@akterjs/effect 0.0.0-stage → 0.1.0

package/src/serve/hosted/hosted-app-checks.layer.ts

@@ -0,0 +1,74 @@
+import { Context, Effect, Layer, Option, Schema } from "effect";
+import { WorkflowEngine } from "effect/workflow";
+
+import { ActorRegistry } from "#src/contract/actor/actor-registry.service";
+import {
+  hostInterface,
+  hostInterfaceOf,
+  oldestHostInterface,
+  servesHostInterface,
+} from "#src/contract/actor/host-interface.pure";
+import { JobCodecsOf } from "#src/contract/command/command.contract";
+import { HostedAppBuildError } from "./hosted-app-build.errors.js";
+
+/** Why a host refuses to load an app's bundle: it was built with an akter this host doesn't serve. */
+type RefusedBuild = HostedAppBuildError;
+
+/** The refusal of an actor built with a host interface version outside this host's window. */
+const outsideWindow = (actor: string, built: number): HostedAppBuildError =>
+  HostedAppBuildError.make({
+    reason: `${actor} was built with akter host interface ${String(built)}, and this host serves ${String(oldestHostInterface)} to ${String(hostInterface)}: deploy the app again with a current akter`,
+  });
+
+/** The workflow engine a bundle registers its jobs with. It refuses a job built before jobs carried their codecs. */
+const bundleWorkflows = Layer.effect(
+  WorkflowEngine.WorkflowEngine,
+  WorkflowEngine.WorkflowEngine.use((engine) =>
+    Effect.succeed(
+      WorkflowEngine.WorkflowEngine.of({
+        ...engine,
+        register: (workflow, execute) => {
+          const codecs = Context.get(workflow.annotations, JobCodecsOf);
+
+          if (Option.isNone(codecs)) {
+            return Effect.die(
+              HostedAppBuildError.make({ reason: "the app was built with an older SDK; rebuild the app" }),
+            );
+          }
+
+          return engine.register(workflow, execute);
+        },
+      }),
+    ),
+  ),
+);
+
+/**
+ * The registry a bundle registers its actors in. It refuses an actor built with a host interface version outside the
+ * window this host reads, so a build it can't serve fails to load, typed, instead of failing each call.
+ */
+const servedRegistry = Layer.effect(
+  ActorRegistry,
+  ActorRegistry.use((registry) =>
+    Effect.succeed(
+      ActorRegistry.of({
+        ...registry,
+        register: (actor) => {
+          const built = hostInterfaceOf(actor);
+
+          if (!servesHostInterface(built)) {
+            return Effect.die(outsideWindow(actor.name, built));
+          }
+
+          return registry.register(actor);
+        },
+      }),
+    ),
+  ),
+);
+
+const isRefusedBuild = Schema.is(HostedAppBuildError);
+
+export { bundleWorkflows, isRefusedBuild, servedRegistry };
+
+export type { RefusedBuild };

package/src/serve/hosted/hosted-file-forward.layer.ts

@@ -0,0 +1,63 @@
+import { Effect, Layer, Schema } from "effect";
+import { Headers, HttpServerRequest } from "effect/http";
+
+import { Authentication } from "#src/contract/caller/authentication.api";
+import { Caller } from "#src/contract/caller/caller.schema";
+import { CurrentCaller } from "#src/contract/caller/current-caller.service";
+import { UnauthenticatedError } from "#src/contract/caller/unauthenticated.errors";
+
+/**
+ * One file RPC a gateway forwarded: the verified caller and the client's RPC request, unchanged. Its `id` is the
+ * client's own, a number or a string, and every frame of the answer carries it back as given, because the client
+ * matches frames to its request by that exact value.
