@3sln/trove 0.0.8 → 0.0.9

package/packages/web/src/bl/views.js

@@ -0,0 +1,64 @@
+// Which of the registered views should draw the results.
+//
+// The reactive half — which views exist, their when-clauses, which one the user pinned —
+// is the `views` query. This is the rest: arithmetic over the items on screen.
+//
+// Still a plain function rather than part of that query only because the launcher assembles
+// the items mid-render. They are themselves derived from the explorer and search state, so
+// this folds into a query as soon as that assembly does.
+//
+// It lived in ui/components/views/index.js, which was half a job: the registry reads moved
+// into the engine and the DECISION stayed in the render layer. Choosing a layout from what
+// a collection contains is a claim about the drive, not about markup.
+
+/** Where a pinned view choice is remembered. */
+export const SETTING = 'explorer.view';
+
+/**
+ * The view to draw with, in order of how much someone meant it.
+ *
+ * 1. A saved choice — they pressed a button. Nothing infers its way past that.
+ * 2. The search transformer's hint, when there is a search on screen. It read the
+ *    sentence: "photos from the trip last summer" is a request for a gallery as much as
+ *    it is a query, and nothing downstream can recover that from a list of content types.
+ * 3. A view whose `match` suits what is actually there — a collection of photographs
+ *    opens as a grid without anyone asking.
+ * 4. The highest priority, which is the list.
+ *
+ * A hint naming a view this build doesn't have is ignored, not an error: the transformer
+ * is deployment configuration and may outlive the build it was written against.
+ *
+ * PURE. It used to take `platform` and read the contribution registry, the context keys and
+ * the settings mid-render — three reads that nothing invalidated on, so the launcher only
+ * kept up because the shell's snapshot was coarse enough to redraw it anyway. The reactive
+ * half is the `views` query now; what is left is arithmetic over the items already on
+ * screen, which is the one input that cannot be a query (there is no sensible key for "these
+ * forty search results").
+ *
+ * @param {{views: Array, saved: string|null}} slice from the `views` query
+ * @param {Array} items the rows being drawn, `{ node }`-shaped
+ * @param {string|null} hint the search transformer's suggestion, if this is a search
+ */
+export function pickView({ views = [], saved = null } = {}, items = [], hint = null) {
+  if (!views.length) return null;
+  const chosen = saved && views.find((v) => v.id === saved);
+  if (chosen) return chosen;
+  const suggested = hint && views.find((v) => v.id === hint);
+  if (suggested) return suggested;
+  const nodes = items.map((i) => i.node).filter(Boolean);
+  if (nodes.length >= 3) {
+    const suits = (v) => v.match && Object.keys(v.match).length
+      && nodes.filter((n) => matchesView(v, n)).length / nodes.length > 0.6;
+    const fitted = views.find(suits);
+    if (fitted) return fitted;
+  }
+  return views[0];
+}
+
+function matchesView(view, node) {
+  const ct = node.contentType || '';
+  const name = (node.name || '').toLowerCase();
+  const ext = name.includes('.') ? name.slice(name.lastIndexOf('.')) : '';
+  if ((view.match.ext || []).includes(ext)) return true;
+  return (view.match.mime || []).some((m) => (m.endsWith('/*') ? ct.startsWith(m.slice(0, -1)) : ct === m));
+}

