@akterjs/effect 0.0.0-stage → 0.1.0

package/dist/serve/erasure/local-actor-erasure.service.d.mts

@@ -0,0 +1,26 @@
+import "../../runtime/akter.layer.mjs";
+import { ActorUnavailableError } from "../../contract/client/actor-unavailable.errors.mjs";
+import { ActorErasedError } from "../../contract/actor/actor-erased.errors.mjs";
+import { ActorRegistry } from "../../contract/actor/actor-registry.service.mjs";
+import { ActorDatabase } from "../../host/actor/actor-database.service.mjs";
+import { ActorAddress, ActorLocation } from "../engine/actor-location.service.mjs";
+import { OpenFailure } from "../engine/actor-residents.pure.mjs";
+import { Context, Effect, FileSystem, Path, Scope, Semaphore } from "effect";
+interface Resident {
+  readonly forking: Semaphore.Semaphore;
+  readonly exclusive: <Value, Failure>(effect: Effect.Effect<Value, Failure>) => Effect.Effect<Value, Failure>;
+}
+declare const LocalActorErasure_base: Context.ServiceClass<LocalActorErasure, "@akterjs/effect/serve/erasure/local-actor-erasure.service/LocalActorErasure", {
+  check: (address: ActorAddress) => Effect.Effect<void, OpenFailure>;
+  erase: (address: ActorAddress) => Effect.Effect<void, OpenFailure>;
+  open: <Value extends Resident>(address: ActorAddress, build: (scope: Scope.Closeable) => Effect.Effect<Value, OpenFailure>) => Effect.Effect<Value, OpenFailure>;
+}>;
+export declare class LocalActorErasure extends LocalActorErasure_base {
+  static readonly make: Effect.Effect<{
+    check: (address: ActorAddress) => Effect.Effect<void, OpenFailure>;
+    erase: (address: ActorAddress) => Effect.Effect<void, OpenFailure>;
+    open: <Value extends Resident>(address: ActorAddress, build: (scope: Scope.Closeable) => Effect.Effect<Value, OpenFailure>) => Effect.Effect<Value, OpenFailure>;
+  }, never, ActorDatabase | ActorLocation | ActorRegistry | FileSystem.FileSystem | Path.Path | Scope.Scope>;
+  static readonly check: (address: ActorAddress) => Effect.Effect<void, ActorErasedError | ActorUnavailableError, ActorLocation | FileSystem.FileSystem>;
+}
+export {};

