@akterjs/effect 0.0.0-stage → 0.1.0

package/dist/serve/rpc/file/file-rpc-access.pure.d.mts

@@ -0,0 +1,55 @@
+import { KeySchema } from "../../../contract/actor/actor.contract.mjs";
+import { FileClientFailure } from "../../../contract/file/file-client-failure.contract.mjs";
+import { admit } from "../../../contract/caller/caller-admission.pure.mjs";
+import { CurrentCaller } from "../../../contract/caller/current-caller.service.mjs";
+import { FileAccessRequest } from "../../../contract/file/access/file-access.contract.mjs";
+import "../../../contract/file/file-client.contract.mjs";
+import { HostFailure } from "../../live/live-reads.service.mjs";
+import { ActorHost } from "../../engine/actor-host.service.mjs";
+import { UploadOwner } from "./upload-sessions.pure.mjs";
+import { Effect, Option } from "effect";
+interface FileActor {
+  /** Whether the actor declares file calls (`Akter.fileAccess`); the host runs the declaration as `akter.files`. */
+  readonly fileAccess: Option.Option<unknown>;
+  readonly key: KeySchema;
+  readonly name: string;
+}
+interface Keyed {
+  readonly key: string;
+}
+type Admitted = Effect.Error<ReturnType<typeof admit>>;
+/** The failures a file RPC answers, which its schema carries; `served` folds the rest. */
+type Served = Exclude<FileClientFailure | Admitted, {
+  readonly _tag: "ActorAlreadyExistsError" | "SqlError" | "UnauthenticatedError";
+}>;
+/**
+ * What a file RPC answers for a failure. A storage failure answers that the actor is unavailable, which a client
+ * retries; its SQL detail stays on the host.
+ */
+declare const served: (actor: string) => (failure: FileClientFailure | HostFailure) => Served;
+/** Which file call is asked for, and of what: the file's path, a listing's prefix, or empty for an upload. */
+interface Asked {
+  readonly access: (typeof FileAccessRequest)["Type"]["access"];
+  readonly path: string;
+}
+interface Admitting extends Keyed {
+  readonly actor: FileActor;
+  readonly caller: CurrentCaller["Service"];
+}
+/**
+ * Who is calling which actor's files, without asking the actor's rule: the actor must declare files, and the key must
+ * decode with its key schema before any file is touched, so one actor's request can't name another's files. An upload's
+ * append and close use this alone: its session was authorized when it opened, and only the same caller may continue it.
+ */
+declare const callerOf: (args_0: Admitting) => Effect.Effect<UploadOwner, Served, never>;
+/**
+ * Admits the caller to the actor's files (`callerOf`), then runs the actor's `files.authorize` rule as the reserved
+ * `akter.files` query, under the verified caller: the engine admits only the kinds `Akter.fileAccess` declared, never
+ * the engine's own actor caller, and the rule reads the state and `Actor.principal`, never the request. The call is
+ * refused unless the rule succeeds.
+ */
+declare const ownerOf: (args_0: Admitting & {
+  readonly asked: Asked;
+  readonly host: ActorHost["Service"];
+}) => Effect.Effect<UploadOwner, Served, never>;
+export { type Asked, type FileActor, type Keyed, type Served, callerOf, ownerOf, served };

