@akterjs/effect 0.0.0-stage → 0.1.0

package/src/serve/rpc/file/file-rpc.layer.ts

@@ -0,0 +1,209 @@
+import { Array as Arr, Effect, Option, Record as Rec, Stream } from "effect";
+import type { Scope } from "effect";
+
+import { CurrentCaller } from "#src/contract/caller/current-caller.service";
+import type {
+  FileClient,
+  FileListing,
+  FilePage,
+  FileRange,
+  FileUsagePage,
+} from "#src/contract/file/file-client.contract";
+import { fileChunkBytes, fileTag } from "#src/contract/file/rpc/file-rpc.contract";
+import { filePathOf } from "#src/contract/file/file-path.pure";
+import { InvalidFileRequestError } from "#src/contract/file/invalid-file-request.errors";
+import { ActorHost } from "#src/serve/engine/actor-host.service";
+import { hostFileClient } from "#src/runtime/local-file-clients.layer";
+import { callerOf, ownerOf, served } from "./file-rpc-access.pure.js";
+import type { Asked, FileActor, Keyed, Served } from "./file-rpc-access.pure.js";
+import { uploadSessionsWith } from "./upload-sessions.pure.js";
+import type { UploadLimits, UploadOwner, UploadSessions } from "./upload-sessions.pure.js";
+
+interface Listed extends Keyed {
+  readonly cursor?: string;
+  readonly limit?: number;
+  readonly prefix?: string;
+}
+
+interface Downloaded extends Keyed {
+  readonly length?: number;
+  readonly offset?: number;
+  readonly path: string;
+}
+
+interface Appended extends Keyed {
+  readonly bytes: Uint8Array;
+  readonly offset: number;
+  readonly upload: string;
+}
+
+interface Closed extends Keyed {
+  readonly bytes: number;
+  readonly upload: string;
+}
+
+interface Serving {
+  readonly actor: FileActor;
+  readonly host: ActorHost["Service"];
+  readonly uploads: UploadSessions;
+}
+
+type Answer<Value> = Effect.Effect<Value, Served, CurrentCaller>;
+
+type FileHandler =
+  | ((request: Appended) => Answer<{ readonly received: number }>)
+  | ((request: Closed) => Answer<{ readonly receipt: string }>)
+  | ((request: Downloaded) => Stream.Stream<Uint8Array, Served, CurrentCaller>)
+  | ((request: Keyed) => Answer<{ readonly upload: string }>)
+  | ((request: Listed) => Answer<FilePage>)
+  | ((request: Listed) => Answer<FileUsagePage>);
+
+type FileHandlers = Readonly<Record<string, FileHandler>>;
+
+const oneChunk = 1;
+
+/** Admits the current caller to the actor's files under the request's key, if the actor's rule allows `asked`. */
+const ownerFor = ({ actor, host }: Serving, { key }: Keyed, asked: Asked): Answer<UploadOwner> =>
+  Effect.flatMap(Effect.service(CurrentCaller), (caller) => ownerOf({ actor, asked, caller, host, key }));
+
+/** The current caller of an open upload, which the session checks is the caller that opened it. */
+const uploaderFor = ({ actor }: Serving, { key }: Keyed): Answer<UploadOwner> =>
+  Effect.flatMap(Effect.service(CurrentCaller), (caller) => callerOf({ actor, caller, key }));
+
+const reading = (path: string | undefined): Asked => ({ access: "read", path: path ?? "" });
+
+const writing: Asked = { access: "write", path: "" };
+
+const clientOf = (serving: Serving, request: Keyed, asked: Asked): Answer<FileClient> =>
+  Effect.map(ownerFor(serving, request, asked), ({ address }) => hostFileClient({ address, host: serving.host }));
+
+const listingOf = ({ cursor, limit, prefix }: Listed): FileListing => ({
+  ...Rec.getSomes({ cursor: Option.fromNullishOr(cursor), prefix: Option.fromNullishOr(prefix) }),
+  ...Rec.getSomes({ limit: Option.fromNullishOr(limit) }),
+});
+
+const rangeOf = ({ length, offset, path }: Downloaded): Effect.Effect<Option.Option<FileRange>, Served> => {
+  const bounds = { length: Option.fromNullishOr(length), offset: Option.fromNullishOr(offset) };
+
+  if (Option.isSome(bounds.length) !== Option.isSome(bounds.offset)) {
+    return Effect.fail(InvalidFileRequestError.make({ message: "a range needs both offset and length", path }));