package/dist/serve/erasure/local-actor-erasure.service.mjs

@@ -0,0 +1,102 @@
+import { ActorErasedError } from "../../contract/actor/actor-erased.errors.mjs";
+import { ActorRegistry } from "../../contract/actor/actor-registry.service.mjs";
+import { ActorDatabase } from "../../host/actor/actor-database.service.mjs";
+import { LocalComputers } from "../../host/computer/local-computers.adapter.mjs";
+import { ActorLocation } from "../engine/actor-location.service.mjs";
+import { fileIdentity, notServed, unavailable } from "../engine/actor-residents.pure.mjs";
+import { Context, Effect, Exit, FileSystem, MutableHashMap, MutableHashSet, Option, Predicate, Scope, Semaphore } from "effect";
+// src/serve/erasure/local-actor-erasure.service.ts
+const oneErasureAtATime = 1;
+/** The marker is also the durable cleanup intent. It survives deleting the database and reserves the erased key. */
+const notErased = Effect.fnUntraced(function* notErased(address) {
+	const location = yield* ActorLocation;
+	const fs = yield* FileSystem.FileSystem;
+	if (yield* Effect.mapError(fs.exists(`${location.locate(address).database}.erased`), unavailable(address.actor))) return yield* ActorErasedError.make({ actor: address.actor });
+	return yield* Effect.void;
+});
+const marker = ({ erased, fs, location }, address) => {
+	const id = ActorLocation.named(address);
+	return Effect.mapError(fs.writeFileString(`${location.locate(address).database}.erased`, "erased\n"), unavailable(address.actor)).pipe(Effect.tap(() => Effect.sync(() => MutableHashSet.add(erased, id))));
+};
+const openErasable = (erasing, address, build) => Effect.gen(function* openActor() {
+	yield* erasing.registry.lookup(address.actor).pipe(Effect.mapError(() => notServed(address)));
+	yield* Effect.provide(notErased(address), erasing.services);
+	const scope = yield* Scope.fork(erasing.parent);
+	const resident = yield* Effect.onError(build(scope), () => Scope.close(scope, Exit.void));
+	const marked = resident.exclusive(marker(erasing, address));
+	MutableHashMap.set(erasing.residents, ActorLocation.named(address), {
+		close: Scope.close(scope, Exit.void),
+		mark: resident.forking.withPermits(oneErasureAtATime)(marked)
+	});
+	return resident;
+});
+const releaseFiles = Effect.fnUntraced(function* releaseFiles({ databases, fs, location }, address, actor) {
+	const { database } = location.locate(address);
+	if (yield* fs.exists(database)) {
+		const opened = yield* databases.open({
+			actor,
+			filename: database,
+			identity: fileIdentity(address)
+		});
+		const session = Option.fromNullishOr(opened.fileSession);
+		yield* Effect.forEach(Option.toArray(session), ({ home, owner }) => home.transfers.erase(owner));
+	}
+});
+const eraseLocal = Effect.fnUntraced(function* eraseLocal(erasing, address) {
+	const actor = yield* erasing.registry.lookup(address.actor).pipe(Effect.mapError(() => notServed(address)));
+	const { fs, location, residents, services } = erasing;
+	const files = location.locate(address);
+	const known = MutableHashMap.get(residents, ActorLocation.named(address));
+	yield* fs.makeDirectory(files.directory, { recursive: true });
+	yield* Option.match(known, {
+		onNone: () => marker(erasing, address),
+		onSome: ({ mark }) => mark
+	});
+	yield* Effect.forEach(Option.toArray(known), ({ close }) => close);
+	yield* Effect.provide(LocalComputers.remove(location.computers, address), services);
+	yield* Effect.scoped(releaseFiles(erasing, address, actor));
+	yield* Effect.forEach([
+		"",
+		"-wal",
+		"-shm"
+	], (suffix) => fs.remove(`${files.database}${suffix}`, { force: true }));
+});
+/** Local, in-process erasure only: no app RPC or Cloud approval boundary is added or bypassed. */
+const localActorErasure = Effect.gen(function* localActorErasure() {
+	const store = yield* Effect.all({
+		databases: ActorDatabase,
+		fs: FileSystem.FileSystem,
+		location: ActorLocation,
+		parent: Effect.scope,
+		registry: ActorRegistry
+	});
+	const services = yield* Effect.context();
+	const residents = MutableHashMap.empty();
+	const serial = yield* Semaphore.make(oneErasureAtATime);
+	const erased = MutableHashSet.empty();
+	const erasing = {
+		...store,
+		erased,
+		residents,
+		services
+	};
+	return {
+		check: (address) => Effect.suspend(() => {
+			if (MutableHashSet.has(erased, ActorLocation.named(address))) return ActorErasedError.make({ actor: address.actor });
+			return Effect.void;
+		}),
+		erase: (address) => {
+			const cleanup = eraseLocal(erasing, address).pipe(Effect.mapError((failure) => {
+				if (Predicate.isTagged(failure, "InvalidRequestError") || Predicate.isTagged(failure, "ActorErasedError")) return failure;
+				return unavailable(address.actor)(failure);
+			}), Effect.tap(() => Effect.sync(() => MutableHashMap.remove(residents, ActorLocation.named(address)))));
+			return serial.withPermits(oneErasureAtATime)(cleanup);
+		},
+		open: (address, build) => openErasable(erasing, address, build)
+	};
+});
+var LocalActorErasure = class extends Context.Service()("@akterjs/effect/serve/erasure/local-actor-erasure.service/LocalActorErasure") {
+	static make = localActorErasure;
+	static check = notErased;
+};
+export { LocalActorErasure };

package/dist/serve/history/actor-host-runners.service.d.mts

@@ -0,0 +1,23 @@
+import { FileUsagePage } from "../../contract/file/actor-files.contract.mjs";
+import { CommandRunner } from "../../host/command/command-runner.service.mjs";
+import { QueryRunner } from "../../host/query/query-runner.service.mjs";
+import { OpenedActor } from "../../host/actor/actor-database.service.mjs";
+import { Residents } from "../engine/actor-residents.pure.mjs";
+import { Context, Duration, Effect, Scope } from "effect";
+interface Prunable {
+  readonly opened: OpenedActor;
+  readonly exclusive: <Value, Failure>(effect: Effect.Effect<Value, Failure>) => Effect.Effect<Value, Failure>;
+}
+interface Runners {
+  readonly queries: QueryRunner["Service"];
+  readonly runner: CommandRunner["Service"];
+  readonly prune: (resident: Prunable) => Effect.Effect<void>;
+  readonly keep: (residents: Residents<Prunable>) => Effect.Effect<void, never, Scope.Scope>;
+}
+declare const ActorHostRunners_base: Context.ServiceClass<ActorHostRunners, "@akterjs/effect/serve/history/actor-host-runners.service/ActorHostRunners", Runners>;
+export declare class ActorHostRunners extends ActorHostRunners_base {
+  static readonly make: Effect.Effect<Runners, never, CommandRunner | QueryRunner>;
+  static readonly historyRetention: Context.Reference<Duration.Duration>;
+  static readonly queries: import("effect/Layer").Layer<QueryRunner, never, never>;
+}
+export type { CommandRunner, FileUsagePage as FileUsage, Runners };

