array.map(others, describeObject);
+	return Array.filter(objects, (object) => !Array.contains(kept, describeObject(object)));
+};
+const checkReserved = ({ actor, after, before, version }) => {
+	const changed = Array.appendAll(missingFrom(after, before), missingFrom(before, after));
+	return Option.match(Array.head(changed), {
+		onNone: () => Effect.void,
+		onSome: (object) => Effect.fail(ReservedNameError.make({
+			actor,
+			table: object.name,
+			version
+		}))
+	});
+};
+export { checkReserved };

package/dist/host/actor/room.actor.d.mts

@@ -0,0 +1,4 @@
+import "../../contract/akter.service.mjs";
+import { ActorHandlers } from "../../contract/actor/actor.contract.mjs";
+declare const RoomLive: import("effect/Layer").Layer<ActorHandlers<"Room">, never, never>;
+export { RoomLive };

package/dist/host/actor/room.actor.mjs

@@ -0,0 +1,36 @@
+import { FileAccessDeniedError } from "../../contract/file/access/file-access-denied.errors.mjs";
+import { Akter } from "../../contract/akter.service.mjs";
+import "../../contract/client/client-failure.contract.mjs";
+import { NotMemberError, Room } from "../../contract/room.contract.mjs";
+import { Array, Effect } from "effect";
+// src/host/actor/room.actor.ts
+const RoomLive = Room.toLayer({
+	commands: {
+		join: (room) => Effect.gen(function* join() {
+			const me = yield* Akter.principal;
+			yield* Room.update({ members: Array.append(room.members, me.id) });
+		}),
+		post: (room, { text }) => Effect.gen(function* post() {
+			const me = yield* Akter.principal;
+			if (!Array.contains(room.members, me.id)) return yield* NotMemberError.make({});
+			const id = yield* Akter.id;
+			const at = yield* Akter.now;
+			const sql = yield* Akter.sql;
+			yield* sql`INSERT INTO messages ${sql.insert({
+				at,
+				author: me.id,
+				id,
+				text
+			})}`;
+			return id;
+		})
+	},
+	files: { authorize: (room, { access, path }) => Akter.principal.pipe(Effect.filterOrFail((me) => Array.contains(room.members, me.id), () => FileAccessDeniedError.make({
+		access,
+		message: "only the room's members may use its files",
+		path
+	})), Effect.asVoid) },
+	migrations: { 1: (sql) => sql`CREATE TABLE messages (id TEXT PRIMARY KEY, author TEXT NOT NULL, text TEXT NOT NULL, at INTEGER NOT NULL)` },
+	queries: { messages: (_room, { limit }) => Effect.flatMap(Akter.sql, (sql) => sql`SELECT id, author, text, at FROM messages ORDER BY at DESC LIMIT ${limit}`) }
+});
+export { RoomLive };

package/dist/host/blob/blob-frames.pure.d.mts

@@ -0,0 +1,7 @@
+import { Stream } from "effect";
+interface Framing<Failure, Services> {
+  readonly size: number;
+  readonly source: Stream.Stream<Uint8Array, Failure, Services>;
+}
+declare const framesOf: <Failure, Services>({ size, source }: Framing<Failure, Services>) => Stream.Stream<Uint8Array, Failure, Services>;
+export { framesOf };

package/dist/host/blob/blob-frames.pure.mjs

@@ -0,0 +1,28 @@
+import { Stream } from "effect";
+// src/host/blob/blob-frames.pure.ts
+const zeroBytes = 0;
+const oneFrame = 1;
+const pieces = function* pieces(pending, input) {
+	let offset = zeroBytes;
+	while (offset < input.byteLength) {
+		const length = Math.min(pending.bytes.byteLength - pending.used, input.byteLength - offset);
+		pending.bytes.set(input.subarray(offset, offset + length), pending.used);
+		pending.used += length;
+		offset += length;
+		if (pending.used === pending.bytes.byteLength) {
+			yield pending.bytes;
+			pending.bytes = new Uint8Array(pending.bytes.byteLength);
+			pending.used = zeroBytes;
+		}
+	}
+};
+const framesOf = ({ size, source }) => Stream.suspend(() => {
+	const pending = {
+		bytes: new Uint8Array(size),
+		used: zeroBytes
+	};
+	const complete = Stream.flatMap(source, (bytes) => Stream.fromIterable(pieces(pending, bytes), { chunkSize: oneFrame }));
+	const final = Stream.suspend(() => Stream.succeed(pending.bytes.subarray(zeroBytes, pending.used)));
+	return Stream.concat(complete, final);
+});
+export { framesOf };

