@volter/world-core 2.0.37 → 3.0.1

package/dist/src/derived-core.js

@@ -7,13 +7,28 @@
 import { applyTwinWrite, applyTwinWriteAtomic, twinResources } from "./serve.js";
 import { copyResource, ownFields, parentStamp, subjectHistory, treeChangesSince, treeStamp } from "./log.js";
 import { getActiveWorldStore } from "./world-store.js";
+import { getActiveBlobStore } from "./blob-store.js";
+import { worldPaths } from "./storage.js";
+import { GitObjectStore } from "./git/objects.js";
+import { GitRefs } from "./git/refs.js";
 import { worldNow } from "./world-clock.js";
-import { createHash } from 'node:crypto';
+import { worldEnvValue } from "./world-env.js";
+import { openSessions, socketWrite } from "./sockets.js";
+import { MACHINE_POOL, poolFor } from "./machines.js";
+import { askApplication, deliverEvents, deliverToApplication } from "./events.js";
+import { handlerCrypto, hmac, lettersFrom, sha256, uuidFrom } from "./signing.js";
 import { hashFieldValue } from "./hash.js";
-import { resolveSubjectId, subjectAliases } from "./actions.js";
+import { readResourceBlob, removeResourceBlob, writeResourceBlob } from "./resource-blob.js";
+import { managedDatabase, unboundDatabase } from "./managed-database.js";
+import { execRedisRun } from "./redis/engine.js";
+import { sendMail } from "./smtp.js";
+import { multipartBoundary, multipartParts } from "./multipart.js";
+import { projectOwnerResources, resolveSubjectId, subjectAliases } from "./actions.js";
+import { vendorFetch } from "./vendor-call.js";
 import { packReferences } from "./references.js";
 import { twinPublicBase, withRequestScopes } from "./twin-fetch.js";
-import { isReadOnlyRequest } from "./request-scope.js";
+import { inVendorMove, isReadOnlyRequest, runAsVendorMove } from "./request-scope.js";
+import { bodyTextOf, checkJsonBody, takeParsedBody } from "./derived.js";
 /** What a move to `to` stores in the field: a boolean field's value is a boolean, and a derived field's
  *  value is written by the move's effects (a state name is not a timestamp), so it stores nothing itself. */
 export function storedState(decl, to) {
@@ -37,6 +52,74 @@ export function stateOf(decl, value) {
     return value === undefined || value === null ? String(decl.initial) : String(value);
 }
 // ── request parsing ──────────────────────────────────────────────────────────────────────────
+/** A body's fields as a strict vendor checks them (`ctx.fields`, the manifest's `body.strict`). Without `strict`, every
+ *  field passes. An object or array field is not typed here: its own shape is the handler's. */
+export function strictFields(m, operation, body) {
+    const strict = m.body.strict;
+    if (!strict)
+        return { fields: { ...body } };
+    const declared = new Map((operation.body ?? []).map((f) => [f.name, f]));
+    const refuse = (template, values) => ({ refused: vendorError(m, { status: strict.status, ...(strict.code ? { code: strict.code } : {}), message: String(fill(template, values)) }) });
+    const fields = {};
+    for (const [name, value] of Object.entries(body)) {
+        const field = declared.get(name);
+        if (!field)
+            return refuse(strict.unknown, { name });
+        const { type } = field;
+        const fits = value === null
+            || (type === 'boolean' && typeof value === 'boolean')
+            || (type === 'integer' && Number.isInteger(value))
+            || (type === 'number' && typeof value === 'number')
+            || (type === 'string' && typeof value === 'string')
+            || !['boolean', 'integer', 'number', 'string'].includes(type);
+        if (!fits)
+            return refuse(strict.type, { name, type: type === 'integer' ? 'an integer' : `a ${type}` });
+        if (typeof value === 'number' && ((field.minimum !== undefined && value < field.minimum) || (field.maximum !== undefined && value > field.maximum))) {
+            return refuse(strict.range, { name, min: field.minimum ?? null, max: field.maximum ?? null });
+        }
+        fields[name] = value;
+    }
+    return { fields };
+}
+/** Top-level schema checks with vendor-supplied response templates; unknown fields pass to semantics. */
+function validateBody(m, operation, body) {
+    const rule = m.body.validation;
+    if (!rule || (rule.operations && !rule.operations.includes(operation.id)))
+        return undefined;
+    const refuse = (template, values) => Response.json(fill(template, values), { status: rule.status });
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return refuse(rule.type, { name: '$body', type: 'object', input: body ?? null });
+    const values = body;
+    for (const field of operation.body ?? []) {
+        const value = values[field.name];
+        if (value === undefined) {
+            if (field.required)
+                return refuse(rule.missing, { name: field.name, input: values });
+            continue;
+        }
+        const types = field.type.split('|');
+        const fits = types.some((type) => type === 'null' ? value === null : type === 'integer' ? Number.isInteger(value) : type === 'array' ? Array.isArray(value) : type === 'object' ? value !== null && typeof value === 'object' && !Array.isArray(value) : type === 'string' ? typeof value === 'string' : type === 'number' ? typeof value === 'number' : type === 'boolean' ? typeof value === 'boolean' : true);
+        if (!fits)
+            return refuse(rule.type, { name: field.name, type: field.type, input: value });
+        if (typeof value === 'number' && ((field.minimum !== undefined && value < field.minimum) || (field.maximum !== undefined && value > field.maximum)))
+            return refuse(rule.range, { name: field.name, min: field.minimum ?? null, max: field.maximum ?? null, input: value });
+    }
+    return undefined;
+}
+/** A value as the vendor reads a boolean (`ctx.flag`, the manifest's `booleans`). */
+export function flagOf(m, value) {
+    if (typeof value === 'boolean')
+        return value;
+    if (value === undefined || value === null)
+        return undefined;
+    const text = String(value).toLowerCase();
+    const { truthy, falsy } = m.booleans ?? { truthy: ['true'], falsy: ['false'] };
+    if (truthy.some((t) => t.toLowerCase() === text))
+        return true;
+    if (falsy.some((f) => f.toLowerCase() === text))
+        return false;
+    return undefined;
+}
 /** A form body's bracket notation (`a[b][0][c]=v`, `expand[]=x`) as nested objects and arrays. A form carries only
  *  text: a field the operation's spec types as a number or a boolean (`scalars`, by bracket path, written by
  *  world-tooling's formScalarsOf) is read as one when its text is that literal; every other field stays the text sent
@@ -98,25 +181,42 @@ export async function readParams(manifest, request, operation) {
         // an upload: text fields as given, each file as its name, media type, size and content (its text), with its raw
         // `bytes` beside them for a pack that must tell an image or audio file from anything else; the bytes are not
         // enumerated, so a write's record of the request keeps the text alone
-        const form = await request.formData();
+        // read from its bytes (multipart.ts): a runtime's form parser drops a part with an empty field name
+        const boundary = multipartBoundary(type);
+        const parts = boundary === null ? [] : multipartParts(new Uint8Array(await request.arrayBuffer()), boundary);
         const out = { ...query };
-        for (const [key, value] of form.entries()) {
-            if (typeof value === 'string') {
-                out[key] = value;
+        for (const part of parts) {
+            if (part.filename === null) {
+                out[part.name] = new TextDecoder().decode(part.body);
                 continue;
             }
-            const file = value;
-            const bytes = new Uint8Array(await file.arrayBuffer());
-            const parsed = { name: file.name, type: file.type, size: file.size, content: new TextDecoder().decode(bytes) };
-            out[key] = Object.defineProperty(parsed, 'bytes', { value: bytes, enumerable: false });
+            const bytes = part.body;
+            const parsed = { name: part.filename, type: part.type ?? '', size: bytes.byteLength, content: new TextDecoder().decode(bytes) };
+            out[part.name] = Object.defineProperty(parsed, 'bytes', { value: bytes, enumerable: false });
         }
         return out;
     }
-    const text = await request.text();
+    const text = await bodyTextOf(request);
     if (!text)
         return query;
-    const asJson = type.includes('json') || manifest.body.json === 'always';
-    const body = asJson ? JSON.parse(text) : parseBracketForm(text, scalars);
+    // NDJSON (`application/x-ndjson`) is lines of JSON, not a JSON document: the handler reads its text
+    const isJson = type.includes('json') && !type.includes('ndjson');
+    const asJson = isJson || manifest.body.json === 'always';
+    // `json: 'always'` reads a body labelled otherwise as JSON (GitHub reads curl -d's); a body that is not JSON is read
+    // as the form it is labelled, never a crash (a sign-in page's own form, posted to the vendor's page)
+    let body;
+    if (asJson) {
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            if (isJson)
+                throw new SyntaxError('malformed JSON body');
+            body = parseBracketForm(text, scalars);
+        }
+    }
+    else
+        body = parseBracketForm(text, scalars);
     // a body that is not an object (GitHub's set-labels takes a bare array) is the body, not fields