package/packages/web/src/bl/watchQuery.js

@@ -0,0 +1,73 @@
+// Reading an engine query from the render layer.
+//
+// Mostly this exists to be the ONE place that knows how a query reaches a component. The
+// bridging itself is a single call; the value is that it is not re-derived at fifteen call
+// sites, and that if it ever needs an initial value or an error view, there is somewhere to
+// put it.
+//
+// `engine.query(q)` answers an observable — `subscribe({next, error, complete})` — and dodo's
+// `watch` takes a Cell — `onDirty(fn)` plus `getValue()`. `fromObservable` already bridges
+// exactly those two shapes, so this is thin on purpose: the point is that there is ONE place
+// that knows how a query reaches a component, rather than the adapter being re-derived at
+// every call site.
+//
+// The subscription belongs to the CELL, not to the component: dodo connects a cell when its
+// first watcher attaches and disconnects when the last one leaves, which is the same
+// lifetime ngin gives a query realization. So a region that scrolls out of the tree stops
+// observing, the query's `kill` runs, and whatever it was holding is released — without any
+// component writing teardown.
+//
+// See docs/tickets/009.
+
+import { fromObservable, PENDING } from '../runtime.js';
+
+/**
+ * Cache the bridged cell per (engine, query instance).
+ *
+ * Not, as this first claimed, because two cells would "undo ngin's sharing" — they would
+ * not. Measured: two independent `fromObservable(engine.query(q))` over one instance boot
+ * the query ONCE and kill it once, because ngin shares the realization by instance and does
+ * not care how many observers arrive or through what. The sharing was never at risk.
+ *
+ * What the cache actually buys is smaller and worth stating accurately:
+ *
+ *   - **Idempotence.** `watchQuery` can be called freely and returns the same cell, so it
+ *     is safe in a render. Without it, `watch` — which compares its source by identity and
+ *     resubscribes when it changes — would tear down and re-establish every pass.
+ *   - **One fan-out per change** instead of one per bridge. Each extra cell is another
+ *     observer on the controller and another invalidation to propagate.
+ *
+ * Neither is correctness, so this is an optimisation and a convenience, not a safeguard.
+ * The safeguard against duplicate realizations is interning the query instance — see
+ * bl/intern.js, which is where that problem is actually solved.
+ *
+ * Weak on the engine so a disposed engine takes its cells with it, and weak on the query so
+ * an interned instance that falls out of use does too.
+ */
+const cells = new WeakMap();
+
+/**
+ * @param {object} engine
+ * @param {object} queryInstance an INTERNED instance — see bl/intern.js
+ * @returns {object} a dodo Cell, PENDING until the query produces its first value
+ */
+export function watchQuery(engine, queryInstance) {
+  let forEngine = cells.get(engine);
+  if (!forEngine) {
+    forEngine = new WeakMap();
+    cells.set(engine, forEngine);
+  }
+  let cell = forEngine.get(queryInstance);
+  if (!cell) {
+    // A query may declare what it means before it knows — `initial = null` for something
+    // fetched over the network, say. Without one the cell is PENDING, and PENDING reaching
+    // a `watch` renders its placeholder: fine for a region that can show an empty bar for a
+    // frame, wrong for a snapshot feeding the whole shell, which would blank until the
+    // request came back. The initial belongs to the query rather than to this call, so it
+    // cannot differ between two call sites reading the same thing.
+    const initial = 'initial' in queryInstance ? queryInstance.initial : PENDING;
+    cell = fromObservable(engine.query(queryInstance), { initial });
+    forEngine.set(queryInstance, cell);
+  }
+  return cell;
+}

package/packages/web/src/platform/api.js

@@ -15,25 +15,6 @@
 
 import { withRetry } from '@3sln/trove/core/retry.js';
 import { TroveError } from '@3sln/trove/core/errors.js';
-// Imported from the module rather than the barrel so a page that never uploads to an
-// encrypted collection still does not pull the rest of core in with it.
-import { encrypt, encryptStream, cipherSize } from '@3sln/trove/core/encryption/envelope.js';
-import { fromHex } from '@3sln/trove/core/encryption/keys.js';
-
-/**
- * Seal a whole file into an envelope.
- *
- * Only used where the plan already decided the STORED size fits a single PUT, so the
- * buffering is bounded by that limit rather than by the file.
- */
-async function sealWhole(file, enc) {
-  const plain = new Uint8Array(await file.arrayBuffer());
-  const sealed = await encrypt(fromHex(enc.key), plain, {
-    fingerprint: fromHex(enc.fingerprint),
-    chunkSize: enc.chunkSize,
-  });
-  return new Blob([sealed], { type: file.type || 'application/octet-stream' });
-}
 
 export class TroveApiClient {
   /**
@@ -257,6 +238,28 @@ export class TroveApiClient {
     return this.request('POST', '/api/collections', { body });
   }
 