+  }
+
+  return Effect.succeed(Option.all(bounds));
+};
+
+const slices = (bytes: Uint8Array): readonly Uint8Array[] =>
+  Arr.makeBy(Math.max(oneChunk, Math.ceil(bytes.length / fileChunkBytes)), (index) =>
+    bytes.subarray(index * fileChunkBytes, (index + oneChunk) * fileChunkBytes),
+  );
+
+const download =
+  (serving: Serving) =>
+  (request: Downloaded): Stream.Stream<Uint8Array, Served, CurrentCaller> => {
+    const opened = Effect.gen(function* opened() {
+      const path = yield* filePathOf(request.path);
+      const client = yield* clientOf(serving, request, reading(path));
+      const range = yield* rangeOf(request);
+
+      return Option.match(range, {
+        onNone: () => client.download(path),
+        onSome: (requested) => client.download(path, requested),
+      });
+    });
+
+    return Stream.unwrap(opened).pipe(
+      Stream.flatMap((chunk) => Stream.fromIterable(slices(chunk))),
+      Stream.mapError(served(serving.actor.name)),
+    );
+  };
+
+type FileEntries = readonly (readonly [string, FileHandler])[];
+
+const listed =
+  (serving: Serving) =>
+  (request: Listed): Answer<FilePage> =>
+    clientOf(serving, request, reading(request.prefix)).pipe(
+      Effect.flatMap((client) => client.list(listingOf(request))),
+      Effect.mapError(served(serving.actor.name)),
+    );
+
+const usage =
+  (serving: Serving) =>
+  (request: Listed): Answer<FileUsagePage> =>
+    clientOf(serving, request, reading(request.prefix)).pipe(
+      Effect.flatMap((client) => client.fileUsage(listingOf(request))),
+      Effect.mapError(served(serving.actor.name)),
+    );
+
+const opened =
+  (serving: Serving) =>
+  (request: Keyed): Answer<{ readonly upload: string }> =>
+    Effect.flatMap(ownerFor(serving, request, writing), (owner) => {
+      const { actor, host, uploads: sessions } = serving;
+      const client = hostFileClient({ address: owner.address, host });
+      const upload = Effect.map(sessions.open(owner, client), (id) => ({ upload: id }));
+
+      return Effect.mapError(upload, served(actor.name));
+    });
+
+const appended =
+  (serving: Serving) =>
+  (request: Appended): Answer<{ readonly received: number }> =>
+    Effect.flatMap(uploaderFor(serving, request), (owner) => {
+      const { actor, uploads: sessions } = serving;
+      const received = Effect.map(sessions.append({ ...owner, ...request }), (bytes) => ({ received: bytes }));
+
+      return Effect.mapError(received, served(actor.name));
+    });
+
+const closed =
+  (serving: Serving) =>
+  (request: Closed): Answer<{ readonly receipt: string }> =>
+    Effect.flatMap(uploaderFor(serving, request), (owner) => {
+      const { actor, uploads: sessions } = serving;
+      const receipt = Effect.map(sessions.close({ ...owner, ...request }), (sealed) => ({ receipt: sealed }));
+
+      return Effect.mapError(receipt, served(actor.name));
+    });
+
+const entriesOf = (serving: Serving): FileEntries => {
+  const actor = serving.actor.name;
+
+  return [
+    [fileTag({ actor, operation: "download" }), download(serving)],
+    [fileTag({ actor, operation: "list" }), listed(serving)],
+    [fileTag({ actor, operation: "usage" }), usage(serving)],
+    [fileTag({ actor, operation: "upload/open" }), opened(serving)],
+    [fileTag({ actor, operation: "upload/append" }), appended(serving)],
+    [fileTag({ actor, operation: "upload/close" }), closed(serving)],
+  ];
+};
+
+/**
+ * The `<Actor>/files/<operation>` handlers of every served actor that declares files. A download, a listing, the
+ * usage and an upload's open run the actor's `files.authorize` rule first (`ownerOf`), then serve the actor's files from
+ * this host with the same client its own code uses outside commands. Uploads are sessions of this server
+ * (`upload-sessions.pure.ts`), bound to the caller that opened them and held to `limits` over `defaultUploadLimits`.