package/dist/serve/rpc/file/file-rpc-access.pure.mjs

@@ -0,0 +1,67 @@
+import { clientPrincipal } from "../../../contract/caller/caller-admission.pure.mjs";
+import { ActorUnavailableError } from "../../../contract/client/actor-unavailable.errors.mjs";
+import { InvalidRequestError } from "../../../contract/client/invalid-request.errors.mjs";
+import { fileAccessMember, fileAccessPayload, fileAccessReply } from "../../../contract/file/access/file-access.contract.mjs";
+import { Effect, Match, Schema } from "effect";
+// src/serve/rpc/file/file-rpc-access.pure.ts
+/**
+* What a file RPC answers for a failure. A storage failure answers that the actor is unavailable, which a client
+* retries; its SQL detail stays on the host.
+*/
+const served = (actor) => (failure) => Match.value(failure).pipe(Match.tag("SqlError", () => ActorUnavailableError.make({
+	actor,
+	message: "the actor's files are unavailable. Retry shortly."
+})), Match.tag("UnauthenticatedError", () => ActorUnavailableError.make({
+	actor,
+	message: "the caller wasn't authenticated before its files were read"
+})), Match.tag("ActorAlreadyExistsError", () => InvalidRequestError.make({
+	actor,
+	message: "a file request can't create an actor"
+})), Match.orElse((other) => other));
+const denied = (actor) => InvalidRequestError.make({
+	actor,
+	message: `${actor} declares no file calls. To use files, declare them with files: Akter.fileAccess({ callers: [...] }), decide each in files.authorize, and deploy again.`
+});
+/**
+* Who is calling which actor's files, without asking the actor's rule: the actor must declare files, and the key must
+* decode with its key schema before any file is touched, so one actor's request can't name another's files. An upload's
+* append and close use this alone: its session was authorized when it opened, and only the same caller may continue it.
+*/
+const callerOf = Effect.fnUntraced(function* callerOf({ actor, caller, key }) {
+	const principal = yield* clientPrincipal({
+		actor: actor.name,
+		caller
+	});
+	yield* Effect.mapError(Effect.fromOption(actor.fileAccess), () => denied(actor.name));
+	yield* Effect.mapError(Schema.decodeEffect(actor.key)(key), () => InvalidRequestError.make({
+		actor: actor.name,
+		message: "the actor key is invalid"
+	}));
+	return {
+		address: {
+			actor: actor.name,
+			key
+		},
+		principal
+	};
+});
+/**
+* Admits the caller to the actor's files (`callerOf`), then runs the actor's `files.authorize` rule as the reserved
+* `akter.files` query, under the verified caller: the engine admits only the kinds `Akter.fileAccess` declared, never
+* the engine's own actor caller, and the rule reads the state and `Actor.principal`, never the request. The call is
+* refused unless the rule succeeds.
+*/
+const ownerOf = Effect.fnUntraced(function* ownerOf({ asked, host, ...admitting }) {
+	const owner = yield* callerOf(admitting);
+	const payload = yield* Effect.orDie(Schema.encodeEffect(fileAccessPayload)(asked));
+	const call = {
+		...owner.address,
+		member: fileAccessMember,
+		payload,
+		principal: owner.principal
+	};
+	const reply = yield* Effect.mapError(host.query(call), served(owner.address.actor));
+	yield* yield* Effect.orDie(Schema.decodeEffect(fileAccessReply)(reply));
+	return owner;
+});
+export { callerOf, ownerOf, served };

package/dist/serve/rpc/file/file-rpc.layer.d.mts

@@ -0,0 +1,53 @@
+import { CurrentCaller } from "../../../contract/caller/current-caller.service.mjs";
+import { FilePage, FileUsagePage } from "../../../contract/file/actor-files.contract.mjs";
+import "../../../contract/file/file-client.contract.mjs";
+import { ActorHost } from "../../engine/actor-host.service.mjs";
+import { FileActor, Keyed, Served } from "./file-rpc-access.pure.mjs";
+import { UploadLimits, UploadSessions } from "./upload-sessions.pure.mjs";
+import { Effect, Scope, Stream } from "effect";
+interface Listed extends Keyed {
+  readonly cursor?: string;
+  readonly limit?: number;
+  readonly prefix?: string;
+}
+interface Downloaded extends Keyed {
+  readonly length?: number;
+  readonly offset?: number;
+  readonly path: string;
+}
+interface Appended extends Keyed {
+  readonly bytes: Uint8Array;
+  readonly offset: number;
+  readonly upload: string;
+}
+interface Closed extends Keyed {
+  readonly bytes: number;
+  readonly upload: string;
+}
+interface Serving {
+  readonly actor: FileActor;
+  readonly host: ActorHost["Service"];
+  readonly uploads: UploadSessions;
+}
+type Answer<Value> = Effect.Effect<Value, Served, CurrentCaller>;
+type FileHandler = ((request: Appended) => Answer<{
+  readonly received: number;
+}>) | ((request: Closed) => Answer<{
+  readonly receipt: string;
+}>) | ((request: Downloaded) => Stream.Stream<Uint8Array, Served, CurrentCaller>) | ((request: Keyed) => Answer<{
+  readonly upload: string;
+}>) | ((request: Listed) => Answer<FilePage>) | ((request: Listed) => Answer<FileUsagePage>);
+type FileHandlers = Readonly<Record<string, FileHandler>>;
+/**
+ * The `<Actor>/files/<operation>` handlers of every served actor that declares files. A download, a listing, the
+ * usage and an upload's open run the actor's `files.authorize` rule first (`ownerOf`), then serve the actor's files from
+ * this host with the same client its own code uses outside commands. Uploads are sessions of this server
+ * (`upload-sessions.pure.ts`), bound to the caller that opened them and held to `limits` over `defaultUploadLimits`.
+ */
+declare const fileRpcHandlers: ({ actors, limits }: {
+  readonly actors: readonly FileActor[];
+  readonly limits?: Partial<UploadLimits>;
+}) => Effect.Effect<FileHandlers, never, ActorHost | Scope.Scope>;
+/** One actor's file handlers, by tag, sharing `uploads` with every other actor the host serves. */
+declare const fileHandlersFor: (serving: Serving) => FileHandlers;
+export { type FileHandler, type FileHandlers, type Serving as FileServing, fileHandlersFor, fileRpcHandlers };

