Limits, placement and recovery

The envelope is what managed infrastructure gives every product: what code may be written in, its limits, where each part runs, and how it recovers.

One call, placed and kept

Records, runs and their logs stay in the Namespace's region. Filled: what a caller sees.

What runs, and inside which limits

The limits below hold for every product; the plan meters on the price list cap concurrency, request rates and schedules on top of them.

Family	What it gives every product
Languages for code	A `code` Function is TypeScript in the file or in a module beside it, or a Python or WebAssembly module by path, shipped with the Version and pinned by its Digest
What code may touch	Its input, its Thing, the secrets it names and the tools it is given; anything outside goes through a Source or an effect, never a raw network call
Compute classes	`standard` for most work, and `large` for heavy model and agent work, with more memory and time, metered on its own allowance
Long work	A run that waits does not count against its time: an agentic run or a Workflow waits for weeks, and only its working time is limited
Placement	Edge for cached reads, the site, the docs and the offer card; the Namespace's region for records, runs, effects, model calls and logs
Caching	Public reads cached at the edge, keyed reads per Customer, each read cleared by the next deploy and by every write to a record it read
The record store	One transaction per write inside one Namespace: the fact, its Event, its meter line and its audit entry together; reads after a write see it
Scale	Records, files and Events grow with each Namespace; a Customer that outgrows shared infrastructure moves to its own with no change to any Interface
Recovery	Continuous backups per Namespace, restore to any point in the last 35 days, a single record restored to any version, and region failover inside the residency

Bound	`standard`	`large`
One run's working time	30 seconds by default, `timeout` up to 15 minutes	Up to 60 minutes
Memory	256 MB	4 GB
A request or reply body	10 MB	10 MB
A file upload	5 GB, resumable	5 GB, resumable
A record	1 MB, files apart	1 MB, files apart
A Batch	100 calls	100 calls
A bulk job	10 million inputs	10 million inputs

Example

A score in code, a long research run on the large class, reads cached for an hour, and a recovery promise the offer card prints.

definition.ts

18 lines

import { define, code, agentic } from 'apis.dev'

/** Answers about any company by its domain, from a score in milliseconds to a person's check in hours. */
export default define({
  name: 'summaries', domain: 'summaries.apis.dev',
  Company: {
    domain:   'url!#',
    score:    code('./score.py', { timeout: '10s' }),              // a Python module
    research: agentic('Find the head of sales at {domain}',
      { returns: { headOfSales: 'string' }, compute: 'large', timeout: '30m' }),
  },
  offer: { 'Company.score': 0.001, 'Company.research': 0.5 },
  operate: {
    cache:    { 'Company.score': '1h' },          // cleared by each deploy
    recovery: { rpo: '5m', rto: '1h' },           // printed on the offer card
    regions:  ['us', 'eu'],
  },
})

Where each part runs

Each Namespace has one region, and every part that touches its records runs there.

Part	Where it runs for an `eu` Namespace
Records, files, Events and backups	In the EU, in two places at least
Calls, runs and Workflow steps	In the EU, after the edge passes them on
The model router	Only providers that process in the EU and keep nothing; a call no such provider serves is refused, never routed out
Effects and Sources	Sent from the EU; a Source outside it is named on the security page with what crosses
Logs, traces and the Call record	Kept in the EU; a sink sends them only where the Customer's admin points it
Cached reads	At the edge, only for reads with no personal or sensitive field

Backups, restores and failover, state by state

The recovery promise per isolation tier is data on the offer card, measured by drills and kept in the proof record.

Isolation	Most data a failure loses	Service back within
Shared	5 minutes	1 hour
Its own	1 minute	15 minutes

Thing	States	What moves it
A run at its limit	`Running`, then `failed` with a Problem at its `timeout`, at no charge	Its working time; a wait does not count
A cached read	`fresh`, `stale`, `cleared`	Its time in `operate.cache`, a deploy, a write to a record it read
A restore	`requested`, `restoring`, then `done` or `halted`	`Restore.create` by the Customer's admin or your operator; it writes the old state as a new change, so nothing is lost
A region	`serving`, `failing_over`, `failed_over`, `failing_back`	A failed region moves its Namespaces to the paired one inside the same residency, and back
A drill	`scheduled`, `running`, then `passed` or `failed`	Each quarter per tier; its measured loss and time replace the proof on the offer card

What engineers, admins and agents meet

An engineer. Bounds stated before the first call, a timeout it can set, and a failed run that costs nothing.
A Customer's admin. Its region on every part, the recovery promise on the security page, and a restore it runs itself.
A security reviewer. Where each part runs, what crosses a border, and the last drill's measured numbers.
An agent. The same limits on every Interface, a Problem at a limit, and Age on a cached reply.

Every product runs inside one stated envelope, so its limits, its region and its recovery are facts a buyer reads before it calls.

What runs, and inside which limitsCopy Anchor Link

ExampleCopy Anchor Link

Where each part runsCopy Anchor Link

Backups, restores and failover, state by stateCopy Anchor Link

What engineers, admins and agents meetCopy Anchor Link

What runs, and inside which limits

Example

Where each part runs

Backups, restores and failover, state by state

What engineers, admins and agents meet