+ */
+const fileRpcHandlers = ({
+  actors,
+  limits = {},
+}: {
+  readonly actors: readonly FileActor[];
+  readonly limits?: Partial<UploadLimits>;
+}): Effect.Effect<FileHandlers, never, ActorHost | Scope.Scope> =>
+  Effect.gen(function* makeFileRpcHandlers() {
+    const host = yield* ActorHost;
+    const sessions = yield* uploadSessionsWith(limits);
+
+    const declaring = Arr.filter(actors, (actor) => Option.isSome(actor.fileAccess));
+
+    return Rec.fromEntries(Arr.flatMap(declaring, (actor) => entriesOf({ actor, host, uploads: sessions })));
+  });
+
+/** One actor's file handlers, by tag, sharing `uploads` with every other actor the host serves. */
+const fileHandlersFor = (serving: Serving): FileHandlers => Rec.fromEntries(entriesOf(serving));
+
+export { fileHandlersFor, fileRpcHandlers };
+
+export type { FileHandler, FileHandlers, Serving as FileServing };

package/src/serve/rpc/file/upload-sessions.pure.ts

@@ -0,0 +1,363 @@
+import {
+  Array as Arr,
+  Clock,
+  Latch,
+  Effect,
+  Exit,
+  Fiber,
+  MutableHashMap,
+  Option,
+  Queue,
+  Semaphore,
+  Stream,
+} from "effect";
+import type { Cause, Scope } from "effect";
+
+import { ActorUnavailableError } from "#src/contract/client/actor-unavailable.errors";
+import type { FileAddress, FileClient, FileClientFailure } from "#src/contract/file/file-client.contract";
+import { uploadChunkBytes } from "#src/contract/file/rpc/file-rpc.contract";
+import { FileTooLargeError } from "#src/contract/file/rpc/file-too-large.errors";
+import { InvalidFileRequestError } from "#src/contract/file/invalid-file-request.errors";
+
+/** What one server's upload sessions may hold. Targets, not measured; a host passes its own to the file RPC layer. */
+interface UploadLimits {
+  /** The largest file one upload may carry; a chunk that would pass it fails with `FileTooLargeError`. */
+  readonly maximumFileBytes: number;
+  /** Sessions open at once for one actor, by type and key. */
+  readonly perActor: number;
+  /** Sessions one caller holds open at once, across every actor. */
+  readonly perCaller: number;
+  /** Sessions open at once on the whole server. */
+  readonly perServer: number;
+}
+
+const defaultUploadLimits: UploadLimits = {
+  maximumFileBytes: 1_073_741_824,
+  perActor: 8,
+  perCaller: 8,
+  perServer: 64,
+};
+
+/** How long an upload session may sit without an append or close before it is dropped with its partial upload. */
+const idleMillis = 60_000;
+
+const reapEvery = "10 seconds";
+
+/** Chunks queued ahead of the sealing upload, so a fast client waits instead of buffering a whole file. */
+const queuedChunks = 4;
+
+const none = 0;
+
+const one = 1;
+
+interface UploadOwner {
+  readonly address: FileAddress;
+  readonly principal: string;
+}
+
+interface Session extends UploadOwner {
+  readonly chunks: Queue.Queue<Uint8Array, Cause.Done>;
+  readonly lock: Semaphore.Semaphore;
+  readonly sealing: Fiber.Fiber<string, FileClientFailure>;
+  received: number;
+  touched: number;
+}
+
+/** The session slots taken, counted when an open starts and given back when its session ends or the open fails. */
+interface Slots {
+  readonly byActor: MutableHashMap.MutableHashMap<string, number>;
+  readonly byCaller: MutableHashMap.MutableHashMap<string, number>;
+  server: number;
+}
+
+interface Sessions {
+  readonly held: MutableHashMap.MutableHashMap<string, Session>;
+  readonly limits: UploadLimits;
+  opened: number;
+  readonly scope: Scope.Scope;
+  readonly slots: Slots;
+}
+
+interface Appending extends UploadOwner {
+  readonly bytes: Uint8Array;
+  readonly offset: number;
+  readonly upload: string;
+}
+
+interface Closing extends UploadOwner {
+  readonly bytes: number;
+  readonly upload: string;
+}
+
+interface UploadSessions {
+  readonly append: (appending: Appending) => Effect.Effect<number, FileClientFailure>;
+  readonly close: (closing: Closing) => Effect.Effect<string, FileClientFailure>;
+  readonly open: (owner: UploadOwner, client: FileClient) => Effect.Effect<string, FileClientFailure>;
+}
+
+const refused = (message: string): InvalidFileRequestError => InvalidFileRequestError.make({ message, path: "" });
+
+const sameOwner = (session: UploadOwner, owner: UploadOwner): boolean =>