     return body && typeof body === 'object' && !Array.isArray(body) ? { ...query, ...body } : { ...query };
 }
@@ -132,21 +232,27 @@ function fill(template, values, omitAbsent = false) {
     if (Array.isArray(template))
         return template.map((t) => fill(t, values, omitAbsent)).filter((v) => v !== ABSENT);
     if (template && typeof template === 'object') {
-        return Object.fromEntries(Object.entries(template).map(([k, v]) => [k, fill(v, values, omitAbsent)]).filter(([, v]) => v !== ABSENT));
+        const entries = Object.entries(template).map(([k, v]) => [k, fill(v, values, omitAbsent)]).filter(([, v]) => v !== ABSENT);
+        // an object every one of whose placeholders was absent is absent itself (Clerk's `meta` with no parameter to name)
+        if (omitAbsent && entries.length === 0 && Object.keys(template).length > 0)
+            return ABSENT;
+        return Object.fromEntries(entries);
     }
     return template;
 }
 export function vendorError(manifest, e) {
     // the status as the answer's number, and as text for a vendor whose body spells it as a string (GitHub's "404")
     const values = { message: e.message, code: e.code ?? null, param: e.param ?? null, kind: e.kind ?? manifest.defaultKind ?? null, status: e.status, statusText: String(e.status) };
+    // the HTTP status, which a vendor may keep apart from the one its body names (errorsAnsweredAs)
+    const answered = manifest.errorsAnsweredAs && e.status < manifest.errorsAnsweredAs.below ? manifest.errorsAnsweredAs.status : e.status;
     // a vendor that answers its errors as a document, not JSON (S3's XML `<Error><Code>…`): the template is that text,
     // each value escaped into it
     if (typeof manifest.error === 'string') {
         const escape = (v) => String(v ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
         const body = manifest.error.replace(/\{(\w+)\}/g, (_, k) => escape(values[k]));
-        return new Response(body, { status: e.status, headers: { 'content-type': body.trimStart().startsWith('<') ? 'application/xml' : 'text/plain; charset=utf-8' } });
+        return new Response(body, { status: answered, headers: { 'content-type': body.trimStart().startsWith('<') ? 'application/xml' : 'text/plain; charset=utf-8' } });
     }
-    return Response.json(fill(manifest.error, values, manifest.errorOmitsAbsent ?? false), { status: e.status });
+    return Response.json(fill(manifest.error, values, manifest.errorOmitsAbsent ?? false), { status: answered });
 }
 function notFound(manifest, object, id, param) {
     const nf = manifest.notFound;
@@ -158,7 +264,7 @@ function notFound(manifest, object, id, param) {
     return vendorError(manifest, { status: nf.status, message: String(fill(message, { object, id })), ...(code ? { code } : {}), ...(nf.kind ? { kind: nf.kind } : {}), ...(param ? { param } : {}) });
 }
 // ── the tree ─────────────────────────────────────────────────────────────────────────────────
-const storedType = (m, resource) => m.resources[resource]?.storedAs ?? resource;
+export const storedType = (m, resource) => m.resources[resource]?.storedAs ?? resource;
 // A service's resources by type, folded once per World state (the tree's stamp; any write moves it), not on every read:
 // a read of one resource type projected the service's whole tree, so a pack whose tree also holds many subjects of
 // other types (PlanetScale's SQL rows beside its management records) paid for all of them on each read. A read gets its
@@ -232,17 +338,16 @@ function missingParent(m, resource, call, root) {
 export function render(r) {
     return Object.fromEntries(Object.entries({ id: r.id, ...ownFields(r) }).filter(([k]) => !k.startsWith('_') && k !== 'updatedAt'));
 }
+/** A stored subject as the vendor answers it: its own fields, its id under the name the vendor gives it. */
 function view(m, resource, r) {
-    const own = m.resources[resource]?.view;
-    if (own)
-        return own(render(r), { id: r.id, type: r.type });
-    if (!m.view)
+    const idAs = m.resources[resource]?.idAs;
+    if (!idAs)
         return render(r);
-    // a pack's view sees the stored row whole, and bookkeeping (`_`) never reaches the wire whatever it returns
-    return Object.fromEntries(Object.entries(m.view(storedType(m, resource), r)).filter(([k]) => !k.startsWith('_')));
+    const { id, ...rest } = render(r);
+    return { [idAs]: id, ...rest };
 }
 function now(m, at) {
-    return m.time === 'unix' ? Math.floor(Date.parse(at) / 1000) : at;
+    return m.time === 'unix' ? Math.floor(Date.parse(at) / 1000) : m.time === 'unix-ms' ? Date.parse(at) : at;
 }
 function applyRule(m, rule, id, values, at) {
     if ('now' in rule)
@@ -251,15 +356,85 @@ function applyRule(m, rule, id, values, at) {
         return id;
     if ('value' in rule)
         return rule.value;
-    return fill(rule.template, { ...values, id });
+    const text = fill(rule.template, { ...values, id });
+    return rule.encode === 'base64' ? btoa(String.fromCharCode(...new TextEncoder().encode(String(text)))) : text;
 }
 const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 /** The next id the manifest's template gives this resource: one past the highest it already minted. */
-function mintId(m, resource, root) {
+/** The World's seed for a service's secrets (ctx.secret): made once from the platform's random source, then read. The
+ *  making is one per service store in the process: two first calls at once share it, so no secret handed out under one
+ *  seed is lost to another written after it (a service's store is one process's). */
+const SEED = '_world_seed';
+const seeding = new Map();
+function worldSeed(service, root, at) {
+    const held = resourcesOfType(service, SEED, root).find((r) => r.id === 'seed');
+    if (typeof held?.value === 'string')
+        return Promise.resolve(held.value);
+    const key = `${root ?? ''}\u0000${service}`;
+    const pending = seeding.get(key);
+    if (pending)
+        return pending;
+    const made = (async () => {
+        const value = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');
+        // the World's own bookkeeping, made on first use whatever the request: a read-only one lands it too (a vendor's move)
+        await runAsVendorMove(() => applyTwinWrite(service, { operation: 'world_seed.record', subjectType: SEED, subjectId: 'seed', fields: { value }, occurredAt: at, actor: { kind: 'system' } }, root));
+        return value;
+    })().finally(() => seeding.delete(key));
+    seeding.set(key, made);
+    return made;
+}
+/** A World's signing key for a label (ctx.signingKey): made once from the platform's random source, then read; the
+ *  making is one per service store and label in the process, as the seed's is. */
+const SIGNING_KEY = '_world_signing_key';
+const keying = new Map();
+const pem = (kind, der) => `-----BEGIN ${kind}-----\n${Buffer.from(der).toString('base64').replace(/(.{64})/g, '$1\n').replace(/\n$/, '')}\n-----END ${kind}-----\n`;
+function heldWorldSigningKey(service, root, label, alg) {
+    const id = alg === 'RS256' ? label : `${label}#${alg}`;
+    const held = resourcesOfType(service, SIGNING_KEY, root).find((r) => r.id === id);
+    return typeof held?.privatePem === 'string' && typeof held.publicPem === 'string' ? { privatePem: held.privatePem, publicPem: held.publicPem } : undefined;
+}
+function worldSigningKey(service, root, at, label, alg) {
+    // an RSA key keeps its label; another algorithm's is kept under the label and the algorithm, so one label never names two
+    const id = alg === 'RS256' ? label : `${label}#${alg}`;
+    const held = resourcesOfType(service, SIGNING_KEY, root).find((r) => r.id === id);
+    if (typeof held?.privatePem === 'string' && typeof held.publicPem === 'string')
+        return Promise.resolve({ privatePem: held.privatePem, publicPem: held.publicPem });
+    const key = `${root ?? ''}\u0000${service}\u0000${id}`;
+    const pending = keying.get(key);
+    if (pending)
+        return pending;
+    const made = (async () => {
+        const pair = (alg === 'Ed25519'
+            ? await globalThis.crypto.subtle.generateKey({ name: 'Ed25519' }, true, ['sign', 'verify'])
+            : await globalThis.crypto.subtle.generateKey({ name: 'RSASSA-PKCS1-v1_5', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' }, true, ['sign', 'verify']));
+        const fields = {
+            privatePem: pem('PRIVATE KEY', await globalThis.crypto.subtle.exportKey('pkcs8', pair.privateKey)),
+            publicPem: pem('PUBLIC KEY', await globalThis.crypto.subtle.exportKey('spki', pair.publicKey)),
+        };
+        await runAsVendorMove(() => applyTwinWrite(service, { operation: 'world_signing_key.record', subjectType: SIGNING_KEY, subjectId: id, fields, occurredAt: at, actor: { kind: 'system' } }, root));
+        return fields;
+    })().finally(() => keying.delete(key));
+    keying.set(key, made);
+    return made;
+}
+function mintId(m, resource, root, at) {
+    if (!m.resources[resource])
+        throw new Error(`mint: ${resource} is not a resource ${m.vendor}'s manifest declares`);
     const prefix = m.resources[resource].idPrefix;
-    if (m.ids.template === '{uuid}')
+    const template = m.resources[resource].ids ?? m.ids.template;
+    if (template === '{uuid}')
         return mintUuid(m, resource, root);
-    const [head, tail = ''] = m.ids.template.split('{n}');
+    const snowflake = /^\{snowflake:(\d+)\}$/.exec(template);
+    if (snowflake)
+        return mintSnowflake(m, BigInt(snowflake[1]), root, at);
+    // `{letters:N}` and `{hex:N}`, alone or after the resource's prefix (`{prefix}{letters:16}`: Fly's `vol_…`)
