@abide/abide 0.100.0 → 0.102.0

package/src/server/answerRpc.ts

@@ -16,6 +16,7 @@ import type { Gated } from '#shared/reactive/argsContract.ts'
 import { deadlineOf, heldGenerationOf } from '#shared/reactive/index.ts'
 import type { Defaults } from '#shared/reactive/parameterDefaults.ts'
 import { notFound, refuse } from '#shared/refuse.ts'
+import { routeOf } from '#shared/routePattern.ts'
 import type { Method, Rpc } from '#shared/rpc.ts'
 import { argsInURL } from '#shared/rpcRequest.ts'
 import { VERSION_HEADER } from '#shared/VERSION_HEADER.ts'
@@ -30,7 +31,12 @@ import { followAsEvents } from './answerSocket.ts'
 import { answerValue, namesEtag, sseHeaders } from './answerValue.ts'
 import { argsFor } from './argsFor.ts'
 import { callerOf } from './callerOf.ts'
-import { argsDocumentOf, collapsed, type Document } from './coerceArgs.ts'
+import {
+    argsDocumentOf,
+    coerceArgs,
+    collapsed,
+    type Document,
+} from './coerceArgs.ts'
 import { positiveSetting } from './config.ts'
 import {
     allows,
@@ -38,7 +44,7 @@ import {
     crossingOrigin,
     crossingRefusal,
 } from './crossingOrigin.ts'
-import { failureOf } from './hooks.ts'
+import { type AppRung, failureOf, rungsOver } from './hooks.ts'
 import { prefers } from './prefers.ts'
 import {
     currentRequestScope,
@@ -51,7 +57,8 @@ import { type Outcome, outcomeOf, takeSeed } from './seedBuffer.ts'
 import { versionOf } from './versionOf.ts'
 
 /**
- * One row of the table the build writes to `<out>/rpc.ts`: where a handler answers, and its module.
+ * One row of the handler table the build writes into the server's table (`SERVER_TABLE`): where a
+ * handler answers, and its module.
  *
  * The module is relative to the app's root, which both commands that serve already know.
  */
@@ -62,7 +69,7 @@ export type Mount = {
     name: string
     /** Whether a browser is handed a wrapper for it. 20.4. */
     ui: boolean
-    /** Whether the command line lists it — the shell's listing and completion, never whether `call` reaches it. 20.3, 38.63. */
+    /** Whether the command line lists it — the shell's listing and completion, never whether `call` reaches it. 20.3, 38.62. */
     cli: boolean
     /**
      * Whether MCP lists it where its runtime `clients` does not say.
@@ -88,9 +95,23 @@ export type Mount = {
     args: JsonValue | undefined
 }
 
+/**
+ * A row of the table the build wrote, with the import of the module its handler is declared in —
+ * the file's server module, the one the route table loads too, so a page and a call reach one
+ * handler.
+ */
+export type MountRow = Mount & { load: () => Promise<Record<string, unknown>> }
+
 /** A handler's row, mounted: the handler imported and its args schema probed. */
 export type Mounted = Mount & {
     method: Method
+    /** The route of the file declaring it, which its hooks are filed at (37.1, 37.2). */
+    route: string
+    /**
+     * The rungs filed over `route`, read once at mount (16.14) — what an http call and a socket
+     * subscription to it both pass through (37.2, 18.26).
+     */
+    rungs: AppRung[]
     handler: Rpc<unknown, unknown> & Gated<unknown>
     /**
      * The args' JSON Schema, probed once at mount.
@@ -127,6 +148,10 @@ export function mountedOwn(
         {
             address,
             method: 'GET',
+            route: '/',
+            // The root's rungs run before routing (37.3), and nothing is filed below a route
+            // of abide's own.
+            rungs: [],
             source: '',
             name,
             ui: false,
@@ -149,20 +174,17 @@ export function environmentTimeout(): number | undefined {
 }
 