+  session.principal === owner.principal &&
+  session.address.actor === owner.address.actor &&
+  session.address.key === owner.address.key;
+
+const actorOf = ({ address }: UploadOwner): string => `${String(address.actor.length)}:${address.actor}${address.key}`;
+
+const countIn = (counts: MutableHashMap.MutableHashMap<string, number>, name: string): number =>
+  Option.getOrElse(MutableHashMap.get(counts, name), () => none);
+
+const adjust = (counts: MutableHashMap.MutableHashMap<string, number>, name: string, by: number): void => {
+  const next = countIn(counts, name) + by;
+
+  if (next === none) {
+    MutableHashMap.remove(counts, name);
+
+    return;
+  }
+
+  MutableHashMap.set(counts, name, next);
+};
+
+const busy = (owner: UploadOwner, what: string): ActorUnavailableError =>
+  ActorUnavailableError.make({
+    actor: owner.address.actor,
+    message: `too many uploads are open ${what}. Retry shortly.`,
+  });
+
+/** The refusal for a new session, if one of the limits is reached; none, after taking its slot, when all have room. */
+const takeSlot = ({ limits, slots }: Sessions, owner: UploadOwner): Option.Option<ActorUnavailableError> => {
+  if (slots.server >= limits.perServer) {
+    return Option.some(busy(owner, "on this host"));
+  }
+
+  if (countIn(slots.byCaller, owner.principal) >= limits.perCaller) {
+    return Option.some(busy(owner, "for this caller"));
+  }
+
+  if (countIn(slots.byActor, actorOf(owner)) >= limits.perActor) {
+    return Option.some(busy(owner, "for this actor"));
+  }
+
+  slots.server += one;
+  adjust(slots.byCaller, owner.principal, one);
+  adjust(slots.byActor, actorOf(owner), one);
+
+  return Option.none();
+};
+
+const giveBack = ({ slots }: Sessions, owner: UploadOwner): void => {
+  slots.server -= one;
+  adjust(slots.byCaller, owner.principal, -one);
+  adjust(slots.byActor, actorOf(owner), -one);
+};
+
+/** Removes the session `upload` and gives its slot back, once however many paths end it. */
+const forget = (sessions: Sessions, upload: string): void => {
+  const found = MutableHashMap.get(sessions.held, upload);
+
+  if (Option.isSome(found)) {
+    MutableHashMap.remove(sessions.held, upload);
+    giveBack(sessions, found.value);
+  }
+};
+
+const drop = (sessions: Sessions, [upload, session]: readonly [string, Session]): Effect.Effect<void> =>
+  Effect.andThen(
+    Effect.sync(() => {
+      forget(sessions, upload);
+    }),
+    Effect.andThen(Queue.shutdown(session.chunks), Fiber.interrupt(session.sealing)),
+  );
+
+const reap = (sessions: Sessions): Effect.Effect<void> =>
+  Effect.flatMap(Clock.currentTimeMillis, (now) => {
+    const idle = Arr.filter([...sessions.held], ([, session]) => now - session.touched > idleMillis);
+
+    return Effect.forEach(idle, (entry) => drop(sessions, entry), { discard: true });
+  });
+
+/** Finds the session `upload` and marks it used; only the actor, key and caller that opened it may use it. */
+const owned = (sessions: Sessions, upload: string, owner: UploadOwner): Effect.Effect<Session, FileClientFailure> => {
+  const found = Option.filter(MutableHashMap.get(sessions.held, upload), (session) => sameOwner(session, owner));
+
+  return Effect.mapError(Effect.fromOption(found), () => refused(`no open upload ${upload} for this caller`)).pipe(
+    Effect.tap((session) =>
+      Effect.map(Clock.currentTimeMillis, (now) => {
+        session.touched = now;
+      }),
+    ),
+  );
+};
+
+/** Fails with the sealing upload's failure, or refuses when it ended without its last chunk. */
+const ended = (sealing: Session["sealing"]): Effect.Effect<never, FileClientFailure> =>
+  Effect.flatMap(Fiber.await(sealing), (exit) =>
+    Exit.match(exit, {
+      onFailure: Effect.failCause,
+      onSuccess: () => Effect.fail(refused("the upload ended before its last chunk")),
+    }),
+  );
+
+interface Starting {
+  readonly chunks: Session["chunks"];
+  readonly client: FileClient;
+  readonly scope: Scope.Scope;
+}
+
+/**
+ * Forks the sealing upload and waits until it reads its first chunk, so an upload the host refuses, such as one past
+ * the actor's unattached uploads, fails the open itself. A failed or interrupted start stops the sealing upload.