package/dist/host/blob/blob-grant.schema.d.mts

@@ -0,0 +1,14 @@
+import { Schema } from "effect";
+/**
+ * How a grant's file key is wrapped. `v1` wraps it with the actor key itself, `v2` with a key HKDF-SHA-256 derives
+ * from the actor key, so the one key that encrypts the actor's pages never wraps file keys directly. New grants are v2;
+ * v1 grants written before stay readable.
+ */
+declare const GrantFormat: Schema.Literals<readonly ["xchacha20-poly1305/v1", "xchacha20-poly1305/v2"]>;
+type GrantFormat = typeof GrantFormat.Type;
+declare const BlobGrantJson: Schema.fromJsonString<Schema.Struct<{
+  readonly format: Schema.Literals<readonly ["xchacha20-poly1305/v1", "xchacha20-poly1305/v2"]>;
+  readonly nonce: Schema.Uint8ArrayFromBase64;
+  readonly wrapped: Schema.Uint8ArrayFromBase64;
+}>>;
+export { BlobGrantJson, type GrantFormat };

package/dist/host/blob/blob-grant.schema.mjs

@@ -0,0 +1,15 @@
+import { Schema } from "effect";
+// src/host/blob/blob-grant.schema.ts
+/**
+* How a grant's file key is wrapped. `v1` wraps it with the actor key itself, `v2` with a key HKDF-SHA-256 derives
+* from the actor key, so the one key that encrypts the actor's pages never wraps file keys directly. New grants are v2;
+* v1 grants written before stay readable.
+*/
+const GrantFormat = Schema.Literals(["xchacha20-poly1305/v1", "xchacha20-poly1305/v2"]);
+const BlobGrant = Schema.Struct({
+	format: GrantFormat,
+	nonce: Schema.Uint8ArrayFromBase64,
+	wrapped: Schema.Uint8ArrayFromBase64
+});
+const BlobGrantJson = Schema.fromJsonString(BlobGrant);
+export { BlobGrantJson };

package/dist/host/blob/blob-grants.service.d.mts

@@ -0,0 +1,28 @@
+import { BlobKeyring } from "./blob-keyring.service.mjs";
+import { Rewrapping } from "./blob-sealing.contract.mjs";
+import { BlobTransferError } from "../../contract/file/blob-transfer.errors.mjs";
+import { Context, Effect, Layer } from "effect";
+import { Aead, Kdf, SecureRandom } from "effect/crypto";
+interface Owner {
+  readonly actor: string;
+  readonly blob: string;
+}
+interface Opening extends Owner {
+  readonly grant: string;
+}
+interface FreshGrant {
+  readonly grant: string;
+  readonly key: Aead.Key;
+}
+interface BlobGrantsOperations {
+  readonly fresh: (owner: Owner) => Effect.Effect<FreshGrant, BlobTransferError>;
+  readonly open: (opening: Opening) => Effect.Effect<Aead.Key, BlobTransferError>;
+  readonly rewrap: (rewrapping: Rewrapping) => Effect.Effect<string, BlobTransferError>;
+}
+declare const BlobGrants_base: Context.ServiceClass<BlobGrants, "@akterjs/effect/host/blob/blob-grants.service/BlobGrants", BlobGrantsOperations> & {
+  readonly make: Effect.Effect<BlobGrantsOperations, never, Aead.Aead | BlobKeyring | Kdf.Kdf | SecureRandom.SecureRandom>;
+};
+export declare class BlobGrants extends BlobGrants_base {
+  static readonly layer: Layer.Layer<BlobGrants, never, BlobKeyring>;
+}
+export {};

