@abide/abide 0.112.0 → 0.113.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @abide/abide
 
+## 0.113.0
+
+### Minor Changes
+
+- 3c32bf6: a Store may watch — each change it reports re-reads get without running the body, and the watch stops when the value is released ([`a5539eb`](https://github.com/briancray/abide/commit/a5539eb9d1673a3b4dd98c0e35cc8d8dfb8c5e96))
+- 3c32bf6: App.run takes a principal — the claims its scope resolves from through onPrincipal, with no cookie written ([`c0db93c`](https://github.com/briancray/abide/commit/c0db93cb8f41533137a7cb3f833627bebbe9d65f))
+- 3c32bf6: under bun test with the test preload, an app that declares no ABIDE_PRINCIPAL_SECRET signs in with one the preload supplies ([`db09b9d`](https://github.com/briancray/abide/commit/db09b9d3aceeffe3d385ae295601ca9158dc2b86))
+
+### Patch Changes
+
+- 3c32bf6: an element the client builds takes the namespace the parser gives it there — a component inside an svg draws — and an xlink:href it writes is XLink's; the harness counts createElementNS and setAttributeNS ([`0dd560a`](https://github.com/briancray/abide/commit/0dd560a35d54a86d8ff5d3bc7762ed6c6968c71f))
+- 3c32bf6: a Keyed holds no entry for args its gate refuses, and the gate runs once per entry rather than on every refresh ([`1560749`](https://github.com/briancray/abide/commit/1560749419b1c571130c812fb0f6c3e2bac2a021))
+- 3c32bf6: abide check takes a url literal naming one of the framework's own fetched addresses — openapi, mcp, health, principal ([`c8af3dc`](https://github.com/briancray/abide/commit/c8af3dc746766fc5cbe322dbde551b15137c7330))
+
 ## 0.112.0
 
 ### Minor Changes

package/docs/REGISTRY.md

@@ -68,7 +68,7 @@ Accepted, Failures>` is the inner value's own `Accepted`. Then `Failures`, then
 | `reactive` | `<Accepted = undefined, Shaped = Accepted, Gate = Schema<Accepted>>(initial: undefined, options?: Omit<ReactiveOptions<Accepted, Kept<Shaped>, never>, 'schema'> & { transform?: (value: Accepted) => Shaped; schema?: Gate & Schema<Accepted> }) => Reactive<Kept<Shaped>, Accepted, Refused<Shaped> \| Gated<Gate, Accepted>>` | The undefined overload, for a value opening at `undefined`. | 4.15, 4.16 |
 | `reactive` | `<Accepted>() => Reactive<Kept<Accepted>, Accepted, Refused<Accepted>>` | The empty overload, for a value nothing has written yet. | 4.14 |
 | `Transformer` | `<Accepted, Stored, Failures = never>(value: Accepted) => Stored \| Failures` | The shape of a `transform`. | 4.6, 4.7, 4.8 |
-| `Store` | `{ get: () => Stored \| undefined \| Promise<Stored \| undefined>; set: (value: Stored, retention: { ttl: number }) => void \| Promise<void> }` | Where a value lives when this process does not. | 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8, 8.9, 8.10, 8.11, 8.12, 8.13, 8.14, 8.15, 8.16, 8.17, 8.18, 8.19 |
+| `Store` | `{ get: () => Stored \| undefined \| Promise<Stored \| undefined>; set: (value: Stored, retention: { ttl: number }) => void \| Promise<void>; watch?: (changed: () => void) => () => void }` | Where a value lives when this process does not. | 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8, 8.9, 8.10, 8.11, 8.12, 8.13, 8.14, 8.15, 8.16, 8.17, 8.18, 8.19, 8.20, 8.21 |
 | `Shared` | `interface Shared {}` | The app's declaration-merged registry of shared keys. | 10.3 |
 | `reactive.share` | `<Key extends string, Value>(key: Key, create: () => Reactive<Value>) => Key extends keyof Shared ? Reactive<Shared[Key]> : Reactive<Value>` | Get-or-create a reactive value in the component's scope by key. | 10.1, 10.2, 10.4, 10.5, 10.6, 10.7 |
 
@@ -94,7 +94,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `structural` | `(next: unknown, previous: unknown) => boolean` | The by-value comparator an app declares on `identity`. | 5.4, 5.5, 18.4 |
 | `by` | `(keyof Element & string) \| ((element: Element) => unknown)`, over the `Element` a `Stored` array holds | What tells one element of the value from another. | 5.22, 18.4, 18.15, 32.32 |
 | `ttl` | `number` | The life of a production, or of a keyed entry. | 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7, 6.8, 6.9, 6.10, 11.6, 11.35, 11.45, 11.48, 11.49, 11.69 |
-| `args` | `Schema<Args>` | The gate on a keyed value's args. | 9.4, 11.28, 11.30, 11.40, 11.41, 11.56, 11.60, 11.68 |
+| `args` | `Schema<Args>` | The gate on a keyed value's args. | 9.4, 11.28, 11.30, 11.40, 11.41, 11.56, 11.60, 11.68, 11.72 |
 | `global` | `boolean` | Opts out of the default scope into one cache shared by every caller in the process. | 11.34, 11.35, 11.36, 11.37, 11.38, 11.39, 11.53, 11.67 |
 | `tags` | `string[] \| ((args: Args) => string[])` | What a `Selection` matches on. | 11.43, 11.44, 18.4, 18.15 |
 | `throttle` | `number` | A ceiling on how often the value changes. | 5.8, 5.9, 5.11, 5.12, 5.14, 5.15, 5.17, 5.18, 5.19, 5.20, 5.21, 5.23, 5.24 |
@@ -529,7 +529,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `{expr}` | Reactive text, escaped. | 32.1, 32.23 |
 | formatting whitespace | What a run of whitespace renders as. | 33.17, 33.18 |
 | `{raw(...)}` | Raw HTML. | 32.2, 32.25, 32.26, 32.30, 32.31, 32.70 |
-| `name={expr}` | A reactive attribute or property. | 32.3, 32.20, 32.23, 32.37, 32.71 |
+| `name={expr}` | A reactive attribute or property. | 32.3, 32.20, 32.23, 32.37, 32.70, 32.71 |
 | `on<event>={fn}` | A native listener on an element, and an ordinary prop on a component. | 32.4 |
 | `name="…{expr}…"` | An interpolated quoted value. | 32.3, 32.71 |
 | `bind:value` | Two-way bind on an element. | 5.16, 32.5, 32.58, 32.59, 32.60, 32.61, 32.62, 32.72 |
@@ -564,10 +564,10 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | Spelling | Meaning | Rules |
 | --- | --- | --- |
 | `{#component Name(pattern)}` | An inline component. | 32.39, 32.40, 32.41, 32.42, 32.43, 32.44, 32.45, 32.46, 32.47, 32.48, 32.49, 32.50, 32.51, 32.52, 32.53, 32.54, 32.55, 32.63, 32.64 |
-| `<Name/>` | A component invocation. | 32.17, 32.34, 32.35, 32.36, 33.19, 33.21, 41.24, 41.28 |
+| `<Name/>` | A component invocation. | 32.17, 32.34, 32.35, 32.36, 32.70, 33.19, 33.21, 41.24, 41.28 |
 | `<slot/>` | The position children render into. | 32.18 |
 | `<slot>fallback</slot>` | Renders children, or a fallback. | 32.18 |
-| `<Tag>…</Tag>` | Children passed to a component's slot. | 32.18 |
+| `<Tag>…</Tag>` | Children passed to a component's slot. | 32.18, 32.70 |
 