+ */
+interface FileForward {
+  readonly caller: Caller;
+  readonly request: { readonly id: number | string; readonly payload: unknown; readonly tag: string };
+}
+
+const callerHeader = "akter-forwarded-caller";
+
+const CallerJson = Schema.fromJsonString(Schema.toCodecJson(Caller));
+
+const RequestMessage = Schema.TaggedStruct("Request", {
+  headers: Schema.Array(Schema.Tuple([Schema.String, Schema.String])),
+  id: Schema.Union([Schema.String, Schema.Finite]),
+  payload: Schema.Unknown,
+  tag: Schema.String,
+});
+
+const RequestLine = Schema.fromJsonString(RequestMessage);
+
+const unverified = UnauthenticatedError.make({ message: "the forwarded file request carried no verified caller" });
+
+const callerOf = (headers: Headers.Headers): Effect.Effect<Caller, UnauthenticatedError> => {
+  const header = Effect.fromOption(Headers.get(headers, callerHeader));
+
+  return Effect.mapError(Effect.flatMap(header, Schema.decodeEffect(CallerJson)), () => unverified);
+};
+
+/** The caller the host verified, which `forwardedRequest` puts in a header only the in-memory file server reads. */
+const ForwardedAuthentication = Layer.succeed(Authentication)((effect, { headers }) =>
+  Effect.flatMap(callerOf(headers), (caller) => Effect.provideService(effect, CurrentCaller, caller)),
+);
+
+/** The forward as the one-request NDJSON body an Effect RPC HTTP server reads, carrying the verified caller. */
+const forwardedRequest = (forward: FileForward): Effect.Effect<HttpServerRequest.HttpServerRequest> =>
+  Effect.gen(function* encodeForward() {
+    const message = RequestMessage.make({ ...forward.request, headers: [] });
+    const line = yield* Schema.encodeEffect(RequestLine)(message);
+    const caller = yield* Schema.encodeEffect(CallerJson)(forward.caller);
+
+    const request = new globalThis.Request("http://akter.internal/rpc", {
+      body: `${line}\n`,
+      headers: { [callerHeader]: caller, "content-type": "application/ndjson" },
+      method: "POST",
+    });
+
+    return HttpServerRequest.fromWeb(request);
+  }).pipe(Effect.orDie);
+
+export { ForwardedAuthentication, forwardedRequest };
+
+export type { FileForward };

package/src/serve/hosted/hosted-file-rpcs.layer.ts

@@ -0,0 +1,149 @@
+import {
+  Array as Arr,
+  Context,
+  Effect,
+  Option,
+  Record as Rec,
+  Schema,
+  Scope,
+  String as Str,
+  SynchronizedRef,
+} from "effect";
+import { HttpServerRequest } from "effect/http";
+import type { HttpServerResponse } from "effect/http";
+
+import { Principal } from "#src/contract/caller/principal.schema";
+import { InvalidRequestError } from "#src/contract/client/invalid-request.errors";
+import { ActorComputerClients } from "#src/contract/computer/computer-client.adapter";
+import { ActorHost } from "#src/serve/engine/actor-host.service";
+import { uploadSessionsWith } from "#src/serve/rpc/file/upload-sessions.pure";
+import type { UploadLimits, UploadSessions } from "#src/serve/rpc/file/upload-sessions.pure";
+import { forwardedRequest } from "./hosted-file-forward.layer.js";
+import type { FileForward } from "./hosted-file-forward.layer.js";
+import { fileServerOf } from "./hosted-file-server.layer.js";
+import type { FileServer } from "./hosted-file-server.layer.js";
+import { HostedRuntime } from "./hosted-runtime.service.js";
+
+type Answer = (
+  forward: FileForward,
+) => Effect.Effect<HttpServerResponse.HttpServerResponse, InvalidRequestError, Scope.Scope>;
+
+interface Started {
+  readonly computers: Option.Option<ActorComputerClients["Service"]>;
+  readonly host: ActorHost["Service"];
+  readonly steps: boolean;
+  readonly runtime: HostedRuntime["Service"];
+  readonly scope: Scope.Scope;
+  readonly uploads: UploadSessions;
+}
+
+/**
+ * Whether forwarded `<Actor>/computer/steps` and `step` read the actor's durable steps. Off by default, so a host
+ * answers them `ComputersUnavailableError` until the engine hosting it turns them on.