package/dist/host/blob/blob-grants.service.mjs

@@ -0,0 +1,129 @@
+import { BlobGrantJson } from "./blob-grant.schema.mjs";
+import { BlobKeyring } from "./blob-keyring.service.mjs";
+import { BlobTransferError } from "../../contract/file/blob-transfer.errors.mjs";
+import { Context, Effect, Layer, Redacted, Schema } from "effect";
+import { Aead, Kdf, SecureRandom } from "effect/crypto";
+// src/host/blob/blob-grants.service.ts
+const nonceBytes = 24;
+const wrappingKeyBytes = 32;
+const wiped = 0;
+/** The format every grant is written in. */
+const writtenFormat = "xchacha20-poly1305/v2";
+/** The format whose file key is wrapped with the actor key itself, still opened for grants written before v2. */
+const rawKeyFormat = "xchacha20-poly1305/v1";
+/**
+* HKDF's info for the wrapping key. The salt is empty: the actor key is already a uniformly random 32-byte key, so
+* RFC 5869 needs no salt for extraction, and the info alone separates this use from the actor's page encryption.
+*/
+const wrappingInfo = new globalThis.TextEncoder().encode("akter/blob-grant/v1");
+const noSalt = /* @__PURE__ */ new Uint8Array();
+const crypto = Layer.mergeAll(Aead.layerWebCrypto, Kdf.layerWebCrypto).pipe(Layer.provideMerge(SecureRandom.layerWebCrypto));
+const refused = (blob) => BlobTransferError.make({
+	blob,
+	message: "the file grant could not be opened for this actor"
+});
+const bindingOf = ({ actor, blob }) => new globalThis.TextEncoder().encode(`akter/blob-grant/v1/${actor.length}:${actor}/${blob}`);
+/** The bytes of the keyring's key this module owns: the keyring's own buffer if it hands it over, else a copy. */
+const ownedBytes = (keyring, lent) => {
+	const bytes = Redacted.value(lent);
+	if (keyring.handsOver === true) return bytes;
+	return Uint8Array.from(bytes);
+};
+const zeroAll = (buffers) => {
+	for (const bytes of buffers) bytes.fill(wiped);
+};
+/**
+* Runs `use` with the wrapping key for one use of an actor's key, and zeroes, in one `ensuring` whatever the outcome,
+* every buffer of key bytes this module owns for it: the actor key's bytes and the key derived from them.
+*/
+const withWrappingKey = (keys, { format, ...owner }, use) => Effect.flatMap(keys.keyring.keyFor(owner), (lent) => {
+	const secret = ownedBytes(keys.keyring, lent);
+	const owned = [secret];
+	const keyed = Effect.gen(function* wrappingKeyOf() {
+		if (format === rawKeyFormat) return yield* Aead.key(Aead.xchacha20Poly1305, secret);
+		const derived = yield* keys.kdf.derive(Kdf.hkdfSha256, secret, {
+			info: wrappingInfo,
+			length: wrappingKeyBytes,
+			salt: noSalt
+		});
+		owned.push(derived);
+		return yield* Aead.key(Aead.xchacha20Poly1305, derived);
+	});
+	return Effect.flatMap(keyed, use).pipe(Effect.ensuring(Effect.sync(() => {
+		zeroAll(owned);
+	})));
+});
+const wrappingWith = (keys) => Effect.fnUntraced(function* wrap({ actor, blob, key }) {
+	const nonce = yield* keys.random.randomBytes(nonceBytes);
+	const wrapped = yield* withWrappingKey(keys, {
+		actor,
+		blob,
+		format: writtenFormat,
+		intent: "create"
+	}, (wrappingKey) => Effect.flatMap(Aead.toBytes(key), (raw) => keys.aead.encrypt(wrappingKey, raw, {
+		aad: bindingOf({
+			actor,
+			blob
+		}),
+		nonce
+	}).pipe(Effect.ensuring(Effect.sync(() => raw.fill(wiped))))));
+	return yield* Schema.encodeEffect(BlobGrantJson)({
+		format: writtenFormat,
+		nonce,
+		wrapped
+	});
+}, (effect, owner) => Effect.mapError(effect, () => refused(owner.blob)));
+const openingWith = (keys) => Effect.fnUntraced(function* open({ actor, blob, grant }) {
+	const { format, nonce, wrapped } = yield* Schema.decodeEffect(BlobGrantJson)(grant);
+	return yield* withWrappingKey(keys, {
+		actor,
+		blob,
+		format,
+		intent: "open"
+	}, (wrappingKey) => Effect.flatMap(keys.aead.decrypt(wrappingKey, wrapped, {
+		aad: bindingOf({
+			actor,
+			blob
+		}),
+		nonce
+	}), (raw) => Aead.key(Aead.xchacha20Poly1305, raw).pipe(Effect.ensuring(Effect.sync(() => raw.fill(wiped))))));
+}, (effect, owner) => Effect.mapError(effect, () => refused(owner.blob)));
+var BlobGrants = class extends Context.Service()("@akterjs/effect/host/blob/blob-grants.service/BlobGrants", { make: Effect.gen(function* makeBlobGrants() {
+	const aead = yield* Aead.Aead;
+	const keys = {
+		aead,
+		kdf: yield* Kdf.Kdf,
+		keyring: yield* BlobKeyring,
+		random: yield* SecureRandom.SecureRandom
+	};
+	const wrap = wrappingWith(keys);
+	const open = openingWith(keys);
+	return {
+		fresh: Effect.fnUntraced(function* fresh(owner) {
+			const key = yield* Effect.mapError(aead.generateKey(Aead.xchacha20Poly1305), () => refused(owner.blob));
+			return {
+				grant: yield* wrap({
+					...owner,
+					key
+				}),
+				key
+			};
+		}),
+		open,
+		rewrap: Effect.fnUntraced(function* rewrap({ blob, from, grant, to }) {
+			const key = yield* open({
+				actor: from,
+				blob,
+				grant
+			});
+			return yield* wrap({
+				actor: to,
+				blob,
+				key
+			});
+		})
+	};
+}) }) {
+	static layer = Layer.effect(this, this.make).pipe(Layer.provide(crypto));
+};
+export { BlobGrants };