 ## Props
 
@@ -629,7 +629,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `APP_NAME` | `string` | The app's name, and `log`'s default namespace. | 27.3, 28.4 |
 | `APP_VERSION` | `string` | The version beside that name. | 27.3 |
 | `APP_DATA_DIR` | `string` | The platform's per-user data directory. | 27.3, 36.4 |
-| `ABIDE_PRINCIPAL_SECRET` | `string \| null` | What seals the principal cookie. | 26.11, 36.5 |
+| `ABIDE_PRINCIPAL_SECRET` | `string \| null` | What seals the principal cookie. | 26.11, 36.5, 38.120 |
 | `ABIDE_PRINCIPAL_TTL` | `number` | The principal cookie's life, in ms. | 26.15, 26.16 |
 | `ABIDE_APP_TOKEN` | `string \| null` | The bearer the remote CLI sends. | 36.6 |
 | `ABIDE_APP_URL` | `string \| null` | Names an app somewhere else, for the remote CLI. | 36.6 |
@@ -706,7 +706,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `createApp` | `() => Promise<App>` | The app built and booted, with no socket bound. | 42.1, 42.2, 42.3, 42.4, 42.16, 37.4, 37.6, 38.100 |
 | `App` | `interface App` | What a host, a test or a script holds the app as. | 42.12, 42.13 |
 | `App.fetch` | `(request: Request) => Promise<Response>` | The whole request path, entered in process. | 42.5, 42.6 |
-| `App.run` | `<Result>(fn: () => Result \| Promise<Result>, options?: { request?: Request }) => Promise<Result>` | One scope around a function, and nothing else. | 42.7, 42.8, 11.38 |
+| `App.run` | `<Result>(fn: () => Result \| Promise<Result>, options?: { request?: Request; principal?: Record<string, unknown> }) => Promise<Result>` | One scope around a function, and nothing else. | 42.7, 42.8, 42.19, 11.38 |
 | `App.listen` | `(options?: { port?: number; hostname?: string; unix?: string }) => Promise<void>` | The socket, bound. | 42.9, 16.23, 16.56, 18.28, 18.29, 18.30 |
 | `App.stop` | `() => Promise<void>` | The drain and the teardown. | 42.10, 42.11, 42.15, 42.17, 37.4 |
 | `App[Symbol.asyncDispose]` | `() => Promise<void>` | `App.stop`, under the name `await using` calls. | 42.14 |

package/docs/RULEBOOK.md

@@ -413,6 +413,12 @@ the value of that write standing in its place.
 
 8.19 A `Store`'s `get` answering a miss with nothing left to serve MUST land an error on `s.error`.
 
+8.20 A `Store`'s `watch` MUST be called once, where the `Reactive` is constructed, and each call of
+the function it is handed MUST run `get` again as a restore, per 8.18, and MUST NOT run the body.
+
+8.21 What a `Store`'s `watch` returns MUST be called once the `Reactive` is released: a `Keyed`
+entry evicted, or the setup or request that built it, or its `Keyed`, ended.
+
 # 9. Streams and wired values
 
 9.1 A streaming producer's `Stored` MUST be the chunks accumulated so far, materialized on the
@@ -641,6 +647,9 @@ start again when the load ends.
 11.71 An unkeyed `reactive` with a `store`, built on a server outside every request, MUST NOT run
 the `store`'s `get` before it is reached.
 
+11.72 A `Keyed` MUST NOT hold an entry for an `Args` its `args` gate refuses, and the gate MUST run
+once per entry.
+
 # 12. Effects
 
 12.1 A `Disposer` MUST run before each rerun of its `Effect`, and once more at teardown.
@@ -1725,8 +1734,8 @@ the page shown, and MUST NOT where only its query or fragment does.
 30.25 A `navigate` that does not remount the page MUST NOT move the scroll, except to the element a
 fragment it carries names.
 
-30.26 `abide check` MUST refuse a `url` literal that no page route of the app (23.3) is filed under
-and no public file of the app is served at.
+30.26 `abide check` MUST refuse a `url` literal that no page route of the app (23.3) is filed under,
+no public file of the app is served at, and that is none of the four addresses 21.4 names.
 
 30.27 A `navigate` whose request fails, or whose route's chunks fail to load, MUST leave the address
 to the document, save where 30.32 holds.
@@ -2001,7 +2010,9 @@ reading layout, querying its descendants or calling `focus()` acts on a connecte
 32.69 `bind:element` on a component MUST be a build error.
 
 32.70 Markup the client parses for a slot holding a value branded by `raw`, a `{#if}` arm or a
-`{#for}` row MUST be parsed as the document's parser parses it inside the element it goes into.
+`{#for}` row MUST be parsed as the document's parser parses it inside the element it goes into, and
+an element the client builds — a component's own, or children a caller hands one — MUST take the
+namespace the document's parser gives it there, as MUST an attribute the client writes on it.
 
 32.71 A `class` or `style` attribute beside a `class:name` or `style:prop` MUST keep moving (32.3)
 and MUST write only its own classes or declarations; a class either of them holds MUST stay on the
@@ -2672,6 +2683,10 @@ it, MUST hydrate it there with that component's browser module, and MUST run eve
 hydration woke before it settles; it MUST throw where the component was not imported from a
 `.abide` and bound, or where the process has no DOM.
 
+38.120 Under `bun test` with `@abide/abide/test` preloaded, an app that declares no
+`ABIDE_PRINCIPAL_SECRET` MUST seal and verify the principal cookie with a secret the preload
+supplies, and `abide start` MUST NOT supply that secret.
+
 # 39. Head and view transitions
 
 39.1 A `<head>` element in a `.abide` file MUST contribute its children to the document head.
@@ -2990,6 +3005,10 @@ connection still answering, and MUST then run `onStop` without waiting on what i
 
 42.18 `ABIDE_STOP_TIMEOUT` MUST default to 5000.
 
+42.19 A `principal` on `App.run` MUST be the claims its scope's `principal` resolves from, through
+`onPrincipal` as a sealed cookie's are, MUST NOT write the principal cookie, and MUST give the scope
+a request where `request` is not given.
+
 # 43. The measurement harness
 
 43.1 `@abide/harness/measure`, `@abide/harness/engine` and `@abide/harness/server` MUST each be

package/docs/abide.md

@@ -2382,6 +2382,8 @@ test('the view picked is the view the next visit opens on', async () => {
 
 A `Store` is a `get` and a `set`. The value reads the store when it is built and falls back to `'board'` on a miss, and every change is written back. The reads and writes in the markup do not change.
 
+Where the stored value can change from outside the app, such as a file another program edits, the store adds `watch`. It is handed a function to call when that happens, and returns the function that stops watching. The value reads `get` again, and the body does not run.
+
 This store goes through two handlers, so the server and the browser read the same preference and the first paint is already right. A store over `localStorage` works too, but only in a browser, so the server paints the fallback first. After a write, `set` invalidates the read it made, so the next read asks the server rather than this tab's copy.
 
 ## Next
@@ -3718,7 +3720,6 @@ export default POST(() => principal.clear(), { description: 'Signs out.' })
 import { expect, test } from 'bun:test'
 import { principal } from '@abide/abide'
 import { createApp } from '@abide/abide/server'
-import { asMember } from './signedIn.ts'
 
 const signIn = (email: string) =>
     new Request('http://crm.invalid/account/signIn', {
@@ -3727,17 +3728,28 @@ const signIn = (email: string) =>
         body: JSON.stringify({ email }),
     })
 
-test('signing in seals the caller into an HttpOnly cookie', async () => {
+test('signing in seals the id into an HttpOnly cookie', async () => {
     await using app = await createApp()
     const answer = await app.fetch(signIn('maya@crm.example'))
     const [sealed = ''] = answer.headers.getSetCookie()
     expect(sealed).toStartWith('abide-principal=')
     expect(sealed).toContain('HttpOnly')
+
+    // The seal is a JWT; its payload is the id, and the times abide adds.
+    const token = sealed.split(';')[0]?.split('=')[1] ?? ''
+    const payload = JSON.parse(
+        Buffer.from(token.split('.')[1] ?? '', 'base64url').toString(),
+    )
+    expect(Object.keys(payload).sort()).toEqual(['exp', 'iat', 'id'])
 })
 
 test('a request carrying the cookie is signed in', async () => {
     await using app = await createApp()
-    const request = await asMember(app, 'maya@crm.example')
+    const answer = await app.fetch(signIn('maya@crm.example'))
+    const [sealed = ''] = answer.headers.getSetCookie()
+    const request = new Request('http://crm.invalid/', {
+        headers: { cookie: sealed.split(';')[0] ?? '' },
+    })
     const signedIn = await app.run(async () => await principal.authenticated, {
         request,
     })
@@ -3749,7 +3761,7 @@ test('a request carrying the cookie is signed in', async () => {
 
 The answer also tells the browser the caller changed. Every tab of the site reads `principal` again, so the form's own button flips with nothing passed to it.
 