package/dist/serve/rpc/file/file-rpc.layer.mjs

@@ -0,0 +1,143 @@
+import { CurrentCaller } from "../../../contract/caller/current-caller.service.mjs";
+import { fileChunkBytes, fileTag } from "../../../contract/file/rpc/file-rpc.contract.mjs";
+import { filePathOf } from "../../../contract/file/file-path.pure.mjs";
+import { InvalidFileRequestError } from "../../../contract/file/invalid-file-request.errors.mjs";
+import { ActorHost } from "../../engine/actor-host.service.mjs";
+import { hostFileClient } from "../../../runtime/local-file-clients.layer.mjs";
+import { callerOf, ownerOf, served } from "./file-rpc-access.pure.mjs";
+import { uploadSessionsWith } from "./upload-sessions.pure.mjs";
+import { Array, Effect, Option, Record, Stream } from "effect";
+// src/serve/rpc/file/file-rpc.layer.ts
+const oneChunk = 1;
+/** Admits the current caller to the actor's files under the request's key, if the actor's rule allows `asked`. */
+const ownerFor = ({ actor, host }, { key }, asked) => Effect.flatMap(Effect.service(CurrentCaller), (caller) => ownerOf({
+	actor,
+	asked,
+	caller,
+	host,
+	key
+}));
+/** The current caller of an open upload, which the session checks is the caller that opened it. */
+const uploaderFor = ({ actor }, { key }) => Effect.flatMap(Effect.service(CurrentCaller), (caller) => callerOf({
+	actor,
+	caller,
+	key
+}));
+const reading = (path) => ({
+	access: "read",
+	path: path ?? ""
+});
+const writing = {
+	access: "write",
+	path: ""
+};
+const clientOf = (serving, request, asked) => Effect.map(ownerFor(serving, request, asked), ({ address }) => hostFileClient({
+	address,
+	host: serving.host
+}));
+const listingOf = ({ cursor, limit, prefix }) => ({
+	...Record.getSomes({
+		cursor: Option.fromNullishOr(cursor),
+		prefix: Option.fromNullishOr(prefix)
+	}),
+	...Record.getSomes({ limit: Option.fromNullishOr(limit) })
+});
+const rangeOf = ({ length, offset, path }) => {
+	const bounds = {
+		length: Option.fromNullishOr(length),
+		offset: Option.fromNullishOr(offset)
+	};
+	if (Option.isSome(bounds.length) !== Option.isSome(bounds.offset)) return Effect.fail(InvalidFileRequestError.make({
+		message: "a range needs both offset and length",
+		path
+	}));
+	return Effect.succeed(Option.all(bounds));
+};
+const slices = (bytes) => Array.makeBy(Math.max(oneChunk, Math.ceil(bytes.length / fileChunkBytes)), (index) => bytes.subarray(index * fileChunkBytes, (index + oneChunk) * fileChunkBytes));
+const download = (serving) => (request) => {
+	const opened = Effect.gen(function* opened() {
+		const path = yield* filePathOf(request.path);
+		const client = yield* clientOf(serving, request, reading(path));
+		const range = yield* rangeOf(request);
+		return Option.match(range, {
+			onNone: () => client.download(path),
+			onSome: (requested) => client.download(path, requested)
+		});
+	});
+	return Stream.unwrap(opened).pipe(Stream.flatMap((chunk) => Stream.fromIterable(slices(chunk))), Stream.mapError(served(serving.actor.name)));
+};