package/dist/serve/history/actor-host-runners.service.mjs

@@ -0,0 +1,35 @@
+import { CommandRunner } from "../../host/command/command-runner.service.mjs";
+import { QueryRunner } from "../../host/query/query-runner.service.mjs";
+import { Clock, Context, Duration, Effect, Schedule } from "effect";
+// src/serve/history/actor-host-runners.service.ts
+/** Prunes on open and hourly, through the same resident serializer as commands. */
+const actorHostRunners = Effect.gen(function* actorHostRunners() {
+	const runner = yield* CommandRunner;
+	const queries = yield* QueryRunner;
+	const retention = yield* CommandRunner.historyRetention;
+	const prune = ({ exclusive, opened }) => {
+		if (!Duration.isFinite(retention)) return Effect.void;
+		return exclusive(Effect.flatMap(Clock.currentTimeMillis, (now) => runner.prune({
+			before: now - Duration.toMillis(retention),
+			opened
+		})).pipe(Effect.catchTag("SqlError", (failure) => Effect.logWarning(`could not prune the history of ${opened.actor.name}: ${failure.message}`))));
+	};
+	const keep = ({ addresses, use }) => {
+		if (!Duration.isFinite(retention)) return Effect.void;
+		const pass = Effect.flatMap(addresses, (current) => Effect.forEach(current, (address) => use(address, prune).pipe(Effect.catchTag("ActorErasedError", () => Effect.void), Effect.orDie), { discard: true }));
+		const repeated = Effect.repeat(pass, Schedule.spaced("1 hour"));
+		return Effect.asVoid(Effect.forkScoped(repeated));
+	};
+	return {
+		keep,
+		prune,
+		queries,
+		runner
+	};
+});
+var ActorHostRunners = class extends Context.Service()("@akterjs/effect/serve/history/actor-host-runners.service/ActorHostRunners") {
+	static make = actorHostRunners;
+	static historyRetention = CommandRunner.historyRetention;
+	static queries = QueryRunner.layer;
+};
+export { ActorHostRunners };

package/dist/serve/hosted/hosted-app-build.errors.d.mts

@@ -0,0 +1,13 @@
+import { Schema } from "effect";
+declare const HostedAppBuildError_base: Schema.Class<HostedAppBuildError, Schema.TaggedStruct<"HostedAppBuildError", {
+  readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError & {
+  readonly brand: unique symbol;
+}>;
+/**
+ * A host refuses to load an app's bundle because the akter it was built with is one the host doesn't serve: a job
+ * from before jobs carried their codecs, or an actor whose host interface version is outside the host's window. The
+ * reason names what to do, which is always to deploy the app again with a current akter.
+ */
+export declare class HostedAppBuildError extends HostedAppBuildError_base {}
+export {};

package/dist/serve/hosted/hosted-app-build.errors.mjs

@@ -0,0 +1,9 @@
+import { Schema } from "effect";
+// src/serve/hosted/hosted-app-build.errors.ts
+/**
+* A host refuses to load an app's bundle because the akter it was built with is one the host doesn't serve: a job
+* from before jobs carried their codecs, or an actor whose host interface version is outside the host's window. The
+* reason names what to do, which is always to deploy the app again with a current akter.
+*/
+var HostedAppBuildError = class extends Schema.TaggedError()("HostedAppBuildError", { reason: Schema.String }) {};
+export { HostedAppBuildError };

package/dist/serve/hosted/hosted-app-checks.layer.d.mts

@@ -0,0 +1,15 @@
+import { ActorRegistry } from "../../contract/actor/actor-registry.service.mjs";
+import { HostedAppBuildError } from "./hosted-app-build.errors.mjs";
+import { Layer } from "effect";
+import { WorkflowEngine } from "effect/workflow";
+/** Why a host refuses to load an app's bundle: it was built with an akter this host doesn't serve. */
+type RefusedBuild = HostedAppBuildError;
+/** The workflow engine a bundle registers its jobs with. It refuses a job built before jobs carried their codecs. */
+declare const bundleWorkflows: Layer.Layer<WorkflowEngine.WorkflowEngine, never, WorkflowEngine.WorkflowEngine>;
+/**
+ * The registry a bundle registers its actors in. It refuses an actor built with a host interface version outside the
+ * window this host reads, so a build it can't serve fails to load, typed, instead of failing each call.
+ */
+declare const servedRegistry: Layer.Layer<ActorRegistry, never, ActorRegistry>;
+declare const isRefusedBuild: <I>(input: I) => input is I & HostedAppBuildError;
+export { type RefusedBuild, bundleWorkflows, isRefusedBuild, servedRegistry };

package/dist/serve/hosted/hosted-app-checks.layer.mjs

@@ -0,0 +1,32 @@
+import { ActorRegistry } from "../../contract/actor/actor-registry.service.mjs";
+import { hostInterfaceOf, servesHostInterface } from "../../contract/actor/host-interface.pure.mjs";
+import { JobCodecsOf } from "../../contract/command/command.contract.mjs";
+import { HostedAppBuildError } from "./hosted-app-build.errors.mjs";
+import { Context, Effect, Layer, Option, Schema } from "effect";
+import { WorkflowEngine } from "effect/workflow";
+// src/serve/hosted/hosted-app-checks.layer.ts
+/** The refusal of an actor built with a host interface version outside this host's window. */
+const outsideWindow = (actor, built) => HostedAppBuildError.make({ reason: `${actor} was built with akter host interface ${String(built)}, and this host serves ${String(0)} to ${String(1)}: deploy the app again with a current akter` });
+/** The workflow engine a bundle registers its jobs with. It refuses a job built before jobs carried their codecs. */
+const bundleWorkflows = Layer.effect(WorkflowEngine.WorkflowEngine, WorkflowEngine.WorkflowEngine.use((engine) => Effect.succeed(WorkflowEngine.WorkflowEngine.of({
+	...engine,
+	register: (workflow, execute) => {
+		const codecs = Context.get(workflow.annotations, JobCodecsOf);
+		if (Option.isNone(codecs)) return Effect.die(HostedAppBuildError.make({ reason: "the app was built with an older SDK; rebuild the app" }));
+		return engine.register(workflow, execute);
+	}
+}))));
+/**
+* The registry a bundle registers its actors in. It refuses an actor built with a host interface version outside the
+* window this host reads, so a build it can't serve fails to load, typed, instead of failing each call.
+*/
+const servedRegistry = Layer.effect(ActorRegistry, ActorRegistry.use((registry) => Effect.succeed(ActorRegistry.of({
+	...registry,
+	register: (actor) => {
+		const built = hostInterfaceOf(actor);
+		if (!servesHostInterface(built)) return Effect.die(outsideWindow(actor.name, built));
+		return registry.register(actor);
+	}
+}))));
+const isRefusedBuild = Schema.is(HostedAppBuildError);
+export { bundleWorkflows, isRefusedBuild, servedRegistry };