-The seal is a JWT signed with `ABIDE_PRINCIPAL_SECRET`, and it lives for `ABIDE_PRINCIPAL_TTL` milliseconds, a week unless you set it. The chapter app keeps a development secret in its `.env`, so set your own wherever the app is deployed. A comma-separated list rotates a secret in: the first signs, and every one verifies.
+The seal is a JWT signed with `ABIDE_PRINCIPAL_SECRET`, and it lives for `ABIDE_PRINCIPAL_TTL` milliseconds, a week unless you set it. The chapter app keeps a development secret in its `.env`, so set your own wherever the app is deployed. A comma-separated list rotates a secret in: the first signs, and every one verifies. Under `bun test` an app that sets no secret is given one, so a test signs in from a fresh clone.
 
 | Read | What it is |
 | --- | --- |
@@ -3808,21 +3820,11 @@ onPrincipal((claims) => {
 import { expect, test } from 'bun:test'
 import { principal } from '@abide/abide'
 import { createApp } from '@abide/abide/server'
-import { asMember } from './signedIn.ts'
 
-test('the cookie holds an id, and the request reads the member', async () => {
+test('the claims resolve to the member they name', async () => {
     await using app = await createApp()
-    const request = await asMember(app, 'theo@crm.example')
-
-    // The seal is a JWT; its payload is the id, and the times abide adds.
-    const sealed = request.headers.get('cookie') ?? ''
-    const payload = JSON.parse(
-        Buffer.from(sealed.split('.')[1] ?? '', 'base64url').toString(),
-    )
-    expect(Object.keys(payload).sort()).toEqual(['exp', 'iat', 'id'])
-
     const member = await app.run(async () => await principal.resolved, {
-        request,
+        principal: { id: 'theo' },
     })
     expect(member.name).toBe('Theo Park')
     expect(member.role).toBe('sales')
@@ -3831,6 +3833,8 @@ test('the cookie holds an id, and the request reads the member', async () => {
 
 `onPrincipal` is handed the claims and returns your half of the caller. It runs on the server, at most once per request, where the team records are. So the cookie stays small, and a rename shows on the next request rather than at the next sign-in. Filed in any handler file or `.abide`, it resolves the caller for every route.
 
+A test signs in without the cookie. `app.run(fn, { principal: { id: 'theo' } })` hands those claims to `onPrincipal` as a sealed cookie's are, and the card's test reads the member they name.
+
 What it returns is read as `principal.resolved`, typed by `Principal`. Declare your fields on that interface, as the app's `lib/TEAM.server.ts` does beside the team it reads. abide's own three fields are `authenticated`, `expiresAt` and `error`, and they win any collision, so a resolver cannot sign a caller in by returning `authenticated: true`. A resolver that throws fills `error` and leaves the caller signed out.
 
 The tabs on this card, the deal-value card and the export card are `lib/SignInAs.abide`, which calls the same `signIn` handler.
@@ -3934,19 +3938,20 @@ export default GET(
 import { expect, test } from 'bun:test'
 import { createApp } from '@abide/abide/server'
 import getContact from '../getContact.ts'
-import { asMember } from './signedIn.ts'
 
 test('an admin reads the deal value', async () => {
     await using app = await createApp()
-    const request = await asMember(app, 'maya@crm.example')
-    const contact = await app.run(async () => await getContact(), { request })
+    const contact = await app.run(async () => await getContact(), {
+        principal: { id: 'maya' },
+    })
     expect(contact.dealValue).toBe('$48,000')
 })
 
 test('sales reads the rest of the contact', async () => {
     await using app = await createApp()
-    const request = await asMember(app, 'theo@crm.example')
-    const contact = await app.run(async () => await getContact(), { request })
+    const contact = await app.run(async () => await getContact(), {
+        principal: { id: 'theo' },
+    })
     expect(contact.name).toBe('Grace Hopper')
     expect(contact.dealValue).toBeUndefined()
 })
@@ -4009,23 +4014,24 @@ export default POST(async () => CONTACTS, {
 import { expect, test } from 'bun:test'
 import { createApp } from '@abide/abide/server'
 import exportContacts from '../exportContacts.ts'
-import { asMember } from './signedIn.ts'
 
 test('an admin exports every contact', async () => {
     await using app = await createApp()
-    const request = await asMember(app, 'maya@crm.example')
     const contacts = await app.run(async () => await exportContacts(), {
-        request,
+        principal: { id: 'maya' },
     })
     expect(contacts).toHaveLength(3)
 })
 
 test('sales and a signed-out caller are refused 403', async () => {
     await using app = await createApp()
-    for (const email of ['theo@crm.example', undefined]) {
-        const request = await asMember(app, email)
+    const callers = [
+        { principal: { id: 'theo' } },
+        { request: new Request('http://crm.invalid/') },
+    ]
+    for (const caller of callers) {
         try {
-            await app.run(async () => await exportContacts(), { request })
+            await app.run(async () => await exportContacts(), caller)
             throw new Error('the export was not refused')
         } catch (refusal) {
             if (!exportContacts.isError(refusal, 'HttpError')) throw refusal
@@ -4961,13 +4967,13 @@ A handler file already carries an address, a method, an argument type and a desc
 
 ```abide src/assistant/lib/OpenApiOperation.abide
 <script>
-import { reactive, type RouteLiteral, url } from '@abide/abide'
+import { reactive, url } from '@abide/abide'
 
 type Operation = { description: string; parameters: object[] }
 let operation = reactive('')
 
 async function readDocument() {
-    const answer = await fetch(url('/__abide/openapi.json' as RouteLiteral))
+    const answer = await fetch(url('/__abide/openapi.json'))
     const document: { paths: Record<string, { get: Operation }> } =
         await answer.json()
     for (const [path, { get }] of Object.entries(document.paths))
@@ -5046,7 +5052,7 @@ abide openapi > openapi.json
 
 ```abide src/assistant/lib/ModelToolCall.abide
 <script>
-import { reactive, type RouteLiteral, url } from '@abide/abide'
+import { reactive, url } from '@abide/abide'
 
 let tool = reactive('—')
 let description = reactive('—')
@@ -5054,7 +5060,7 @@ let answer = reactive('—')
 