+    const letters = /^(\{prefix\})?\{letters:(\d+)\}$/.exec(template);
+    if (letters)
+        return mintLetters(m, resource, Number(letters[2]), root, letters[1] ? prefix : '');
+    const hex = /^(\{prefix\})?\{hex:(\d+)\}$/.exec(template);
+    if (hex)
+        return mintHex(m, resource, Number(hex[2]), root, hex[1] ? prefix : '');
+    const [head, tail = ''] = template.split('{n}');
     const pattern = new RegExp(`^${escapeRe(String(fill(head, { prefix })))}(\\d+)${escapeRe(String(fill(tail, { prefix })))}$`);
     let max = 0;
     // the one type, from the index that follows writes (a scan of the whole World per create grew with it)
@@ -268,7 +443,55 @@ function mintId(m, resource, root) {
         if (hit)
             max = Math.max(max, Number(hit[1]));
     }
-    return String(fill(m.ids.template, { prefix, n: max + 1 }));
+    return String(fill(template, { prefix, n: max + 1 }));
+}
+/** The next snowflake (Discord's, X's): the milliseconds since the vendor's epoch shifted left 22 bits, the low bits an
+ *  increment. One space over every snowflake resource of the vendor, as its one generator's: the instant's first, or one
+ *  past the greatest the World holds when that is later (a frozen clock, or several ids in one millisecond), so ids
+ *  rise with time and never repeat. */
+/** The last snowflake minted per vendor and World in this process: two mints before the first is written (a message
+ *  and its attachment) must not meet. */
+const lastSnowflake = new Map();
+function mintSnowflake(m, epoch, root, at) {
+    const ms = BigInt(Date.parse(at ?? '') || 0);
+    const base = ms > epoch ? (ms - epoch) << 22n : 0n;
+    let max = -1n;
+    for (const [name, decl] of Object.entries(m.resources)) {
+        if (!/^\{snowflake:\d+\}$/.test(decl.ids ?? m.ids.template))
+            continue;
+        for (const r of resourcesOfType(m.service, storedType(m, name), root))
+            if (/^\d+$/.test(r.id)) {
+                const v = BigInt(r.id);
+                if (v > max)
+                    max = v;
+            }
+    }
+    const key = `${m.service}\0${root ?? ''}`;
+    const last = lastSnowflake.get(key) ?? -1n;
+    const floor = max > last ? max : last;
+    const id = base > floor ? base : floor + 1n;
+    lastSnowflake.set(key, id);
+    return String(id);
+}
+/** The next id of `count` lowercase letters for a resource, derived from the resource and the count before it, past
+ *  any the World already holds. */
+function mintLetters(m, resource, count, root, prefix = '') {
+    const held = new Set(resourcesOfType(m.service, storedType(m, resource), root).map((r) => r.id));
+    for (let n = held.size + 1;; n++) {
+        const id = `${prefix}${lettersFrom(`${m.service}:${resource}:${n}`, count)}`;
+        if (!held.has(id))
+            return id;
+    }
+}
+/** The next hex id for a resource: N hex digits derived from the resource and the count before it, past any the World
+ *  already holds (a Cloudflare id, 32). */
+function mintHex(m, resource, count, root, prefix = '') {
+    const held = new Set(resourcesOfType(m.service, storedType(m, resource), root).map((r) => r.id));
+    for (let n = held.size + 1;; n++) {
+        const id = `${prefix}${sha256(`${m.service}:${resource}:${n}`).slice(0, count)}`;
+        if (!held.has(id))
+            return id;
+    }
 }
 /** The next UUID for a resource: a version-4-shaped UUID derived from the resource and the count before it, past any
  *  the World already holds. */
@@ -276,8 +499,7 @@ function mintUuid(m, resource, root) {
     const type = storedType(m, resource);
     const held = new Set(resourcesOfType(m.service, type, root).map((r) => r.id));
     for (let n = held.size + 1;; n++) {
-        const h = createHash('sha256').update(`${m.service}:${resource}:${n}`).digest('hex');
-        const id = `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-${'89ab'[parseInt(h[16], 16) % 4]}${h.slice(17, 20)}-${h.slice(20, 32)}`;
+        const id = uuidFrom(`${m.service}:${resource}:${n}`);
         if (!held.has(id))
             return id;
     }
@@ -289,7 +511,15 @@ function expand(m, resource, body, paths, root) {
         const [head, ...rest] = path.split('.');
         const target = embeds[head];
         const id = out[head];
-        if (!target || typeof id !== 'string')
+        if (!target)
+            continue;
+        // an object already embedded (an earlier path's) is walked further, not fetched again
+        if (id && typeof id === 'object' && !Array.isArray(id)) {
+            if (rest.length)
+                out[head] = expand(m, target, id, [rest.join('.')], root);
+            continue;
+        }
+        if (typeof id !== 'string')
             continue;
         const hit = stored(m, target, root).find((r) => r.id === id);
         if (hit)
@@ -304,17 +534,114 @@ function expandPaths(m, params) {
 async function write(m, call, resource, id, fields, operation, params, root, occurredAt) {
     return (await writeDetailed(m, call, resource, id, fields, operation, params, root, occurredAt)).body;
 }
+const sentOf = new WeakMap();
+/** The lane a vendor's router sent a request to (pack-fetch's laneRouter sets it). */
+export const LANE_HEADER = 'x-volter-lane';
+function sentRequest(m, call, body) {
+    const url = new URL(call.request.url);
+    const named = [...(m.headers ?? []), ...(m.version ? [m.version.header] : [])];
+    const headers = Object.fromEntries(named.flatMap((h) => { const v = call.request.headers.get(h); return v === null ? [] : [[h.toLowerCase(), v]]; }));
+    const lane = call.request.headers.get(LANE_HEADER) ?? undefined;
+    const requestId = call.request.headers.get('x-twins-request-id') ?? undefined;
+    const declared = new Set((call.operation.query ?? []).map((q) => q.name));
+    const query = {};
+    for (const name of new Set(url.searchParams.keys())) {
+        if (!declared.has(name))
+            continue;
+        const values = url.searchParams.getAll(name);
+        query[name] = values.length > 1 ? values : values[0];
+    }
+    const fields = new Set((call.operation.body ?? []).map((f) => f.name));
+    const asCame = body !== null && typeof body === 'object' && ('$text' in body || '$base64' in body);
+    const sentBody = fields.size && !asCame && body !== null && typeof body === 'object' && !Array.isArray(body) ? Object.fromEntries(Object.entries(body).filter(([k]) => fields.has(k))) : body;
+    return { path: { ...call.params }, query, body: sentBody, headers, ...(lane ? { lane } : {}), ...(requestId ? { requestId } : {}) };
+}
+/** What a write records of the call that made it: the surface operation and the request as it came, or which of the
+ *  World's own doors made it (a door or a screen, the gap, the clock), which a perform never sends. */
+/** A body as it came: `{ $text }` when its bytes are UTF-8, else `{ $base64 }`. */
+async function rawBody(request) {
+    const bytes = new Uint8Array(await request.clone().arrayBuffer());
+    try {
+        return { $text: new TextDecoder('utf-8', { fatal: true }).decode(bytes) };
+    }
+    catch {
+        return { $base64: Buffer.from(bytes).toString('base64') };
+    }
+}
+/** A multipart request's file parts, kept in the World's blob store by their bytes' digest (`files/<sha256>`): what a
+ *  write records of them (`input.files`), so a perform sends them again. */
+async function keptFiles(m, call, root) {
+    const files = sentOf.get(call)?.parts?.filter((p) => p.filename !== null);
+    if (!files?.length)
+        return undefined;
+    const out = [];
+    for (const f of files) {
+        const blob = `files/${hashFieldValue({ bytes: Buffer.from(f.body).toString('base64') })}`;
+        await writeResourceBlob(m.service, blob, f.body, root);
+        out.push({ field: f.name, name: f.filename, type: f.type, blob });
+    }
+    return out;
+}
+function recordedInput(m, call, merged) {
+    const id = call.operation.id;
+    const sent = sentOf.get(call);
+    const asSent = sent ? { path: sent.path, query: sent.query, body: sent.body, headers: sent.headers, ...(sent.lane ? { lane: sent.lane } : {}), ...(sent.requestId ? { requestId: sent.requestId } : {}), ...(sent.type ? { contentType: sent.type } : {}) } : { path: call.params, body: merged };
+    if (id === 'graphql') {
+        const b = (sent?.body ?? {});
+        return { graphql: { query: b.query, variables: b.variables ?? {}, ...(b.operationName ? { operationName: b.operationName } : {}) }, ...(sent?.lane ? { lane: sent.lane } : {}), headers: sent?.headers ?? {} };
+    }
+    if (id === 'clock')
+        return { clock: true };
+    if (id === 'unmatched')
+        return { gap: true, ...asSent };
+    if ((m.doors ?? []).some((d) => d.id === id) || (m.screens ?? []).some((sc) => sc.id === id) || id === 'machine-pool' || id.startsWith('socket:'))
+        return { door: id, ...asSent };
+    return { operationId: id, ...asSent };
+}
 async function writeDetailed(m, call, resource, id, fields, operation, params, root, occurredAt) {
+    const withFiles = async (input) => { const files = input.operationId ? await keptFiles(m, call, root) : undefined; return files ? { ...input, files } : input; };
     const { resource: row, result } = await applyTwinWrite(m.service, 
     // who made it: the login the pack's identity reads off the request, when it declares one, so a subject's
     // history can say who did each thing
-    { operation, subjectType: storedType(m, resource), subjectId: id, fields, input: { operationId: call.operation.id, params: call.params, body: params }, occurredAt, actor: { kind: 'agent', ...(m.identity ? { id: m.identity(call.request.headers.get('authorization'), root) } : {}) } }, root);
