@loopbacktools/server 0.0.0-stage → 0.4.0

package/dist/src/space/rpc.js

@@ -0,0 +1,96 @@
+import { Data, Effect, Schedule, Schema } from "effect";
+import { AskClosed, AskNotFound, ContentInvalid, NotYourTurn, ReplyInvalid, TicketInvalid, UploadExpired, UploadNotFound, UploadRejected, } from "../domain/errors.js";
+import { operations } from "./operations.js";
+/** A deployment's build, from its version metadata binding, if it has one. */
+export const buildOf = (env) => {
+    const metadata = env
+        .CF_VERSION_METADATA;
+    return typeof metadata?.timestamp === "string" ? metadata.timestamp : undefined;
+};
+/** Whether a build is from a later deploy than another; unknown when either is. */
+export const isLater = (build, than) => build !== undefined && than !== undefined && Date.parse(build) > Date.parse(than);
+/**
+ * A space's refusal of a call from newer code than its own: it ran nothing, and restarts onto the new
+ * code a moment later. The client tries the call again, whatever it is, and never hands this on.
+ */
+export class Outdated extends Schema.TaggedError()("Outdated", {}) {
+}
+/** Every error a space operation fails with. */
+export const SpaceFailure = Schema.Union([
+    AskNotFound,
+    AskClosed,
+    NotYourTurn,
+    ReplyInvalid,
+    ContentInvalid,
+    TicketInvalid,
+    UploadNotFound,
+    UploadExpired,
+    UploadRejected,
+]);
+/** What a call can fail with across the boundary: an operation's errors, or the space's refusal. */
+const CallFailure = Schema.Union([...SpaceFailure.members, Outdated]);
+// A defect keeps its stack across the hop, so it is logged where it happened: this codec only ever
+// runs between the Worker and its own Durable Object, never towards a client.
+let codec;
+const exitCodec = () => (codec ??= Schema.toCodecJson(Schema.Exit(Schema.Json, CallFailure, Schema.Defect({ includeStack: true }))));
+export const encodeExit = (exit) => Schema.encodeSync(exitCodec())(exit);
+const decodeExit = (json) => Schema.decodeUnknownSync(exitCodec())(json);
+/**
+ * Operations that are safe to run twice: reads, and writes that leave the space as the first run
+ * did. Only these are retried. A reply, an upload ticket, or an upload claim is not: a second run
+ * is refused, or issues another.
+ */
+const idempotent = new Set([
+    "open",
+    "answerFollowUp",
+    "answerBriefing",
+    "awaitReply",
+    "markDelivered",
+    "followTask",
+    "cancelTask",
+    "get",
+    "snapshot",
+    "history",
+    "findUpload",
+]);
+/** A call the object never answered: it was reset (by a deploy, say), or the transport failed. */
+class Refused extends Data.TaggedError("Refused") {
+    /** Whether Cloudflare marks it safe to try again: retryable, and not because the object is overloaded. */
+    get retryable() {
+        const flags = this.cause;
+        return flags?.retryable === true && flags.overloaded !== true;
+    }
+}
+/** A deploy resets every space; its new instance is up within moments. */
+const RETRY = {
+    schedule: Schedule.exponential("100 millis").pipe(Schedule.jittered),
+    times: 5,
+    while: (refused) => refused.retryable,
+};
+/**
+ * A space restarting onto new code takes a moment, and refuses as `Outdated` until it has; the
+ * retries outlast that.
+ */
+const OUTDATED_RETRY = {
+    schedule: Schedule.exponential("50 millis").pipe(Schedule.jittered),
+    times: 6,
+    while: (failure) => failure instanceof Outdated,
+};
+/**
+ * The typed client for one space, for code of the version `caller` names. Each call is decoded back
+ * into the operation's own success value or tagged error. A call the object refused is tried again on
+ * a fresh stub when it is safe to, as Cloudflare advises; otherwise it is a defect. A call a space
+ * refused as `Outdated` ran nothing, so it is tried again whatever it is, until the space is on the
+ * new code.
+ */
+export const spaceClient = (stub, caller) => Object.fromEntries(Object.keys(operations).map((method) => {
+    const once = (args) => Effect.tryPromise({
+        try: () => stub().call(method, args, caller),
+        catch: (cause) => new Refused({ cause }),
+    });
+    const attempt = (args) => (idempotent.has(method) ? Effect.retry(once(args), RETRY) : once(args)).pipe(Effect.catchTag("Refused", (refused) => Effect.die(refused.cause)), Effect.flatMap((json) => decodeExit(json)));
+    return [
+        method,
+        (...args) => attempt(args).pipe(Effect.retry(OUTDATED_RETRY), Effect.catchIf((failure) => failure instanceof Outdated, () => Effect.die(new Error("The space did not move onto this code in time.")))),
+    ];
+}));