+  /** Change a collection's settings — including turning encryption on. */
+  updateCollection(id, patch) {
+    return this.request('PATCH', `/api/collections/${encodeURIComponent(id)}`, { body: patch });
+  }
+
+  // --- key rotation ---------------------------------------------------------
+  //
+  // What a rotation would cost before anyone starts one: on a metered store it is a real
+  // bill, and the button should not be the first place that becomes apparent.
+  rotationEstimate(id) {
+    return this.request('GET', `/api/collections/${encodeURIComponent(id)}/rotate/estimate`);
+  }
+  rotationState(id) {
+    return this.request('GET', `/api/collections/${encodeURIComponent(id)}/rotate`);
+  }
+  beginRotation(id) {
+    return this.request('POST', `/api/collections/${encodeURIComponent(id)}/rotate`);
+  }
+  cancelRotation(id) {
+    return this.request('DELETE', `/api/collections/${encodeURIComponent(id)}/rotate`);
+  }
+
   // --- conversations, tags, sidecar ------------------------------------------
   sidecar(id) {
     return this.request('GET', `/api/items/${encodeURIComponent(id)}/sidecar`);
@@ -432,26 +435,24 @@ export class TroveApiClient {
     // (otherwise a multipart upload leaks server + storage state).
     if (plan.uploadId) opts.onStart?.(plan.uploadId);
 
-    // Progress is measured against what TRAVELS, which for an encrypted upload is the
-    // envelope — larger than the file by a header and a tag per chunk. Measured against the
-    // file, the bar would pass 100% and sit there.
-    const progress = new ProgressAggregator(plan.encryption?.storedSize || size, opts.onProgress);
+    // Progress is measured against what TRAVELS, which is now the file itself even for an
+    // encrypted collection: the drive seals it on the way to the store, so nothing larger
+    // than the file ever leaves this tab.
+    const progress = new ProgressAggregator(size, opts.onProgress);
     const t = plan.transfer || {};
     const completeUrl = plan.endpoints?.complete || `/api/uploads/${plan.uploadId}/complete`;
 
     if (plan.strategy === 'single') {
-      // One presigned PUT straight to storage (bytes never touch our server).
-      // Sealed here, before a byte leaves the browser, so the bucket only ever receives
-      // ciphertext while the PUT still goes straight to it. The whole envelope is built in
-      // memory, which is fine on this path: the plan only chooses `single` when what is
-      // stored fits under the single-PUT limit.
-      const body = plan.encryption ? await sealWhole(file, plan.encryption) : file;
+      // One presigned PUT straight to storage (bytes never touch our server). The plan
+      // only ever chooses this for an UNENCRYPTED collection now — a presigned PUT of a
+      // file this client has not sealed would put plaintext in the bucket.
+      const body = file;
       await step(() => xhrPut(t.url || plan.url, body, { headers: t.requiredHeaders, signal: opts.signal, onProgress: (l) => progress.set('single', l) }));
       const done = await step(() => this.request('POST', completeUrl, { body: {}, signal: opts.signal }));
       return done.node;
     }
     if (plan.strategy === 'direct-single') {
-      const body = plan.encryption ? await sealWhole(file, plan.encryption) : file;
+      const body = file;
       await step(() => xhrPut(this.baseUrl + this.#partUrl(plan, 1), body, {
         // Our own server, so it needs our bearer token; `t.authHeaders` lets the plan
         // add its own and wins on a clash.
@@ -462,21 +463,6 @@ export class TroveApiClient {
       return done.node;
     }
 