+const listed = (serving) => (request) => clientOf(serving, request, reading(request.prefix)).pipe(Effect.flatMap((client) => client.list(listingOf(request))), Effect.mapError(served(serving.actor.name)));
+const usage = (serving) => (request) => clientOf(serving, request, reading(request.prefix)).pipe(Effect.flatMap((client) => client.fileUsage(listingOf(request))), Effect.mapError(served(serving.actor.name)));
+const opened = (serving) => (request) => Effect.flatMap(ownerFor(serving, request, writing), (owner) => {
+	const { actor, host, uploads: sessions } = serving;
+	const client = hostFileClient({
+		address: owner.address,
+		host
+	});
+	const upload = Effect.map(sessions.open(owner, client), (id) => ({ upload: id }));
+	return Effect.mapError(upload, served(actor.name));
+});
+const appended = (serving) => (request) => Effect.flatMap(uploaderFor(serving, request), (owner) => {
+	const { actor, uploads: sessions } = serving;
+	const received = Effect.map(sessions.append({
+		...owner,
+		...request
+	}), (bytes) => ({ received: bytes }));
+	return Effect.mapError(received, served(actor.name));
+});
+const closed = (serving) => (request) => Effect.flatMap(uploaderFor(serving, request), (owner) => {
+	const { actor, uploads: sessions } = serving;
+	const receipt = Effect.map(sessions.close({
+		...owner,
+		...request
+	}), (sealed) => ({ receipt: sealed }));
+	return Effect.mapError(receipt, served(actor.name));
+});
+const entriesOf = (serving) => {
+	const actor = serving.actor.name;
+	return [
+		[fileTag({
+			actor,
+			operation: "download"
+		}), download(serving)],
+		[fileTag({
+			actor,
+			operation: "list"
+		}), listed(serving)],
+		[fileTag({
+			actor,
+			operation: "usage"
+		}), usage(serving)],
+		[fileTag({
+			actor,
+			operation: "upload/open"
+		}), opened(serving)],
+		[fileTag({
+			actor,
+			operation: "upload/append"
+		}), appended(serving)],
+		[fileTag({
+			actor,
+			operation: "upload/close"
+		}), closed(serving)]
+	];
+};
+/**
+* The `<Actor>/files/<operation>` handlers of every served actor that declares files. A download, a listing, the
+* usage and an upload's open run the actor's `files.authorize` rule first (`ownerOf`), then serve the actor's files from
+* this host with the same client its own code uses outside commands. Uploads are sessions of this server
+* (`upload-sessions.pure.ts`), bound to the caller that opened them and held to `limits` over `defaultUploadLimits`.
+*/
+const fileRpcHandlers = ({ actors, limits = {} }) => Effect.gen(function* makeFileRpcHandlers() {
+	const host = yield* ActorHost;
+	const sessions = yield* uploadSessionsWith(limits);
+	const declaring = Array.filter(actors, (actor) => Option.isSome(actor.fileAccess));
+	return Record.fromEntries(Array.flatMap(declaring, (actor) => entriesOf({
+		actor,
+		host,
+		uploads: sessions
+	})));
+});
+/** One actor's file handlers, by tag, sharing `uploads` with every other actor the host serves. */
+const fileHandlersFor = (serving) => Record.fromEntries(entriesOf(serving));
+export { fileHandlersFor, fileRpcHandlers };