package/dist/src/space/services.d.ts

@@ -0,0 +1,41 @@
+import type { ServerEvent } from "@loopbacktools/protocol";
+import { Context, Effect, Layer, PubSub } from "effect";
+/** The longest a single wait for a reply may be held inside the object. */
+export declare const MAX_WAIT_MS = 30000;
+/** How long an ask still shows an agent following it after its last lap or poll. */
+export declare const PRESENCE_GRACE_MS = 10000;
+declare const Replies_base: Context.ServiceClass<Replies, "loopback/Replies", PubSub.PubSub<void>>;
+/**
+ * A signal for every reply the space records. A caller waiting on the space subscribes before it
+ * first looks, so a reply landing between its looking and its waiting still wakes it.
+ */
+export declare class Replies extends Replies_base {
+    static readonly layer: Layer.Layer<Replies, never, never>;
+}
+declare const Presence_base: Context.ServiceClass<Presence, "loopback/Presence", {
+    readonly isWaiting: (askId: string) => boolean;
+    /** A lap or poll begins. True when that starts the ask being followed. */
+    readonly begin: (askId: string) => Effect.Effect<boolean>;
+    /** A lap or poll ends; `whenGone` runs if no other begins within the grace. */
+    readonly end: <R>(askId: string, whenGone: Effect.Effect<void, never, R>) => Effect.Effect<void, never, R>;
+    /** The agent has said it stopped following: no grace. True when that ends the following. */
+    readonly drop: (askId: string) => Effect.Effect<boolean>;
+}>;
+/**
+ * Which asks an agent is following right now: blocked on in laps, or polling as a background task.
+ * An ask stays followed for `PRESENCE_GRACE_MS` after the last lap or poll ends; if none comes by
+ * then, the agent has gone. That grace is a fiber per ask, so a lap that begins in time cancels it.
+ */
+export declare class Presence extends Presence_base {
+    static readonly layer: Layer.Layer<Presence, never, never>;
+}
+declare const Host_base: Context.ServiceClass<Host, "loopback/Host", {
+    /** Sends an event to every connected inbox. */
+    readonly broadcast: (event: ServerEvent) => Effect.Effect<void>;
+    /** The DO id, which upload URLs name the space by. */
+    readonly spaceId: string;
+}>;
+/** What the space's operations need from the object that hosts them. */
+export declare class Host extends Host_base {
+}
+export {};

package/dist/src/space/services.js

@@ -0,0 +1,58 @@
+import { Context, Effect, FiberMap, Layer, PubSub } from "effect";
+/** The longest a single wait for a reply may be held inside the object. */
+export const MAX_WAIT_MS = 30_000;
+/** How long an ask still shows an agent following it after its last lap or poll. */
+export const PRESENCE_GRACE_MS = 10_000;
+/**
+ * A signal for every reply the space records. A caller waiting on the space subscribes before it
+ * first looks, so a reply landing between its looking and its waiting still wakes it.
+ */
+export class Replies extends Context.Service()("loopback/Replies") {
+    static layer = Layer.effect(Replies, PubSub.unbounded());
+}
+/**
+ * Which asks an agent is following right now: blocked on in laps, or polling as a background task.
+ * An ask stays followed for `PRESENCE_GRACE_MS` after the last lap or poll ends; if none comes by
+ * then, the agent has gone. That grace is a fiber per ask, so a lap that begins in time cancels it.
+ */
+export class Presence extends Context.Service()("loopback/Presence") {
+    static layer = Layer.effect(Presence, Effect.gen(function* () {
+        const laps = new Map();
+        // Asks in their grace: still shown as followed until their timer fires or a lap begins.
+        const leaving = new Set();
+        const timers = yield* FiberMap.make();
+        const isWaiting = (askId) => laps.has(askId) || leaving.has(askId);
+        return Presence.of({
+            isWaiting,
+            begin: (askId) => Effect.gen(function* () {
+                const was = isWaiting(askId);
+                leaving.delete(askId);
+                yield* FiberMap.remove(timers, askId);
+                laps.set(askId, (laps.get(askId) ?? 0) + 1);
+                return !was;
+            }),
+            end: (askId, whenGone) => Effect.gen(function* () {
+                const left = (laps.get(askId) ?? 1) - 1;
+                if (left > 0) {
+                    laps.set(askId, left);
+                    return;
+                }
+                laps.delete(askId);
+                leaving.add(askId);
+                yield* FiberMap.run(timers, askId, Effect.sleep(PRESENCE_GRACE_MS).pipe(Effect.andThen(Effect.suspend(() => {
+                    leaving.delete(askId);
+                    return whenGone;
+                }))));
+            }),
+            drop: (askId) => Effect.gen(function* () {
+                if (laps.has(askId) || !leaving.delete(askId))
+                    return false;
+                yield* FiberMap.remove(timers, askId);
+                return true;
+            }),
+        });
+    }));
+}
+/** What the space's operations need from the object that hosts them. */
+export class Host extends Context.Service()("loopback/Host") {
+}