 // One JSON-RPC message to the app's MCP endpoint, as a model's client sends it.
 async function ask(method: string, params: object) {
-    const reply = await fetch(url('/__abide/mcp' as RouteLiteral), {
+    const reply = await fetch(url('/__abide/mcp'), {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }),
@@ -5147,14 +5153,14 @@ abide mcp --url https://crm.example
 
 ```abide src/assistant/lib/WithheldExport.abide
 <script>
-import { reactive, type RouteLiteral, url } from '@abide/abide'
+import { reactive, url } from '@abide/abide'
 import exportContacts from '../exportContacts.ts'
 
 let listed = reactive('—')
 let answers = reactive('—')
 
 async function check() {
-    const reply = await fetch(url('/__abide/mcp' as RouteLiteral), {
+    const reply = await fetch(url('/__abide/mcp'), {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
@@ -5743,7 +5749,7 @@ test('the summary answers in process as it does on the wire', async () => {
 | --- | --- |
 | `App` | what `createApp` hands back, to a test, a script or a host |
 | `App.fetch` | one request, through the whole app, in this process |
-| `App.run` | runs a function inside one request's scope, so two reads of one key load once |
+| `App.run` | runs a function inside one request's scope, so two reads of one key load once, signed in as the `principal` claims you give it |
 | `App.listen` | binds the socket, for a test that needs a real `WebSocket` |
 | `App.stop` | drains what is in flight, then runs `onStop` |
 | `App[Symbol.asyncDispose]` | `stop`, under the name `await using` calls |
@@ -6827,7 +6833,7 @@ Arrive here knowing which name you want. Each page is read off the registry: the
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `Store` | `{ get: () => Stored \| undefined \| Promise<Stored \| undefined>; set: (value: Stored, retention: { ttl: number }) => void \| Promise<void> }` | Where a value lives when this process does not. | [8.1](/rulebook#8.1), [8.2](/rulebook#8.2), [8.3](/rulebook#8.3), [8.4](/rulebook#8.4), [8.5](/rulebook#8.5), [8.6](/rulebook#8.6), [8.7](/rulebook#8.7), [8.8](/rulebook#8.8), [8.9](/rulebook#8.9), [8.10](/rulebook#8.10), [8.11](/rulebook#8.11), [8.12](/rulebook#8.12), [8.13](/rulebook#8.13), [8.14](/rulebook#8.14), [8.15](/rulebook#8.15), [8.16](/rulebook#8.16), [8.17](/rulebook#8.17), [8.18](/rulebook#8.18), [8.19](/rulebook#8.19) |
+| `Store` | `{ get: () => Stored \| undefined \| Promise<Stored \| undefined>; set: (value: Stored, retention: { ttl: number }) => void \| Promise<void>; watch?: (changed: () => void) => () => void }` | Where a value lives when this process does not. | [8.1](/rulebook#8.1), [8.2](/rulebook#8.2), [8.3](/rulebook#8.3), [8.4](/rulebook#8.4), [8.5](/rulebook#8.5), [8.6](/rulebook#8.6), [8.7](/rulebook#8.7), [8.8](/rulebook#8.8), [8.9](/rulebook#8.9), [8.10](/rulebook#8.10), [8.11](/rulebook#8.11), [8.12](/rulebook#8.12), [8.13](/rulebook#8.13), [8.14](/rulebook#8.14), [8.15](/rulebook#8.15), [8.16](/rulebook#8.16), [8.17](/rulebook#8.17), [8.18](/rulebook#8.18), [8.19](/rulebook#8.19), [8.20](/rulebook#8.20), [8.21](/rulebook#8.21) |
 
 ## Taught in
 
@@ -6869,7 +6875,7 @@ Arrive here knowing which name you want. Each page is read off the registry: the
 | `identity` | `(next: Stored, previous: Stored) => unknown` | What makes it the same value. | [5.1](/rulebook#5.1), [5.2](/rulebook#5.2), [5.3](/rulebook#5.3), [5.4](/rulebook#5.4), [5.5](/rulebook#5.5), [9.3](/rulebook#9.3), [11.17](/rulebook#11.17), [18.4](/rulebook#18.4) |
 | `by` | `(keyof Element & string) \| ((element: Element) => unknown)`, over the `Element` a `Stored` array holds | What tells one element of the value from another. | [5.22](/rulebook#5.22), [18.4](/rulebook#18.4), [18.15](/rulebook#18.15), [32.32](/rulebook#32.32) |
 | `ttl` | `number` | The life of a production, or of a keyed entry. | [6.1](/rulebook#6.1), [6.2](/rulebook#6.2), [6.3](/rulebook#6.3), [6.4](/rulebook#6.4), [6.5](/rulebook#6.5), [6.6](/rulebook#6.6), [6.7](/rulebook#6.7), [6.8](/rulebook#6.8), [6.9](/rulebook#6.9), [6.10](/rulebook#6.10), [11.6](/rulebook#11.6), [11.35](/rulebook#11.35), [11.45](/rulebook#11.45), [11.48](/rulebook#11.48), [11.49](/rulebook#11.49), [11.69](/rulebook#11.69) |
-| `args` | `Schema<Args>` | The gate on a keyed value's args. | [9.4](/rulebook#9.4), [11.28](/rulebook#11.28), [11.30](/rulebook#11.30), [11.40](/rulebook#11.40), [11.41](/rulebook#11.41), [11.56](/rulebook#11.56), [11.60](/rulebook#11.60), [11.68](/rulebook#11.68) |
+| `args` | `Schema<Args>` | The gate on a keyed value's args. | [9.4](/rulebook#9.4), [11.28](/rulebook#11.28), [11.30](/rulebook#11.30), [11.40](/rulebook#11.40), [11.41](/rulebook#11.41), [11.56](/rulebook#11.56), [11.60](/rulebook#11.60), [11.68](/rulebook#11.68), [11.72](/rulebook#11.72) |
 | `global` | `boolean` | Opts out of the default scope into one cache shared by every caller in the process. | [11.34](/rulebook#11.34), [11.35](/rulebook#11.35), [11.36](/rulebook#11.36), [11.37](/rulebook#11.37), [11.38](/rulebook#11.38), [11.39](/rulebook#11.39), [11.53](/rulebook#11.53), [11.67](/rulebook#11.67) |
 | `tags` | `string[] \| ((args: Args) => string[])` | What a `Selection` matches on. | [11.43](/rulebook#11.43), [11.44](/rulebook#11.44), [18.4](/rulebook#18.4), [18.15](/rulebook#18.15) |
 | `throttle` | `number` | A ceiling on how often the value changes. | [5.8](/rulebook#5.8), [5.9](/rulebook#5.9), [5.11](/rulebook#5.11), [5.12](/rulebook#5.12), [5.14](/rulebook#5.14), [5.15](/rulebook#5.15), [5.17](/rulebook#5.17), [5.18](/rulebook#5.18), [5.19](/rulebook#5.19), [5.20](/rulebook#5.20), [5.21](/rulebook#5.21), [5.23](/rulebook#5.23), [5.24](/rulebook#5.24) |
@@ -8628,7 +8634,7 @@ Generated surfaces: what is written in place rather than imported.
 | `{expr}` | Reactive text, escaped. | [32.1](/rulebook#32.1), [32.23](/rulebook#32.23) |
 | formatting whitespace | What a run of whitespace renders as. | [33.17](/rulebook#33.17), [33.18](/rulebook#33.18) |
 | `{raw(...)}` | Raw HTML. | [32.2](/rulebook#32.2), [32.25](/rulebook#32.25), [32.26](/rulebook#32.26), [32.30](/rulebook#32.30), [32.31](/rulebook#32.31), [32.70](/rulebook#32.70) |
-| `name={expr}` | A reactive attribute or property. | [32.3](/rulebook#32.3), [32.20](/rulebook#32.20), [32.23](/rulebook#32.23), [32.37](/rulebook#32.37), [32.71](/rulebook#32.71) |
+| `name={expr}` | A reactive attribute or property. | [32.3](/rulebook#32.3), [32.20](/rulebook#32.20), [32.23](/rulebook#32.23), [32.37](/rulebook#32.37), [32.70](/rulebook#32.70), [32.71](/rulebook#32.71) |
 | `on<event>={fn}` | A native listener on an element, and an ordinary prop on a component. | [32.4](/rulebook#32.4) |
 | `name="…{expr}…"` | An interpolated quoted value. | [32.3](/rulebook#32.3), [32.71](/rulebook#32.71) |
 | `bind:value` | Two-way bind on an element. | [5.16](/rulebook#5.16), [32.5](/rulebook#32.5), [32.58](/rulebook#32.58), [32.59](/rulebook#32.59), [32.60](/rulebook#32.60), [32.61](/rulebook#32.61), [32.62](/rulebook#32.62), [32.72](/rulebook#32.72) |
@@ -8656,10 +8662,10 @@ Generated surfaces: what is written in place rather than imported.
 | Spelling | Meaning | Rules |
 | --- | --- | --- |
 | `{#component Name(pattern)}` | An inline component. | [32.39](/rulebook#32.39), [32.40](/rulebook#32.40), [32.41](/rulebook#32.41), [32.42](/rulebook#32.42), [32.43](/rulebook#32.43), [32.44](/rulebook#32.44), [32.45](/rulebook#32.45), [32.46](/rulebook#32.46), [32.47](/rulebook#32.47), [32.48](/rulebook#32.48), [32.49](/rulebook#32.49), [32.50](/rulebook#32.50), [32.51](/rulebook#32.51), [32.52](/rulebook#32.52), [32.53](/rulebook#32.53), [32.54](/rulebook#32.54), [32.55](/rulebook#32.55), [32.63](/rulebook#32.63), [32.64](/rulebook#32.64) |
-| `<Name/>` | A component invocation. | [32.17](/rulebook#32.17), [32.34](/rulebook#32.34), [32.35](/rulebook#32.35), [32.36](/rulebook#32.36), [33.19](/rulebook#33.19), [33.21](/rulebook#33.21), [41.24](/rulebook#41.24), [41.28](/rulebook#41.28) |
+| `<Name/>` | A component invocation. | [32.17](/rulebook#32.17), [32.34](/rulebook#32.34), [32.35](/rulebook#32.35), [32.36](/rulebook#32.36), [32.70](/rulebook#32.70), [33.19](/rulebook#33.19), [33.21](/rulebook#33.21), [41.24](/rulebook#41.24), [41.28](/rulebook#41.28) |
 | `<slot/>` | The position children render into. | [32.18](/rulebook#32.18) |
 | `<slot>fallback</slot>` | Renders children, or a fallback. | [32.18](/rulebook#32.18) |
-| `<Tag>…</Tag>` | Children passed to a component's slot. | [32.18](/rulebook#32.18) |