 /**
- * The table's handlers, imported and keyed by address.
+ * The table's handlers, imported and keyed by method and address.
  *
- * Imported from the SOURCE tree, so a page rendering on the server and a call over the wire reach
- * one module and so one handler. AT BOOT rather than on the first call, because a page's render
- * reaches a handler through the page's own import and has to know its address before anything has
- * called it over the wire.
+ * Imported through each row's own loader, which the route table shares, so a page rendering on the
+ * server and a call over the wire reach one module and so one handler. AT BOOT rather than on the
+ * first call, because a page's render reaches a handler through the page's own import and has to
+ * know its address before anything has called it over the wire.
  */
 export async function mountHandlers(
-    table: Mount[],
-    moduleOf: (source: string) => Promise<Record<string, unknown>>,
+    table: MountRow[],
 ): Promise<{ handlers: Map<string, Mounted> }> {
-    const modules = await Promise.all(
-        table.map((mount) => moduleOf(mount.source)),
-    )
+    const modules = await Promise.all(table.map((mount) => mount.load()))
     const handlers = new Map<string, Mounted>()
     for (let at = 0; at < table.length; at += 1) {
         const mount = table[at] as Mount
@@ -172,9 +194,14 @@ export async function mountHandlers(
         // 16.9, 16.10 — the address `rpc.url` and `rpc.raw` build on, under the mount — and what a
         // page's render turns a call it made into the browser's request by (41.20).
         handler.address = underMount(mount.address)
-        handlers.set(mount.address, {
+        // 23.19 — the route its address answers below, which is its mount's for a package's file,
+        // never the file's place on disk.
+        const route = routeOf(mount.address)
+        handlers.set(handlerKey(mount.method, mount.address), {
             ...mount,
             method: mount.method,
+            route,
+            rungs: rungsOver(route),
             handler,
             argsDocument: declared ?? (mount.args as Document | undefined),
             wireArgs: declared === undefined ? mount.args : undefined,
@@ -183,30 +210,34 @@ export async function mountHandlers(
     return { handlers }
 }
 