package/dist/src/space/store.d.ts

@@ -0,0 +1,87 @@
+import type { AskStatus, Entry, ImageType } from "@loopbacktools/protocol";
+import { Context, Effect, Layer, Option } from "effect";
+import { SqlClient } from "effect/sql";
+import type { AskRecord, EntryRecord } from "../domain/ask.ts";
+/** A page of closed asks, and where the next one starts. */
+export interface ClosedPage {
+    readonly records: AskRecord[];
+    readonly nextBefore: string | null;
+}
+declare const AskStore_base: Context.ServiceClass<AskStore, "loopback/AskStore", {
+    readonly find: (id: string) => Effect.Effect<Option.Option<AskRecord>>;
+    /** The newest ask with this key, still open or holding an undelivered reply, waited on since `since`. */
+    readonly findRetry: (key: string, since: string) => Effect.Effect<Option.Option<AskRecord>>;
+    readonly insert: (record: AskRecord) => Effect.Effect<void>;
+    readonly setStatus: (id: string, status: AskStatus, at: string) => Effect.Effect<void>;
+    readonly touchWaited: (id: string, at: string) => Effect.Effect<void>;
+    /** An ask's thread. One holding an entry this code can't read is a defect. */
+    readonly thread: (id: string) => Effect.Effect<EntryRecord[]>;
+    /** The threads of several asks, leaving out each ask whose thread this code can't read. */
+    readonly threads: (ids: readonly string[]) => Effect.Effect<Map<string, EntryRecord[]>>;
+    readonly append: (askId: string, entry: Entry) => Effect.Effect<EntryRecord>;
+    /**
+     * The oldest human entry not yet handed to an agent: replies reach it in the order they were
+     * given, so replies on a briefing are not passed over for a dismissal that followed them.
+     */
+    readonly undelivered: (askId: string) => Effect.Effect<Option.Option<EntryRecord>>;
+    readonly markDelivered: (askId: string, seq: number, at: string) => Effect.Effect<void>;
+    /** Marks every human entry on the ask as handed to the agent. */
+    readonly markAllDelivered: (askId: string, at: string) => Effect.Effect<void>;
+    /** Every open ask, newest first. */
+    readonly open: Effect.Effect<AskRecord[]>;
+    /** Up to `limit` closed asks, newest first, closed before `before` when given. */
+    readonly closed: (before: string | undefined, limit: number) => Effect.Effect<ClosedPage>;
+    /** Records that an agent stopped following the reply to its turn `afterSeq`. */
+    readonly cancelTask: (askId: string, afterSeq: number, at: string) => Effect.Effect<void>;
+    readonly taskCancelledAt: (askId: string, afterSeq: number) => Effect.Effect<Option.Option<string>>;
+    /** Runs `effect` as one storage transaction. */
+    readonly transaction: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+}>;
+/**
+ * Persistence for asks and their threads. Storage failing is a defect, not an error to handle.
+ *
+ * Every ask and entry is stamped with the revision of the contract it was written at. An ask's is the
+ * newest any of it was written at, its thread included, so code reading it knows from that alone
+ * whether it can. One from a later revision than this code's, as after a rollback, is never read:
+ * left out of every list and found by no lookup, so nothing here rewrites it. Everything read is
+ * decoded, and a row that doesn't decode is passed over the same way, and logged, rather than
+ * handed on. See docs/design/versioned-messages.md.
+ */
+export declare class AskStore extends AskStore_base {
+    static readonly layer: Layer.Layer<AskStore, never, SqlClient.SqlClient>;
+}
+declare const TicketStore_base: Context.ServiceClass<TicketStore, "loopback/TicketStore", {
+    readonly insert: (tokenHash: string, actorId: string, expiresAt: string) => Effect.Effect<void>;
+    /** Removes the ticket and gives back who it was for and until when; none if it is unknown. */
+    readonly take: (tokenHash: string) => Effect.Effect<Option.Option<{
+        readonly actorId: string;
+        readonly expiresAt: string;
+    }>>;
+    /** Forgets tickets that expired before `at`. */
+    readonly purge: (at: string) => Effect.Effect<void>;
+}>;
+/** Persistence for event tickets, kept only by their hash. */
+export declare class TicketStore extends TicketStore_base {
+    static readonly layer: Layer.Layer<TicketStore, never, SqlClient.SqlClient>;
+}
+export interface UploadRecord {
+    readonly id: string;
+    readonly tokenHash: string;
+    readonly contentType: ImageType;
+    readonly maxBytes: number;
+    readonly status: "pending" | "claimed" | "stored";
+    readonly size: number | null;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+}
+declare const UploadStore_base: Context.ServiceClass<UploadStore, "loopback/UploadStore", {
+    readonly insert: (record: UploadRecord) => Effect.Effect<void>;
+    readonly find: (id: string) => Effect.Effect<Option.Option<UploadRecord>>;
+    readonly findByToken: (tokenHash: string) => Effect.Effect<Option.Option<UploadRecord>>;
+    readonly setStatus: (id: string, status: UploadRecord["status"], size: number | null) => Effect.Effect<void>;
+}>;
+/** Persistence for upload tickets and the uploads they produce. */
+export declare class UploadStore extends UploadStore_base {
+    static readonly layer: Layer.Layer<UploadStore, never, SqlClient.SqlClient>;
+}
+export {};