-    // Multipart, encrypted: sequential, and streamed.
-    //
-    // Two things stop the ordinary path working here. The parts have to be slices of the
-    // ENVELOPE rather than of the file, and the envelope is produced in order — chunk n
-    // cannot be sealed before chunk n-1, because the nonce is derived from its position. So
-    // parts are produced and sent one at a time, and the concurrency the plaintext path
-    // enjoys is not available.
-    //
-    // Streamed rather than assembled: building the whole envelope before slicing it would
-    // hold a second copy of the file in a browser tab, which for the large files that
-    // reach this path is exactly what it cannot afford.
-    if (plan.encryption) {
-      return this.#uploadSealed(file, plan, { ...opts, progress, step, completeUrl });
-    }
-
     // Multipart (presign or direct).
     const partSize = plan.partSize;
     const partCount = plan.partCount ?? Math.ceil(size / partSize);
@@ -552,63 +538,6 @@ export class TroveApiClient {
   }
 
 
-  /**
-   * A multipart upload of an encrypted object, one part at a time.
-   *
-   * Parts are gathered to the plan's part size because every part but the last has to clear
-   * the backend's floor, and an envelope chunk is far smaller than that.
-   */
-  async #uploadSealed(file, plan, { signal, progress, step, completeUrl, onRetry }) {
-    const enc = plan.encryption;
-    const sealed = await encryptStream(fromHex(enc.key), file.stream(), {
-      fingerprint: fromHex(enc.fingerprint),
-      plaintextSize: file.size,
-      chunkSize: enc.chunkSize,
-    });
-    const reader = sealed.getReader();
-    const parts = [];
-    let held = [];
-    let size = 0;
-    let n = 1;
-    let sent = 0;
-
-    const flush = async () => {
-      const body = new Uint8Array(size);
-      let at = 0;
-      for (const p of held) { body.set(p, at); at += p.length; }
-      held = [];
-      size = 0;
-      const partNumber = n++;
-      const base = sent;
-      const etag = await withRetry(
-        () => this.#uploadPart(plan, partNumber, new Blob([body]), {
-          signal, onProgress: (l) => progress.set(partNumber, l),
-        }),
-        {
-          signal,
-          retries: 4,
-          onRetry: ({ attempt, delayMs, error }) => onRetry?.({ attempt, delayMs, part: partNumber, message: error.message }),
-        },
-      );
-      sent = base + body.length;
-      progress.set(partNumber, body.length);
-      parts.push({ partNumber, etag });
-    };
-
-    for (;;) {
-      const { value, done } = await reader.read();
-      if (done) break;
-      held.push(value);
-      size += value.length;
-      if (size >= plan.partSize) await flush();
-    }
-    // The final part may be under the floor, and only the final part may be.
-    if (size || parts.length === 0) await flush();
-
-    const finished = await step(() => this.request('POST', completeUrl, { body: { parts }, signal }));
-    return finished.node;
-  }
-
   async #uploadPart(plan, n, blob, { signal, onProgress }) {
     const t = plan.transfer || {};
     if (plan.strategy === 'presign') {

package/packages/web/src/platform/commands.js

@@ -15,16 +15,30 @@ export class CommandService {
     this.contributions = contributions;
     this.context = context;
     this.notifications = notifications;
-    this.handlers = new Map(); // id -> fn
+    this.handlers = new Map(); // id -> (...args) => Action | Action[] | null
+    // How a resolved command reaches the engine. Filled in by createApp, because this
+    // service is built with the rest of the platform and the engine does not exist yet.
+    //
+    // It is a seam rather than a smell: keystrokes and plugin RPC arrive from outside the
+    // engine and something has to carry them in. Until it is set, a command says so instead
+    // of silently doing nothing.
+    this.dispatch = () => {
+      throw new Error('CommandService has no dispatcher yet — see createApp');
+    };
   }
 