+    // a vendor's own move (ctx.asVendor, the clock) is the World's, as the clock's writes are: no API call a head performs
+    inVendorMove()
+        ? { operation, subjectType: storedType(m, resource), subjectId: id, fields, input: { clock: true }, occurredAt, actor: { kind: 'system' } }
+        : { operation, subjectType: storedType(m, resource), subjectId: id, fields, input: await withFiles(recordedInput(m, call, params)), occurredAt, actor: { kind: 'agent', ...(m.identity ? { id: m.identity(call.request.headers.get('authorization'), root) } : {}) } }, root);
+    await keepCounts(m, call, resource, row, params, root, occurredAt);
     const body = view(m, resource, row);
+    const context = () => contextFor(m, { ...call, request: call.request.clone() }, { ...(root !== undefined ? { root } : {}), clock: () => occurredAt });
     if (m.onWrite)
-        await m.onWrite({ operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request, context: () => contextFor(m, { ...call, request: call.request.clone() }, { ...(root !== undefined ? { root } : {}), clock: () => occurredAt }) });
+        await m.onWrite({ operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request, context });
+    if (m.events) {
+        const events = m.events;
+        const write = { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request };
+        await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values(await context(), write, type) : undefined, (answer) => deliveryOutcome(m, answer, root));
+    }
+    if (m.sockets?.length)
+        socketWrite(m.service, root, { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request });
     // the subject's id as it stands after the write: the vendor's, when a live head minted one
     return { body, id: result.externalId ?? row.id, ...(result.vendorData !== undefined ? { vendorData: result.vendorData } : {}) };
 }
+/** The declared counts a written subject is a child in (a resource's `counts`), each kept on its parent: written when
+ *  the count moved, through the write path, so the parent's history says when. */
+async function keepCounts(m, call, resource, row, params, root, occurredAt) {
+    for (const [parent, decl] of Object.entries(m.resources)) {
+        for (const [field, c] of Object.entries(decl.counts ?? {})) {
+            if (storedType(m, c.of) !== storedType(m, resource) || row[c.by] === undefined || row[c.by] === null)
+                continue;
+            const pid = String(row[c.by]);
+            const held = stored(m, parent, root).find((r) => r.id === pid);
+            if (!held)
+                continue;
+            const n = stored(m, c.of, root).filter((r) => {
+                const x = r;
+                return String(x[c.by]) === pid && (c.present === undefined || (x[c.present] !== undefined && x[c.present] !== null));
+            }).length + (c.plus ?? 0);
+            if (held[field] !== n)
+                await writeDetailed(m, call, parent, pid, { [field]: n }, `${storedType(m, parent)}.counted`, params, root, occurredAt);
+        }
+    }
+}
 /** An answer in the vendor's success envelope, under the operation's key, when the vendor has one. */
 function envelope(m, op, body) {
     return m.success && op.answers?.key ? { ...m.success, [op.answers.key]: body } : body;
@@ -339,6 +666,45 @@ export function observeTransitions(observer) {
 /** What a declared machine says to one move: the transition that allows it, or the refusal it gives (and
  *  nothing when it declares neither). The derived core and `legal` ask it; so does an engine that is not
  *  HTTP-shaped (a line protocol's session), so one machine rules every wire. */
+/** What a delivery's answer writes on its endpoint (the endpoint kind's `outcome`, architecture "Events and webhooks"):
+ *  a success resets the failure count and writes its fields; a failure counts, and a run of them makes the declared
+ *  move, asked of the endpoint's machine as the vendor's (a move the machine does not allow is not made). Read fresh
+ *  and written in one move, since the answer arrives after the write's own and answers may arrive together. */
+async function deliveryOutcome(m, answer, root) {
+    const o = answer.kind.outcome;
+    const type = answer.kind.storedAs;
+    const ok = answer.status >= 200 && answer.status < 300;
+    // the read and the count are one move under the action lock, so two answers at once count twice
+    await runAsVendorMove(() => applyTwinWriteAtomic(m.service, (resources) => {
+        const row = resources.find((r) => r.type === type && String(r.id) === String(answer.row.id));
+        if (!row || row.deleted === true)
+            return { kind: 'skip', value: undefined };
+        const fields = {};
+        let operation = `${type}.delivered`;
+        if (ok) {
+            fields[o.failures] = 0;
+            const seconds = Math.floor((Date.parse(answer.occurredAt) || 0) / 1000);
+            for (const [k, v] of Object.entries(o.success ?? {}))
+                fields[k] = v === '$time.iso' ? answer.occurredAt : v === '$time.s' ? seconds : v;
+        }
+        else {
+            const failures = (Number(row[o.failures]) || 0) + 1;
+            fields[o.failures] = failures;
+            operation = `${type}.delivery-failed`;
+            const exempt = o.unless !== undefined && row[o.unless.field] === o.unless.equals;
+            if (o.move && o.after !== undefined && failures >= o.after && !exempt) {
+                const decl = Object.values(m.resources).find((r) => (r.storedAs ?? '') === type) ?? m.resources[type];
+                const machine = decl?.state?.[o.move.field];
+                const { move } = machine ? transitionFor(o.move.field, machine, o.move.operation, row[o.move.field], o.move.to, String(row.id), 'vendor') : {};
+                if (move) {
+                    fields[o.move.field] = o.move.to;
+                    operation = o.move.operation;
+                }
+            }
+        }
+        return { kind: 'write', value: undefined, write: { operation, subjectType: type, subjectId: String(row.id), fields, occurredAt: answer.occurredAt, actor: { kind: 'system' } } };
+    }, root));
+}
 export function transitionFor(field, decl, operationId, current, requested, id, actor = 'api') {
     const now = stateOf(decl, current);
     const candidates = decl.transitions.filter((t) => (t.actor ?? 'api') === actor && (t.operation ? t.operation === operationId : true) && (requested === undefined || (t.to ?? now) === String(requested)));
@@ -418,7 +784,153 @@ function adoptedInCall(service, fields, root) {
 async function boundaryParams(m, call, root) {
     return adoptedInCall(m.service, await readParams(m, call.request, call.operation), root);
 }
+/** The refusal a subject's fields would draw from its resource's `unique` rules: another live subject (not `except`)
+ *  already holds every field of a rule, each field given. */
+function conflictOf(m, resource, fields, except, root) {
+    for (const rule of m.resources[resource]?.unique ?? []) {
+        if (rule.fields.some((f) => fields[f] === undefined || fields[f] === null))
+            continue;
+        const held = stored(m, resource, root).some((r) => r.id !== except && rule.fields.every((f) => r[f] === fields[f]));
+        if (held)
+            return rule.refusal;
+    }
+    return undefined;
+}
+/** A subject deleted through the write path, after every subject its resource's `cascade` takes with it (depth first). */
+async function removeSubject(m, call, resource, id, params, root, at, operation) {
+    for (const child of m.resources[resource]?.cascade ?? []) {
+        for (const row of stored(m, child.resource, root).filter((r) => r[child.field] === id)) {
+            await removeSubject(m, call, child.resource, String(row.id), params, root, at);
+        }
+    }
+    await write(m, call, resource, id, { deleted: true }, operation ?? `${storedType(m, resource)}.delete`, params, root, at);
+}
+/** Whether a key names a stored subject: its id, or one of the resource's alternate keys. */
+const namedBy = (decl, row, key) => row.id === key || (decl?.alternateKeys ?? []).some((f) => key !== undefined && key !== null && row[f] === key);
+const isBag = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+/** One field of an update, as the resource's `update` rule merges it into what is stored. */
+/** A bag with every `null` key removed, at every level (a deep merge's new branch: null removes a key "at any level"). */
+const withoutNulls = (bag) => Object.fromEntries(Object.entries(bag).filter(([, v]) => v !== null).map(([k, v]) => [k, isBag(v) ? withoutNulls(v) : v]));
+export function mergeField(rule, prior, next) {
+    if (rule === 'deep' && isBag(next) && !isBag(prior))
+        return withoutNulls(next);
+    if (rule === 'replace' || !isBag(next) || !isBag(prior))
+        return next;
+    if (rule === 'deep') {
+        const out = { ...prior };
+        for (const [k, v] of Object.entries(next)) {
+            if (v === null)
+                delete out[k];
+            else
+                out[k] = isBag(v) && isBag(out[k]) ? mergeField('deep', out[k], v) : v;
+        }
+        return out;
+    }
+    return Object.fromEntries(Object.entries({ ...prior, ...next }).filter(([, value]) => value !== ''));
+}
+/** A list's rows as the resource declares them arranged for this call: its field filters, its search, its order (the
+ *  `orderBy` parameter's, else `order`, else newest first); a refusal when the call orders by a field it does not take. */