+ */
+const ServeDurableSteps = Context.Reference<boolean>(
+  "@akterjs/effect/serve/hosted/hosted-file-rpcs.layer/ServeDurableSteps",
+  {
+    defaultValue: () => false,
+  },
+);
+
+/** The groups this server answers: `<Actor>/files/<operation>` and `<Actor>/computer/<operation>`. */
+const groupSegments: readonly string[] = ["/files/", "/computer/"];
+
+const noActor = 0;
+
+const notForwarded = (tag: string): InvalidRequestError =>
+  InvalidRequestError.make({ actor: tag, message: `${tag} isn't a file or computer request` });
+
+const actorOfTag = (tag: string): Effect.Effect<string, InvalidRequestError> => {
+  const found = Arr.findFirst(groupSegments, (segment) => Option.isSome(Str.indexOf(segment)(tag)));
+  const at = Option.flatMap(found, (segment) => Str.indexOf(segment)(tag));
+  const named = Option.filter(at, (index) => index !== noActor);
+
+  return Effect.mapBoth(Effect.fromOption(named), {
+    onFailure: () => notForwarded(tag),
+    onSuccess: (index) => Str.slice(noActor, index)(tag),
+  });
+};
+
+const startServer = (
+  { computers, host, runtime, scope, steps, uploads }: Started,
+  actor: string,
+): Effect.Effect<FileServer, InvalidRequestError> =>
+  Effect.gen(function* declaredServer() {
+    const declared = yield* Effect.mapError(runtime.declare(actor), () =>
+      InvalidRequestError.make({ actor, message: `${actor} isn't an actor of this app` }),
+    );
+
+    const { callers, fileAccess = Option.none(), key } = declared.actor;
+
+    /* A bundle carries its own copy of effect (akter-cloud ADR 0027), and this host's copy can't run what the bundle's
+       built inside a schema: it hands a transformation no value and decodes a declaration such as `Schema.Json` to
+       nothing, so a plain SDK actor, whose key and principals run their Standard validators that way, had every key
+       and caller refused. The host decodes a key by its encoded side, a string with its own checks, and admits a
+       principal of a kind the actor declares by the shape every principal has; the actor's handlers decode the rest in
+       the bundle. */
+    const hostPrincipals = Rec.map(callers, () => Principal);
+
+    /* A bundle built before contracts declared file calls has no `fileAccess`. Its file calls are refused like those of
+       a new build that declares none, since a rule-less path would let any admitted kind reach every key's files (FG1). */
+    const fileActor = { callers: hostPrincipals, fileAccess, key: Schema.toEncoded(key), name: actor };
+
+    return yield* Effect.provideService(
+      fileServerOf({ actor: fileActor, computers, host, steps: Option.liftPredicate(host, () => steps), uploads }),
+      Scope.Scope,
+      scope,
+    );
+  });
+
+/**
+ * Serves forwarded `<Actor>/files/<operation>` and `<Actor>/computer/<operation>` RPCs: one in-memory Effect RPC
+ * server per actor, started on first use, answering each request with the NDJSON frames a gateway relays to the client
+ * unchanged (chunks as they are produced, then one `Exit`). Upload sessions are shared by every actor the host serves,
+ * so build this once per host. Computers are reached through the `ActorComputerClients` in context when it is built;
+ * without one they answer `ComputersUnavailableError`. The forward's caller must already be verified by the host.
+ * Uploads are held to `limits` over `defaultUploadLimits`, so a host sets its own largest file and session caps.