   /**
-   * Register a command. Accepts either register(id, handler) or a full spec
-   * object { id, title, handler, category, icon, when, palette }.
+   * Register a command. Accepts either register(id, actions) or a full spec object
+   * { id, title, actions, category, icon, when, palette }.
+   *
+   * `actions` is a PURE FACTORY: `(...args) => Action | Action[] | null`. It is not a
+   * handler, and the difference is the point — a handler did the work, which meant every
+   * menu item, keybinding and palette entry a person triggered went around the engine. A
+   * factory only says what should be dispatched, and `execute` dispatches it.
    */
-  register(idOrSpec, handler) {
-    const spec = typeof idOrSpec === 'string' ? { id: idOrSpec, handler } : idOrSpec;
-    if (spec.handler) this.handlers.set(spec.id, spec.handler);
+  register(idOrSpec, actions) {
+    const spec = typeof idOrSpec === 'string' ? { id: idOrSpec, actions } : idOrSpec;
+    if (spec.actions) this.handlers.set(spec.id, spec.actions);
     const dispose = this.contributions.register(spec.id, {
       type: 'command',
       title: spec.title ?? spec.id,
@@ -58,9 +72,20 @@ export class CommandService {
     return this.availability ? this.availability(cmd) : true;
   }
 
+  /**
+   * Run a command: resolve what it means, then dispatch it.
+   *
+   * The gating stays here rather than moving into an action, because it is the same three
+   * questions for every command however it was triggered — does it exist, is the plugin
+   * behind it answering, does its when-clause hold — and answering them in one place is
+   * what keeps a keybinding and a palette entry behaving identically.
+   *
+   * What is NOT here any more is the work. `actions` returns descriptions and this
+   * dispatches them, so the engine sees the command AND everything it causes.
+   */
   async execute(id, ...args) {
-    const handler = this.handlers.get(id);
-    if (!handler) {
+    const actionsFor = this.handlers.get(id);
+    if (!actionsFor) {
       this.notifications.error(`Command not found: ${id}`);
       return;
     }
@@ -71,7 +96,22 @@ export class CommandService {
     }
     if (!this.isEnabled(id)) return; // gated by when-clause
     try {
-      return await handler(...args);
+      const actions = actionsFor(...args);
+      if (!actions) return;
+      // One at a time, each genuinely finished before the next begins.
+      //
+      // `dispatch` answers an event FEED, not a promise for the work — awaiting it resolves
+      // immediately and the action runs afterwards, so a bare `await dispatch(a)` in a loop
+      // would start all of them at once while looking like it sequenced them. `next` on the
+      // terminal events is the actual completion signal.
+      //
+      // It resolves with whichever of complete/error/abort fired rather than rejecting, so
+      // a failing action does not throw here — but it does stop the rest, because a command
+      // whose first step failed rarely wants its second.
+      for (const action of [].concat(actions)) {
+        const settled = await this.dispatch(action).next(['complete', 'error', 'abort']);
+        if (settled?.type !== 'complete') break;
+      }
     } catch (err) {
       console.error(`Command ${id} failed`, err);
       this.notifications.error(err?.message || `Command failed: ${id}`);