package/dist/serve/hosted/hosted-file-forward.layer.d.mts

@@ -0,0 +1,22 @@
+import { Authentication } from "../../contract/caller/authentication.api.mjs";
+import { Caller } from "../../contract/caller/caller.schema.mjs";
+import { Effect, Layer } from "effect";
+import { HttpServerRequest } from "effect/http";
+/**
+ * One file RPC a gateway forwarded: the verified caller and the client's RPC request, unchanged. Its `id` is the
+ * client's own, a number or a string, and every frame of the answer carries it back as given, because the client
+ * matches frames to its request by that exact value.
+ */
+interface FileForward {
+  readonly caller: Caller;
+  readonly request: {
+    readonly id: number | string;
+    readonly payload: unknown;
+    readonly tag: string;
+  };
+}
+/** The caller the host verified, which `forwardedRequest` puts in a header only the in-memory file server reads. */
+declare const ForwardedAuthentication: Layer.Layer<Authentication, never, never>;
+/** The forward as the one-request NDJSON body an Effect RPC HTTP server reads, carrying the verified caller. */
+declare const forwardedRequest: (forward: FileForward) => Effect.Effect<HttpServerRequest.HttpServerRequest>;
+export { type FileForward, ForwardedAuthentication, forwardedRequest };

package/dist/serve/hosted/hosted-file-forward.layer.mjs

@@ -0,0 +1,42 @@
+import { Authentication } from "../../contract/caller/authentication.api.mjs";
+import { Caller } from "../../contract/caller/caller.schema.mjs";
+import { CurrentCaller } from "../../contract/caller/current-caller.service.mjs";
+import { UnauthenticatedError } from "../../contract/caller/unauthenticated.errors.mjs";
+import { Effect, Layer, Schema } from "effect";
+import { Headers, HttpServerRequest } from "effect/http";
+// src/serve/hosted/hosted-file-forward.layer.ts
+const callerHeader = "akter-forwarded-caller";
+const CallerJson = Schema.fromJsonString(Schema.toCodecJson(Caller));
+const RequestMessage = Schema.TaggedStruct("Request", {
+	headers: Schema.Array(Schema.Tuple([Schema.String, Schema.String])),
+	id: Schema.Union([Schema.String, Schema.Finite]),
+	payload: Schema.Unknown,
+	tag: Schema.String
+});
+const RequestLine = Schema.fromJsonString(RequestMessage);
+const unverified = UnauthenticatedError.make({ message: "the forwarded file request carried no verified caller" });
+const callerOf = (headers) => {
+	const header = Effect.fromOption(Headers.get(headers, callerHeader));
+	return Effect.mapError(Effect.flatMap(header, Schema.decodeEffect(CallerJson)), () => unverified);
+};
+/** The caller the host verified, which `forwardedRequest` puts in a header only the in-memory file server reads. */
+const ForwardedAuthentication = Layer.succeed(Authentication)((effect, { headers }) => Effect.flatMap(callerOf(headers), (caller) => Effect.provideService(effect, CurrentCaller, caller)));
+/** The forward as the one-request NDJSON body an Effect RPC HTTP server reads, carrying the verified caller. */
+const forwardedRequest = (forward) => Effect.gen(function* encodeForward() {
+	const message = RequestMessage.make({
+		...forward.request,
+		headers: []
+	});
+	const line = yield* Schema.encodeEffect(RequestLine)(message);
+	const caller = yield* Schema.encodeEffect(CallerJson)(forward.caller);
+	const request = new globalThis.Request("http://akter.internal/rpc", {
+		body: `${line}\n`,
+		headers: {
+			[callerHeader]: caller,
+			"content-type": "application/ndjson"
+		},
+		method: "POST"
+	});
+	return HttpServerRequest.fromWeb(request);
+}).pipe(Effect.orDie);
+export { ForwardedAuthentication, forwardedRequest };