+| `<Tag>…</Tag>` | Children passed to a component's slot. | [32.18](/rulebook#32.18), [32.70](/rulebook#32.70) |
 
 ## Script / style blocks
 
@@ -8837,7 +8843,7 @@ Configuration: what is written in place rather than imported.
 | `APP_NAME` | `string` | The app's name, and `log`'s default namespace. | [27.3](/rulebook#27.3), [28.4](/rulebook#28.4) |
 | `APP_VERSION` | `string` | The version beside that name. | [27.3](/rulebook#27.3) |
 | `APP_DATA_DIR` | `string` | The platform's per-user data directory. | [27.3](/rulebook#27.3), [36.4](/rulebook#36.4) |
-| `ABIDE_PRINCIPAL_SECRET` | `string \| null` | What seals the principal cookie. | [26.11](/rulebook#26.11), [36.5](/rulebook#36.5) |
+| `ABIDE_PRINCIPAL_SECRET` | `string \| null` | What seals the principal cookie. | [26.11](/rulebook#26.11), [36.5](/rulebook#36.5), [38.120](/rulebook#38.120) |
 | `ABIDE_PRINCIPAL_TTL` | `number` | The principal cookie's life, in ms. | [26.15](/rulebook#26.15), [26.16](/rulebook#26.16) |
 | `ABIDE_APP_TOKEN` | `string \| null` | The bearer the remote CLI sends. | [36.6](/rulebook#36.6) |
 | `ABIDE_APP_URL` | `string \| null` | Names an app somewhere else, for the remote CLI. | [36.6](/rulebook#36.6) |
@@ -9177,7 +9183,7 @@ Configuration: what is written in place rather than imported.
 | --- | --- | --- | --- |
 | `App` | `interface App` | What a host, a test or a script holds the app as. | [42.12](/rulebook#42.12), [42.13](/rulebook#42.13) |
 | `App.fetch` | `(request: Request) => Promise<Response>` | The whole request path, entered in process. | [42.5](/rulebook#42.5), [42.6](/rulebook#42.6) |
-| `App.run` | `<Result>(fn: () => Result \| Promise<Result>, options?: { request?: Request }) => Promise<Result>` | One scope around a function, and nothing else. | [42.7](/rulebook#42.7), [42.8](/rulebook#42.8), [11.38](/rulebook#11.38) |
+| `App.run` | `<Result>(fn: () => Result \| Promise<Result>, options?: { request?: Request; principal?: Record<string, unknown> }) => Promise<Result>` | One scope around a function, and nothing else. | [42.7](/rulebook#42.7), [42.8](/rulebook#42.8), [42.19](/rulebook#42.19), [11.38](/rulebook#11.38) |
 | `App.listen` | `(options?: { port?: number; hostname?: string; unix?: string }) => Promise<void>` | The socket, bound. | [42.9](/rulebook#42.9), [16.23](/rulebook#16.23), [16.56](/rulebook#16.56), [18.28](/rulebook#18.28), [18.29](/rulebook#18.29), [18.30](/rulebook#18.30) |
 | `App.stop` | `() => Promise<void>` | The drain and the teardown. | [42.10](/rulebook#42.10), [42.11](/rulebook#42.11), [42.15](/rulebook#42.15), [42.17](/rulebook#42.17), [37.4](/rulebook#37.4) |
 | `App[Symbol.asyncDispose]` | `() => Promise<void>` | `App.stop`, under the name `await using` calls. | [42.14](/rulebook#42.14) |

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@abide/abide",
-    "version": "0.112.0",
+    "version": "0.113.0",
     "type": "module",
     "description": "Isomorphic type-safe framework for reactive async interfaces for humans and machines",
     "license": "MIT",

package/src/compiler/appLayout.ts

@@ -1,6 +1,12 @@
 import { relative as relativeTo } from 'node:path' // bun exposes no path helpers of its own
 import { appFiles } from '#server/appTree.ts'
 import { type Placement, placement, routeOf } from '#server/placement.ts'
+import {
+    HEALTH_ADDRESS,
+    MCP_ADDRESS,
+    OPENAPI_ADDRESS,
+    PRINCIPAL_ADDRESS,
+} from '#shared/ADDRESSES.ts'
 import { LAUNCHER_PAGE } from '#shared/LAUNCHER_FILES.ts'
 import {
     coversRoute,
@@ -76,7 +82,7 @@ export type AppLayout = {
     errors: AppRoute[]
     /** Every public file's source path to its address. 36.11. */
     published: Map<string, string>
-    /** 30.26 — every address a link may name: a page's, and a public file's. */
+    /** 30.26 — every address a link may name: a page's, a public file's, and 21.4's four. */
     addresses: string[]
     /** What the tree refuses, each at its file; a build stops naming every one. */
     refused: Diagnosis[]
@@ -150,6 +156,7 @@ export async function appLayout(root: string): Promise<AppLayout> {
     const addresses = new Set<string>()
     for (const route of routes) addresses.add(route.pattern)
     for (const address of published.values()) addresses.add(address)
+    for (const address of FETCHED_ADDRESSES) addresses.add(address)
     return {
         root,
         sources,
@@ -165,6 +172,14 @@ export async function appLayout(root: string): Promise<AppLayout> {
     }
 }
 
+// 30.26, 21.4 — the framework's own addresses an app fetches, which every app answers at.
+const FETCHED_ADDRESSES = [
+    OPENAPI_ADDRESS,
+    MCP_ADDRESS,
+    HEALTH_ADDRESS,
+    PRINCIPAL_ADDRESS,
+]
+
 /** The file at each of `paths`, read. The reads overlap. */
 function textsAt(
     paths: readonly string[],

package/src/compiler/classifyTemplate.ts

@@ -532,11 +532,11 @@ export function isSingleRooted(children: TemplateNode[]): boolean {
     )
 }
 
-// CONTENT ONLY THE PARSER MAKES RIGHT, which is what a row the browser BUILDS cannot reproduce with
-// `createElement` and `appendChild`: an `<svg>` or `<math>` subtree lives in another namespace (and
-// the parser fixes the case of `linearGradient`), a raw-text element's contents are not decoded
-// the way body text is, and a `<template>`'s children go into its `content`. A row that touches any
-// of it is left to the parser — the general path, as the fallback it is.
+// CONTENT A ROW THE BROWSER BUILDS LEAVES TO THE PARSER: an `<svg>` or `<math>` that opens its
+// namespace inside the row (a build only carries one in, off the parent it goes into — 32.70), a
+// raw-text element's contents, which are not decoded the way body text is, and a `<template>`'s
+// children, which go into its `content`. A row that touches any of it is left to the parser — the
+// general path, as the fallback it is.
 const PARSER_OWNED = new Set([
     'svg',
     'math',

package/src/compiler/emitClient.ts

@@ -7,6 +7,11 @@ import {
 } from '#shared/ANCHORS.ts'
 import { anchorMarkup } from '#shared/anchorMarkup.ts'
 import { CHILDREN } from '#shared/CHILDREN.ts'
+import { FOREIGN_ATTRIBUTES } from '#shared/FOREIGN_ATTRIBUTES.ts'
+import {
+    HTML_NAMESPACE,
+    INTEGRATION_POINTS,
+} from '#shared/INTEGRATION_POINTS.ts'
 import { RUNTIME_SPECIFIER, SHARED_SPECIFIER } from '#shared/SPECIFIERS.ts'
 import { type CheckerAnswer, UNCHECKED } from './CheckerAnswer.ts'
 import {
@@ -880,6 +885,9 @@ const SHARE_AT = '__shareAt'
 const PARENT = '__parent'
 // The document a built region makes its nodes with, read off `PARENT` once a build.
 const DOCUMENT = '__document'
+// The namespace a built region's top-level elements take, read off `PARENT` once a build.
+const SPACE = '__space'
+const HTML_SPACE = JSON.stringify(HTML_NAMESPACE)
 
 // A run's anchors while it holds markup (32.30), as the JS string literals a built run parses with.
 const RAW_OPEN_MARKUP = JSON.stringify(anchorMarkup(RAW_OPEN))
@@ -942,17 +950,29 @@ function emitMaker(
  *
  * A NESTED REGION IS AN EMPTY ANCHOR PAIR, filled by its own machinery on the mount's first run
  * (`fillEmpty`), and a component or a slot is the same pair filled by the child.
+ *
+ * 32.70 — AN ELEMENT IS BUILT IN THE NAMESPACE THE PARSER WOULD GIVE IT, read off the parent it goes
+ * into (`namespaceUnder`) rather than decided here: a component's root does not know it is invoked
+ * inside an `<svg>`, and a `<g>` made with `createElement` is an HTML element that draws nothing.
+ * Read once a build, and again only below an `<annotation-xml>`, which reads its children as HTML by
+ * the encoding it declares; below any other integration point (`INTEGRATION_POINTS`) a child is
+ * HTML's, and everywhere else it takes its parent's. `createElementNS` with
+ * HTML's namespace costs what `createElement` does (Chromium, 2026-10-22), and a build that makes
+ * no top-level element reads none.
  */
 function emitBuild(row: Cursor, anchored: boolean, lowering: Lowering): string {
     const lines: string[] = [
         `const ${DOCUMENT} = ${PARENT}.ownerDocument`,
         'const __built = []',
     ]
+    let readsSpace = false
     if (anchored)
         lines.push(
             `__built.push(${DOCUMENT}.createComment(${JSON.stringify(ROW_OPEN)}))`,
         )
     const render = buildRender(lowering)
+    // The expression each built element's namespace was, for its children to take.
+    const spaceOf = new Map<PlacedNode, string>()
     const into = (at: PlacedNode, node: string): string =>
         at.within === null