+ */
+const hostedFileRpcsWith = (
+  limits: Partial<UploadLimits> = {},
+): Effect.Effect<Answer, never, ActorHost | HostedRuntime | Scope.Scope> =>
+  Effect.gen(function* makeHostedFileRpcs() {
+    const started: Started = {
+      computers: yield* Effect.serviceOption(ActorComputerClients),
+      host: yield* ActorHost,
+      runtime: yield* HostedRuntime,
+      scope: yield* Effect.scope,
+      steps: yield* ServeDurableSteps,
+      uploads: yield* uploadSessionsWith(limits),
+    };
+
+    const servers = yield* SynchronizedRef.make(new Map<string, FileServer>());
+
+    const serverFor = (actor: string): Effect.Effect<FileServer, InvalidRequestError> =>
+      SynchronizedRef.modifyEffect(servers, (known) =>
+        Option.match(Option.fromNullishOr(known.get(actor)), {
+          onNone: () =>
+            Effect.map(
+              startServer(started, actor),
+              (server) => [server, new Map([...known, [actor, server]])] as const,
+            ),
+          onSome: (server) => Effect.succeed([server, known] as const),
+        }),
+      );
+
+    return (forward: FileForward) =>
+      Effect.gen(function* answer() {
+        const server = yield* Effect.flatMap(actorOfTag(forward.request.tag), serverFor);
+        const request = yield* forwardedRequest(forward);
+
+        return yield* Effect.provideService(server, HttpServerRequest.HttpServerRequest, request);
+      });
+  });
+
+/** `hostedFileRpcsWith` at `defaultUploadLimits`. */
+const hostedFileRpcs = hostedFileRpcsWith();
+
+export { hostedFileRpcs, hostedFileRpcsWith, ServeDurableSteps };
+
+export type { FileForward } from "./hosted-file-forward.layer.js";

package/src/serve/hosted/hosted-file-server.layer.ts

@@ -0,0 +1,75 @@
+import { Effect } from "effect";
+import type { Scope } from "effect";
+import type { HttpServerRequest, HttpServerResponse } from "effect/http";
+import { RpcGroup, RpcSerialization, RpcServer } from "effect/rpc";
+import type { Rpc } from "effect/rpc";
+
+import { Authentication } from "#src/contract/caller/authentication.api";
+import type { CurrentCaller } from "#src/contract/caller/current-caller.service";
+import { computerRpcsOf } from "#src/contract/computer/rpc/computer-rpc.contract";
+import type { ComputerRpc } from "#src/contract/computer/rpc/computer-rpc.contract";
+import { fileRpcsOf } from "#src/contract/file/rpc/file-rpc.contract";
+import type { FileRpc } from "#src/contract/file/rpc/file-rpc.contract";
+import { computerHandlersFor } from "#src/serve/rpc/computer/computer-rpc.layer";
+import type { ComputerHandlers } from "#src/serve/rpc/computer/computer-rpc.layer";
+import { fileHandlersFor } from "#src/serve/rpc/file/file-rpc.layer";
+import type { FileHandlers, FileServing } from "#src/serve/rpc/file/file-rpc.layer";
+import { ForwardedAuthentication } from "./hosted-file-forward.layer.js";
+
+/** One actor's file RPC server: answers the request in context with its NDJSON frames. */
+type FileServer = Effect.Effect<
+  HttpServerResponse.HttpServerResponse,
+  never,
+  HttpServerRequest.HttpServerRequest | Scope.Scope
+>;
+
+type ServedFileRpc = Rpc.AddMiddleware<FileRpc | ComputerRpc, typeof Authentication>;
+
+const groupOf = (actor: string): RpcGroup.RpcGroup<ServedFileRpc> =>
+  RpcGroup.make(...fileRpcsOf(actor), ...computerRpcsOf(actor)).middleware(Authentication);
+
+type GroupHandlers = {
+  readonly [Current in ServedFileRpc as Current["_tag"]]: Rpc.ToHandlerFn<Current, CurrentCaller>;
+};
+
+type Handlers = Readonly<Record<string, FileHandlers[string] | ComputerHandlers[string]>>;
+
+function asGroupHandlers(handlers: Handlers): GroupHandlers;
+function asGroupHandlers(handlers: Handlers): Handlers | GroupHandlers {
+  return handlers;
+}
+
+/**
+ * Serves one actor's `<Actor>/files/<operation>` and `<Actor>/computer/<operation>` RPCs with the same Effect RPC
+ * server and NDJSON framing `akter dev` serves them with, behind the forwarded caller. The server lives as long as
+ * `Scope`.