+ */
+const sealingUpload = ({ chunks, client, scope }: Starting): Effect.Effect<Session["sealing"], FileClientFailure> =>
+  Effect.uninterruptibleMask((restore) =>
+    Effect.gen(function* startSealing() {
+      const reading = yield* Latch.make();
+      const source = Stream.unwrap(Effect.as(reading.open, Stream.fromQueue(chunks)));
+      const sealing = yield* Effect.forkIn(client.upload(source), scope);
+
+      yield* restore(Effect.raceFirst(reading.await, ended(sealing))).pipe(
+        Effect.onError(() => Effect.andThen(Queue.shutdown(chunks), Fiber.interrupt(sealing))),
+      );
+
+      return sealing;
+    }),
+  );
+
+const started = Effect.fnUntraced(function* started(sessions: Sessions, owner: UploadOwner, client: FileClient) {
+  const chunks = yield* Queue.bounded<Uint8Array, Cause.Done>(queuedChunks);
+  const sealing = yield* sealingUpload({ chunks, client, scope: sessions.scope });
+  const touched = yield* Clock.currentTimeMillis;
+  const lock = yield* Semaphore.make(one);
+
+  sessions.opened += one;
+
+  const upload = `upload-${String(sessions.opened)}`;
+
+  MutableHashMap.set(sessions.held, upload, { ...owner, chunks, lock, received: none, sealing, touched });
+
+  return upload;
+});
+
+/**
+ * Opens a session. Its slot is taken before the first yield, so concurrent opens can't all pass the same check, and
+ * given back if the open fails or is interrupted; a session that opens keeps it until it closes or is dropped.
+ */
+const open =
+  (sessions: Sessions): UploadSessions["open"] =>
+  (owner, client) =>
+    Effect.acquireUseRelease(
+      Effect.suspend(() => Option.match(takeSlot(sessions, owner), { onNone: () => Effect.void, onSome: Effect.fail })),
+      () => started(sessions, owner, client),
+      (_slot, exit) =>
+        Effect.sync(() => {
+          if (Exit.isFailure(exit)) {
+            giveBack(sessions, owner);
+          }
+        }),
+    );
+
+const tooLarge = (session: Session, maximumBytes: number): FileTooLargeError =>
+  FileTooLargeError.make({ actor: session.address.actor, maximumBytes });
+
+/** Refuses a chunk that would take the file past `maximumFileBytes`, and drops its session with the partial upload. */
+const withinMaximum = (
+  sessions: Sessions,
+  session: Session,
+  { bytes, upload }: Appending,
+): Effect.Effect<void, FileTooLargeError> => {
+  const { maximumFileBytes } = sessions.limits;
+
+  if (session.received + bytes.length <= maximumFileBytes) {
+    return Effect.void;
+  }
+
+  return Effect.andThen(drop(sessions, [upload, session]), Effect.fail(tooLarge(session, maximumFileBytes)));
+};
+
+const appendTo = Effect.fnUntraced(function* appendTo(sessions: Sessions, session: Session, request: Appending) {
+  const { bytes, offset } = request;
+
+  if (offset < session.received && offset + bytes.length <= session.received) {
+    return session.received;
+  }
+
+  if (offset !== session.received) {
+    return yield* refused(`the chunk starts at byte ${String(offset)}, but the upload has ${String(session.received)}`);
+  }
+
+  yield* withinMaximum(sessions, session, request);
+  yield* Effect.raceFirst(Queue.offer(session.chunks, bytes), ended(session.sealing));
+  session.received += bytes.length;
+
+  return session.received;
+});
+
+const append = (sessions: Sessions): UploadSessions["append"] =>
+  Effect.fnUntraced(function* appending(request: Appending) {
+    if (request.bytes.length > uploadChunkBytes) {
+      return yield* refused(`a chunk holds at most ${String(uploadChunkBytes)} bytes`);
+    }
+
+    const session = yield* owned(sessions, request.upload, request);