             ? `__built.push(${node})`
@@ -975,8 +995,19 @@ function emitBuild(row: Cursor, anchored: boolean, lowering: Lowering): string {
             for (const line of builtRun(at, lowering, into)) lines.push(line)
             continue
         }
+        const within = at.within
+        const space =
+            within === null
+                ? SPACE
+                : INTEGRATION_POINTS.has(within.tag)
+                  ? HTML_SPACE
+                  : within.tag === 'annotation-xml'
+                    ? `${lowering.use('namespaceUnder')}(${within.name})`
+                    : (spaceOf.get(within) ?? SPACE)
+        if (space === SPACE) readsSpace = true
+        spaceOf.set(at, space)
         lines.push(
-            `const ${at.name} = ${DOCUMENT}.createElement(${JSON.stringify(at.tag)})`,
+            `const ${at.name} = ${DOCUMENT}.createElementNS(${space}, ${JSON.stringify(at.tag)})`,
         )
         for (const one of classifyAttributes(
             at.holder as ElementNode,
@@ -984,7 +1015,13 @@ function emitBuild(row: Cursor, anchored: boolean, lowering: Lowering): string {
         )) {
             const value = builtAttribute(one, lowering, render)
             if (value === null) continue
-            const set = `${at.name}.setAttribute(${JSON.stringify(one.kind === 'merged' ? one.group?.name : one.attribute.name)}, `
+            const name =
+                one.kind === 'merged' ? one.group?.name : one.attribute.name
+            // 32.70 — one the parser would put in a namespace is written in it (`addAttribute`).
+            const set =
+                name !== undefined && FOREIGN_ATTRIBUTES.has(name)
+                    ? `${lowering.use('addAttribute')}(${at.name}, ${JSON.stringify(name)}, `
+                    : `${at.name}.setAttribute(${JSON.stringify(name)}, `
             // 32.37 — a whole-value attribute may be absent, which the server wrote as nothing.
             lines.push(
                 one.kind === 'dynamic'
@@ -994,6 +1031,12 @@ function emitBuild(row: Cursor, anchored: boolean, lowering: Lowering): string {
         }
         lines.push(into(at, at.name))
     }
+    if (readsSpace)
+        lines.splice(
+            1,
+            0,
+            `const ${SPACE} = ${lowering.use('namespaceUnder')}(${PARENT})`,
+        )
     lines.push('return __built')
     return lines.join('\n    ')
 }

package/src/server/commands.ts

@@ -6,6 +6,7 @@
 import { resolve } from 'node:path' // bun exposes no path helpers of its own
 import { parseArgs } from 'node:util' // bun exposes no argv parser of its own yet
 import { MCP_ADDRESS, OPENAPI_ADDRESS } from '#shared/ADDRESSES.ts'
+import { IN_PROCESS_ORIGIN } from '#shared/IN_PROCESS_ORIGIN.ts'
 import { banner } from './banner.ts'
 import { type App, type AppHandle, enterApp } from './createApp.ts'
 import { stopOnSignalOrFault } from './faultPolicy.ts'
@@ -494,7 +495,7 @@ async function surfaceAt(
     const booted = await booting(host, app, given)
     if (typeof booted === 'number') return booted
     return (init) =>
-        booted.fetch(new Request(`http://abide.local${address}`, init))
+        booted.fetch(new Request(`${IN_PROCESS_ORIGIN}${address}`, init))
 }
 
 /**

package/src/server/config.ts

@@ -49,6 +49,16 @@ export interface Config {
     APP_DATA_DIR: string
 }
 
+// What a preload derives beside 27.3's three — the test preload's principal secret (38.120). Declared
+// above `config`, which resolves as it is built — and so is invalidated by an addition.
+const ADDED: Record<string, string> = {}
+
+/** Adds `values` to the derived layer, so every `onConfig` default and the env still win (27.2). */
+export function addDerived(values: Record<string, string>): void {
+    Object.assign(ADDED, values)
+    config.invalidate()
+}
+
 /** The resolved configuration: abide's derived values, then `onConfig`'s defaults, then the env. */
 export const config = reactive(resolve, { global: true })
 
@@ -100,7 +110,8 @@ function coerce(text: string, standing: unknown): unknown {
 }
 
 /**
- * The app's name, version and data directory, off its own `package.json` and the platform.
+ * The app's name, version and data directory, off its own `package.json` and the platform, and
+ * what `addDerived` added.
  *
  * 27.3 — a layer under the other two, so a config or an environment that carries one wins.
  */
@@ -108,6 +119,7 @@ function derived(): Record<string, string> {
     const manifest = APP_PACKAGE.current
     const name = manifest.name ?? 'app'
     return {
+        ...ADDED,
         APP_NAME: name,
         APP_VERSION: manifest.version ?? '0.0.0',
         // 36.4 — A PATH, and never created: an app that wants the directory makes it.

package/src/server/createApp.ts

@@ -7,6 +7,7 @@ import { existsSync } from 'node:fs' // bun exposes no sync existence check of i
 import { resolve } from 'node:path' // bun exposes no path helpers of its own
 import { FAILURE_STATUS_TEXT } from '#shared/FAILURE_STATUS_TEXT.ts'
 import { framingOf } from '#shared/framing.ts'
+import { IN_PROCESS_ORIGIN } from '#shared/IN_PROCESS_ORIGIN.ts'
 import { LONGEST_DELAY } from '#shared/LONGEST_DELAY.ts'
 import { namedLogger } from '#shared/log.ts'
 import { compose } from '#shared/Middleware.ts'
@@ -32,6 +33,7 @@ import { IDLE_TIMEOUT_SECONDS } from './IDLE_TIMEOUT_SECONDS.ts'
 import { installServer } from './installServer.ts'
 import { admitsMux, muxSocketOptions, upgraded } from './muxUpgrade.ts'
 import { plainAnswer } from './plainAnswer.ts'
+import { presumePrincipal } from './principal.ts'
 import { realOrAsGiven } from './realOrAsGiven.ts'
 import {
     type AnsweringApp,
@@ -60,7 +62,7 @@ export interface App {
     fetch(request: Request): Promise<Response>
     run<Result>(
         fn: () => Result | Promise<Result>,
-        options?: { request?: Request },
+        options?: { request?: Request; principal?: Record<string, unknown> },
     ): Promise<Result>
     listen(options?: {
         port?: number
@@ -289,11 +291,21 @@ export async function bootEntered(
     let stopping = false
     let bound: Bun.Server<unknown> | undefined
 
-    const run = async <Result>(
-        fn: () => Result | Promise<Result>,
-        options?: { request?: Request },
-    ): Promise<Result> =>
-        inReleasedScope(options?.request, async () => await fn(), answering)
+    const run: App['run'] = async (fn, options) => {
+        const claims = options?.principal
+        // 42.19 — a principal is a request's, so one given alone is given a request to be.
+        const request =
+            options?.request ??
+            (claims === undefined ? undefined : new Request(IN_PROCESS_ORIGIN))
+        return inReleasedScope(
+            request,
+            async () => {
+                if (claims !== undefined) presumePrincipal(claims)
+                return await fn()
+            },
+            answering,
+        )
+    }
 
     const fetch = async (given: Request): Promise<Response> => {
         if (stopping) return plainAnswer('the app is stopping', 503)

package/src/server/preload.ts

@@ -5,8 +5,13 @@
 // one place that runs first. The build is `createApp`'s own under `bun test` (42.16), so a test that
 // boots the app afterwards reuses it rather than building twice.
 
+import { addDerived } from './config.ts'
 import { appRoot, servedBuild } from './createApp.ts'
 
+// 38.120 — a sign-in seals under test where the app declared no secret: derived, so the app's
+// `onConfig` default and the env both still win (27.2), where an env value would beat the default.
+addDerived({ ABIDE_PRINCIPAL_SECRET: 'abide-test-principal-secret' })
+
 const root = appRoot(undefined)
 // A run from a directory that holds no app preloads nothing — nor from a workspace's root, whose
 // packages' `.abide` files are each their own app's rather than one app laid out across them.

package/src/server/principal.ts

@@ -195,6 +195,20 @@ function resolvePrincipal(): Promise<Principal> {
     return scope.principal
 }
 
+/**
+ * This request's principal, resolved from `claims` as a sealed cookie's are, with no cookie written.
+ *
+ * 42.19 — `App.run`'s `principal`, which is why it throws where `principal.set` does.
+ */
+export function presumePrincipal(claims: Record<string, unknown>): void {
+    const scope = within('App.run principal')
+    if (!isRecord(claims))
+        throw new Error(
+            'abide: App.run takes a principal of claims, as principal.set does. RULEBOOK 26.11.',
+        )
