@volter/world-core 3.0.153 → 3.0.155

package/dist/generated/pack-facts.json

@@ -270,6 +270,9 @@
         {
           "host": "api.clerk.com"
         },
+        {
+          "host": "dashboard.clerk.com"
+        },
         {
           "suffix": ".clerk.accounts.dev"
         },
@@ -1309,8 +1312,7 @@
           "host": "api.linear.app"
         },
         {
-          "host": "linear.app",
-          "pathPattern": "^/oauth/"
+          "host": "linear.app"
         }
       ],
       "archetype": "crud",
@@ -1330,7 +1332,7 @@
         "comment",
         "issue_label"
       ],
-      "endpointEnvNone": "Linear uses api.linear.app/graphql and linear.app/oauth/authorize; the World claims the documented hosts",
+      "endpointEnvNone": "Linear uses api.linear.app/graphql and linear.app for its workspace and OAuth authorize page; the World claims those hosts",
       "credentialDoor": {
         "path": "/_twin/local-credentials",
         "body": {},
@@ -2023,6 +2025,10 @@
         },
         {
           "host": "inbound-cdn.resend.com"
+        },
+        {
+          "host": "resend.com",
+          "pathPattern": "^/emails(?:/|$)"
         }
       ],
       "archetype": "crud",
@@ -2179,6 +2185,9 @@
         ]
       },
       "hosts": [
+        {
+          "host": "app.slack.com"
+        },
         {
           "host": "slack.com"
         },

package/dist/src/client-bundle.js

@@ -1,7 +1,8 @@
 // A page's browser client from its `client/<name>.tsx` entry (the console's, the platform's), runtime-neutral (the
-// serve seam's helpers, docs/contributing/architecture.md#the-serve-seam): under Bun a `Bun.build` at serve time; under Node the PREBUILT `<name>.bundle.js` beside the entry, written at pack time
-// by scripts/publish/build.mjs into dist/client/. Built once per process and kept; a failed build
-// is retried on the next call. Nothing here runs at module scope.
+// serve seam's helpers, docs/contributing/architecture.md#the-serve-seam): serve an adjacent `<name>.bundle.js`
+// under either runtime, written at pack time by scripts/publish/build.mjs into dist/client/. Without one, Bun
+// builds the source at serve time and Node refuses it. Kept once per process; a failed attempt is retried on
+// the next call. Nothing here runs at module scope.
 import { existsSync, readFileSync } from 'node:fs';
 /** A file URL's path on this machine, without `node:url` (the modules that call it ride into browser
  *  bundles): percent-escapes decoded, and without the slash `URL.pathname` puts before a Windows drive
@@ -18,19 +19,18 @@ const PROCESS_SHIM = 'globalThis.process=globalThis.process||{env:{NODE_ENV:"pro
 export function bundleClient(entry) {
     let pending = bundles.get(entry);
     if (!pending) {
-        const bun = globalThis.Bun;
-        pending = (bun && typeof bun.build === 'function'
-            ? bun.build({ entrypoints: [entry], target: 'browser', minify: true }).then(async (result) => {
-                if (!result.success)
-                    throw new Error(result.logs.map((l) => l.message).join('\n') || `client build failed: ${entry}`);
-                return PROCESS_SHIM + await result.outputs[0].text();
-            })
-            : Promise.resolve().then(() => {
-                const prebuilt = entry.replace(/\.tsx?$/, '.bundle.js');
-                if (!existsSync(prebuilt))
-                    throw new Error(`client bundle missing at ${prebuilt} — the package's \`build\` writes it (scripts/publish/build.mjs); Node serves the prebuilt client`);
+        pending = Promise.resolve().then(async () => {
+            const prebuilt = entry.replace(/\.tsx?$/, '.bundle.js');
+            if (existsSync(prebuilt))
                 return PROCESS_SHIM + readFileSync(prebuilt, 'utf8');
-            }))
+            const bun = globalThis.Bun;
+            if (!bun || typeof bun.build !== 'function')
+                throw new Error(`client bundle missing at ${prebuilt} — the package's \`build\` writes it (scripts/publish/build.mjs); Node serves the prebuilt client`);
+            const result = await bun.build({ entrypoints: [entry], target: 'browser', minify: true });
+            if (!result.success)
+                throw new Error(result.logs.map((l) => l.message).join('\n') || `client build failed: ${entry}`);
+            return PROCESS_SHIM + await result.outputs[0].text();
+        })
             .catch((error) => { bundles.delete(entry); throw error; });
         bundles.set(entry, pending);
     }