+function arrangeRows(m, resource, params, input) {
+    const decl = m.resources[resource];
+    let rows = input;
+    for (const f of decl?.filters ?? [])
+        if (params[f] !== undefined)
+            rows = rows.filter((r) => String(r[f]) === String(params[f]));
+    const needle = decl?.search ? params[decl.search.param] : undefined;
+    if (decl?.search && typeof needle === 'string' && needle !== '') {
+        const q = needle.toLowerCase();
+        rows = rows.filter((r) => (decl.search.exact ?? []).some((f) => String(r[f] ?? '').toLowerCase() === q) || (decl.search.partial ?? []).some((f) => String(r[f] ?? '').toLowerCase().includes(q)));
+    }
+    let order = decl?.order ?? { field: 'created', direction: 'desc' };
+    // a declared ordering parameter orders text by its text; without one, the order is numeric, as it always was
+    let byText = false;
+    if (decl?.orderBy) {
+        const asked = params[decl.orderBy.param];
+        const spec = typeof asked === 'string' && asked !== '' ? asked : decl.orderBy.default;
+        const field = spec.replace(/^[+-]/, '');
+        if (!decl.orderBy.fields.includes(field))
+            return { ...decl.orderBy.invalid, message: decl.orderBy.invalid.message.replace('{fields}', decl.orderBy.fields.join(', ')) };
+        order = { field, direction: spec.startsWith('-') ? 'desc' : 'asc' };
+        byText = true;
+    }
+    const indexed = rows.map((row, i) => ({ row, i }));
+    indexed.sort((a, b) => {
+        const x = a.row[order.field];
+        const y = b.row[order.field];
+        const byValue = !byText || typeof x === 'number' || typeof y === 'number' ? Number(x ?? 0) - Number(y ?? 0) : String(x ?? '').localeCompare(String(y ?? ''));
+        // ties by mint order (`file-twin-10` after `file-twin-9`), not by the ids' lexical order
+        const d = byValue || String(a.row.id).localeCompare(String(b.row.id), undefined, { numeric: true });
+        return order.direction === 'desc' ? -d : d;
+    });
+    return indexed.map((x) => x.row);
+}
+/** A page of arranged rows, answered in the manifest's list envelope with its paging (cursors, pages, offsets). */
+function pageRows(m, op, call, params, rows, resource, root, paths) {
+    const size = m.list.limits?.[op.id] ?? m.list.limit;
+    const asked = params[m.list.limit.param];
+    const n = asked === undefined || asked === '' ? size.default : Number(asked);
+    const limit = Number.isFinite(n) ? Math.min(size.max, Math.max(1, Math.trunc(n))) : size.default;
+    const after = m.list.after ? params[m.list.after] : undefined;
+    const before = m.list.before ? params[m.list.before] : undefined;
+    let from = 0;
+    let to;
+    if (typeof before === 'string') {
+        const at = rows.findIndex((r) => r.id === before);
+        to = at === -1 ? (m.list.unknownCursor === 'end' ? 0 : rows.length) : at;
+        from = Math.max(0, to - limit);
+    }
+    else {
+        if (typeof after === 'string') {
+            const at = rows.findIndex((r) => r.id === after);
+            from = at === -1 ? (m.list.unknownCursor === 'end' ? rows.length : 0) : at + 1;
+        }
+        to = from + limit;
+    }
+    const page = rows.slice(from, to).map((r) => (paths.length ? expand(m, resource, r, paths.filter((p) => p.startsWith('data.')).map((p) => p.slice(5)), root) : r));
+    const hasMore = typeof before === 'string' ? from > 0 : to < rows.length;
+    const url = op.path.replace(/\{[^}]+\}/g, (p) => call.params[p.slice(1, -1)] ?? p);
+    if (m.list.page) {
+        const n = Math.max(1, Math.floor(Number(params[m.list.page.param]) || 1));
+        const slice = rows.slice((n - 1) * limit, n * limit);
+        const last = Math.max(1, Math.ceil(rows.length / limit));
+        const headers = new Headers();
+        if (m.list.page.link && rows.length > limit) {
+            const at = (k) => {
+                const u = new URL(call.request.url);
+                u.searchParams.set(m.list.page.param, String(k));
+                return u.toString();
+            };
+            const rels = [...(n > 1 ? [`<${at(n - 1)}>; rel="prev"`] : []), ...(n < last ? [`<${at(n + 1)}>; rel="next"`, `<${at(last)}>; rel="last"`] : []), ...(n > 1 ? [`<${at(1)}>; rel="first"`] : [])];
+            if (rels.length)
+                headers.set('link', rels.join(', '));
+        }
+        // `{total_count}` the count before paging, `{max_page}` the number of pages (none for an empty list: Polar's pagination)
+        return Response.json(fill(m.list.envelope, { data: slice, next_cursor: null, key: op.answers?.key ?? 'data', total_count: rows.length, max_page: Math.ceil(rows.length / limit) }), { headers });
+    }
+    if (m.list.offset) {
+        const skip = Math.max(0, Math.trunc(Number(params[m.list.offset.param]) || 0));
+        const slice = rows.slice(skip, skip + limit);
+        const key = op.answers?.key ?? 'data';
+        return Response.json({ ...(m.success ?? {}), [key]: slice, ...fill(m.list.envelopes?.[op.id] ?? m.list.envelope, { data: slice, total_count: rows.length, key }) });
+    }
+    if (m.list.cursor) {
+        const start = decodeOffset(params[m.list.cursor.param]);
+        const slice = rows.slice(start, start + limit);
+        const next = start + limit < rows.length ? encodeOffset(start + limit) : '';
+        return Response.json({ ...(m.success ?? {}), ...fill(m.list.envelope, { data: slice, next_cursor: next, key: op.answers?.key ?? 'data' }), ...(op.answers?.key ? { [op.answers.key]: slice } : {}) });
+    }
+    return Response.json(fill(m.list.envelope, { data: page, has_more: hasMore, url, first_id: page[0]?.id ?? null, last_id: page.at(-1)?.id ?? null }));
+}
 /** Serve one operation from the manifest, or say why the core cannot. */
+/** A setting's fields as the vendor answers them: its own, without the kernel's bookkeeping or the parent it is kept
+ *  under (a setting answers its values, not an identity). */
+function settingFields(own, parentField) {
+    return Object.fromEntries(Object.entries(own).filter(([k]) => !k.startsWith('_') && k !== 'deleted' && k !== parentField));
+}
+function settingView(m, resource, hit) {
+    // ownFields: the kernel's id, type and updatedAt gone, a vendor's own of those names restored
+    return settingFields(ownFields(hit), m.resources[resource]?.parent?.field);
+}
 export async function serveCore(m, call, scope = {}) {
     const root = scope.root;
     const at = (scope.clock ?? worldNow)();
@@ -436,7 +948,13 @@ export async function serveCore(m, call, scope = {}) {
         return { served: orphan };
     const parent = decl.parent;
     const parentId = parent ? parentValue(parent, call.params) : undefined;
-    const underParent = (r) => !parent || r[parent.field] === parentId;
+    // the caller's tenant, when the vendor has tenancy and the resource is not shared by every tenant
+    const tenantField = m.tenant && !decl.shared ? m.tenant.field : undefined;
+    const tenant = tenantField && scope.tenant ? await scope.tenant(await contextFor(m, { ...call, request: call.request.clone() }, scope)) : undefined;
+    if (tenantField && tenant === undefined)
+        return { unmodeled: `the caller names no tenant (semantics/tenant.ts) for ${resource}` };
+    const underParent = (r) => (!parent || r[parent.field] === parentId)
+        && (!tenantField || r[tenantField] === tenant);
     const paths = expandPaths(m, params);
     // the vendor's success status from its spec: 201 for most creates, 204 with no body where it answers nothing
     const status = op.successStatus ?? 200;
@@ -445,6 +963,13 @@ export async function serveCore(m, call, scope = {}) {
     });
     const control = new Set([m.expandParam, m.list.limit.param, m.list.after, m.list.before, m.list.offset?.param].filter(Boolean));
     const data = Object.fromEntries(Object.entries(params).filter(([k]) => !control.has(k) && k !== 'id'));
+    // a strict vendor refuses a body it does not declare before the core writes it (body.strict, as ctx.fields)
+    if (m.body.strict && (op.class === 'create' || op.class === 'update')) {
+        const queried = new Set((op.query ?? []).map((q) => q.name));
+        const checked = strictFields(m, op, Object.fromEntries(Object.entries(data).filter(([k]) => !queried.has(k) && !(k in call.params))));
+        if ('refused' in checked)
+            return { served: checked.refused };
+    }
     switch (op.class) {
         case 'create': {
             for (const field of Object.keys(decl.state ?? {}))
@@ -453,88 +978,51 @@ export async function serveCore(m, call, scope = {}) {
             if (decl.key)
                 return { unmodeled: 'a create under a composite key is a handler' };
             const provided = m.ids.acceptProvided && typeof params.id === 'string' && params.id ? params.id : undefined;
-            const id = provided ?? mintId(m, resource, root);
+            const id = provided ?? mintId(m, resource, root, at);
             const assigned = Object.fromEntries(Object.entries(decl.assigned ?? {}).map(([k, rule]) => [k, applyRule(m, rule, id, data, at)]));
             const initial = Object.fromEntries(Object.entries(decl.state ?? {}).map(([k, s]) => [k, s.initial]));
-            const under = parent ? { [parent.field]: parentId } : {};
+            const under = { ...(parent ? { [parent.field]: parentId } : {}), ...(tenantField ? { [tenantField]: tenant } : {}) };
             if (decl.number) {
-                const siblings = stored(m, resource, root, { withDeleted: true }).filter((r) => !parent || r[parent.field] === parentId);