-/** The `Response` to a handler call made over http. */
+/** What a handler is keyed by among the mounted: its method and its route. 19.1. */
+export function handlerKey(method: string, address: string): string {
+    return `${method} ${address}`
+}
+
+/**
+ * The `Response` to a call of `found` made over http, `params` being what its route matched.
+ *
+ * `found` answers the request's method — or, for an `OPTIONS`, the method its preflight asks
+ * about: which handler a request reaches is the route table's to say (19.21).
+ */
 export async function answerRpc(
-    handlers: Map<string, Mounted>,
+    found: Mounted,
+    params: Record<string, string | string[]>,
     url: URL,
     request: Request,
     // 16.38 — what paints a refusal for a request that came as a navigation.
     pages: ErrorPages,
 ): Promise<Response> {
     const pathname = url.pathname
-    const found = handlers.get(pathname)
     const origin = request.headers.get('origin')
     // 16.24 — THE PREFLIGHT, answered by abide where the handler declared `crossOrigin`.
-    if (
-        found !== undefined &&
-        request.method === 'OPTIONS' &&
-        origin !== null &&
-        allows(found.handler.crossOrigin, origin)
-    )
-        return preflight(found, origin, request)
+    if (request.method === 'OPTIONS')
+        return origin !== null && allows(found.handler.crossOrigin, origin)
+            ? preflight(found, origin, request)
+            : answered(notFound({ path: pathname, method: request.method }))
     // 16.50 — a `HEAD` is the `GET`'s answer, which the server sends without its body.
     const head = request.method === 'HEAD'
-    // 15.7 — no handler at this address AND this method is one refusal, not two.
-    if (found === undefined || found.method !== (head ? 'GET' : request.method))
-        return answered(notFound({ path: pathname, method: request.method }))
     const handler = found.handler
     const inUrl = argsInURL(found.method)
     const form = isForm(request)
@@ -226,10 +257,12 @@ export async function answerRpc(
         return answered(overCeiling(ceiling))
     const raw = await argsOf(request, url, inUrl, form, ceiling)
     if (isFailed(raw)) return answered(raw)
+    const sent = withParameters(raw, params, inUrl || form, found)
+    if (isFailed(sent)) return answered(sent)
     let args: unknown
     try {
         // A URL's and a form's args are text, and the query tells a bare name from `name=` (19.7).
-        args = argsFor(found, raw, inUrl ? url.search : form ? '' : undefined)
+        args = argsFor(found, sent, inUrl ? url.search : form ? '' : undefined)
     } catch (refused) {
         if (isFailed(refused)) return answered(refused)
         throw refused
@@ -243,24 +276,36 @@ export async function answerRpc(
     const caller = head ? undefined : callerOf()
     const seeded =
         caller === undefined ? undefined : takeSeed(caller, handler, args)
+    // The entry key of a `global` value, taken once for every read of it below.
+    const global = GLOBAL_GETS.get(handler)
+    const key = global?.key(args)
     // 21.15 — A `global` PRODUCTION ALREADY HELD, and not loading, answers without a run: a run
     // this call started moves the generation, and one it joined was loading when it came.
     const held =
-        seeded === undefined ? GLOBAL_GETS.get(handler)?.(args) : undefined
+        seeded === undefined && key !== undefined ? global?.at(key) : undefined
     const heldAt = held === undefined ? undefined : heldGenerationOf(held)
     const timing = currentRequestScope()?.timing
     if (timing !== undefined) timing.answering = handler
     const started = performance.now()
     const outcome =
         seeded === undefined ? await outcomeOf(handler(args)) : await seeded
+    // The entry as the run left it, which the answer reads too.
+    const entry = key === undefined ? undefined : global?.at(key)
     const cached =
         heldAt !== undefined &&
-        GLOBAL_GETS.get(handler)?.(args) === held &&
+        entry === held &&
         heldGenerationOf(held) === heldAt
     // 16.38 — A MUTATION A DOCUMENT MADE — a form posted with no script — is answered as a navigation.
     if (!inUrl && prefers(request, 'text/html', 'application/json'))
         return navigated(outcome, request, pathname, pages)
-    const answer = await answerOutcome(outcome, request, found, args)
+    const answer = await answerOutcome(
+        outcome,
+        request,
+        found,
+        args,
+        key,
+        entry,
+    )
     // A `Response` the handler built is its own — but the origin answer below is laid over it, so it
     // varies on `Origin` too (21.7), which `handlerHeaders` never reached.
     if (outcome.settled && outcome.value instanceof Response) {
@@ -308,23 +353,24 @@ async function answerOutcome(
     request: Request,
     found: Mounted,
     args: unknown,
+    key: string | undefined,
+    entry: unknown,
 ): Promise<Response> {
     const handler = found.handler
     if (!outcome.settled) return answered(failureOf(outcome.error))
+    const value = outcome.value
     // The `global` value the answer came from, or `undefined` for one built per request. 18.22 — or
     // for one whose production has moved past what is answered: a seeded answer is what the render
     // reached (41.13). 18.23 — or for a binary.
-    const global = GLOBAL_GETS.get(handler)?.(args)
-    const value = outcome.value
     const serving =
-        global !== undefined &&
+        entry !== undefined &&
         !(
             value instanceof Blob ||
             value instanceof ArrayBuffer ||
             ArrayBuffer.isView(value)
         ) &&
-        (streams(value) || (global as { peek(): unknown }).peek() === value)
-            ? global
+        (streams(value) || (entry as { peek(): unknown }).peek() === value)
+            ? entry
             : undefined
     // 21.3 — what the handler wrote through `response` is laid over it at the exit (21.10).
     const headers = handlerHeaders()
@@ -337,7 +383,7 @@ async function answerOutcome(
     const etag = serving !== undefined ? `"${versionOf(serving)}"` : undefined
     if (etag !== undefined) {
         headers.set(VERSION_HEADER, etag)
-        RPC_SERVER.served?.(handler, serving)
+        RPC_SERVER.served?.(handler, serving, key as string)
     }
     // 21.8, 21.9, 21.11 — WHAT IS LEFT OF THE LIFE OF THE PRODUCTION ANSWERED, in place of `no-store`
     // and nothing else. A `ttl` of Infinity is bounded by `invalidate` alone (11.35), which no cache
@@ -423,6 +469,39 @@ async function argsOf(
     return parsed
 }
 