package/dist/serve/hosted/hosted-file-rpcs.layer.d.mts

@@ -0,0 +1,25 @@
+import { InvalidRequestError } from "../../contract/client/invalid-request.errors.mjs";
+import { ActorHost } from "../engine/actor-host.service.mjs";
+import { UploadLimits } from "../rpc/file/upload-sessions.pure.mjs";
+import { FileForward } from "./hosted-file-forward.layer.mjs";
+import { HostedRuntime } from "./hosted-runtime.service.mjs";
+import { Context, Effect, Scope } from "effect";
+import { HttpServerResponse } from "effect/http";
+type Answer = (forward: FileForward) => Effect.Effect<HttpServerResponse.HttpServerResponse, InvalidRequestError, Scope.Scope>;
+/**
+ * Whether forwarded `<Actor>/computer/steps` and `step` read the actor's durable steps. Off by default, so a host
+ * answers them `ComputersUnavailableError` until the engine hosting it turns them on.
+ */
+declare const ServeDurableSteps: Context.Reference<boolean>;
+/**
+ * Serves forwarded `<Actor>/files/<operation>` and `<Actor>/computer/<operation>` RPCs: one in-memory Effect RPC
+ * server per actor, started on first use, answering each request with the NDJSON frames a gateway relays to the client
+ * unchanged (chunks as they are produced, then one `Exit`). Upload sessions are shared by every actor the host serves,
+ * so build this once per host. Computers are reached through the `ActorComputerClients` in context when it is built;
+ * without one they answer `ComputersUnavailableError`. The forward's caller must already be verified by the host.
+ * Uploads are held to `limits` over `defaultUploadLimits`, so a host sets its own largest file and session caps.
+ */
+declare const hostedFileRpcsWith: (limits?: Partial<UploadLimits>) => Effect.Effect<Answer, never, ActorHost | HostedRuntime | Scope.Scope>;
+/** `hostedFileRpcsWith` at `defaultUploadLimits`. */
+declare const hostedFileRpcs: Effect.Effect<Answer, never, ActorHost | HostedRuntime | Scope.Scope>;
+export { type FileForward, ServeDurableSteps, hostedFileRpcs, hostedFileRpcsWith };

package/dist/serve/hosted/hosted-file-rpcs.layer.mjs

@@ -0,0 +1,82 @@
+import { Principal } from "../../contract/caller/principal.schema.mjs";
+import { InvalidRequestError } from "../../contract/client/invalid-request.errors.mjs";
+import { ActorComputerClients } from "../../contract/computer/computer-client.adapter.mjs";
+import { ActorHost } from "../engine/actor-host.service.mjs";
+import { uploadSessionsWith } from "../rpc/file/upload-sessions.pure.mjs";
+import { forwardedRequest } from "./hosted-file-forward.layer.mjs";
+import { fileServerOf } from "./hosted-file-server.layer.mjs";
+import { HostedRuntime } from "./hosted-runtime.service.mjs";
+import { Array, Context, Effect, Option, Record, Schema, Scope, String, SynchronizedRef } from "effect";
+import { HttpServerRequest } from "effect/http";
+// src/serve/hosted/hosted-file-rpcs.layer.ts
+/**
+* Whether forwarded `<Actor>/computer/steps` and `step` read the actor's durable steps. Off by default, so a host
+* answers them `ComputersUnavailableError` until the engine hosting it turns them on.
+*/
+const ServeDurableSteps = Context.Reference("@akterjs/effect/serve/hosted/hosted-file-rpcs.layer/ServeDurableSteps", { defaultValue: () => false });
+/** The groups this server answers: `<Actor>/files/<operation>` and `<Actor>/computer/<operation>`. */
+const groupSegments = ["/files/", "/computer/"];
+const noActor = 0;
+const notForwarded = (tag) => InvalidRequestError.make({
+	actor: tag,
+	message: `${tag} isn't a file or computer request`
+});
+const actorOfTag = (tag) => {
+	const found = Array.findFirst(groupSegments, (segment) => Option.isSome(String.indexOf(segment)(tag)));
+	const at = Option.flatMap(found, (segment) => String.indexOf(segment)(tag));
+	const named = Option.filter(at, (index) => index !== noActor);
+	return Effect.mapBoth(Effect.fromOption(named), {
+		onFailure: () => notForwarded(tag),
+		onSuccess: (index) => String.slice(noActor, index)(tag)
+	});
+};
+const startServer = ({ computers, host, runtime, scope, steps, uploads }, actor) => Effect.gen(function* declaredServer() {
+	const { callers, fileAccess = Option.none(), key } = (yield* Effect.mapError(runtime.declare(actor), () => InvalidRequestError.make({
+		actor,
+		message: `${actor} isn't an actor of this app`
+	}))).actor;
+	const fileActor = {
+		callers: Record.map(callers, () => Principal),
+		fileAccess,
+		key: Schema.toEncoded(key),
+		name: actor
+	};
+	return yield* Effect.provideService(fileServerOf({
+		actor: fileActor,
+		computers,
+		host,
+		steps: Option.liftPredicate(host, () => steps),
+		uploads
+	}), Scope.Scope, scope);
+});
+/**
+* Serves forwarded `<Actor>/files/<operation>` and `<Actor>/computer/<operation>` RPCs: one in-memory Effect RPC
+* server per actor, started on first use, answering each request with the NDJSON frames a gateway relays to the client
+* unchanged (chunks as they are produced, then one `Exit`). Upload sessions are shared by every actor the host serves,
+* so build this once per host. Computers are reached through the `ActorComputerClients` in context when it is built;
+* without one they answer `ComputersUnavailableError`. The forward's caller must already be verified by the host.
+* Uploads are held to `limits` over `defaultUploadLimits`, so a host sets its own largest file and session caps.
+*/
+const hostedFileRpcsWith = (limits = {}) => Effect.gen(function* makeHostedFileRpcs() {
+	const started = {
+		computers: yield* Effect.serviceOption(ActorComputerClients),
+		host: yield* ActorHost,
+		runtime: yield* HostedRuntime,
+		scope: yield* Effect.scope,
+		steps: yield* ServeDurableSteps,
+		uploads: yield* uploadSessionsWith(limits)
+	};
+	const servers = yield* SynchronizedRef.make(/* @__PURE__ */ new Map());
+	const serverFor = (actor) => SynchronizedRef.modifyEffect(servers, (known) => Option.match(Option.fromNullishOr(known.get(actor)), {
+		onNone: () => Effect.map(startServer(started, actor), (server) => [server, new Map([...known, [actor, server]])]),
+		onSome: (server) => Effect.succeed([server, known])
+	}));
+	return (forward) => Effect.gen(function* answer() {
+		const server = yield* Effect.flatMap(actorOfTag(forward.request.tag), serverFor);
+		const request = yield* forwardedRequest(forward);
+		return yield* Effect.provideService(server, HttpServerRequest.HttpServerRequest, request);
+	});
+});
+/** `hostedFileRpcsWith` at `defaultUploadLimits`. */
+const hostedFileRpcs = hostedFileRpcsWith();
+export { ServeDurableSteps, hostedFileRpcs, hostedFileRpcsWith };