package/dist/src/event-delivery.d.ts

@@ -0,0 +1,4 @@
+import type { EventTransport } from './events.js';
+/** Dispatch one newly recorded packet once. Legacy rows, existing attempts and
+ * interrupted sending claims never turn into an unrequested second send. */
+export declare function sendRecordedEvent(service: string, deliveryType: string, deliveryId: string, root: string | undefined, transport: EventTransport, trace: Record<string, string>): Promise<void>;

package/dist/src/event-delivery.js

@@ -0,0 +1,70 @@
+// FIRST DECLARED-EVENT OUTCOMES (architecture, "What an author writes, and how").
+// A queued packet is not evidence its receiver answered. Keep the first attempt
+// under the shared action lock; this is not the originating-write outbox or a
+// substitute for a vendor's declared retry/redelivery policy.
+import { applyTwinWriteAtomic } from "./serve.js";
+import { worldNow } from "./world-clock.js";
+const ATTEMPT = '_world_event_delivery_attempt';
+/** Dispatch one newly recorded packet once. Legacy rows, existing attempts and
+ * interrupted sending claims never turn into an unrequested second send. */
+export async function sendRecordedEvent(service, deliveryType, deliveryId, root, transport, trace) {
+    const { value: claim } = await applyTwinWriteAtomic(service, (resources) => {
+        const row = resources.find((r) => r.type === deliveryType && r.id === deliveryId);
+        if (!row || row.deleted === true || row.delivery_protocol !== 1 || row.delivery_state !== 'queued'
+            || row.attempt_count !== 0 || row.current_attempt !== null)
+            return { kind: 'skip', value: undefined };
+        const attemptId = `${deliveryType}:${deliveryId}:1`;
+        if (resources.some((r) => r.type === ATTEMPT && r.id === attemptId))
+            return { kind: 'skip', value: undefined };
+        if (typeof row.url !== 'string' || typeof row.body !== 'string'
+            || !row.headers || typeof row.headers !== 'object' || Array.isArray(row.headers)
+            || Object.values(row.headers).some((v) => typeof v !== 'string')) {
+            throw new Error('A retained declared-event packet is incomplete; it cannot be dispatched.');
+        }
+        const occurredAt = worldNow();
+        return { kind: 'write', value: {
+                attemptId, url: row.url, body: row.body, headers: { ...row.headers },
+            }, write: {
+                operation: 'world_event_delivery.claim', subjectType: deliveryType, subjectId: deliveryId,
+                fields: { delivery_state: 'sending', attempt_count: 1, current_attempt: attemptId },
+                projection: { creates: [{ type: ATTEMPT, id: attemptId, fields: {
+                                delivery_type: deliveryType, delivery_id: deliveryId, attempt: 1,
+                                state: 'sending', started_at: Date.parse(occurredAt), finished_at: null, transport_status: null,
+                            } }] },
+                occurredAt, actor: { kind: 'system' },
+            } };
+    }, root);
+    if (!claim)
+        return;
+    let status = null;
+    try {
+        const answer = await transport(claim.url, claim.body, { ...claim.headers, ...trace });
+        if (typeof answer === 'number' && Number.isInteger(answer) && answer >= 100 && answer <= 599)
+            status = answer;
+    }
+    catch {
+        // A thrown request can have reached the receiver. Preserve uncertainty and
+        // never copy exception strings, response bodies or credentials into history.
+    }
+    const state = status === null ? 'unknown' : status >= 200 && status < 300 ? 'succeeded' : 'failed';
+    const occurredAt = worldNow(), finishedAt = Date.parse(occurredAt);
+    await applyTwinWriteAtomic(service, (resources) => {
+        const attempt = resources.find((r) => r.type === ATTEMPT && r.id === claim.attemptId);
+        if (!attempt || attempt.deleted === true || attempt.state !== 'sending'
+            || attempt.delivery_type !== deliveryType || attempt.delivery_id !== deliveryId)
+            return { kind: 'skip', value: undefined };
+        const row = resources.find((r) => r.type === deliveryType && r.id === deliveryId);
+        const current = row && row.deleted !== true && row.delivery_protocol === 1
+            && row.delivery_state === 'sending' && row.current_attempt === claim.attemptId;
+        return { kind: 'write', value: undefined, write: {
+                operation: 'world_event_delivery.finish', subjectType: ATTEMPT, subjectId: claim.attemptId,
+                fields: { state, finished_at: finishedAt, transport_status: status },
+                ...(current && row ? { projection: { updates: [{ type: deliveryType, id: deliveryId, fields: {
+                                    delivery_state: state, finished_at: finishedAt, transport_status: status,
+                                    // A future manual attempt must not erase earlier positive acceptance.
+                                    accepted_at: state === 'succeeded' ? row.accepted_at ?? finishedAt : row.accepted_at ?? null,
+                                } }] } } : {}),
+                occurredAt, actor: { kind: 'system' },
+            } };
+    }, root);
+}