+ */
+type ComputerServing = Parameters<typeof computerHandlersFor>[number];
+
+const fileServerOf = (
+  serving: FileServing & {
+    readonly actor: ComputerServing["actor"];
+    readonly computers: ComputerServing["clients"];
+    readonly steps: ComputerServing["steps"];
+  },
+): Effect.Effect<FileServer, never, Scope.Scope> => {
+  const group = groupOf(serving.actor.name);
+
+  const computers = computerHandlersFor({
+    actor: serving.actor,
+    clients: serving.computers,
+    host: serving.host,
+    steps: serving.steps,
+  });
+
+  const served = asGroupHandlers({ ...fileHandlersFor(serving), ...computers });
+  const handlers = group.toLayer(Effect.succeed(served));
+
+  return RpcServer.toHttpEffect(group).pipe(
+    Effect.provide([handlers, ForwardedAuthentication, RpcSerialization.layerNdjson]),
+  );
+};
+
+export { fileServerOf };
+
+export type { FileServer };

package/src/serve/hosted/hosted-files.layer.ts

@@ -0,0 +1,76 @@
+import { Context, Effect, Layer } from "effect";
+import type { FileSystem, Path, Scope } from "effect";
+import type { SqlClient } from "effect/sql";
+
+import type { OpenedActor } from "#src/host/actor/actor-database.service";
+import { BlobSealing } from "#src/host/blob/blob-sealing.service";
+import type { BlobOwner, TransferEffect } from "#src/host/blob/reference/blob-transfer.pure";
+import { actorFileStorage } from "#src/host/file/actor-file-storage.sql";
+import { blobHomeOn, canonicalHome } from "#src/host/file/blob-home.sql";
+import type { LocalBlobHome } from "#src/host/file/blob-home.sql";
+import { actorFilesOn, blobOwnerOn } from "#src/host/file/local-blob-owner.sql";
+import { BlobHashing } from "#src/host/hash/blob-hashing.service";
+import { blobHashing } from "#src/runtime/blob-hashing.layer";
+
+interface HostedFileHomeOpening {
+  readonly catalog: SqlClient.SqlClient;
+  readonly root: string;
+}
+
+interface HostedActorFilesOpening {
+  readonly exclusive: BlobOwner["exclusive"];
+  readonly home: LocalBlobHome;
+  readonly identity: string;
+  readonly opened: OpenedActor;
+  readonly snapshot: BlobOwner["snapshot"];
+}
+
+/**
+ * A file home for a host that keeps its own SQLite connections, such as one per Cloud shard: blobs are written under
+ * `root` (created if missing), sealed by the provided `BlobSealing`, and their catalog (claims and reference counts) lives on `catalog`,
+ * which only this home writes. Blobs adopted from another home are checked with akter's own SHA-256, so the host
+ * provides no hashing. Its transfers close with the scope.
+ */
+const hostedFileHome = ({
+  catalog,
+  root,
+}: HostedFileHomeOpening): TransferEffect<
+  LocalBlobHome,
+  BlobSealing | FileSystem.FileSystem | Path.Path | Effect.Services<ReturnType<typeof blobHomeOn>>
+> =>
+  Effect.gen(function* openHostedFileHome() {
+    const sealing = yield* BlobSealing;
+    const hashed = yield* Layer.build(blobHashing);
+    const hashing = Context.get(hashed, BlobHashing);
+    const canonical = yield* canonicalHome(root);
+
+    return yield* blobHomeOn({ catalog, hashing, root: canonical, sealing });
+  });
+
+/**
+ * Gives an opened actor its files on `home`. `identity` names the actor to the sealing keyring and the catalog, and
+ * every read and write of the actor's own file tables goes through `exclusive`, the host's serializer for the actor's
+ * connection, so it never interleaves with a command batch. It recovers unfinished transfers, settles references and
+ * keeps them settled until the scope closes. Commands of the returned actor reach the files through `Akter.files`.