package/dist/serve/rpc/file/upload-sessions.pure.d.mts

@@ -0,0 +1,45 @@
+import { FileClientFailure } from "../../../contract/file/file-client-failure.contract.mjs";
+import { FileAddress, FileClient } from "../../../contract/file/file-client.contract.mjs";
+import { Effect, Scope } from "effect";
+/** What one server's upload sessions may hold. Targets, not measured; a host passes its own to the file RPC layer. */
+interface UploadLimits {
+  /** The largest file one upload may carry; a chunk that would pass it fails with `FileTooLargeError`. */
+  readonly maximumFileBytes: number;
+  /** Sessions open at once for one actor, by type and key. */
+  readonly perActor: number;
+  /** Sessions one caller holds open at once, across every actor. */
+  readonly perCaller: number;
+  /** Sessions open at once on the whole server. */
+  readonly perServer: number;
+}
+declare const defaultUploadLimits: UploadLimits;
+interface UploadOwner {
+  readonly address: FileAddress;
+  readonly principal: string;
+}
+interface Appending extends UploadOwner {
+  readonly bytes: Uint8Array;
+  readonly offset: number;
+  readonly upload: string;
+}
+interface Closing extends UploadOwner {
+  readonly bytes: number;
+  readonly upload: string;
+}
+interface UploadSessions {
+  readonly append: (appending: Appending) => Effect.Effect<number, FileClientFailure>;
+  readonly close: (closing: Closing) => Effect.Effect<string, FileClientFailure>;
+  readonly open: (owner: UploadOwner, client: FileClient) => Effect.Effect<string, FileClientFailure>;
+}
+/**
+ * Upload sessions of one RPC server. Effect RPC has no client streams, so a network upload is `open`, ordered
+ * `append`s and `close`. Each session feeds one sealing upload through a short queue, so a fast client waits for the
+ * seal instead of filling memory. Appends are idempotent by offset, so a client may resend a chunk whose reply it
+ * lost; a gap or an oversized chunk is refused, and a chunk that would take the file past `maximumFileBytes` fails
+ * with `FileTooLargeError` and drops the session. A session is bound to the actor, key and caller that opened it, so
+ * its id needs no secrecy. The server holds at most `perServer` sessions, `perCaller` for one caller and `perActor`
+ * for one actor (`defaultUploadLimits` unless the host passes its own), and drops one idle for a minute with its
+ * partial upload, which is never attached and which the blob store collects as it does any upload no command attached.
+ */
+declare const uploadSessionsWith: (limits?: Partial<UploadLimits>) => Effect.Effect<UploadSessions, never, Scope.Scope>;
+export { type UploadLimits, type UploadOwner, type UploadSessions, defaultUploadLimits, uploadSessionsWith };