package/dist/src/space/store.js

@@ -0,0 +1,276 @@
+import * as Contract from "@loopbacktools/protocol/schema";
+import { Context, Effect, Layer, Option, Result } from "effect";
+import { SqlClient } from "effect/sql";
+import { read } from "./read.js";
+const { REVISION } = Contract;
+/** A column holding a message as JSON, decoded. */
+const parsed = (schema, json) => {
+    try {
+        return read(schema, JSON.parse(json));
+    }
+    catch {
+        return Result.fail("it is not JSON");
+    }
+};
+/**
+ * A stored ask as this code reads it, or why it can't: what a deploy once left half-written, say.
+ * What `read` hands back holds nothing from a newer revision, so it is what this code writes.
+ */
+const askOf = (row) => Result.gen(function* () {
+    const head = {
+        id: row.id,
+        key: row.key,
+        status: (yield* read(Contract.AskStatus, row.status)),
+        project: row.project,
+        client: row.client,
+        raisedBy: row.raisedBy === null ? null : (yield* parsed(Contract.Actor, row.raisedBy)),
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+        closedAt: row.closedAt,
+        lastWaitedAt: row.lastWaitedAt,
+    };
+    switch (row.kind) {
+        case "question": {
+            const prompt = yield* parsed(Contract.QuestionPrompt, row.prompt);
+            return { ...head, kind: "question", prompt: prompt };
+        }
+        case "review": {
+            const prompt = yield* parsed(Contract.ReviewPrompt, row.prompt);
+            return {
+                ...head,
+                kind: "review",
+                prompt: prompt,
+                revises: row.revises,
+            };
+        }
+        case "briefing": {
+            const prompt = yield* parsed(Contract.BriefingPrompt, row.prompt);
+            return { ...head, kind: "briefing", prompt: prompt };
+        }
+        default:
+            return yield* Result.fail(`it is of the kind "${row.kind}"`);
+    }
+});
+/** A stored thread entry as this code reads it, or why it can't. */
+const entryOf = (row) => row.revision > REVISION
+    ? Result.fail(`it was written at revision ${row.revision}, after this code's`)
+    : Result.map(parsed(Contract.Entry, row.body), (entry) => ({
+        askId: row.askId,
+        seq: row.seq,
+        entry: entry,
+        deliveredAt: row.deliveredAt,
+    }));
+/**
+ * Persistence for asks and their threads. Storage failing is a defect, not an error to handle.
+ *
+ * Every ask and entry is stamped with the revision of the contract it was written at. An ask's is the
+ * newest any of it was written at, its thread included, so code reading it knows from that alone
+ * whether it can. One from a later revision than this code's, as after a rollback, is never read:
+ * left out of every list and found by no lookup, so nothing here rewrites it. Everything read is
+ * decoded, and a row that doesn't decode is passed over the same way, and logged, rather than
+ * handed on. See docs/design/versioned-messages.md.
+ */
+export class AskStore extends Context.Service()("loopback/AskStore") {
+    static layer = Layer.effect(AskStore, Effect.gen(function* () {
+        const sql = yield* SqlClient.SqlClient;
+        /** The asks among `rows` this code can read. */
+        const readable = Effect.fnUntraced(function* (rows) {
+            const records = [];
+            for (const row of rows) {