+/**
+ * The args a request sent, with the parameters its route matched laid in.
+ *
+ * 16.65 — the path's, whatever the method. 16.66 — a parameter the query or the body names as
+ * well is refused rather than one of the two chosen. A JSON body's members are typed already, so the
+ * path's text is coerced to the declared types before it joins them (19.7); text args are coerced
+ * with the rest of the text.
+ */
+function withParameters(
+    sent: unknown,
+    params: Record<string, string | string[]>,
+    text: boolean,
+    found: Mounted,
+): unknown | Failed<'HttpError', undefined> {
+    let none = true
+    for (const name in params) {
+        none = false
+        if (isRecord(sent) && name in sent)
+            return refuse(
+                400,
+                `The parameter '${name}' is in the path and in the request as well.`,
+            )
+    }
+    if (none) return sent
+    const fromPath = text
+        ? params
+        : (coerceArgs(params, found.argsDocument, '') as Record<
+              string,
+              unknown
+          >)
+    return isRecord(sent) ? { ...sent, ...fromPath } : { ...fromPath }
+}
+
 /**
  * The request's body read up to `ceiling`, as a `Response`, or a 413 refusal past it.
  *
@@ -474,6 +553,12 @@ function preflight(found: Mounted, origin: string, request: Request): Response {
  * 16.57 — `Infinity` is never reaped, which bun spells 0; any finite bound is capped at the 255
  * seconds bun's idle timeout can hold.
  *
+ * FOUR SECONDS PAST THE TIMEOUT, NOT AT IT: a load that goes its timeout is refused at that moment,
+ * and a stream's refusal is a frame written then (16.68). bun's sockets check an idle timeout on a
+ * tick four seconds wide, so an idle timeout of the same second — or one past it — fired anywhere in
+ * the tick before it and reaped the connection ahead of the frame, one stream in two under `abide
+ * dev`. Four is the tick, so the refusal always goes out first.
+ *
  * ON THE REQUEST THE LISTENER RECEIVED, never the one being answered: under a mount, or past a
  * rung that handed `next` its own, that is a copy, and bun's `timeout` does nothing for a request
  * it was not handed itself.
@@ -483,7 +568,7 @@ export function raiseTimeout(milliseconds: number): void {
     const received = scope?.received
     if (scope === undefined || received === undefined) return
     const seconds = Number.isFinite(milliseconds)
-        ? Math.min(255, Math.ceil(milliseconds / 1000))
+        ? Math.min(255, Math.ceil(milliseconds / 1000) + 4)
         : Number.POSITIVE_INFINITY
     if (seconds <= scope.timeout) return
     scope.timeout = seconds

package/src/server/answerSocket.ts

@@ -10,18 +10,20 @@
 // built per request, since a trigger names args rather than a value. A `global` value is also fed its productions, a guarded one only to a
 // subscription its rungs admitted when it opened (18.8) — they run once, in the connection's request.
 