package/dist/serve/hosted/hosted-file-server.layer.d.mts

@@ -0,0 +1,18 @@
+import { computerHandlersFor } from "../rpc/computer/computer-rpc.layer.mjs";
+import { FileServing as Serving } from "../rpc/file/file-rpc.layer.mjs";
+import { Effect, Scope } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+/** One actor's file RPC server: answers the request in context with its NDJSON frames. */
+type FileServer = Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest | Scope.Scope>;
+/**
+ * Serves one actor's `<Actor>/files/<operation>` and `<Actor>/computer/<operation>` RPCs with the same Effect RPC
+ * server and NDJSON framing `akter dev` serves them with, behind the forwarded caller. The server lives as long as
+ * `Scope`.
+ */
+type ComputerServing = Parameters<typeof computerHandlersFor>[number];
+declare const fileServerOf: (serving: Serving & {
+  readonly actor: ComputerServing["actor"];
+  readonly computers: ComputerServing["clients"];
+  readonly steps: ComputerServing["steps"];
+}) => Effect.Effect<FileServer, never, Scope.Scope>;
+export { type FileServer, fileServerOf };

package/dist/serve/hosted/hosted-file-server.layer.mjs

@@ -0,0 +1,33 @@
+import { Authentication } from "../../contract/caller/authentication.api.mjs";
+import { computerRpcsOf } from "../../contract/computer/rpc/computer-rpc.contract.mjs";
+import { fileRpcsOf } from "../../contract/file/rpc/file-rpc.contract.mjs";
+import { computerHandlersFor } from "../rpc/computer/computer-rpc.layer.mjs";
+import { fileHandlersFor } from "../rpc/file/file-rpc.layer.mjs";
+import { ForwardedAuthentication } from "./hosted-file-forward.layer.mjs";
+import { Effect } from "effect";
+import { RpcGroup, RpcSerialization, RpcServer } from "effect/rpc";
+// src/serve/hosted/hosted-file-server.layer.ts
+const groupOf = (actor) => RpcGroup.make(...fileRpcsOf(actor), ...computerRpcsOf(actor)).middleware(Authentication);
+function asGroupHandlers(handlers) {
+	return handlers;
+}
+const fileServerOf = (serving) => {
+	const group = groupOf(serving.actor.name);
+	const computers = computerHandlersFor({
+		actor: serving.actor,
+		clients: serving.computers,
+		host: serving.host,
+		steps: serving.steps
+	});
+	const served = asGroupHandlers({
+		...fileHandlersFor(serving),
+		...computers
+	});
+	const handlers = group.toLayer(Effect.succeed(served));
+	return RpcServer.toHttpEffect(group).pipe(Effect.provide([
+		handlers,
+		ForwardedAuthentication,
+		RpcSerialization.layerNdjson
+	]));
+};
+export { fileServerOf };