+                const record = askOf(row);
+                if (Result.isSuccess(record))
+                    records.push(record.success);
+                else
+                    yield* Effect.logError(`Ask ${row.id} can't be read, so it is left out: ${record.failure}.`);
+            }
+            return records;
+        });
+        const asks = (statement) => statement.pipe(Effect.orDie, Effect.flatMap(readable));
+        // Rows from a later revision are left out by every query, never read.
+        const columns = sql.literal(`
+				id, kind, key, status, prompt, project, client, raised_by AS raisedBy, revises,
+				created_at AS createdAt, updated_at AS updatedAt, closed_at AS closedAt,
+				last_waited_at AS lastWaitedAt
+			`);
+        const entryColumns = sql.literal("ask_id AS askId, seq, body, delivered_at AS deliveredAt, revision");
+        /** An ask's entries, or a defect when one can't be read: an operation must see its whole thread. */
+        const entries = (askId, rows) => Effect.forEach(rows, (row) => Result.match(entryOf(row), {
+            onSuccess: Effect.succeed,
+            onFailure: (why) => Effect.die(new Error(`Entry ${row.seq} of ask ${askId} can't be read: ${why}.`)),
+        }));
+        const first = (effect) => Effect.map(effect, (rows) => Option.fromNullishOr(rows[0]));
+        return AskStore.of({
+            find: (id) => first(asks(sql `SELECT ${columns} FROM asks WHERE id = ${id} AND revision <= ${REVISION}`)),
+            findRetry: (key, since) => first(asks(sql `
+							SELECT ${columns} FROM asks
+							WHERE key = ${key}
+								AND revision <= ${REVISION}
+								AND last_waited_at >= ${since}
+								AND (
+									status != 'closed'
+									OR EXISTS (
+										SELECT 1 FROM entries
+										WHERE entries.ask_id = asks.id
+											AND entries.author = 'human'
+											AND entries.delivered_at IS NULL
+									)
+								)
+							ORDER BY created_at DESC
+							LIMIT 1
+						`)),
+            insert: (record) => sql `INSERT INTO asks ${sql.insert({
+                id: record.id,
+                kind: record.kind,
+                key: record.key,
+                status: record.status,
+                prompt: JSON.stringify(record.prompt),
+                project: record.project,
+                client: record.client,
+                raised_by: record.raisedBy === null ? null : JSON.stringify(record.raisedBy),
+                revises: record.kind === "review" ? record.revises : null,
+                created_at: record.createdAt,
+                updated_at: record.updatedAt,
+                closed_at: record.closedAt,
+                last_waited_at: record.lastWaitedAt,
+                revision: REVISION,
+            })}`.pipe(Effect.asVoid, Effect.orDie),
+            setStatus: (id, status, at) => sql `
+						UPDATE asks
+						SET status = ${status},
+							updated_at = ${at},
+							closed_at = ${status === "closed" ? at : null},
+							revision = MAX(revision, ${REVISION})
+						WHERE id = ${id}
+					`.pipe(Effect.asVoid, Effect.orDie),
+            touchWaited: (id, at) => sql `UPDATE asks SET last_waited_at = ${at} WHERE id = ${id}`.pipe(Effect.asVoid, Effect.orDie),
+            thread: (id) => sql `SELECT ${entryColumns} FROM entries WHERE ask_id = ${id} ORDER BY seq`.pipe(Effect.orDie, Effect.flatMap((rows) => entries(id, rows))),