+ */
+const hostedActorFiles = ({
+  exclusive,
+  home,
+  identity,
+  opened,
+  snapshot,
+}: HostedActorFilesOpening): TransferEffect<OpenedActor, Scope.Scope> =>
+  Effect.gen(function* openHostedActorFiles() {
+    const owner = yield* blobOwnerOn({ actor: identity, exclusive, snapshot, sql: opened.sql });
+    const fileSession = yield* actorFilesOn({ home, owner, sql: opened.sql });
+
+    return {
+      ...opened,
+      fileSession,
+      files: (sql: SqlClient.SqlClient) => actorFileStorage({ actor: identity, open: home.transfers.open, sql }),
+    };
+  });
+
+export { hostedActorFiles, hostedFileHome };
+
+export type { HostedActorFilesOpening, HostedFileHomeOpening };

package/src/serve/hosted/hosted-runtime.layer.ts

@@ -0,0 +1,145 @@
+import { layer as nodeFileSystem } from "@effect/platform-node/NodeFileSystem";
+import { layer as nodePath } from "@effect/platform-node/NodePath";
+import { Cause, Effect, Layer } from "effect";
+import type { WorkflowEngine } from "effect/workflow";
+
+import { ActorRegistry } from "#src/contract/actor/actor-registry.service";
+import { withJobs } from "#src/serve/engine/job-runtime.layer";
+import { providedHandlers } from "#src/serve/engine/actor-engine.layer";
+import { HostedRuntime } from "./hosted-runtime.service.js";
+import { bundleWorkflows, isRefusedBuild, servedRegistry } from "./hosted-app-checks.layer.js";
+import type { RefusedBuild } from "./hosted-app-checks.layer.js";
+import { servedSecrets } from "./hosted-secrets.layer.js";
+
+const runtime = HostedRuntime.layer.pipe(Layer.provide([providedHandlers, nodeFileSystem, nodePath]));
+
+const hostedRuntime: Layer.Layer<HostedRuntime | WorkflowEngine.WorkflowEngine> = withJobs(runtime);
+
+const hostedApp = <Output, Failure>(
+  app: Layer.Layer<Output, Failure, ActorRegistry | WorkflowEngine.WorkflowEngine>,
+): Layer.Layer<HostedRuntime | WorkflowEngine.WorkflowEngine, Failure | RefusedBuild> => {
+  const registered = app.pipe(Layer.provide([bundleWorkflows, servedRegistry, servedSecrets]));
+
+  return runtime.pipe(
+    Layer.provide(registered),
+    Layer.provide(ActorRegistry.layer),
+    withJobs,
+    Layer.catchCause((cause): Layer.Layer<HostedRuntime | WorkflowEngine.WorkflowEngine, Failure | RefusedBuild> => {
+      for (const reason of cause.reasons) {
+        if (Cause.isDieReason(reason) && isRefusedBuild(reason.defect)) {
+          return Layer.effectContext<HostedRuntime | WorkflowEngine.WorkflowEngine, Failure | RefusedBuild, never>(
+            Effect.fail(reason.defect),
+          );
+        }
+      }
+
+      return Layer.effectContext<HostedRuntime | WorkflowEngine.WorkflowEngine, Failure | RefusedBuild, never>(
+        Effect.failCause(cause),
+      );
+    }),
+  );
+};
+
+export { hostedApp, hostedRuntime };
+
+export { ActorSecrets } from "#src/contract/secret/actor-secrets.adapter";
+
+export type { SecretRequest } from "#src/contract/secret/actor-secrets.adapter";
+
+export { ExecutionAuthority } from "#src/host/upkeep/execution-authority.pure";
+
+export { engineOwnedRefusal } from "#src/contract/hosted/handler-failure.pure";
+
+export { engineOwned, HandlerSql, QueryReadOnly } from "#src/host/query/query-policy.pure";
+