+
+    return yield* session.lock.withPermit(appendTo(sessions, session, request));
+  });
+
+const finish = (
+  sessions: Sessions,
+  session: Session,
+  { bytes, upload }: Closing,
+): Effect.Effect<string, FileClientFailure> => {
+  if (bytes !== session.received) {
+    return Effect.fail(refused(`the upload has ${String(session.received)} bytes, not ${String(bytes)}`));
+  }
+
+  return Effect.andThen(
+    Queue.end(session.chunks),
+    Effect.ensuring(
+      Fiber.join(session.sealing),
+      Effect.sync(() => {
+        forget(sessions, upload);
+      }),
+    ),
+  );
+};
+
+const close =
+  (sessions: Sessions) =>
+  (closing: Closing): Effect.Effect<string, FileClientFailure> =>
+    Effect.flatMap(owned(sessions, closing.upload, closing), (session) =>
+      session.lock.withPermit(finish(sessions, session, closing)),
+    );
+
+/**
+ * Upload sessions of one RPC server. Effect RPC has no client streams, so a network upload is `open`, ordered
+ * `append`s and `close`. Each session feeds one sealing upload through a short queue, so a fast client waits for the
+ * seal instead of filling memory. Appends are idempotent by offset, so a client may resend a chunk whose reply it
+ * lost; a gap or an oversized chunk is refused, and a chunk that would take the file past `maximumFileBytes` fails
+ * with `FileTooLargeError` and drops the session. A session is bound to the actor, key and caller that opened it, so
+ * its id needs no secrecy. The server holds at most `perServer` sessions, `perCaller` for one caller and `perActor`
+ * for one actor (`defaultUploadLimits` unless the host passes its own), and drops one idle for a minute with its
+ * partial upload, which is never attached and which the blob store collects as it does any upload no command attached.
+ */
+const uploadSessionsWith = (limits: Partial<UploadLimits> = {}): Effect.Effect<UploadSessions, never, Scope.Scope> =>
+  Effect.gen(function* makeUploadSessions() {
+    const sessions: Sessions = {
+      held: MutableHashMap.empty(),
+      limits: { ...defaultUploadLimits, ...limits },
+      opened: none,
+      scope: yield* Effect.scope,
+      slots: { byActor: MutableHashMap.empty(), byCaller: MutableHashMap.empty(), server: none },
+    };
+
+    const reaping = Effect.andThen(Effect.sleep(reapEvery), reap(sessions));
+
+    yield* Effect.forkScoped(Effect.forever(reaping));
+
+    return { append: append(sessions), close: close(sessions), open: open(sessions) };
+  });
+
+export { defaultUploadLimits, uploadSessionsWith };
+
+export type { UploadLimits, UploadOwner, UploadSessions };

package/src/serve/rpc/in-process-client.layer.ts

@@ -0,0 +1,62 @@
+import { Effect, Layer } from "effect";
+import { SecureRandom } from "effect/crypto";
+import { HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpRouter } from "effect/http";
+import { RpcClient, RpcSerialization } from "effect/rpc";
+
+import { ActorClients } from "#src/contract/client/actor-client.adapter";
+import type { ActorFileClients } from "#src/contract/file/file-client.adapter";
+import { rpcFileClients } from "#src/contract/file/rpc/rpc-file-clients.layer";
+import type { ActorHost } from "#src/serve/engine/actor-host.service";
+import type { ActorsNotHostedError } from "#src/serve/engine/actors-not-hosted.errors";
+import { rpcPath, rpcRoutes } from "./akter-server.layer.js";
+import type { ServedActor } from "./akter-server.layer.js";
+
+interface InProcessOptions<Actors extends readonly ServedActor[]> {
+  readonly actors: Actors;
+}
+