+            // The ids travel as one JSON parameter: SQLite in a Durable Object binds at most 100.
+            threads: (ids) => ids.length === 0
+                ? Effect.succeed(new Map())
+                : sql `
+								SELECT ${entryColumns} FROM entries
+								WHERE ask_id IN (SELECT value FROM json_each(${JSON.stringify(ids)}))
+								ORDER BY ask_id, seq
+							`.pipe(Effect.orDie, Effect.flatMap(Effect.fnUntraced(function* (rows) {
+                    const byAsk = new Map(ids.map((id) => [id, []]));
+                    for (const row of rows) {
+                        const thread = byAsk.get(row.askId);
+                        if (thread === undefined)
+                            continue;
+                        const entry = entryOf(row);
+                        if (Result.isSuccess(entry)) {
+                            thread.push(entry.success);
+                        }
+                        else {
+                            byAsk.delete(row.askId);
+                            yield* Effect.logError(`Ask ${row.askId} can't be read, so it is left out: entry ${row.seq} can't, as ${entry.failure}.`);
+                        }
+                    }
+                    return byAsk;
+                }))),
+            append: (askId, entry) => Effect.gen(function* () {
+                const [row] = yield* sql `
+							SELECT COALESCE(MAX(seq), 0) + 1 AS next FROM entries WHERE ask_id = ${askId}
+						`;
+                const seq = row?.next ?? 1;
+                yield* sql `INSERT INTO entries ${sql.insert({
+                    ask_id: askId,
+                    seq,
+                    author: entry.author,
+                    body: JSON.stringify(entry),
+                    delivered_at: null,
+                    revision: REVISION,
+                })}`;
+                yield* sql `UPDATE asks SET revision = MAX(revision, ${REVISION}) WHERE id = ${askId}`;
+                return { askId, seq, entry, deliveredAt: null };
+            }).pipe(Effect.orDie),
+            undelivered: (askId) => sql `
+						SELECT ${entryColumns} FROM entries
+						WHERE ask_id = ${askId} AND author = 'human' AND delivered_at IS NULL
+						ORDER BY seq
+						LIMIT 1
+					`.pipe(Effect.orDie, Effect.flatMap((rows) => entries(askId, rows)), Effect.map((found) => Option.fromNullishOr(found[0]))),
+            markDelivered: (askId, seq, at) => sql `
+						UPDATE entries SET delivered_at = ${at}
+						WHERE ask_id = ${askId} AND seq = ${seq} AND delivered_at IS NULL
+					`.pipe(Effect.asVoid, Effect.orDie),
+            markAllDelivered: (askId, at) => sql `
+						UPDATE entries SET delivered_at = ${at}
+						WHERE ask_id = ${askId} AND author = 'human' AND delivered_at IS NULL
+					`.pipe(Effect.asVoid, Effect.orDie),
+            open: asks(sql `
+					SELECT ${columns} FROM asks
+					WHERE status != 'closed' AND revision <= ${REVISION}
+					ORDER BY created_at DESC
+				`),
+            // One row past the page says whether there is another, counted before any is left out.
+            closed: (before, limit) => (before === undefined
+                ? sql `
+								SELECT ${columns} FROM asks
+								WHERE status = 'closed' AND revision <= ${REVISION}
+								ORDER BY closed_at DESC LIMIT ${limit + 1}
+							`
+                : sql `
+								SELECT ${columns} FROM asks
+								WHERE status = 'closed' AND revision <= ${REVISION} AND closed_at < ${before}