-import { ABIDE_ADDRESS } from '#shared/ADDRESSES.ts'
 import { type Problem, problemOf } from '#shared/Failed.ts'
 import { GLOBAL_GETS } from '#shared/GLOBAL_GETS.ts'
 import { namedLogger } from '#shared/log.ts'
+import { compose } from '#shared/Middleware.ts'
+import { unmounted } from '#shared/mount.ts'
+import type { BrowserFrame, ServerFrame } from '#shared/muxFrames.ts'
 import { FOLLOWED } from '#shared/reactive/FOLLOWED.ts'
 import { servedCellOf } from '#shared/reactive/index.ts'
 import { matchesPattern } from '#shared/reactive/matchesPattern.ts'
 import { PATCH_SINKS } from '#shared/reactive/PATCH_SINKS.ts'
 import { unowned } from '#shared/reactive/watch.ts'
 import { refuse } from '#shared/refuse.ts'
-import type { BrowserFrame, ServerFrame } from '#shared/muxFrames.ts'
-import type { Mounted } from './answerRpc.ts'
+import { rpcRequest } from '#shared/rpcRequest.ts'
+import { handlerKey, type Mounted } from './answerRpc.ts'
 import { argsFor } from './argsFor.ts'
 import { closedTo, crossingOrigin, crossingRefusal } from './crossingOrigin.ts'
 import { failureOf } from './hooks.ts'
@@ -38,7 +40,7 @@ import { patchesSince, versionOf } from './versionOf.ts'
  * The far end of one connection to the mux, which its frames are written to.
  *
  * Bun's socket under `abide start`, and under `abide dev` a stand-in that posts each frame to the
- * listener holding the real one (38.15).
+ * listener holding the real one (38.14).
  */
 export type Peer = {
     send(text: string): unknown
@@ -54,19 +56,30 @@ type Follower = {
     peer: Peer
     id: number
     args: unknown
+    // The entry key its args are filed under (`GLOBAL_GETS`), taken once as it subscribes.
+    key: string
     // The `global` entry its productions are pushed from, which is what a refresh would otherwise
     // re-fetch — or `undefined`, and it is sent triggers instead.
     serving: unknown
     stopFeed: (() => void) | undefined
     // 18.6 — the version it was last sent, or named on subscribing.
     sent: number | undefined
-    // 13.15 — the literal `tags` the build copied onto the browser's copy, for a sweep to match.
-    tags: string[] | undefined
     // 18.8 — whether the handler's rungs let it through when it opened: a guarded `GET` feeds only
     // a follower they admitted, and sends the rest its triggers alone.
     admitted: boolean
 }
-const FOLLOWERS = new Map<object, Set<Follower>>()
+type Followed = {
+    // 13.15 — the literal `tags` the build copied onto the browser's copy, for a sweep to match:
+    // the handler's, so one for all of its followers.
+    tags: string[] | undefined
+    // What a trigger walks, matching each follower's args against its pattern.
+    all: Set<Follower>
+    // BY ENTRY KEY, so an entry answered walks the followers of its own args alone (18.8). Filed
+    // apart from `all` rather than instead of it: a walk of every follower through a set per key
+    // measured twice a flat set's.
+    byKey: Map<string, Set<Follower>>
+}
+const FOLLOWERS = new Map<object, Followed>()
 
 // 13.12 — narrowed by the pattern the trigger was handed, as the handler's own entries are.
 export function broadcast(
@@ -74,9 +87,9 @@ export function broadcast(
     member: 'invalidate' | 'refresh',
     pattern: unknown,
 ): void {
-    const followers = FOLLOWERS.get(rpc)
-    if (followers === undefined) return
-    for (const follower of followers) {
+    const followed = FOLLOWERS.get(rpc)
+    if (followed === undefined) return
+    for (const follower of followed.all) {
         if (!matchesPattern(follower.args, pattern)) continue
         // A fed copy is refreshed by the production the reload mints (7.18), and invalidated through
         // the cell it is fed from (`FOLLOWED`), whichever trigger reached it — where the entry it is
@@ -93,13 +106,14 @@ export function swept(
     member: 'invalidate' | 'refresh',
     tags: string[] | null,
 ): void {
-    for (const [rpc, followers] of FOLLOWERS)
-        for (const follower of followers) {
-            if (tags !== null && !sharesTag(follower.tags, tags)) continue
+    for (const [rpc, followed] of FOLLOWERS) {
+        if (tags !== null && !sharesTag(followed.tags, tags)) continue
+        for (const follower of followed.all) {
             if (attach(rpc as Mounted['handler'], follower) !== undefined)
                 continue
             send(follower.peer, { op: member, id: follower.id })
         }
+    }
 }
 
 function sharesTag(held: string[] | undefined, swept: string[]): boolean {
@@ -110,10 +124,14 @@ function sharesTag(held: string[] | undefined, swept: string[]): boolean {
 