package/dist/serve/hosted/hosted-files.layer.d.mts

@@ -0,0 +1,32 @@
+import { OpenedActor } from "../../host/actor/actor-database.service.mjs";
+import { BlobSealing } from "../../host/blob/blob-sealing.service.mjs";
+import { BlobOwner, TransferEffect } from "../../host/blob/reference/blob-transfer.pure.mjs";
+import { LocalBlobHome, blobHomeOn } from "../../host/file/blob-home.sql.mjs";
+import { Effect, FileSystem, Path, Scope } from "effect";
+import { SqlClient } from "effect/sql";
+interface HostedFileHomeOpening {
+  readonly catalog: SqlClient.SqlClient;
+  readonly root: string;
+}
+interface HostedActorFilesOpening {
+  readonly exclusive: BlobOwner["exclusive"];
+  readonly home: LocalBlobHome;
+  readonly identity: string;
+  readonly opened: OpenedActor;
+  readonly snapshot: BlobOwner["snapshot"];
+}
+/**
+ * A file home for a host that keeps its own SQLite connections, such as one per Cloud shard: blobs are written under
+ * `root` (created if missing), sealed by the provided `BlobSealing`, and their catalog (claims and reference counts) lives on `catalog`,
+ * which only this home writes. Blobs adopted from another home are checked with akter's own SHA-256, so the host
+ * provides no hashing. Its transfers close with the scope.
+ */
+declare const hostedFileHome: ({ catalog, root }: HostedFileHomeOpening) => TransferEffect<LocalBlobHome, BlobSealing | FileSystem.FileSystem | Path.Path | Effect.Services<ReturnType<typeof blobHomeOn>>>;
+/**
+ * Gives an opened actor its files on `home`. `identity` names the actor to the sealing keyring and the catalog, and
+ * every read and write of the actor's own file tables goes through `exclusive`, the host's serializer for the actor's
+ * connection, so it never interleaves with a command batch. It recovers unfinished transfers, settles references and
+ * keeps them settled until the scope closes. Commands of the returned actor reach the files through `Akter.files`.
+ */
+declare const hostedActorFiles: ({ exclusive, home, identity, opened, snapshot }: HostedActorFilesOpening) => TransferEffect<OpenedActor, Scope.Scope>;
+export { type HostedActorFilesOpening, type HostedFileHomeOpening, hostedActorFiles, hostedFileHome };

package/dist/serve/hosted/hosted-files.layer.mjs

@@ -0,0 +1,55 @@
+import { BlobSealing } from "../../host/blob/blob-sealing.service.mjs";
+import { actorFileStorage } from "../../host/file/actor-file-storage.sql.mjs";
+import { blobHomeOn, canonicalHome } from "../../host/file/blob-home.sql.mjs";
+import { actorFilesOn, blobOwnerOn } from "../../host/file/local-blob-owner.sql.mjs";
+import { BlobHashing } from "../../host/hash/blob-hashing.service.mjs";
+import { blobHashing } from "../../runtime/blob-hashing.layer.mjs";
+import { Context, Effect, Layer } from "effect";
+// src/serve/hosted/hosted-files.layer.ts
+/**
+* A file home for a host that keeps its own SQLite connections, such as one per Cloud shard: blobs are written under
+* `root` (created if missing), sealed by the provided `BlobSealing`, and their catalog (claims and reference counts) lives on `catalog`,
+* which only this home writes. Blobs adopted from another home are checked with akter's own SHA-256, so the host
+* provides no hashing. Its transfers close with the scope.
+*/
+const hostedFileHome = ({ catalog, root }) => Effect.gen(function* openHostedFileHome() {
+	const sealing = yield* BlobSealing;
+	const hashed = yield* Layer.build(blobHashing);
+	const hashing = Context.get(hashed, BlobHashing);
+	const canonical = yield* canonicalHome(root);
+	return yield* blobHomeOn({
+		catalog,
+		hashing,
+		root: canonical,
+		sealing
+	});
+});
+/**
+* Gives an opened actor its files on `home`. `identity` names the actor to the sealing keyring and the catalog, and
+* every read and write of the actor's own file tables goes through `exclusive`, the host's serializer for the actor's
+* connection, so it never interleaves with a command batch. It recovers unfinished transfers, settles references and
+* keeps them settled until the scope closes. Commands of the returned actor reach the files through `Akter.files`.
+*/
+const hostedActorFiles = ({ exclusive, home, identity, opened, snapshot }) => Effect.gen(function* openHostedActorFiles() {
+	const owner = yield* blobOwnerOn({
+		actor: identity,
+		exclusive,
+		snapshot,
+		sql: opened.sql
+	});
+	const fileSession = yield* actorFilesOn({
+		home,
+		owner,
+		sql: opened.sql
+	});
+	return {
+		...opened,
+		fileSession,
+		files: (sql) => actorFileStorage({
+			actor: identity,
+			open: home.transfers.open,
+			sql
+		})
+	};
+});
+export { hostedActorFiles, hostedFileHome };