+								ORDER BY closed_at DESC LIMIT ${limit + 1}
+							`).pipe(Effect.orDie, Effect.flatMap((rows) => Effect.map(readable(rows.slice(0, limit)), (records) => ({
+                records,
+                nextBefore: rows.length > limit ? (rows[limit - 1]?.closedAt ?? null) : null,
+            })))),
+            cancelTask: (askId, afterSeq, at) => sql `
+						INSERT OR IGNORE INTO task_cancellations (ask_id, after_seq, cancelled_at)
+						VALUES (${askId}, ${afterSeq}, ${at})
+					`.pipe(Effect.asVoid, Effect.orDie),
+            taskCancelledAt: (askId, afterSeq) => sql `
+						SELECT cancelled_at AS cancelledAt FROM task_cancellations
+						WHERE ask_id = ${askId} AND after_seq = ${afterSeq}
+					`.pipe(Effect.map((rows) => Option.map(Option.fromNullishOr(rows[0]), (row) => row.cancelledAt)), Effect.orDie),
+            transaction: (effect) => sql.withTransaction(effect).pipe(Effect.catchTag("SqlError", Effect.die)),
+        });
+    }));
+}
+/** Persistence for event tickets, kept only by their hash. */
+export class TicketStore extends Context.Service()("loopback/TicketStore") {
+    static layer = Layer.effect(TicketStore, Effect.gen(function* () {
+        const sql = yield* SqlClient.SqlClient;
+        return TicketStore.of({
+            insert: (tokenHash, actorId, expiresAt) => sql `INSERT INTO event_tickets ${sql.insert({
+                token_hash: tokenHash,
+                actor_id: actorId,
+                expires_at: expiresAt,
+            })}`.pipe(Effect.asVoid, Effect.orDie),
+            take: (tokenHash) => sql `
+						DELETE FROM event_tickets WHERE token_hash = ${tokenHash}
+						RETURNING actor_id AS actorId, expires_at AS expiresAt
+					`.pipe(Effect.map((rows) => Option.fromNullishOr(rows[0])), Effect.orDie),
+            purge: (at) => sql `DELETE FROM event_tickets WHERE expires_at < ${at}`.pipe(Effect.asVoid, Effect.orDie),
+        });
+    }));
+}
+/** Persistence for upload tickets and the uploads they produce. */
+export class UploadStore extends Context.Service()("loopback/UploadStore") {
+    static layer = Layer.effect(UploadStore, Effect.gen(function* () {
+        const sql = yield* SqlClient.SqlClient;
+        const columns = sql.literal(`
+				id, token_hash AS tokenHash, content_type AS contentType, max_bytes AS maxBytes,
+				status, size, created_at AS createdAt, expires_at AS expiresAt
+			`);
+        const one = (statement) => statement.pipe(Effect.map((rows) => Option.fromNullishOr(rows[0])), Effect.orDie);
+        return UploadStore.of({
+            insert: (record) => sql `INSERT INTO uploads ${sql.insert({
+                id: record.id,
+                token_hash: record.tokenHash,
+                content_type: record.contentType,
+                max_bytes: record.maxBytes,
+                status: record.status,
+                size: record.size,
+                created_at: record.createdAt,
+                expires_at: record.expiresAt,
+            })}`.pipe(Effect.asVoid, Effect.orDie),
+            find: (id) => one(sql `SELECT ${columns} FROM uploads WHERE id = ${id}`),
+            findByToken: (tokenHash) => one(sql `SELECT ${columns} FROM uploads WHERE token_hash = ${tokenHash}`),
+            setStatus: (id, status, size) => sql `UPDATE uploads SET status = ${status}, size = ${size} WHERE id = ${id}`.pipe(Effect.asVoid, Effect.orDie),
+        });
+    }));
+}