 // 18.8 — AN ENTRY ANSWERED THAT NOBODY IS FED FROM: one made after a follower subscribed for its
 // args, or rebuilt after the one it was fed from was evicted. An entry already fed is the common
-// answer, and asks nothing more.
-export function feedFromServed(rpc: object, serving: unknown): void {
+// answer, and asks nothing more; one that is not reaches the followers filed under its key.
+export function feedFromServed(
+    rpc: object,
+    serving: unknown,
+    key: string,
+): void {
     if (FEEDS.has(serving as object)) return
-    const followers = FOLLOWERS.get(rpc)
+    const followers = FOLLOWERS.get(rpc)?.byKey.get(key)
     if (followers === undefined) return
     for (const follower of followers)
         attach(rpc as Mounted['handler'], follower)
@@ -125,10 +143,10 @@ export function feedFromServed(rpc: object, serving: unknown): void {
  * Only where that entry is not the one it is fed from already.
  */
 function attach(rpc: Mounted['handler'], follower: Follower): unknown {
-    const serving =
-        rpc.guarded && !follower.admitted
-            ? undefined
-            : GLOBAL_GETS.get(rpc)?.(follower.args)
+    // 18.8, 18.26 — what its own rungs or its route's refused is sent its triggers alone.
+    const serving = !follower.admitted
+        ? undefined
+        : GLOBAL_GETS.get(rpc)?.at(follower.key)
     if (serving === follower.serving) return serving
     follower.stopFeed?.()
     // A version is one entry's count, so what it was sent of another says nothing about this one.
@@ -234,8 +252,8 @@ export class MuxConnection {
             return
         }
         const id = frame.id ?? 0
-        // THE ADDRESS FROM `/__abide` ON, which is what both tables are keyed by: a browser names
-        // it as its wrapper resolved it, which is a whole URL, or a path under the app's mount.
+        // THE ADDRESS BELOW THE MOUNT, which is what the handlers are keyed by: a browser names it
+        // as its wrapper resolved it, which is a whole URL, or a path under the app's mount.
         const address = addressIn(frame.address ?? '')
         const subscriptions = this.subscriptions
         if (frame.op === 'unsub') {
@@ -244,7 +262,9 @@ export class MuxConnection {
             return
         }
         const handler =
-            frame.op === 'sub' ? this.mux.handlers.get(address) : undefined
+            frame.op === 'sub'
+                ? this.mux.handlers.get(handlerKey('GET', address))
+                : undefined
         const followed = handler?.ui ? handler : undefined
         if (followed === undefined) {
             send(this.peer, {
@@ -279,16 +299,24 @@ export class MuxConnection {
             // 18.8 — A GUARDED `GET`'s RUNGS RUN ONCE, as the subscription opens, in this
             // connection's request: one they admit is fed the value, and one they refuse is sent its
             // triggers alone.
-            let admitted = !followed.handler.guarded
+            // 18.26 — AND THE MIDDLEWARE ITS FILE'S ROUTE FILED, over the request a `GET` of it
+            // would be: one a rung answers in the handler's place is not fed, as an http call it
+            // answered would never reach the handler.
+            const routed = followed.rungs.length > 0
+            let admitted = !followed.handler.guarded && !routed
             if (!admitted) {
                 subscriptions.get(id)?.()
                 subscriptions.set(id, pending)
-                admitted = await Promise.resolve(
-                    followed.handler(args as never) as PromiseLike<unknown>,
-                ).then(
-                    () => true,
-                    () => false,
-                )
+                // No route rungs, no turn: a guarded `GET`'s rungs start in this frame's own run.
+                admitted =
+                    !routed || (await routeAdmits(this.scope, followed, args))
+                if (admitted && followed.handler.guarded)
+                    admitted = await Promise.resolve(
+                        followed.handler(args as never) as PromiseLike<unknown>,
+                    ).then(
+                        () => true,
+                        () => false,
+                    )
                 if (subscriptions.get(id) !== pending) return
             }
             follow(this, id, followed, args, frame.version, admitted)
@@ -299,6 +327,39 @@ export class MuxConnection {
     }
 }
 