package/dist/serve/rpc/file/upload-sessions.pure.mjs

@@ -0,0 +1,187 @@
+import { ActorUnavailableError } from "../../../contract/client/actor-unavailable.errors.mjs";
+import { uploadChunkBytes } from "../../../contract/file/rpc/file-rpc.contract.mjs";
+import { FileTooLargeError } from "../../../contract/file/rpc/file-too-large.errors.mjs";
+import { InvalidFileRequestError } from "../../../contract/file/invalid-file-request.errors.mjs";
+import { Array, Clock, Effect, Exit, Fiber, Latch, MutableHashMap, Option, Queue, Semaphore, Stream } from "effect";
+// src/serve/rpc/file/upload-sessions.pure.ts
+const defaultUploadLimits = {
+	maximumFileBytes: 1073741824,
+	perActor: 8,
+	perCaller: 8,
+	perServer: 64
+};
+/** How long an upload session may sit without an append or close before it is dropped with its partial upload. */
+const idleMillis = 6e4;
+const reapEvery = "10 seconds";
+/** Chunks queued ahead of the sealing upload, so a fast client waits instead of buffering a whole file. */
+const queuedChunks = 4;
+const none = 0;
+const one = 1;
+const refused = (message) => InvalidFileRequestError.make({
+	message,
+	path: ""
+});
+const sameOwner = (session, owner) => session.principal === owner.principal && session.address.actor === owner.address.actor && session.address.key === owner.address.key;
+const actorOf = ({ address }) => `${String(address.actor.length)}:${address.actor}${address.key}`;
+const countIn = (counts, name) => Option.getOrElse(MutableHashMap.get(counts, name), () => none);
+const adjust = (counts, name, by) => {
+	const next = countIn(counts, name) + by;
+	if (next === none) {
+		MutableHashMap.remove(counts, name);
+		return;
+	}
+	MutableHashMap.set(counts, name, next);
+};
+const busy = (owner, what) => ActorUnavailableError.make({
+	actor: owner.address.actor,
+	message: `too many uploads are open ${what}. Retry shortly.`
+});
+/** The refusal for a new session, if one of the limits is reached; none, after taking its slot, when all have room. */
+const takeSlot = ({ limits, slots }, owner) => {
+	if (slots.server >= limits.perServer) return Option.some(busy(owner, "on this host"));
+	if (countIn(slots.byCaller, owner.principal) >= limits.perCaller) return Option.some(busy(owner, "for this caller"));
+	if (countIn(slots.byActor, actorOf(owner)) >= limits.perActor) return Option.some(busy(owner, "for this actor"));
+	slots.server += one;
+	adjust(slots.byCaller, owner.principal, one);
+	adjust(slots.byActor, actorOf(owner), one);
+	return Option.none();
+};
+const giveBack = ({ slots }, owner) => {
+	slots.server -= one;
+	adjust(slots.byCaller, owner.principal, -1);
+	adjust(slots.byActor, actorOf(owner), -1);
+};
+/** Removes the session `upload` and gives its slot back, once however many paths end it. */
+const forget = (sessions, upload) => {
+	const found = MutableHashMap.get(sessions.held, upload);
+	if (Option.isSome(found)) {
+		MutableHashMap.remove(sessions.held, upload);
+		giveBack(sessions, found.value);
+	}
+};
+const drop = (sessions, [upload, session]) => Effect.andThen(Effect.sync(() => {
+	forget(sessions, upload);
+}), Effect.andThen(Queue.shutdown(session.chunks), Fiber.interrupt(session.sealing)));
+const reap = (sessions) => Effect.flatMap(Clock.currentTimeMillis, (now) => {
+	const idle = Array.filter([...sessions.held], ([, session]) => now - session.touched > idleMillis);
+	return Effect.forEach(idle, (entry) => drop(sessions, entry), { discard: true });
+});
+/** Finds the session `upload` and marks it used; only the actor, key and caller that opened it may use it. */
+const owned = (sessions, upload, owner) => {
+	const found = Option.filter(MutableHashMap.get(sessions.held, upload), (session) => sameOwner(session, owner));
+	return Effect.mapError(Effect.fromOption(found), () => refused(`no open upload ${upload} for this caller`)).pipe(Effect.tap((session) => Effect.map(Clock.currentTimeMillis, (now) => {
+		session.touched = now;
+	})));
+};
+/** Fails with the sealing upload's failure, or refuses when it ended without its last chunk. */
+const ended = (sealing) => Effect.flatMap(Fiber.await(sealing), (exit) => Exit.match(exit, {
+	onFailure: Effect.failCause,
+	onSuccess: () => Effect.fail(refused("the upload ended before its last chunk"))
+}));
+/**
+* Forks the sealing upload and waits until it reads its first chunk, so an upload the host refuses, such as one past
+* the actor's unattached uploads, fails the open itself. A failed or interrupted start stops the sealing upload.
+*/
+const sealingUpload = ({ chunks, client, scope }) => Effect.uninterruptibleMask((restore) => Effect.gen(function* startSealing() {
+	const reading = yield* Latch.make();
+	const source = Stream.unwrap(Effect.as(reading.open, Stream.fromQueue(chunks)));
+	const sealing = yield* Effect.forkIn(client.upload(source), scope);