+                const siblings = stored(m, resource, root, { withDeleted: true }).filter(underParent);
                 under[decl.number.field] = 1 + siblings.reduce((n, r) => Math.max(n, Number(r[decl.number.field]) || 0), 0);
             }
-            return answer(await write(m, call, resource, id, { ...assigned, ...initial, ...under, ...data }, `${storedType(m, resource)}.create`, params, root, at));
+            const made = { ...assigned, ...initial, ...under, ...data };
+            const clash = conflictOf(m, resource, made, undefined, root);
+            if (clash)
+                return { served: vendorError(m, clash) };
+            return answer(await write(m, call, resource, id, made, `${storedType(m, resource)}.create`, params, root, at));
         }
         case 'retrieve': {
-            const hit = idParam ? stored(m, resource, root).find((r) => r.id === idParam && underParent(r)) : undefined;
+            const hit = idParam ? stored(m, resource, root).find((r) => namedBy(decl, r, idParam) && underParent(r)) : undefined;
+            // a setting never written answers its defaults; one written answers them under what was written
+            if (decl.setting)
+                return answer({ ...decl.setting.defaults, ...(hit ? settingView(m, resource, hit) : {}) });
             return hit ? answer(view(m, resource, hit)) : { served: notFound(m, resource, String(idParam), Object.keys(call.params).at(-1)) };
         }
         case 'list': {
-            let rows = stored(m, resource, root).filter(underParent).map((r) => view(m, resource, r));
-            for (const f of decl.filters ?? [])
-                if (params[f] !== undefined)
-                    rows = rows.filter((r) => String(r[f]) === String(params[f]));
-            const order = decl.order ?? { field: 'created', direction: 'desc' };
-            rows.sort((a, b) => {
-                // ties by mint order (`file-twin-10` after `file-twin-9`), not by the ids' lexical order
-                const d = Number(a[order.field] ?? 0) - Number(b[order.field] ?? 0) || String(a.id).localeCompare(String(b.id), undefined, { numeric: true });
-                return order.direction === 'desc' ? -d : d;
-            });
-            const size = m.list.limits?.[op.id] ?? m.list.limit;
-            const asked = params[m.list.limit.param];
-            const n = asked === undefined || asked === '' ? size.default : Number(asked);
-            const limit = Number.isFinite(n) ? Math.min(size.max, Math.max(1, Math.trunc(n))) : size.default;
-            const after = m.list.after ? params[m.list.after] : undefined;
-            const before = m.list.before ? params[m.list.before] : undefined;
-            let from = 0;
-            let to;
-            if (typeof before === 'string') {
-                const at = rows.findIndex((r) => r.id === before);
-                to = at === -1 ? (m.list.unknownCursor === 'end' ? 0 : rows.length) : at;
-                from = Math.max(0, to - limit);
-            }
-            else {
-                if (typeof after === 'string') {
-                    const at = rows.findIndex((r) => r.id === after);
-                    from = at === -1 ? (m.list.unknownCursor === 'end' ? rows.length : 0) : at + 1;
-                }
-                to = from + limit;
-            }
-            const page = rows.slice(from, to).map((r) => (paths.length ? expand(m, resource, r, paths.filter((p) => p.startsWith('data.')).map((p) => p.slice(5)), root) : r));
-            const hasMore = typeof before === 'string' ? from > 0 : to < rows.length;
-            const url = op.path.replace(/\{[^}]+\}/g, (p) => call.params[p.slice(1, -1)] ?? p);
-            if (m.list.page) {
-                const n = Math.max(1, Math.floor(Number(params[m.list.page.param]) || 1));
-                const slice = rows.slice((n - 1) * limit, n * limit);
-                const last = Math.max(1, Math.ceil(rows.length / limit));
-                const headers = new Headers();
-                if (m.list.page.link && rows.length > limit) {
-                    const at = (k) => {
-                        const u = new URL(call.request.url);
-                        u.searchParams.set(m.list.page.param, String(k));
-                        return u.toString();
-                    };
-                    const rels = [...(n > 1 ? [`<${at(n - 1)}>; rel="prev"`] : []), ...(n < last ? [`<${at(n + 1)}>; rel="next"`, `<${at(last)}>; rel="last"`] : []), ...(n > 1 ? [`<${at(1)}>; rel="first"`] : [])];
-                    if (rels.length)
-                        headers.set('link', rels.join(', '));
-                }
-                return { served: Response.json(fill(m.list.envelope, { data: slice, next_cursor: null, key: op.answers?.key ?? 'data' }), { headers }) };
-            }
-            if (m.list.offset) {
-                const skip = Math.max(0, Math.trunc(Number(params[m.list.offset.param]) || 0));
-                const slice = rows.slice(skip, skip + limit);
-                const key = op.answers?.key ?? 'data';
-                return { served: Response.json({ ...(m.success ?? {}), [key]: slice, ...fill(m.list.envelopes?.[op.id] ?? m.list.envelope, { data: slice, total_count: rows.length, key }) }) };
-            }
-            if (m.list.cursor) {
-                const start = decodeOffset(params[m.list.cursor.param]);
-                const slice = rows.slice(start, start + limit);
-                const next = start + limit < rows.length ? encodeOffset(start + limit) : '';
-                return { served: Response.json({ ...(m.success ?? {}), ...fill(m.list.envelope, { data: slice, next_cursor: next, key: op.answers?.key ?? 'data' }), ...(op.answers?.key ? { [op.answers.key]: slice } : {}) }) };
-            }
-            return { served: Response.json(fill(m.list.envelope, { data: page, has_more: hasMore, url, first_id: page[0]?.id ?? null, last_id: page.at(-1)?.id ?? null })) };
+            const rows = stored(m, resource, root).filter(underParent).map((r) => view(m, resource, r));
+            const arranged = arrangeRows(m, resource, params, rows);
+            if (!Array.isArray(arranged))
+                return { served: vendorError(m, arranged) };
+            return { served: pageRows(m, op, call, params, arranged, resource, root, paths) };
         }
         case 'update':
         case 'action': {
-            const hit = idParam ? stored(m, resource, root).find((r) => r.id === idParam && underParent(r)) : undefined;
+            const hit = idParam ? stored(m, resource, root).find((r) => namedBy(decl, r, idParam) && underParent(r)) : undefined;
+            // a setting's update merges what is given over what it holds (its defaults until first written), making it
+            if (decl.setting && op.class === 'update' && idParam) {
+                const current = { ...decl.setting.defaults, ...(hit ? settingView(m, resource, hit) : {}) };
+                const merged = {};
+                for (const [k, v] of Object.entries(data))
+                    merged[k] = mergeField(decl.update, current[k], v);
+                const under = { ...(parent ? { [parent.field]: parentId } : {}), ...(tenantField ? { [tenantField]: tenant } : {}) };
+                await write(m, call, resource, hit?.id ?? String(idParam), { ...under, ...merged }, `${storedType(m, resource)}.update`, params, root, at);
+                // a setting whose update the spec documents with no content answers none (a specification that omits a body
+                // elsewhere is not trusted this far: only a setting's update reads it)
+                if (op.emptySuccess)
+                    return { served: new Response(null, { status }) };
+                return answer({ ...current, ...merged });
+            }
             if (!hit)
                 return { served: notFound(m, resource, String(idParam), Object.keys(call.params).at(-1)) };
             const current = view(m, resource, hit);
@@ -562,17 +1050,18 @@ export async function serveCore(m, call, scope = {}) {
             if (op.class === 'action' && !moved)
                 return { unmodeled: `action ${op.id} declares no transition` };
             const merged = {};
-            for (const [k, v] of Object.entries(changes)) {
-                const prior = current[k];
-                merged[k] = decl.update !== 'replace' && v && typeof v === 'object' && !Array.isArray(v) && prior && typeof prior === 'object' && !Array.isArray(prior) ? Object.fromEntries(Object.entries({ ...prior, ...v }).filter(([, value]) => value !== '')) : v;
-            }
+            for (const [k, v] of Object.entries(changes))
+                merged[k] = mergeField(decl.update, current[k], v);
+            const clash = conflictOf(m, resource, { ...current, ...merged }, hit.id, root);
+            if (clash)
+                return { served: vendorError(m, clash) };
             return answer(await write(m, call, resource, hit.id, merged, `${storedType(m, resource)}.${op.class === 'update' ? 'update' : op.id}`, params, root, at));
         }
         case 'delete': {
-            const hit = idParam ? stored(m, resource, root).find((r) => r.id === idParam && underParent(r)) : undefined;
+            const hit = idParam ? stored(m, resource, root).find((r) => namedBy(decl, r, idParam) && underParent(r)) : undefined;
             if (!hit)
                 return { served: notFound(m, resource, String(idParam), Object.keys(call.params).at(-1)) };
-            await write(m, call, resource, hit.id, { deleted: true }, `${storedType(m, resource)}.delete`, params, root, at);