+/**
+ * Whether the rungs over `mounted`'s route let a `GET` of it with `args` through, asked over the
+ * upgrade's own request at the handler's address. 18.26.
+ */
+async function routeAdmits(
+    scope: RequestScope,
+    mounted: Mounted,
+    args: unknown,
+): Promise<boolean> {
+    const upgrade = scope.request as Request
+    const asked = rpcRequest(
+        'GET',
+        mounted.address,
+        args as Record<string, unknown> | undefined,
+    )
+    const request = new Request(new URL(asked.url, upgrade.url), {
+        headers: upgrade.headers,
+        signal: upgrade.signal,
+    })
+    // REACHED BY A FLAG, not by the answer's identity: a rung that wraps or re-heads what `next`
+    // answered still let the call through, and a shared answer would carry every rung's headers.
+    let reached = false
+    try {
+        const answered = await compose(mounted.rungs, async () => {
+            reached = true
+            return new Response(null, { status: 204 })
+        })({ request })
+        return reached && answered.ok
+    } catch {
+        return false
+    }
+}
+
 /**
  * Follows a handler for `id`: its triggers always, its value where `global` and unguarded.
  *
@@ -331,26 +392,42 @@ function followWith(
     admitted: boolean,
 ): () => void {
     const rpc = mounted.handler
+    const key = GLOBAL_GETS.get(rpc)?.key(args) ?? ''
     const follower: Follower = {
         peer,
         id,
         args,
+        key,
         serving: undefined,
         stopFeed: undefined,
         sent: held,
-        tags: mounted.copy?.tags,
         admitted,
     }
     attach(rpc, follower)
-    let followers = FOLLOWERS.get(rpc)
+    let followed = FOLLOWERS.get(rpc)
+    if (followed === undefined) {
+        followed = {
+            tags: mounted.copy?.tags,
+            all: new Set(),
+            byKey: new Map(),
+        }
+        FOLLOWERS.set(rpc, followed)
+    }
+    const byKey = followed.byKey
+    let followers = byKey.get(key)
     if (followers === undefined) {
         followers = new Set()
-        FOLLOWERS.set(rpc, followers)
+        byKey.set(key, followers)
     }
     followers.add(follower)
+    const all = followed.all
+    all.add(follower)
     return () => {
         follower.stopFeed?.()
-        followers.delete(follower)
+        all.delete(follower)
+        // A key nobody follows leaves, or the index grows with every key ever followed.
+        if (followers.delete(follower) && followers.size === 0)
+            byKey.delete(key)
     }
 }
 
@@ -410,19 +487,35 @@ export function followAsEvents(
     })
 }
 
-/** One mux frame as the SSE event it is: `event`, `id` where it names a version, and `data`. */
+/**
+ * One mux frame as the SSE event it is: `event`, `id` where it names a version, and `data`.
+ *
+ * 18.6 — READ OFF THE FRAME'S HEAD, never parsed: the body was serialized once for every follower
+ * (`sendAll`), and a parse and a stringify per event stream would pay it again per follower. Every
+ * frame this module writes is `{"op":…,"id":…`, numbers named `base` or `version`, and at most one
+ * body last — so the body is the rest of the text, as it was written.
+ */
 function eventOf(text: string): string {
-    const frame = JSON.parse(text) as ServerFrame
-    const data =
-        frame.op === 'value'
-            ? JSON.stringify(frame.value ?? null)
-            : frame.op === 'patch'
-              ? JSON.stringify(frame.ops ?? [])
-              : frame.op === 'error'
-                ? JSON.stringify(frame.error ?? null)
-                : ''
-    const id = frame.version === undefined ? '' : `id: ${frame.version}\n`
-    return `event: ${frame.op}\n${id}data: ${data}\n\n`
+    const opEnd = text.indexOf('"', 7)
+    const op = text.slice(7, opEnd)
+    let id = ''
+    let data =
+        op === 'value' || op === 'error' ? 'null' : op === 'patch' ? '[]' : ''
+    // Past `,"id":` — a number, so the next comma is the next member's.
+    let at = text.indexOf(',', opEnd + 6)
+    while (at !== -1) {
+        const nameEnd = text.indexOf('"', at + 2)
+        const name = text.slice(at + 2, nameEnd)
+        const from = nameEnd + 2
+        if (name !== 'base' && name !== 'version') {
+            data = text.slice(from, -1)
+            break
+        }
+        at = text.indexOf(',', from)
+        if (name === 'version')
+            id = `id: ${text.slice(from, at === -1 ? -1 : at)}\n`
+    }
+    return `event: ${op}\n${id}data: ${data}\n\n`
 }
 
 // 18.6 — ONE WATCH PER VALUE SERVED, however many follow it, and each frame's body serialized once
@@ -516,8 +609,8 @@ function sendAll(serving: unknown, fed: Iterable<Follower>): void {
 }
 
 function addressIn(named: string): string {
-    const at = named.indexOf(ABIDE_ADDRESS)
-    return at === -1 ? named : named.slice(at)
+    const path = URL.parse(named)?.pathname ?? named
+    return unmounted(path) ?? path
 }
 
 /**