+    scope.principal = documentOf(claims, Date.now() + ttl())
+}
+
 /**
  * Signs this caller in with `claims`, sealing them into the cookie.
  *

package/src/shared/FOREIGN_ATTRIBUTES.ts

@@ -0,0 +1,24 @@
+const XLINK = 'http://www.w3.org/1999/xlink'
+const XML = 'http://www.w3.org/XML/1998/namespace'
+const XMLNS = 'http://www.w3.org/2000/xmlns/'
+
+/**
+ * The attributes the HTML parser puts in a namespace on an SVG or MathML element — its "adjust
+ * foreign attributes" table — each to that namespace. Every other attribute it writes has none.
+ *
+ * A leaf, because the compiler reads it to know which built attribute needs the client's
+ * `addAttribute`, and the client reads it to write one.
+ */
+export const FOREIGN_ATTRIBUTES: ReadonlyMap<string, string> = new Map([
+    ['xlink:actuate', XLINK],
+    ['xlink:arcrole', XLINK],
+    ['xlink:href', XLINK],
+    ['xlink:role', XLINK],
+    ['xlink:show', XLINK],
+    ['xlink:title', XLINK],
+    ['xlink:type', XLINK],
+    ['xml:lang', XML],
+    ['xml:space', XML],
+    ['xmlns', XMLNS],
+    ['xmlns:xlink', XMLNS],
+])

package/src/shared/INTEGRATION_POINTS.ts

@@ -0,0 +1,20 @@
+/**
+ * The SVG and MathML elements whose children the HTML parser reads as HTML again — the
+ * integration points — less `annotation-xml`, which is one only by the encoding it declares.
+ *
+ * A leaf, because the client's parse and build read it (`namespaceUnder`) and the compiler reads
+ * it to know a built element below one is HTML's, whatever its parent's namespace.
+ */
+export const INTEGRATION_POINTS: ReadonlySet<string> = new Set([
+    'foreignObject',
+    'desc',
+    'title',
+    'mi',
+    'mo',
+    'mn',
+    'ms',
+    'mtext',
+])
+
+/** HTML's namespace: what the parser gives an element outside SVG and MathML, and below an integration point. */
+export const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml'

package/src/shared/IN_PROCESS_ORIGIN.ts

@@ -0,0 +1,5 @@
+// The origin a request made in process is addressed to, where no listener names a real one: an
+// rpc's `raw` answered by the app this process holds, a CLI command asking the app it booted, and
+// an `App.run` given a principal and no request (42.19). A leaf, because the server and the shared
+// rpc both build one.
+export const IN_PROCESS_ORIGIN = 'http://app.internal'

package/src/shared/reactive/Keyed.ts

@@ -34,6 +34,7 @@ import {
     refuseBothCaps,
     signalMoved,
     startDeferred,
+    unwatchStore,
 } from './Reactive.ts'
 import {
     detach,
@@ -46,6 +47,7 @@ import {
     type Tracked,
     trackProbe,
 } from './tracking.ts'
+import { owned, owning } from './watch.ts'
 
 /**
  * The keyed face: one `Reactive` per `Args` key, plus the probes and triggers over its entries.
@@ -262,27 +264,22 @@ class StartWindow {
 }
 
 /**
- * `body` behind the `args` gate: validate, then run the body with what the gate accepted.
- *
- * 11.27's LAST TWO STEPS as one body. The gate runs on every run of the entry — a refresh
- * re-validates — and throws the refusal, which is what a body failing already does: the entry's
- * `error` holds it and its read throws it (2.2), and the body the gate stands in front of is never
- * called. What it accepts is what the body is handed (11.68).
+ * `body` handed what the `args` gate accepted for one entry (11.68), rather than the args it was
+ * reached with.
  *
  * A STREAM STAYS A STREAM FROM CONSTRUCTION. 9.6 reads the body's KIND, so the wrapper around an
  * async generator is an async generator, or a gated keyed stream would be one only from its first
  * run.
  */
-function gated<Args>(
+function handed<Args>(
     body: (args: Args) => unknown,
-    gate: Schema<Args>,
+    accepted: Args,
 ): (args: Args) => unknown {
-    const check = (args: Args): Args => checkArgs(gate, args)
     if (isStreamBody(body))
-        return async function* (args: Args) {
-            yield* (body as (args: Args) => AsyncIterable<unknown>)(check(args))
+        return async function* () {
+            yield* (body as (args: Args) => AsyncIterable<unknown>)(accepted)
         }
-    return (args: Args): unknown => body(check(args))
+    return (): unknown => body(accepted)
 }
 
 /**
@@ -348,7 +345,7 @@ export function createKeyed<
                   (throttle ?? debounce) as number,
               )
     const lifetime = ttl === undefined ? null : new Lifetime(ttl)
-    const entryBody = heldOnce(gate === undefined ? body : gated(body, gate))
+    const entryBody = heldOnce(body)
     // 11.27, 11.29 — the defaults are applied before the key is taken, so the entry is one for a
     // call that wrote them and one that left them to the parameter. Read once, here: a body with
     // none pays a `null` test per reach.
@@ -358,6 +355,12 @@ export function createKeyed<
     // there were, so the key that starts loading next — search-as-you-type — never woke it. One
     // signal per `Keyed`, moved where an entry is reached and where one is released.
     const membership = newTracked()
+    // 8.21 — A `Keyed` BUILT IN A SETUP OR A REQUEST ends with it, and every store its entries
+    // watch is stopped then: the entries are the cache's, so no owner of their own stops them.
+    if (options?.store !== undefined && owning())
+        owned(() => {
+            for (const entry of entries.values()) unwatchStore(entry)
+        })
 
     function askMembership(): void {
         const reader = TRACKING.reader
@@ -372,6 +375,7 @@ export function createKeyed<
     ): void {
         entries.delete(key)
         leaveSelections(created)
+        unwatchStore(created)
         signalMoved(membership)
     }
 
@@ -385,9 +389,32 @@ export function createKeyed<
             if (failedTransiently(standing)) standing.refresh()
             return standing
         }
+        // 11.27's VALIDATE, ONCE PER ENTRY AND BEFORE IT IS FILED: a refused `Args` is answered by a
+        // value holding the refusal (2.2) that no map keeps, so args nobody should have sent never
+        // take a place among the entries — on a `global` value, a place nothing but `invalidate`
+        // would take back (11.35). Built with none of the options: a `store` would restore a value
+        // over the refusal and watch for an entry nothing releases.
+        let run: (args: Args) => unknown = entryBody
+        if (gate !== undefined) {
+            let accepted: Args
+            try {
+                accepted = checkArgs(gate, args)
+            } catch (refusal) {
+                return createReactive<Stored, Accepted, Failures>(
+                    `${label}(${key})`,
+                    () => {
+                        throw refusal
+                    },
+                    args,
+                    undefined,
+                    undefined,
+                )
+            }
+            run = handed(entryBody, accepted)
+        }
         const created = createReactive<Stored, Accepted, Failures>(
             `${label}(${key})`,
-            entryBody as (args: unknown) => unknown,
+            run as (args: unknown) => unknown,
             args,
             undefined,
             entryOptions as ReactiveOptions<Accepted, Stored, Failures>,

package/src/shared/reactive/Reactive.ts

@@ -75,6 +75,7 @@ export type Transformer<Accepted, Stored, Failures = never> = (
 export type Store<Stored> = {
     get: () => Stored | undefined | Promise<Stored | undefined>
     set: (value: Stored, retention: { ttl: number }) => void | Promise<void>
+    watch?: (changed: () => void) => () => void
 }
 
 /**
@@ -366,6 +367,8 @@ type Persisted = {
      * what `pending` sends next, and what 8.18 serves a re-read in place of calling `get`.
      */
     unconfirmed: unknown
+    /** What stops the store's `watch`, where it has one (8.21). */
+    unwatch: (() => void) | null
 }
 
 /**
@@ -891,6 +894,7 @@ class Cell {
                       writing: false,
                       pending: false,
                       unconfirmed: undefined,
+                      unwatch: null,
                   }
         this.by = (options?.by ?? null) as
             | string
@@ -3801,6 +3805,32 @@ function rereadStore(cell: Cell, persisted: Persisted): void {
     )
 }
 
+/**
+ * Follows what the store says changed outside this process, re-reading it each time.
+ *
+ * 8.20 — A RE-READ, NEVER THE BODY: an edit made where the value lives is the store's news, so it
+ * is read back as a refresh of a value whose only producer is its store would read it, and 8.18