package/dist/host/blob/blob-keyring.service.d.mts

@@ -0,0 +1,18 @@
+import { BlobTransferError } from "../../contract/file/blob-transfer.errors.mjs";
+import { Context, Effect, Redacted } from "effect";
+interface BlobOwnerKey {
+  readonly actor: string;
+  readonly blob: string;
+  readonly intent: "create" | "open";
+}
+declare const BlobKeyring_base: Context.ServiceClass<BlobKeyring, "@akterjs/effect/host/blob/blob-keyring.service/BlobKeyring", {
+  /**
+   * Whether every `keyFor` call returns a buffer of its own that the caller may zero once it is done. When it does,
+   * the grants module zeroes that buffer after each use; otherwise, as for a keyring that caches its keys, it copies
+   * the bytes and zeroes only its copy, so the cached key stays intact for its other users.
+   */
+  readonly handsOver?: boolean;
+  readonly keyFor: (owner: BlobOwnerKey) => Effect.Effect<Redacted.Redacted<Uint8Array>, BlobTransferError>;
+}>;
+export declare class BlobKeyring extends BlobKeyring_base {}
+export type { BlobOwnerKey };

package/dist/host/blob/blob-keyring.service.mjs

@@ -0,0 +1,4 @@
+import { Context } from "effect";
+// src/host/blob/blob-keyring.service.ts
+var BlobKeyring = class extends Context.Service()("@akterjs/effect/host/blob/blob-keyring.service/BlobKeyring") {};
+export { BlobKeyring };