+type WebHandler = (request: globalThis.Request) => Promise<globalThis.Response>;
+
+const inProcessOrigin = "http://127.0.0.1";
+
+const sendTo = (handler: WebHandler): HttpClient.HttpClient =>
+  HttpClient.make((request, _url, signal) => {
+    const failed = (cause: unknown): HttpClientError.HttpClientError =>
+      new HttpClientError.HttpClientError({ reason: new HttpClientError.TransportError({ cause, request }) });
+
+    return HttpClientRequest.toWeb(request, { signal }).pipe(
+      Effect.mapError(failed),
+      Effect.flatMap((web) => Effect.tryPromise({ catch: failed, try: () => handler(web) })),
+      Effect.map((response) => HttpClientResponse.fromWeb(request, response)),
+    );
+  });
+
+const inProcessHttp = Effect.fnUntraced(function* inProcessHttp(actors: readonly ServedActor[]) {
+  const routes = yield* rpcRoutes(actors);
+  const context = yield* Effect.context<ActorHost>();
+  const hosted = Layer.provide(routes, Layer.succeedContext(context));
+
+  const web = yield* Effect.acquireRelease(
+    Effect.sync(() => HttpRouter.toWebHandler(hosted, { disableLogger: true })),
+    (built) => Effect.promise(() => built.dispose()),
+  );
+
+  return Layer.succeed(HttpClient.HttpClient)(sendTo(web.handler));
+});
+
+const localClient = (
+  options: InProcessOptions<readonly ServedActor[]>,
+): Layer.Layer<ActorClients | ActorFileClients | RpcClient.Protocol, ActorsNotHostedError, ActorHost> => {
+  const url = new globalThis.URL(rpcPath, inProcessOrigin).href;
+  const http = Layer.unwrap(inProcessHttp(options.actors));
+
+  const protocol = RpcClient.layerProtocolHttp({ url }).pipe(Layer.provide([http, RpcSerialization.layerNdjson]));
+
+  const clients = Layer.merge(ActorClients.layer.pipe(Layer.provide(SecureRandom.layerWebCrypto)), rpcFileClients);
+
+  return Layer.provideMerge(clients, protocol);
+};
+
+export { localClient };
+
+export type { InProcessOptions };

package/src/serve/rpc/listener-not-loopback.errors.ts

@@ -0,0 +1,9 @@
+import { Schema } from "effect";
+
+export class ListenerNotLoopbackError extends Schema.TaggedError<
+  ListenerNotLoopbackError,
+  { readonly brand: unique symbol }
+>()("ListenerNotLoopbackError", {
+  address: Schema.String,
+  message: Schema.String,
+}) {}

package/src/serve/rpc/ndjson-only.pure.ts

@@ -0,0 +1,33 @@
+import { Array as Arr, Effect, Option, String as Str } from "effect";
+import { Headers, HttpServerRequest, HttpServerResponse } from "effect/http";
+
+type Response = HttpServerResponse.HttpServerResponse;
+
+const unsupportedMediaType = 415;
+
+const ndjsonTypes: readonly string[] = ["application/ndjson", "application/x-ndjson"];
+
+const refusal =
+  "a POST here must be application/ndjson; a browser sends any other body from another site without asking first, so it is refused";
+
+const parameters = /;.*$/su;
+
+const mediaType = (contentType: string): string => Str.toLowerCase(Str.trim(Str.replace(parameters, "")(contentType)));
+
+const isNdjson = (request: HttpServerRequest.HttpServerRequest): boolean =>
+  Option.exists(Headers.get(request.headers, "content-type"), (contentType) =>
+    Arr.contains(ndjsonTypes, mediaType(contentType)),
+  );
+
+const ndjsonOnly = <Failure, Services>(
+  app: Effect.Effect<Response, Failure, Services>,
+): Effect.Effect<Response, Failure, Services | HttpServerRequest.HttpServerRequest> =>
+  HttpServerRequest.HttpServerRequest.use((request) => {
+    if (request.method !== "POST" || isNdjson(request)) {
+      return app;
+    }
+
+    return Effect.succeed(HttpServerResponse.text(refusal, { status: unsupportedMediaType }));
+  });
+
+export { ndjsonOnly };