+ * still has a write the app made stand over it. 8.21 — stopped with the value: by its owner here,
+ * and by its `Keyed` through `unwatchStore` where an entry is evicted.
+ */
+function watchStore(cell: Cell, persisted: Persisted, cached: boolean): void {
+    const watch = persisted.store.watch
+    if (watch === undefined) return
+    persisted.unwatch = watch(() => {
+        rereadStore(cell, persisted)
+    })
+    if (!cached && owning()) owned(() => unwatchStore(cell.callable))
+}
+
+/** Stops the store's `watch` on `value`, once (8.21). */
+export function unwatchStore(value: unknown): void {
+    const persisted = (value as Callable)[CELL].store
+    if (persisted === null || persisted.unwatch === null) return
+    const unwatch = persisted.unwatch
+    persisted.unwatch = null
+    unwatch()
+}
+
 /**
  * Lands a store re-read, letting an unconfirmed write win.
  *
@@ -4693,8 +4723,10 @@ export function createReactive<
     // (2.2, 4.14) rather than serving an `undefined` its own type says is a `Stored`.
     // 8.3 AND 8.14: a store answers first, where the value is constructed, and whatever it misses
     // falls back to what the value would have done without one.
-    if (cell.store !== null) restoreFirst(cell, cell.store, initial)
-    else if (body === null) {
+    if (cell.store !== null) {
+        restoreFirst(cell, cell.store, initial)
+        watchStore(cell, cell.store, cached)
+    } else if (body === null) {
         if (initial === undefined) landOpening(cell)
         else if (initial !== NO_INITIAL) open(cell, initial)
     } else if (deferred) cell.loading = true

package/src/shared/rpc.ts

@@ -16,6 +16,7 @@
 import { type Failed, isFailedNamed } from './Failed.ts'
 import { GLOBAL_GETS } from './GLOBAL_GETS.ts'
 import { HandlerRoute } from './HandlerRoute.ts'
+import { IN_PROCESS_ORIGIN } from './IN_PROCESS_ORIGIN.ts'
 import { compose, type Middleware } from './Middleware.ts'
 import { principalRotated } from './principalRotated.ts'
 import { RPC_SERVER } from './RPC_SERVER.ts'
@@ -442,7 +443,7 @@ export function declare(method: Method): Declare {
                 if (RPC_SERVER.raw !== null)
                     return RPC_SERVER.raw(
                         new Request(
-                            new URL(asked.url, 'http://app.internal'),
+                            new URL(asked.url, IN_PROCESS_ORIGIN),
                             given,
                         ),
                     )

package/src/ui/bindSpread.ts

@@ -4,6 +4,7 @@
 
 import { spreadEntries } from '#shared/spread.ts'
 import type { Scope } from './Scope.ts'
+import { addAttribute } from './setAttribute.ts'
 
 /** Keeps an element's spread attributes and `on<event>` listeners written as the value changes. */
 export function bindSpread(
@@ -19,8 +20,9 @@ export function bindSpread(
         const next = new Set<string>()
         for (const [name, text] of spreadEntries(read(), explicit, wanted)) {
             next.add(name)
-            if (element.getAttribute(name) !== text)
-                element.setAttribute(name, text)
+            const standing = element.getAttribute(name)
+            if (standing === null) addAttribute(element, name, text)
+            else if (standing !== text) element.setAttribute(name, text)
         }
         for (const name of written)
             if (!next.has(name)) element.removeAttribute(name)

package/src/ui/index.ts

@@ -48,7 +48,7 @@ export { escapeless } from './escapeless.ts'
 export { contributeHead } from './Level.ts'
 export { listAt, updateList } from './List.ts'
 export { warnMismatch } from './Mismatch.ts'
-export { markupNodes } from './parseMarkup.ts'
+export { markupNodes, namespaceUnder } from './parseMarkup.ts'
 export {
     fillEmpty,
     fillRegion,
@@ -58,7 +58,7 @@ export {
 export { rowKeyOf } from './rowKeyOf.ts'
 export { itemOf, noUpdate, replaceRow, rowCell } from './rows.ts'
 export { EMPTY_SCOPE, Scope } from './Scope.ts'
-export { setAttribute } from './setAttribute.ts'
+export { addAttribute, setAttribute } from './setAttribute.ts'
 export { setClass } from './setClass.ts'
 export { setClassGroup } from './setClassGroup.ts'
 export { setMarkup } from './setMarkup.ts'

package/src/ui/parseMarkup.ts

@@ -1,3 +1,8 @@
+import {
+    HTML_NAMESPACE,
+    INTEGRATION_POINTS,
+} from '#shared/INTEGRATION_POINTS.ts'
+
 // MARKUP PARSED IN THE DOCUMENT `parent` BELONGS TO, not the global one. A page mounted into a second
 // document (an example `<iframe>`) parsed its `{#if}` arms in the right one and its `{#for}` rows in
 // the page's while the two were separate copies of this; one copy is one answer.
@@ -9,26 +14,22 @@ const TEMPLATES = new WeakMap<Document, HTMLTemplateElement>()
 const SVG = 'http://www.w3.org/2000/svg'
 const MATHML = 'http://www.w3.org/1998/Math/MathML'
 
-// The foreign elements whose children the parser reads as HTML again — the integration points —
-// so markup going into one parses the way it would at the template's own top level.
-const INTEGRATION_POINTS = new Set([
-    'foreignObject',
-    'desc',
-    'title',
-    'mi',
-    'mo',
-    'mn',
-    'ms',
-    'mtext',
-])
-
-/** Whether the parser reads `element`'s children as HTML again, though it is SVG or MathML. */
-function isIntegrationPoint(element: Element): boolean {
-    if (INTEGRATION_POINTS.has(element.localName)) return true
+/**
+ * The namespace an element the parser makes inside `parent` takes: SVG's or MathML's under an
+ * element of either, and HTML's under anything else — an HTML element, a document, a fragment, and
+ * an integration point (`INTEGRATION_POINTS`), whose children the parser reads as HTML again.
+ */
+export function namespaceUnder(parent: Node): string {
+    const element = parent as Element
+    const space = element.namespaceURI
+    if (space !== SVG && space !== MATHML) return HTML_NAMESPACE
+    if (INTEGRATION_POINTS.has(element.localName)) return HTML_NAMESPACE
     // The HTML standard makes an `<annotation-xml>` one only by the encoding it declares.
-    if (element.localName !== 'annotation-xml') return false
+    if (element.localName !== 'annotation-xml') return space
     const encoding = element.getAttribute('encoding')?.toLowerCase()
     return encoding === 'text/html' || encoding === 'application/xhtml+xml'
+        ? HTML_NAMESPACE
+        : space
 }
 
 /**
@@ -48,14 +49,8 @@ export function parseMarkup(parent: Node, markup: string): DocumentFragment {
         template = document.createElement('template')
         TEMPLATES.set(document, template)
     }
-    const space = (parent as Element).namespaceURI
-    const wrapper =
-        (space !== SVG && space !== MATHML) ||
-        isIntegrationPoint(parent as Element)
-            ? undefined
-            : space === SVG
-              ? 'svg'
-              : 'math'
+    const space = namespaceUnder(parent)
+    const wrapper = space === HTML_NAMESPACE ? undefined : space === SVG ? 'svg' : 'math'
     if (wrapper === undefined) {
         template.innerHTML = markup
         return template.content

package/src/ui/setAttribute.ts

@@ -1,4 +1,6 @@
 import { attributeText } from '#shared/attributeText.ts'
+import { FOREIGN_ATTRIBUTES } from '#shared/FOREIGN_ATTRIBUTES.ts'
+import { HTML_NAMESPACE } from '#shared/INTEGRATION_POINTS.ts'
 import { WORK } from '#shared/WORK.ts'
 
 /**
@@ -33,5 +35,27 @@ export function setAttribute(
         if (element.hasAttribute(name)) element.removeAttribute(name)
         return
     }
-    if (element.getAttribute(name) !== next) element.setAttribute(name, next)
+    const standing = element.getAttribute(name)
+    if (standing === next) return
+    if (standing === null) addAttribute(element, name, next)
+    else element.setAttribute(name, next)
+}
+
+/**
+ * Writes an attribute `element` does not hold yet, in the namespace the parser gives it there.
+ *
+ * 32.70 — an `xlink:href` on an SVG element is XLink's (`FOREIGN_ATTRIBUTES`), and one
+ * `setAttribute` makes has none, so a `<use>` it names draws nothing. Only an attribute's CREATION
+ * decides its namespace: `setAttribute` and `getAttribute` find a standing one by its qualified
+ * name, whatever namespace it is in.
+ */
+export function addAttribute(
+    element: Element,
+    name: string,
+    text: string,
+): void {
+    const space = FOREIGN_ATTRIBUTES.get(name)
+    if (space === undefined || element.namespaceURI === HTML_NAMESPACE)
+        element.setAttribute(name, text)
+    else element.setAttributeNS(space, name, text)
 }