package/packages/web/src/platform/context.js

@@ -1,74 +1,169 @@
-// ContextKeyService — the reactive bag of boolean/string/number flags that
-// describe the workbench's current state (which view is focused, whether a file
-// is open, its type, whether the palette is showing…). when-clauses evaluate
-// against it, so commands/keybindings/menus light up and dim as state changes.
+// ContextRegistry — the named facts a when-clause is evaluated against.
 //
-// It's a single cell of the whole context object, so any consumer can `watch` it and
-// re-render, and keybinding resolution reads a plain snapshot.
-// Plugins get a *scoped* setter (keys they set are namespaced under their id) so
-// they can drive their own when-clauses without stomping core keys.
+// A REGISTRY of cells, not a bag of values, and the difference is the whole design:
+//
+//   - Every key is backed by a cell somebody OWNS. The registry never hands the cell out,
+//     only its value, so a key can be read by anyone and written by exactly one thing.
+//   - A contributor registers while it exists and unregisters when it is disposed, so the
+//     set of keys is a fact about what is currently installed rather than a pile that only
+//     grows.
+//   - Because the backings are cells, a derived layer sits on top for free: a built-in key
+//     is a `derive` over the resource it summarises, and so cannot go stale.
+//
+// That last point is why this replaced a plain map with setters. Context keys are DERIVED
+// state — what is selected, what is open, what is focused — and they were maintained by
+// pushing: OverlayService wrote `palette.open` as a side effect of opening the palette,
+// NavigationService wrote three `editor.*` keys, WorkbenchService four more, ViewportService
+// three, and an effect in bl/index.js the explorer's two. Five writers for one derivation,
+// and the bug that shape produces is on the record: selecting a file never flipped
+// `explorer.hasSelection`, so the Delete keybinding silently did nothing, because only
+// NavigateAction had been taught to set it. The fix at the time was to add another writer.
+//
+// Nothing sets a built-in key now. They are derived — see bl/context.js.
+
+import { cell, derive } from '../runtime.js';
+import { evaluateWhen, compileWhen } from './whenclause.js';
 
-import { cell } from '../runtime.js';
-import { evaluateWhen } from './whenclause.js';
+/** A cell whose value never changes — for facts about the machine rather than the drive. */
+const constant = (value) => ({ onDirty: () => () => {}, getValue: () => value });
+
+export class ContextRegistry {
+  #cells = new Map(); // key -> a Cell its owner holds
+  #offs = new Map(); // key -> unsubscribe
+  #slots = new Map(); // key -> a stable cell that outlives any one owner
+  #snapshot = cell({});
 
-export class ContextKeyService {
   constructor(initial = {}) {
-    this.state = {
+    const fixed = {
       platform: navigatorPlatform(),
       isMac: /mac/i.test(navigatorPlatform()),
       ...initial,
     };
-    this.cell = cell(this.state);
+    for (const [key, value] of Object.entries(fixed)) this.register(key, constant(value));
   }
 
-  get(key) {
-    return this.state[key];
+  /**
+   * Back `key` with a cell. Returns the unregister function.
+   *
+   * The caller keeps the cell, and that is what makes it the owner: writing means writing
+   * something the registry cannot reach. Registering a key twice is refused rather than
+   * silently taken over — two owners for one fact is exactly the confusion this shape
+   * exists to prevent, so it should be loud.
+   *
+   * @param {string} key
+   * @param {{onDirty: Function, getValue: Function}} source
+   * @returns {() => void} unregister
+   */
+  register(key, source) {
+    if (this.#cells.has(key)) {
+      throw new Error(`Context key "${key}" already has an owner`);
+    }
+    this.#cells.set(key, source);
+    this.#offs.set(key, source.onDirty(() => this.#changed(key)));
+    this.#changed(key); // gaining an owner is itself a change
+    return () => this.unregister(key);
   }
-  snapshot() {
-    return this.state;
+
+  unregister(key) {
+    const off = this.#offs.get(key);
+    if (!off) return;
+    off();
+    this.#offs.delete(key);
+    this.#cells.delete(key);
+    this.#changed(key); // and so is losing one
   }
-  observe() {
-    return this.cell;
+
+  /**
+   * A cell for one key, whether or not anything owns it yet.
+   *
+   * The indirection is the point. A keymap naming a plugin's register is parsed long before
+   * that plugin installs, and the plugin may later be uninstalled — so a watcher cannot
+   * hold the OWNER's cell, which does not exist at either end. It holds this slot, which
+   * reads through to whoever currently owns the key and goes dirty when ownership changes
+   * as well as when the value does. Unowned reads as `undefined`, which every clause
+   * already treats as falsy.
+   *
+   * Slots are kept once created. They are bounded by the number of distinct keys any
+   * when-clause has ever named, which is small and does not grow with use.
+   */
+  cellFor(key) {
+    let slot = this.#slots.get(key);
+    if (!slot) {
+      const listeners = new Set();
+      slot = {
+        listeners,
+        onDirty: (fn) => { listeners.add(fn); return () => listeners.delete(fn); },
+        getValue: () => this.#cells.get(key)?.getValue(),
+      };
+      this.#slots.set(key, slot);
+    }
+    return slot;
   }
 