package/dist/serve/hosted/hosted-runtime.layer.d.mts

@@ -0,0 +1,42 @@
+import { ActorRegistry } from "../../contract/actor/actor-registry.service.mjs";
+import { DeclaredActor, HostedKept, HostedOpening, HostedRuntime, HostedUpkeep } from "./hosted-runtime.service.mjs";
+import { RefusedBuild } from "./hosted-app-checks.layer.mjs";
+import { ActorSecrets, SecretRequest } from "../../contract/secret/actor-secrets.adapter.mjs";
+import { ExecutionAuthority, ExecutionGuard } from "../../host/upkeep/execution-authority.pure.mjs";
+import { engineOwnedRefusal } from "../../contract/hosted/handler-failure.pure.mjs";
+import { HandlerSql, QueryReadOnly, engineOwned } from "../../host/query/query-policy.pure.mjs";
+import { CommandBatch, CommandBatchScope as Batch, commandBatch, dropCommand, keepCommand } from "../../host/command/batch/command-batch.sql.mjs";
+import { ActorConnectionOpener, ActorConnections, ActorDatabaseTarget, SqliteHandle, SqliteRow, SqliteStatement, SqliteValue } from "../../host/sqlite/actor-connections.pure.mjs";
+import { HostedAppBuildError } from "./hosted-app-build.errors.mjs";
+import { bundleHostInterface, hostInterface, hostInterfaceLine, hostInterfaceOf, oldestHostInterface, servesHostInterface } from "../../contract/actor/host-interface.pure.mjs";
+import { JobComputers } from "../../host/computer/job-computers.service.mjs";
+import { LocalBlobHome } from "../../host/file/blob-home.sql.mjs";
+import { HostedActorFilesOpening, HostedFileHomeOpening, hostedActorFiles, hostedFileHome } from "./hosted-files.layer.mjs";
+import { ServeDurableSteps, hostedFileRpcs, hostedFileRpcsWith } from "./hosted-file-rpcs.layer.mjs";
+import { UploadLimits, defaultUploadLimits } from "../rpc/file/upload-sessions.pure.mjs";
+import "../../host/file/local-blob-home.service.mjs";
+import { JobStore } from "../../host/job/job-runs.pure.mjs";
+import { LocalActorFiles } from "../../host/file/local-blob-owner.sql.mjs";
+import { ExportHold, ExportedFile, HeldBlob, HeldLookup, HeldPage, heldExportFile, heldExportFiles, holdExportFiles } from "../../host/blob/export/blob-export-holds.sql.mjs";
+import { ArchivedActors } from "../archive/archived-actors.layer.mjs";
+import { ArchivedStore } from "../archive/archived-store.layer.mjs";
+import { BlobKeyring } from "../../host/blob/blob-keyring.service.mjs";
+import { BlobSealing } from "../../host/blob/blob-sealing.service.mjs";
+import { BlobTransferError } from "../../contract/file/blob-transfer.errors.mjs";
+import { blobHashing } from "../../runtime/blob-hashing.layer.mjs";
+import { BlobHashing } from "../../host/hash/blob-hashing.service.mjs";
+import { CommittedCommand, HostFailure, LiveActor } from "../live/live-reads.service.mjs";
+import { LiveUpdate } from "../../contract/client/actor-rpc.contract.mjs";
+import { QueryRequest } from "../../host/query/query-runner.service.mjs";
+import { OpenedActor } from "../../host/actor/actor-database.service.mjs";
+import { CommandRequest, CreationRequest } from "../../host/command/command-runner.service.mjs";
+import { JournalWindow } from "../../contract/history/actor-journal.service.mjs";
+import { FileForward } from "./hosted-file-forward.layer.mjs";
+import "../../host/job/job-engine.adapter.mjs";
+import { Delivery, DeliveryBatch } from "../../host/outbox/outbox-runner.service.mjs";
+import { JobAddress } from "../../contract/job/job-id.pure.mjs";
+import { Layer } from "effect";
+import { WorkflowEngine } from "effect/workflow";
+declare const hostedRuntime: Layer.Layer<HostedRuntime | WorkflowEngine.WorkflowEngine>;
+declare const hostedApp: <Output, Failure>(app: Layer.Layer<Output, Failure, ActorRegistry | WorkflowEngine.WorkflowEngine>) => Layer.Layer<HostedRuntime | WorkflowEngine.WorkflowEngine, Failure | RefusedBuild>;
+export { type ActorConnectionOpener, ActorConnections, type ActorDatabaseTarget, ActorSecrets, ArchivedActors, ArchivedStore, BlobHashing, BlobKeyring, BlobSealing, BlobTransferError, CommandBatch, type Batch as CommandBatchScope, type CommandRequest, type CommittedCommand, type CreationRequest, type DeclaredActor, type Delivery, type DeliveryBatch, ExecutionAuthority, type ExecutionGuard, type ExportHold, type ExportedFile, type FileForward, HandlerSql, type HeldBlob, type HeldLookup, type HeldPage, type HostFailure, type HostedActorFilesOpening, HostedAppBuildError, type LocalBlobHome as HostedFileHome, type HostedFileHomeOpening, type LocalActorFiles as HostedFileSession, type HostedKept, type HostedOpening, HostedRuntime, type HostedUpkeep, type JobAddress, JobComputers, type JobStore, type JournalWindow, type LiveActor, type LiveUpdate, type OpenedActor, QueryReadOnly, type QueryRequest, type SecretRequest, ServeDurableSteps, type SqliteHandle, type SqliteRow, type SqliteStatement, type SqliteValue, type UploadLimits, blobHashing, bundleHostInterface, commandBatch, defaultUploadLimits, dropCommand, engineOwned, engineOwnedRefusal, heldExportFile, heldExportFiles, holdExportFiles, hostInterface, hostInterfaceLine, hostInterfaceOf, hostedActorFiles, hostedApp, hostedFileHome, hostedFileRpcs, hostedFileRpcsWith, hostedRuntime, keepCommand, oldestHostInterface, servesHostInterface };