package/dist/src/version.d.ts

@@ -0,0 +1,2 @@
+/** This release of Loopback: what the MCP server and the OpenAPI document report. */
+export declare const VERSION: string;

package/dist/src/version.js

@@ -0,0 +1,3 @@
+import packageJson from "../package.json" with { type: "json" };
+/** This release of Loopback: what the MCP server and the OpenAPI document report. */
+export const VERSION = packageJson.version;

package/dist/src/worker/env.d.ts

@@ -0,0 +1,19 @@
+import { Context } from "effect";
+/** The bindings a Loopback Worker must declare, under these names. */
+export interface LoopbackBindings {
+    readonly FILES: R2Bucket;
+    /**
+     * Which deploy the code is from. A space still running older code than the Worker calling it
+     * restarts onto the newer; without it, nothing is compared. Declare it in every deployment.
+     */
+    readonly CF_VERSION_METADATA?: WorkerVersionMetadata;
+}
+/**
+ * The Worker's environment as the runtime hands it over: Loopback's bindings, and whatever else the
+ * deployment declares, which a gate may read (the token gate reads `LOOPBACK_TOKEN`).
+ */
+export type WorkerBindings = LoopbackBindings & Readonly<Record<string, unknown>>;
+declare const WorkerEnv_base: Context.ServiceClass<WorkerEnv, "loopback/WorkerEnv", WorkerBindings>;
+export declare class WorkerEnv extends WorkerEnv_base {
+}
+export {};

package/dist/src/worker/env.js

@@ -0,0 +1,3 @@
+import { Context } from "effect";
+export class WorkerEnv extends Context.Service()("loopback/WorkerEnv") {
+}

package/dist/src/worker/files.d.ts

@@ -0,0 +1,21 @@
+import { Context, Effect, Layer, Option } from "effect";
+import { UploadIncomplete } from "../domain/errors.ts";
+import { WorkerEnv } from "./env.ts";
+declare const Files_base: Context.ServiceClass<Files, "loopback/Files", {
+    /**
+     * Stores exactly `length` bytes from `body`. A body that turns out longer or shorter than it
+     * declared is refused by the stream itself, so the size limit holds whatever the client claims.
+     * R2 failing is a defect: nothing the client sent caused it.
+     */
+    readonly put: (key: string, body: ReadableStream<Uint8Array>, length: number, contentType: string) => Effect.Effect<void, UploadIncomplete>;
+    readonly get: (key: string) => Effect.Effect<Option.Option<ReadableStream<Uint8Array>>>;
+}>;
+/** Uploaded images, kept in R2 under the space that holds them. */
+export declare class Files extends Files_base {
+    static readonly layer: Layer.Layer<Files, never, WorkerEnv>;
+}
+/** Where every file a space holds lives, under one prefix. */
+export declare const filesOf: (spaceId: string) => string;
+/** Where an upload's bytes live. */
+export declare const fileKey: (spaceId: string, uploadId: string) => string;
+export {};

package/dist/src/worker/files.js

@@ -0,0 +1,42 @@
+import { Context, Effect, Layer, Option } from "effect";
+import { UploadIncomplete } from "../domain/errors.js";
+import { WorkerEnv } from "./env.js";
+/** Uploaded images, kept in R2 under the space that holds them. */
+export class Files extends Context.Service()("loopback/Files") {
+    static layer = Layer.effect(Files, Effect.gen(function* () {
+        const env = yield* WorkerEnv;
+        return Files.of({
+            put: (key, body, length, contentType) => Effect.gen(function* () {
+                const sized = new FixedLengthStream(length);
+                // A wrong length fails both the pipe and R2's put, as R2 failing does, so what the
+                // body itself did decides whose fault it was.
+                let seen = 0;
+                let ended = false;
+                const counted = body.pipeThrough(new TransformStream({
+                    transform: (chunk, controller) => {
+                        seen += chunk.byteLength;
+                        controller.enqueue(chunk);
+                    },
+                    flush: () => {
+                        ended = true;
+                    },
+                }));
+                const [stored, piped] = yield* Effect.promise(() => Promise.allSettled([
+                    env.FILES.put(key, sized.readable, { httpMetadata: { contentType } }),
+                    counted.pipeTo(sized.writable),
+                ]));
+                if (seen > length || (ended && seen !== length))
+                    return yield* new UploadIncomplete();
+                if (stored.status === "rejected")
+                    return yield* Effect.die(stored.reason);
+                if (piped.status === "rejected")
+                    return yield* Effect.die(piped.reason);
+            }),
+            get: (key) => Effect.promise(() => env.FILES.get(key)).pipe(Effect.map((object) => Option.map(Option.fromNullishOr(object), (found) => found.body))),
+        });
+    }));
+}
+/** Where every file a space holds lives, under one prefix. */
+export const filesOf = (spaceId) => `spaces/${spaceId}/`;
+/** Where an upload's bytes live. */
+export const fileKey = (spaceId, uploadId) => `${filesOf(spaceId)}uploads/${uploadId}`;