+	yield* restore(Effect.raceFirst(reading.await, ended(sealing))).pipe(Effect.onError(() => Effect.andThen(Queue.shutdown(chunks), Fiber.interrupt(sealing))));
+	return sealing;
+}));
+const started = Effect.fnUntraced(function* started(sessions, owner, client) {
+	const chunks = yield* Queue.bounded(queuedChunks);
+	const sealing = yield* sealingUpload({
+		chunks,
+		client,
+		scope: sessions.scope
+	});
+	const touched = yield* Clock.currentTimeMillis;
+	const lock = yield* Semaphore.make(one);
+	sessions.opened += one;
+	const upload = `upload-${String(sessions.opened)}`;
+	MutableHashMap.set(sessions.held, upload, {
+		...owner,
+		chunks,
+		lock,
+		received: none,
+		sealing,
+		touched
+	});
+	return upload;
+});
+/**
+* Opens a session. Its slot is taken before the first yield, so concurrent opens can't all pass the same check, and
+* given back if the open fails or is interrupted; a session that opens keeps it until it closes or is dropped.
+*/
+const open = (sessions) => (owner, client) => Effect.acquireUseRelease(Effect.suspend(() => Option.match(takeSlot(sessions, owner), {
+	onNone: () => Effect.void,
+	onSome: Effect.fail
+})), () => started(sessions, owner, client), (_slot, exit) => Effect.sync(() => {
+	if (Exit.isFailure(exit)) giveBack(sessions, owner);
+}));
+const tooLarge = (session, maximumBytes) => FileTooLargeError.make({
+	actor: session.address.actor,
+	maximumBytes
+});
+/** Refuses a chunk that would take the file past `maximumFileBytes`, and drops its session with the partial upload. */
+const withinMaximum = (sessions, session, { bytes, upload }) => {
+	const { maximumFileBytes } = sessions.limits;
+	if (session.received + bytes.length <= maximumFileBytes) return Effect.void;
+	return Effect.andThen(drop(sessions, [upload, session]), Effect.fail(tooLarge(session, maximumFileBytes)));
+};
+const appendTo = Effect.fnUntraced(function* appendTo(sessions, session, request) {
+	const { bytes, offset } = request;
+	if (offset < session.received && offset + bytes.length <= session.received) return session.received;
+	if (offset !== session.received) return yield* refused(`the chunk starts at byte ${String(offset)}, but the upload has ${String(session.received)}`);
+	yield* withinMaximum(sessions, session, request);
+	yield* Effect.raceFirst(Queue.offer(session.chunks, bytes), ended(session.sealing));
+	session.received += bytes.length;
+	return session.received;
+});
+const append = (sessions) => Effect.fnUntraced(function* appending(request) {
+	if (request.bytes.length > 1048576) return yield* refused(`a chunk holds at most ${String(uploadChunkBytes)} bytes`);
+	const session = yield* owned(sessions, request.upload, request);
+	return yield* session.lock.withPermit(appendTo(sessions, session, request));
+});
+const finish = (sessions, session, { bytes, upload }) => {
+	if (bytes !== session.received) return Effect.fail(refused(`the upload has ${String(session.received)} bytes, not ${String(bytes)}`));
+	return Effect.andThen(Queue.end(session.chunks), Effect.ensuring(Fiber.join(session.sealing), Effect.sync(() => {
+		forget(sessions, upload);
+	})));
+};
+const close = (sessions) => (closing) => Effect.flatMap(owned(sessions, closing.upload, closing), (session) => session.lock.withPermit(finish(sessions, session, closing)));
+/**
+* Upload sessions of one RPC server. Effect RPC has no client streams, so a network upload is `open`, ordered
+* `append`s and `close`. Each session feeds one sealing upload through a short queue, so a fast client waits for the
+* seal instead of filling memory. Appends are idempotent by offset, so a client may resend a chunk whose reply it
+* lost; a gap or an oversized chunk is refused, and a chunk that would take the file past `maximumFileBytes` fails
+* with `FileTooLargeError` and drops the session. A session is bound to the actor, key and caller that opened it, so
+* its id needs no secrecy. The server holds at most `perServer` sessions, `perCaller` for one caller and `perActor`
+* for one actor (`defaultUploadLimits` unless the host passes its own), and drops one idle for a minute with its
+* partial upload, which is never attached and which the blob store collects as it does any upload no command attached.
+*/
+const uploadSessionsWith = (limits = {}) => Effect.gen(function* makeUploadSessions() {
+	const sessions = {
+		held: MutableHashMap.empty(),
+		limits: {
+			...defaultUploadLimits,
+			...limits
+		},
+		opened: none,
+		scope: yield* Effect.scope,
+		slots: {
+			byActor: MutableHashMap.empty(),
+			byCaller: MutableHashMap.empty(),
+			server: none
+		}
+	};
+	const reaping = Effect.andThen(Effect.sleep(reapEvery), reap(sessions));
+	yield* Effect.forkScoped(Effect.forever(reaping));
+	return {
+		append: append(sessions),
+		close: close(sessions),
+		open: open(sessions)
+	};
+});
+export { defaultUploadLimits, uploadSessionsWith };