+export { CommandBatch, commandBatch, dropCommand, keepCommand } from "#src/host/command/batch/command-batch.sql";
+
+export type { CommandBatchScope } from "#src/host/command/batch/command-batch.sql";
+
+export { ActorConnections } from "#src/host/sqlite/actor-connections.pure";
+
+export type {
+  ActorConnectionOpener,
+  ActorDatabaseTarget,
+  SqliteHandle,
+  SqliteRow,
+  SqliteStatement,
+  SqliteValue,
+} from "#src/host/sqlite/actor-connections.pure";
+
+export type { ExecutionGuard } from "#src/host/upkeep/execution-authority.pure";
+
+export { HostedAppBuildError } from "./hosted-app-build.errors.js";
+
+export {
+  bundleHostInterface,
+  hostInterface,
+  hostInterfaceLine,
+  hostInterfaceOf,
+  oldestHostInterface,
+  servesHostInterface,
+} from "#src/contract/actor/host-interface.pure";
+
+export { HostedRuntime } from "./hosted-runtime.service.js";
+
+export { JobComputers } from "#src/host/computer/job-computers.service";
+
+export { hostedActorFiles, hostedFileHome } from "./hosted-files.layer.js";
+
+export { hostedFileRpcs, hostedFileRpcsWith, ServeDurableSteps } from "./hosted-file-rpcs.layer.js";
+
+export { defaultUploadLimits } from "#src/serve/rpc/file/upload-sessions.pure";
+
+export type { UploadLimits } from "#src/serve/rpc/file/upload-sessions.pure";
+
+export type { FileForward } from "./hosted-file-rpcs.layer.js";
+
+export type { HostedActorFilesOpening, HostedFileHomeOpening } from "./hosted-files.layer.js";
+
+export type { LocalBlobHome as HostedFileHome } from "#src/host/file/local-blob-home.service";
+
+export type { LocalActorFiles as HostedFileSession } from "#src/host/file/local-blob-owner.sql";
+
+export { heldExportFile, heldExportFiles, holdExportFiles } from "#src/host/blob/export/blob-export-holds.sql";
+
+export type {
+  ExportedFile,
+  ExportHold,
+  HeldBlob,
+  HeldLookup,
+  HeldPage,
+} from "#src/host/blob/export/blob-export-holds.sql";
+
+export { ArchivedActors } from "#src/serve/archive/archived-actors.layer";
+
+export { ArchivedStore } from "#src/serve/archive/archived-store.layer";
+
+export { BlobKeyring } from "#src/host/blob/blob-keyring.service";
+
+export { BlobSealing } from "#src/host/blob/blob-sealing.service";
+
+export { BlobTransferError } from "#src/contract/file/blob-transfer.errors";
+
+export { blobHashing } from "#src/runtime/blob-hashing.layer";
+
+export { BlobHashing } from "#src/host/hash/blob-hashing.service";
+
+export type { DeclaredActor, HostedKept, HostedOpening, HostedUpkeep } from "./hosted-runtime.service.js";
+
+export type { CommittedCommand, HostFailure, LiveActor } from "#src/serve/live/live-reads.service";
+
+export type { LiveUpdate } from "#src/contract/client/actor-rpc.contract";
+
+export type { QueryRequest } from "#src/host/query/query-runner.service";
+
+export type { OpenedActor } from "#src/host/actor/actor-database.service";
+
+export type { CommandRequest, CreationRequest } from "#src/host/command/command-runner.service";
+
+export type { JournalWindow } from "#src/contract/history/actor-journal.service";
+
+export type { JobStore } from "#src/host/job/job-engine.adapter";
+
+export type { Delivery, DeliveryBatch } from "#src/host/outbox/outbox-runner.service";
+
+export type { JobAddress } from "#src/contract/job/job-id.pure";