+            await removeSubject(m, call, resource, hit.id, params, root, at);
             const shape = decl.deleted !== undefined ? decl.deleted : m.deleted;
             return { served: status === 204 || shape === null ? new Response(null, { status: 204 }) : Response.json(fill(shape, { id: hit.id, object: current(hit) }), { status }) };
         }
@@ -600,19 +1089,32 @@ export function sse(m, events, operationId) {
     });
     return new Response(body, { status: 200, headers: { 'content-type': 'text/event-stream; charset=utf-8', 'cache-control': 'no-cache' } });
 }
-async function contextFor(m, call, scope) {
+/** The context the kernel opens for a call (a handler's, a door's, a screen's). Kernel-internal: packs are given it. */
+export async function contextFor(m, call, scope) {
     const root = scope.root;
     const asAsked = call;
     call = adoptedPath(m, call, root);
     const at = (scope.clock ?? worldNow)();
-    const text = await call.request.clone().text().catch(() => '');
-    let body = undefined;
-    try {
-        body = text ? JSON.parse(text) : undefined;
-    }
-    catch {
-        body = text;
+    // the guard's parse when it made one (taken once), else this context's own
+    const parsed = takeParsedBody(call.request);
+    const text = parsed ? '' : await bodyTextOf(call.request.clone()).catch(() => '');
+    let body = parsed?.value;
+    if (!parsed) {
+        try {
+            body = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            body = text;
+        }
     }
+    // the request as it came, before the core's parameter merge and alias adoption: what a write records, so a perform
+    // can send it again (the real-system adapters, "What the derived core records with a write")
+    const boundary = multipartBoundary(call.request.headers.get('content-type'));
+    const parts = boundary === null ? undefined : multipartParts(new Uint8Array(await call.request.clone().arrayBuffer()), boundary);
+    // a body that is not JSON is recorded as it came, its type with it: text as text, bytes (a gzip the vendor's client
+    // compressed itself, PostHog's `compression=gzip-js`) as base64
+    const raw = !parts && typeof body === 'string' && body !== '' ? await rawBody(call.request) : undefined;
+    sentOf.set(call, { ...sentRequest(m, asAsked, parts ? Object.fromEntries(parts.filter((p) => p.filename === null).map((p) => [p.name, new TextDecoder().decode(p.body)])) : raw ?? body), ...(parts ? { parts } : {}), ...(raw ? { type: call.request.headers.get('content-type') ?? undefined } : {}) });
     // a handler reading the body itself sees the adopted id too (the boundary's one resolution, below)
     if (body && typeof body === 'object' && !Array.isArray(body))
         body = adoptedInCall(m.service, body, root);
@@ -629,17 +1131,71 @@ async function contextFor(m, call, scope) {
         text,
         root,
         occurredAt: at,
+        publicBase: twinPublicBase(call.request),
+        scenario: scenarioDecisionOf(call.request),
+        deliver: (url, init) => deliverToApplication(url, init),
+        ask: (url, init, within) => askApplication(url, init, within),
+        worldEnv: (name) => worldEnvValue(name),
+        asVendor: (fn) => runAsVendorMove(fn),
+        git: (name) => {
+            if (!/^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$/.test(name) || name.split('/').some((seg) => seg === '.' || seg === '..'))
+                throw new Error(`semantics: ${name} is not a git repository name`);
+            const plane = `${worldPaths(m.service, root).dir}/git`;
+            return { store: new GitObjectStore(getActiveBlobStore(), `${plane}/objects`), refs: new GitRefs(getActiveWorldStore(), `${plane}/repos/${name}`) };
+        },
+        mail: (route, mail, headers) => sendMail(route, mail, headers),
         actor: m.identity ? m.identity(call.request.headers.get('authorization'), root) : undefined,
         now: () => now(m, at),
         get: (resource, id) => {
             const hit = stored(m, resource, root).find((r) => r.id === id);
             return hit ? view(m, resource, hit) : undefined;
         },
+        ownerRow: (owner, resource, id) => {
+            if (!m.ownerReads?.some((r) => r.owner === owner && r.resource === resource))
+                throw new Error(`semantics: undeclared owner read ${owner}/${resource}`);
+            const row = projectOwnerResources(owner, root, { type: resource, id }).find((r) => r.type === resource && r.id === id);
+            return row ? { ...ownFields(row), ...(row.deleted === true ? { deleted: true } : {}) } : undefined;
+        },
         rows: (resource) => stored(m, resource, root).map((r) => view(m, resource, r)),
-        mint: (resource) => mintId(m, resource, root),
+        mint: (resource) => mintId(m, resource, root, at),
+        sockets: (id) => openSessions(m.service, root, id),
+        issue: async (resource) => {
+            const id = mintId(m, resource, root, at);
+            if (!resource.startsWith('_'))
+                throw new Error(`semantics: ${resource} is not a bookkeeping type (an issued id's type starts with _)`);
+            if (scope.readOnly !== true && !isReadOnlyRequest(call.request)) {
+                await applyTwinWrite(m.service, { operation: `${resource.slice(1)}.issue`, subjectType: storedType(m, resource), subjectId: id, fields: { issuedAt: at }, occurredAt: at, actor: { kind: 'system' } }, root);
+            }
+            return id;
+        },
+        secret: async (label) => hmac(await worldSeed(m.service, root, at), label, 'base64url'),
+        get machines() {
+            const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool');
+            return poolFor(m.service, root, enrolled?.kind ?? 'none');
+        },
+        signingKey: (label, alg) => worldSigningKey(m.service, root, at, label, alg ?? 'RS256'),
+        heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, label, alg ?? 'RS256'),
         write: (resource, id, fields, operation) => write(m, call, resource, id, fields, operation, params, root, at),
+        accumulate: async (resource, id, deltas, operation) => {
+            if (!resource.startsWith('_') || !m.resources[resource])
+                throw new Error('accumulate requires a declared bookkeeping resource');
+            await applyTwinWriteAtomic(m.service, (resources) => {
+                const prior = resources.find((row) => row.type === storedType(m, resource) && row.id === id && row.deleted !== true);
+                if (!prior)
+                    throw new Error('accumulate requires an existing bookkeeping row');
+                const fields = {};
+                for (const [field, delta] of Object.entries(deltas)) {
+                    const value = prior[field];
+                    if (typeof value !== 'number' || !Number.isFinite(value) || !Number.isFinite(delta) || !Number.isFinite(value + delta))
+                        throw new Error('accumulate requires finite numeric fields and deltas');
+                    fields[field] = value + delta;
+                }
+                return { kind: 'write', value: undefined, write: { operation, subjectType: storedType(m, resource), subjectId: id, fields, occurredAt: at, actor: { kind: 'agent' } } };
+            }, root);
+        },
         writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at),
         resolve: (resource, id) => resolveSubjectId(m.service, storedType(m, resource), id, root),
+        storedType: (resource) => storedType(m, resource),
         ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
         row: (resource, id, opts) => stored(m, resource, root, opts).find((r) => r.id === id),
         rowsRaw: (resource, opts) => stored(m, resource, root, opts),
@@ -648,7 +1204,18 @@ async function contextFor(m, call, scope) {
         record: async (type, fields, id) => {
             if (!type.startsWith('_'))
                 throw new Error(`semantics: ${type} is not a bookkeeping type (bookkeeping types start with _)`);
-            const subject = id ?? `${type.slice(1)}_${twinResources(m.service, root).filter((r) => r.type === type).length + 1}`;
+            // an id the caller does not give is the next past every one of this type the tree holds (as `{n}` ids are minted),
+            // never a count of the rows, which a removed row would make repeat
+            const subject = id ?? (() => {
+                const prefix = `${type.slice(1)}_`;
+                let max = 0;
+                for (const r of resourcesOfType(m.service, type, root)) {
+                    const n = r.id.startsWith(prefix) ? Number(r.id.slice(prefix.length)) : NaN;
+                    if (Number.isInteger(n) && n > max)
+                        max = n;
+                }
+                return `${prefix}${max + 1}`;
+            })();
             await applyTwinWrite(m.service, { operation: `${type.slice(1)}.record`, subjectType: type, subjectId: subject, fields, occurredAt: at, actor: { kind: 'system' } }, root);
             return subject;
         },
@@ -677,11 +1244,45 @@ async function contextFor(m, call, scope) {
         },
         refuse: (e) => vendorError(m, e),
         notFound: (resource, id, param) => notFound(m, resource, id, param),
+        validate: () => validateBody(m, call.operation, body),
         reply: (body, status = 200) => Response.json(body, { status }),
         wrap: (body, extra = {}) => Response.json({ ...envelope(m, call.operation, body), ...extra }),
         sse: (events) => sse(m, events, call.operation.id),