package/dist/host/blob/blob-range.pure.d.mts

@@ -0,0 +1,13 @@
+import { BlobRange } from "./blob-sealing.contract.mjs";
+import { BlobTransferError } from "../../contract/file/blob-transfer.errors.mjs";
+import { Effect } from "effect";
+interface Ranging {
+  readonly blob: string;
+  readonly bytes: number;
+  readonly range?: BlobRange;
+}
+declare const rangeOf: (args_0: Ranging) => Effect.Effect<{
+  readonly length: number;
+  readonly offset: number;
+}, BlobTransferError, never>;
+export { rangeOf };

package/dist/host/blob/blob-range.pure.mjs

@@ -0,0 +1,23 @@
+import { BlobTransferError } from "../../contract/file/blob-transfer.errors.mjs";
+import { Effect, Schema } from "effect";
+// src/host/blob/blob-range.pure.ts
+const zeroBytes = 0;
+const Range = Schema.Struct({
+	length: Schema.Int.check(Schema.isGreaterThanOrEqualTo(zeroBytes)),
+	offset: Schema.Int.check(Schema.isGreaterThanOrEqualTo(zeroBytes))
+});
+const rangeOf = Effect.fnUntraced(function* rangeOf({ blob, bytes, range }) {
+	const valid = yield* Schema.decodeEffect(Range)(range ?? {
+		length: bytes,
+		offset: zeroBytes
+	}).pipe(Effect.mapError(() => BlobTransferError.make({
+		blob,
+		message: "the byte range must use non-negative safe integers"
+	})));
+	if (valid.length > bytes - valid.offset) return yield* BlobTransferError.make({
+		blob,
+		message: "the byte range is outside the file"
+	});
+	return valid;
+});
+export { rangeOf };

package/dist/host/blob/blob-sealing.contract.d.mts

@@ -0,0 +1,37 @@
+import { BlobTransferError } from "../../contract/file/blob-transfer.errors.mjs";
+import "../../contract/client/client-failure.contract.mjs";
+import { Effect, Stream } from "effect";
+interface BlobRange {
+  readonly length: number;
+  readonly offset: number;
+}
+interface SealedBlob {
+  readonly bytes: number;
+  readonly grant: string;
+  readonly sha256: string;
+}
+interface Sealing<Failure, Services> {
+  readonly actor: string;
+  readonly blob: string;
+  readonly filename: string;
+  readonly source: Stream.Stream<Uint8Array, Failure, Services>;
+}
+interface Opening {
+  readonly actor: string;
+  readonly blob: string;
+  readonly filename: string;
+  readonly grant: string;
+  readonly range?: BlobRange;
+}
+interface Rewrapping {
+  readonly blob: string;
+  readonly from: string;
+  readonly grant: string;
+  readonly to: string;
+}
+interface BlobSealingOperations {
+  readonly open: (opening: Opening) => Stream.Stream<Uint8Array, BlobTransferError>;
+  readonly rewrap: (rewrapping: Rewrapping) => Effect.Effect<string, BlobTransferError>;
+  readonly seal: <Failure, Services>(sealing: Sealing<Failure, Services>) => Effect.Effect<SealedBlob, BlobTransferError | Failure, Services>;
+}
+export type { BlobRange, BlobSealingOperations, Opening, Rewrapping, SealedBlob, Sealing };

package/dist/host/blob/blob-sealing.contract.mjs

@@ -0,0 +1 @@
+export {};

package/dist/host/blob/blob-sealing.service.d.mts

@@ -0,0 +1,11 @@
+import { BlobKeyring } from "./blob-keyring.service.mjs";
+import { BlobHashing } from "../hash/blob-hashing.service.mjs";
+import { BlobSealingOperations } from "./blob-sealing.contract.mjs";
+import { Context, Effect, Layer } from "effect";
+declare const BlobSealing_base: Context.ServiceClass<BlobSealing, "@akterjs/effect/host/blob/blob-sealing.service/BlobSealing", BlobSealingOperations>;
+export declare class BlobSealing extends BlobSealing_base {
+  static readonly makePlain: Effect.Effect<BlobSealingOperations, never, BlobHashing | import("effect/FileSystem").FileSystem>;
+  static readonly plaintext: Layer.Layer<BlobSealing, never, BlobHashing | import("effect/FileSystem").FileSystem>;
+  static readonly sealed: Layer.Layer<BlobSealing, never, BlobHashing | BlobKeyring | import("effect/FileSystem").FileSystem>;
+}
+export {};