-  set(key, value) {
-    if (this.state[key] === value) return;
-    this.state = { ...this.state, [key]: value };
-    this.cell.setValue(this.state);
+  /**
+   * A when-clause as a live boolean.
+   *
+   * Derived over exactly the keys the expression NAMES (the parser collects them — see
+   * whenclause.js), so a clause about `view.active` does not recompute when the selection
+   * changes. That is the difference from `evaluate`, which reads the whole snapshot: a
+   * consumer holding many clauses — the palette holds one per registered command — stops
+   * re-running all of them on every unrelated change.
+   *
+   * A clause naming nothing derives over nothing and is computed once, which is right: a
+   * constant cannot become false.
+   */
+  watch(expr) {
+    const predicate = compileWhen(expr);
+    const keys = predicate.keys ?? [];
+    return derive(keys.map((key) => this.cellFor(key)), (...values) => {
+      const ctx = {};
+      for (let i = 0; i < keys.length; i++) ctx[keys[i]] = values[i];
+      return predicate(ctx);
+    });
   }
-  setMany(obj) {
-    let changed = false;
-    const next = { ...this.state };
-    for (const [k, v] of Object.entries(obj)) {
-      if (next[k] !== v) {
-        next[k] = v;
-        changed = true;
-      }
-    }
-    if (changed) {
-      this.state = next;
-      this.cell.setValue(next);
-    }
+
+  #changed(key) {
+    this.#recompute();
+    const slot = this.#slots.get(key);
+    if (slot) for (const fn of [...slot.listeners]) fn();
   }
-  remove(key) {
-    if (!(key in this.state)) return;
-    const { [key]: _drop, ...rest } = this.state;
-    this.state = rest;
-    this.cell.setValue(rest);
+
+  /**
+   * Own a key outright: the registry makes the cell and hands back the writer.
+   *
+   * For the facts that genuinely are pushed rather than derived — a plugin setting its own
+   * declared register over RPC. The write capability IS the returned `set`, so holding a
+   * reference to the registry is not enough to change anything.
+   */
+  own(key, initial = undefined) {
+    const held = cell(initial);
+    const dispose = this.register(key, held);
+    return { set: (value) => held.setValue(value), dispose };
   }
 
-  /** True if `whenExpr` holds against the current context. */
-  evaluate(whenExpr) {
-    return evaluateWhen(whenExpr, this.state);
+  #recompute() {
+    const next = {};
+    for (const [key, source] of this.#cells) next[key] = source.getValue();
+    this.#snapshot.setValue(next);
   }
 
-  /** A setter namespaced under a plugin id, so plugin keys can't collide. */
-  scopedFor(pluginId) {
-    const prefix = `${pluginId}.`;
-    return {
-      set: (key, value) => this.set(prefix + key, value),
-      remove: (key) => this.remove(prefix + key),
-    };
+  /** Every key and its current value. */
+  snapshot() {
+    return this.#snapshot.getValue();
+  }
+  get(key) {
+    return this.#cells.get(key)?.getValue();
+  }
+  has(key) {
+    return this.#cells.has(key);
+  }
+  observe() {
+    return this.#snapshot;
+  }
+
+  /** True if `whenExpr` holds against the current context. */
+  evaluate(whenExpr) {
+    return evaluateWhen(whenExpr, this.snapshot());
   }
 }