-        expand: (resource, body) => (paths.length ? expand(m, resource, body, paths, root) : body),
+        expand: (resource, body, given) => ((given ?? paths).length ? expand(m, resource, body, given ?? paths, root) : body),
         at: (when) => contextFor(m, { ...call, request: new Request(call.request.url) }, { ...scope, clock: () => when }),
+        crypto: handlerCrypto,
+        flag: (value) => flagOf(m, value),
+        fields: (body) => strictFields(m, call.operation, body),
+        vendorFetch: (url, init) => vendorFetch(url, init),
+        parts: async () => {
+            const boundary = multipartBoundary(call.request.headers.get('content-type'));
+            return boundary === null ? [] : multipartParts(new Uint8Array(await call.request.clone().arrayBuffer()), boundary);
+        },
+        engine: scope.database === undefined ? unboundDatabase(m.service) : managedDatabase(scope.database, { readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), clock: at }),
+        redis: (commands, options) => execRedisRun(commands, {
+            root, occurredAt: at, service: m.service, readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), dialect: options.dialect,
+            ...(options.database === undefined ? {} : { database: options.database }),
+        }),
+        blobs: {
+            put: (key, bytes) => writeResourceBlob(m.service, key, bytes, root),
+            get: (key) => readResourceBlob(m.service, key, root),
+            remove: (key) => removeResourceBlob(m.service, key, root),
+        },
+        merge: (resource, prior, next) => mergeField(m.resources[resource]?.update, prior, next),
+        conflict: (resource, fields, except) => {
+            const clash = conflictOf(m, resource, fields, except, root);
+            return clash ? vendorError(m, clash) : undefined;
+        },
+        remove: (resource, id, operation) => removeSubject(m, call, resource, id, params, root, at, operation),
+        find: (resource, key) => {
+            const id = resolveSubjectId(m.service, storedType(m, resource), key, root);
+            const hit = stored(m, resource, root).find((r) => r.id === id || namedBy(m.resources[resource], r, key));
+            return hit ? view(m, resource, hit) : undefined;
+        },
+        list: (resource, rows) => {
+            const arranged = arrangeRows(m, resource, params, rows);
+            return Array.isArray(arranged) ? pageRows(m, call.operation, call, params, arranged, resource, root, paths) : vendorError(m, arranged);
+        },
         over: (other) => contextFor(other, { ...asAsked, request: asAsked.request.clone() }, { ...scope, clock: () => at }),
         core: async () => { const out = await serveCore(m, { ...call, request: pristine.clone() }, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
         own: (row) => ownFields(row),
@@ -708,6 +1309,59 @@ export function coreFor(m, scope = {}) {
 const hex = (s) => Array.from(new TextEncoder().encode(s), (b) => b.toString(16).padStart(2, '0')).join('');
 /** Read-only refusal, API-version validation and idempotent replay, applied once around every
  *  operation a handler or the core serves. */
+/** The vendor's refusal of a request's credential under the manifest's `auth`, or undefined when it passes: what the
+ *  cross-cutting gate answers for an operation, and what a pack whose vendor checks the credential before routing (an
+ *  unknown path answers 401, as Supabase's recording shows) calls in front of its dispatch. */
+/** The header the kernel names a scenario's decision in, set by createPackFetch alone (it strips it from every request it
+ *  is sent). */
+export const SCENARIO_DECISION_HEADER = 'x-volter-scenario-decision';
+function scenarioDecisionOf(request) {
+    const raw = request.headers.get(SCENARIO_DECISION_HEADER);
+    if (!raw)
+        return undefined;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function authRefusal(m, request, root) {
+    if (!m.auth)
+        return undefined;
+    const url = new URL(request.url);
+    if (m.auth.paths !== undefined && !new RegExp(m.auth.paths).test(url.pathname))
+        return undefined;
+    const sources = [{ header: m.auth.header, scheme: m.auth.scheme }, ...(m.auth.also ?? [])];
+    const given = sources.map((s) => (s.query !== undefined ? url.searchParams.get(s.query) : s.header ? request.headers.get(s.header) : null)).some((v) => v !== null);
+    if (!given && !m.auth.gateWhenAbsent)
+        return undefined;
+    const keyOf = (s) => {
+        if (s.query !== undefined)
+            return (url.searchParams.get(s.query) ?? '').trim();
+        const raw = s.header ? request.headers.get(s.header) : null;
+        if (raw === null)
+            return '';
+        if (!s.scheme)
+            return raw.trim();
+        const scheme = `${s.scheme.toLowerCase()} `;
+        return raw.toLowerCase().startsWith(scheme) ? raw.slice(scheme.length).trim() : '';
+    };
+    const key = sources.map(keyOf).find((k) => k !== '') ?? '';
+    // no credential sent is `missing`; one sent in a form the vendor does not read is a key it does not know
+    if (!key)
+        return vendorError(m, given ? m.auth.invalid : m.auth.missing);
+    if (m.auth.invalidKeys.includes(key) || (m.auth.keyFormat && !new RegExp(m.auth.keyFormat).test(key)))
+        return vendorError(m, m.auth.invalid);
+    const held = m.auth.held;
+    if (held && !held.standing?.includes(key)) {
+        const hash = sha256(key);
+        const holds = resourcesOfType(m.service, held.storedAs, root).some((r) => r.deleted !== true && r[held.hashField] === hash && (held.unless === undefined || r[held.unless] !== true));
+        if (!holds)
+            return vendorError(m, m.auth.invalid);
+    }
+    return undefined;
+}
 export function crossCutting(m, opts = {}) {
     const finish = async (r, request) => {
         if (!m.origin || !(r.headers.get('content-type') ?? '').includes('json'))
@@ -727,17 +1381,9 @@ export function crossCutting(m, opts = {}) {
     return async (call, next) => finish(await guarded(call, next), call.request);
     async function guarded(call, next) {
         const { request } = call;
-        if (m.auth) {
-            const raw = request.headers.get(m.auth.header);
-            if (raw !== null || m.auth.gateWhenAbsent) {
-                const scheme = `${m.auth.scheme.toLowerCase()} `;
-                const key = raw && raw.toLowerCase().startsWith(scheme) ? raw.slice(scheme.length).trim() : '';
-                if (!key)
-                    return vendorError(m, m.auth.missing);
-                if (m.auth.invalidKeys.includes(key) || (m.auth.keyFormat && !new RegExp(m.auth.keyFormat).test(key)))
-                    return vendorError(m, m.auth.invalid);
-            }
-        }
+        const refused = m.auth?.exempt?.includes(call.operation.id) ? undefined : authRefusal(m, request, opts.root);
+        if (refused)
+            return refused;
         // a read-only twin refuses writes: what the operation does, not the HTTP verb it came by (an RPC
         // wire POSTs its reads). A read-only REQUEST (x-volter-read-only, request-scope.ts) is refused the
         // same way, up front, on a writable twin.
@@ -745,16 +1391,14 @@ export function crossCutting(m, opts = {}) {
         if (readOnly && !['retrieve', 'list', 'computed'].includes(call.operation.class) && !m.reads?.includes(call.operation.id))
             return vendorError(m, m.readOnly);
         // a body labelled JSON that does not parse is the vendor's refusal, never a crash of the twin
-        if ((request.headers.get('content-type') ?? '').includes('json') || m.body.json === 'always') {
-            const text = request.method === 'GET' || request.method === 'HEAD' ? '' : await request.clone().text().catch(() => '');
-            if (text) {
-                try {
-                    JSON.parse(text);
-                }
-                catch {
-                    return vendorError(m, m.malformedBody ?? { status: 400, message: 'The request body could not be parsed as JSON.' });
-                }
-            }
+        // (`json: 'always'` reads the vendor's JSON bodies whatever their label, never an operation its spec declares
+        // multipart or form: Cloudflare's asset and script uploads)
+        const declared = call.operation.bodyEncoding;
+        const labelled = request.headers.get('content-type') ?? '';
+        if ((labelled.includes('json') && !labelled.includes('ndjson')) || (m.body.json === 'always' && declared !== 'multipart' && declared !== 'form')) {
+            const ok = request.method === 'GET' || request.method === 'HEAD' ? true : await checkJsonBody(request.clone()).catch(() => true);
+            if (!ok)
+                return vendorError(m, m.malformedBody ?? { status: 400, message: 'The request body could not be parsed as JSON.' });
         }
         if (m.version) {
             const value = request.headers.get(m.version.header);
@@ -765,7 +1409,7 @@ export function crossCutting(m, opts = {}) {
         if (!m.idempotency || !key || !(m.idempotency.methods ?? ['POST']).includes(request.method.toUpperCase()))
             return next();
         const url = new URL(request.url);
-        const signature = hashFieldValue({ path: url.pathname + url.search, body: await request.clone().text() });
+        const signature = hashFieldValue({ path: url.pathname + url.search, body: await bodyTextOf(request.clone()) });
         const id = `idem_${hex(key)}`;
         const prior = twinResources(m.service, opts.root).find((r) => r.type === m.idempotency.storedAs && r.id === id);
         if (prior) {