package/dist/host/blob/blob-sealing.service.mjs

@@ -0,0 +1,16 @@
+import { BlobGrants } from "./blob-grants.service.mjs";
+import { BlobHashing } from "../hash/blob-hashing.service.mjs";
+import { plainBlobSealing } from "./plain-blob-sealing.pure.mjs";
+import { sealedBlobSealing } from "./sealed-blob-sealing.pure.mjs";
+import { Context, Effect, Layer } from "effect";
+import { Aead, SecureRandom } from "effect/crypto";
+// src/host/blob/blob-sealing.service.ts
+var BlobSealing = class extends Context.Service()("@akterjs/effect/host/blob/blob-sealing.service/BlobSealing") {
+	static makePlain = Effect.flatMap(BlobHashing, plainBlobSealing);
+	static plaintext = Layer.effect(this, this.makePlain);
+	static sealed = Layer.effect(this, Effect.flatMap(Effect.all({
+		grants: BlobGrants,
+		hashing: BlobHashing
+	}), sealedBlobSealing)).pipe(Layer.provide(BlobGrants.layer), Layer.provide(Aead.layerWebCrypto), Layer.provide(SecureRandom.layerWebCrypto));
+};
+export { BlobSealing };

package/dist/host/blob/export/blob-archive.sql.d.mts

@@ -0,0 +1,21 @@
+import { BlobTransferError } from "../../../contract/file/blob-transfer.errors.mjs";
+import { BlobTransfers } from "../reference/blob-transfer.pure.mjs";
+import { Effect, Stream } from "effect";
+import { SqlClient, SqlError } from "effect/sql";
+/** An archived actor's database and the home its files move into. */
+interface ArchivedOwner<Failure, Services> {
+  /** The identity this home holds the actor's files by. */
+  readonly actor: string;
+  readonly adopt: BlobTransfers["adopt"];
+  readonly sql: SqlClient.SqlClient;
+  /** The archived bytes of the file with this SHA-256, read only when the home lacks its blob. */
+  readonly stored: (sha256: string) => Stream.Stream<Uint8Array, Failure, Services>;
+}
+/**
+ * Takes an archived actor's files into this engine's home in place: each file it keeps is adopted under its own
+ * claim for `owner.actor`, then its file tables are rewritten for that identity and the grants this home answered.
+ * An actor that never kept a file is left as it is. Running it again after a crash adopts the same claims again and
+ * rewrites the same rows, so it finishes what the first run started.
+ */
+declare const adoptArchivedFiles: <Failure, Services>(owner: ArchivedOwner<Failure, Services>) => Effect.Effect<void, Failure | BlobTransferError | SqlError.SqlError, Services>;
+export { type ArchivedOwner, adoptArchivedFiles };