package/dist/serve/rpc/in-process-client.layer.d.mts

@@ -0,0 +1,13 @@
+import { ActorClients } from "../../contract/client/actor-client.adapter.mjs";
+import { ActorFileClients } from "../../contract/file/file-client.adapter.mjs";
+import { ActorHost } from "../engine/actor-host.service.mjs";
+import { ActorsNotHostedError } from "../engine/actors-not-hosted.errors.mjs";
+import { ServedActor } from "./actor-rpc.handlers.mjs";
+import "./akter-server.layer.mjs";
+import { Layer } from "effect";
+import { RpcClient } from "effect/rpc";
+interface InProcessOptions<Actors extends readonly ServedActor[]> {
+  readonly actors: Actors;
+}
+declare const localClient: (options: InProcessOptions<readonly ServedActor[]>) => Layer.Layer<ActorClients | ActorFileClients | RpcClient.Protocol, ActorsNotHostedError, ActorHost>;
+export { type InProcessOptions, localClient };

package/dist/serve/rpc/in-process-client.layer.mjs

@@ -0,0 +1,34 @@
+import { ActorClients } from "../../contract/client/actor-client.adapter.mjs";
+import { rpcFileClients } from "../../contract/file/rpc/rpc-file-clients.layer.mjs";
+import { rpcPath, rpcRoutes } from "./akter-server.layer.mjs";
+import { Effect, Layer } from "effect";
+import { RpcClient, RpcSerialization } from "effect/rpc";
+import { SecureRandom } from "effect/crypto";
+import { HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpRouter } from "effect/http";
+// src/serve/rpc/in-process-client.layer.ts
+const inProcessOrigin = "http://127.0.0.1";
+const sendTo = (handler) => HttpClient.make((request, _url, signal) => {
+	const failed = (cause) => new HttpClientError.HttpClientError({ reason: new HttpClientError.TransportError({
+		cause,
+		request
+	}) });
+	return HttpClientRequest.toWeb(request, { signal }).pipe(Effect.mapError(failed), Effect.flatMap((web) => Effect.tryPromise({
+		catch: failed,
+		try: () => handler(web)
+	})), Effect.map((response) => HttpClientResponse.fromWeb(request, response)));
+});
+const inProcessHttp = Effect.fnUntraced(function* inProcessHttp(actors) {
+	const routes = yield* rpcRoutes(actors);
+	const context = yield* Effect.context();
+	const hosted = Layer.provide(routes, Layer.succeedContext(context));
+	const web = yield* Effect.acquireRelease(Effect.sync(() => HttpRouter.toWebHandler(hosted, { disableLogger: true })), (built) => Effect.promise(() => built.dispose()));
+	return Layer.succeed(HttpClient.HttpClient)(sendTo(web.handler));
+});
+const localClient = (options) => {
+	const url = new globalThis.URL(rpcPath, inProcessOrigin).href;
+	const http = Layer.unwrap(inProcessHttp(options.actors));
+	const protocol = RpcClient.layerProtocolHttp({ url }).pipe(Layer.provide([http, RpcSerialization.layerNdjson]));
+	const clients = Layer.merge(ActorClients.layer.pipe(Layer.provide(SecureRandom.layerWebCrypto)), rpcFileClients);
+	return Layer.provideMerge(clients, protocol);
+};
+export { localClient };

package/dist/serve/rpc/listener-not-loopback.errors.d.mts

@@ -0,0 +1,9 @@
+import { Schema } from "effect";
+declare const ListenerNotLoopbackError_base: Schema.Class<ListenerNotLoopbackError, Schema.TaggedStruct<"ListenerNotLoopbackError", {
+  readonly address: Schema.String;
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError & {
+  readonly brand: unique symbol;
+}>;
+export declare class ListenerNotLoopbackError extends ListenerNotLoopbackError_base {}
+export {};

package/dist/serve/rpc/listener-not-loopback.errors.mjs

@@ -0,0 +1,7 @@
+import { Schema } from "effect";
+// src/serve/rpc/listener-not-loopback.errors.ts
+var ListenerNotLoopbackError = class extends Schema.TaggedError()("ListenerNotLoopbackError", {
+	address: Schema.String,
+	message: Schema.String
+}) {};
+export { ListenerNotLoopbackError };

package/dist/serve/rpc/ndjson-only.pure.d.mts

@@ -0,0 +1,5 @@
+import { Effect } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+type Response = HttpServerResponse.HttpServerResponse;
+declare const ndjsonOnly: <Failure, Services>(app: Effect.Effect<Response, Failure, Services>) => Effect.Effect<Response, Failure, Services | HttpServerRequest.HttpServerRequest>;
+export { ndjsonOnly };

package/dist/serve/rpc/ndjson-only.pure.mjs

@@ -0,0 +1,14 @@
+import { Array, Effect, Option, String } from "effect";
+import { Headers, HttpServerRequest, HttpServerResponse } from "effect/http";
+// src/serve/rpc/ndjson-only.pure.ts
+const unsupportedMediaType = 415;
+const ndjsonTypes = ["application/ndjson", "application/x-ndjson"];
+const refusal = "a POST here must be application/ndjson; a browser sends any other body from another site without asking first, so it is refused";
+const parameters = /;.*$/su;
+const mediaType = (contentType) => String.toLowerCase(String.trim(String.replace(parameters, "")(contentType)));
+const isNdjson = (request) => Option.exists(Headers.get(request.headers, "content-type"), (contentType) => Array.contains(ndjsonTypes, mediaType(contentType)));
+const ndjsonOnly = (app) => HttpServerRequest.HttpServerRequest.use((request) => {
+	if (request.method !== "POST" || isNdjson(request)) return app;
+	return Effect.succeed(HttpServerResponse.text(refusal, { status: unsupportedMediaType }));
+});
+export { ndjsonOnly };

package/dist/serve/rpc/served-rpc.layer.d.mts

@@ -0,0 +1,6 @@
+import { ActorHost } from "../engine/actor-host.service.mjs";
+import { ActorRpcHandlers, ServedActor } from "./actor-rpc.handlers.mjs";
+import { Effect, Scope } from "effect";
+/** Every handler of the served actors' RPC groups: calls, reads and subscriptions, file streams and computers. */
+declare const servedRpcHandlers: (actors: readonly ServedActor[]) => Effect.Effect<ActorRpcHandlers, never, ActorHost | Scope.Scope>;
+export { type ServedActor, servedRpcHandlers };