package/dist/host/blob/export/blob-archive.sql.mjs

@@ -0,0 +1,75 @@
+import { prepareReceipts } from "../reference/blob-receipts.sql.mjs";
+import { Array, Effect, Option } from "effect";
+// src/host/blob/export/blob-archive.sql.ts
+const keptPageSize = 100;
+const ownerTables = [
+	"akter_blob_owners",
+	"akter_blob_receipts",
+	"akter_blob_links",
+	"akter_blob_releases",
+	"akter_blob_history",
+	"akter_blob_ancestry"
+];
+const grantTables = [
+	"akter_blob_links",
+	"akter_blob_ancestry",
+	"akter_blob_receipts"
+];
+const recordedOwner = (sql) => Effect.map(sql`SELECT actor FROM akter_blob_owners WHERE id = 1`, (rows) => Option.map(Array.head(rows), (row) => row.actor));
+/**
+* A page of the files the actor keeps after the claim `after`, the same files an export snapshot holds: its linked
+* files, its ancestry's, and the receipts its history keeps.
+*/
+const keptFiles = (sql, after) => sql`SELECT blob, bytes, claim, grant, sha256 FROM (SELECT blob, bytes, claim, grant, sha256 FROM akter_blob_links UNION SELECT blob, bytes, claim, grant, sha256 FROM akter_blob_ancestry UNION SELECT blob, bytes, claim, grant, sha256 FROM akter_blob_receipts AS receipt WHERE EXISTS (SELECT 1 FROM akter_blob_history WHERE claim = receipt.claim) AND NOT EXISTS (SELECT 1 FROM akter_blob_links WHERE claim = receipt.claim)) WHERE claim > ${after} ORDER BY claim LIMIT ${keptPageSize}`;
+const adoptedPage = (owner, origin, files) => Effect.forEach(files, ({ blob, bytes, claim, grant, sha256 }) => Effect.map(owner.adopt({
+	claim: {
+		actor: owner.actor,
+		blob,
+		claim
+	},
+	file: {
+		bytes,
+		grant,
+		sha256
+	},
+	origin,
+	stored: owner.stored(sha256)
+}), (adopted) => ({
+	claim,
+	grant: adopted
+})));
+const adoptedFiles = Effect.fnUntraced(function* adoptedFiles(owner, origin) {
+	const adopted = [];
+	let after = "";
+	for (;;) {
+		const files = yield* keptFiles(owner.sql, after);
+		if (!Array.isReadonlyArrayNonEmpty(files)) return adopted;
+		adopted.push(...yield* adoptedPage(owner, origin, files));
+		after = Array.lastNonEmpty(files).claim;
+	}
+});
+/**
+* Rewrites the file tables for the actor's new identity and grants. Uploads no command attached never left their
+* engine, so their receipts go, and so do releases of claims the actor no longer keeps.
+*/
+const rewritten = (sql, actor, adopted) => sql.withTransaction(Effect.gen(function* rewriteFiles() {
+	yield* sql`DELETE FROM akter_blob_receipts AS receipt WHERE NOT EXISTS (SELECT 1 FROM akter_blob_links WHERE claim = receipt.claim) AND NOT EXISTS (SELECT 1 FROM akter_blob_history WHERE claim = receipt.claim)`;
+	yield* sql`DELETE FROM akter_blob_releases WHERE claim NOT IN (SELECT claim FROM akter_blob_links UNION SELECT claim FROM akter_blob_ancestry UNION SELECT claim FROM akter_blob_receipts)`;
+	yield* sql`DELETE FROM akter_blob_export_holds`;
+	yield* Effect.forEach(ownerTables, (table) => sql.unsafe(`UPDATE ${table} SET actor = ?`, [actor]), { discard: true });
+	yield* Effect.forEach(adopted, ({ claim, grant }) => Effect.forEach(grantTables, (table) => sql.unsafe(`UPDATE ${table} SET grant = ? WHERE claim = ?`, [grant, claim]), { discard: true }), { discard: true });
+}));
+/**
+* Takes an archived actor's files into this engine's home in place: each file it keeps is adopted under its own
+* claim for `owner.actor`, then its file tables are rewritten for that identity and the grants this home answered.
+* An actor that never kept a file is left as it is. Running it again after a crash adopts the same claims again and
+* rewrites the same rows, so it finishes what the first run started.
+*/
+const adoptArchivedFiles = Effect.fnUntraced(function* adoptArchivedFiles(owner) {
+	yield* prepareReceipts(owner.sql);
+	const origin = yield* recordedOwner(owner.sql);
+	if (Option.isNone(origin)) return yield* Effect.void;
+	const adopted = yield* adoptedFiles(owner, origin.value);
+	return yield* rewritten(owner.sql, owner.actor, adopted);
+});
+export { adoptArchivedFiles };