package/dist/src/events.d.ts

@@ -110,7 +110,8 @@ export type EventsDecl = {
     envelope: unknown;
     /** Where the World's endpoints are kept: one kind, or several (GitHub's repository and organization hooks). */
     endpoints: EndpointsDecl | ReadonlyArray<EndpointsDecl>;
-    /** The bookkeeping type each delivery is kept as (`_webhook_message`): what a World reads to see what was sent. */
+    /** The bookkeeping type each delivery is kept as (`_webhook_message`), otherwise `_world_event_delivery`.
+     *  Queuing and the first transport attempt/outcome are separate retained facts. */
     record?: string;
 };
 /** An event's further envelope values (`$`-named) the pack computes for a write, from the vendor's own state (the
@@ -131,7 +132,7 @@ export type EventWrite = {
  *  it: the pack's `semantics/events.ts`, under the handler contract's read-only context, for each type the write sends
  *  (a Slack message renders as `message` and as `app_mention`). */
 export type EventRender<C> = (ctx: C, write: EventWrite, type: string) => Record<string, unknown>;
-/** A delivery made: where it went and exactly what was sent. */
+/** A rendered delivery packet. Its transport attempt and acceptance are separate retained facts. */
 export type EventDelivery = {
     url: string;
     body: string;
@@ -163,8 +164,8 @@ export declare function eventTypeOf(decl: Pick<EventsDecl, 'types' | 'known'>, o
 /** Whether an endpoint's list of event types takes a type: every type when the list is empty, `*` or `<family>.*`
  *  its patterns, else the type itself. */
 export declare function takesEvent(list: unknown, type: string): boolean;
-/** Who watches what the World sends (a walk reading each delivery as its receiver would): told of every delivery as it
- *  is made, before its transport. Set and restored by the walk, as its World store is; unset, nothing watches. */
+/** Who watches signed packets before dispatch (a walk reading each as its receiver would). This is not evidence of
+ *  transport or acceptance. Set and restored by the walk, as its World store is; unset, nothing watches. */
 export type DeliveryObserver = (delivery: EventDelivery & {
     service: string;
 }) => void;

package/dist/src/events.js

@@ -10,6 +10,9 @@ import { createHash, createHmac } from 'node:crypto';
 import { applyTwinWrite, applyTwinWriteAtomic, twinResources } from "./serve.js";
 import { equalSecrets as same, ksuidFrom } from "./signing.js";
 import { deliveryTraceHeaders } from "./trace-context.js";
+import { sendRecordedEvent } from "./event-delivery.js";
+import { getActiveWorldStore, withWorldStore } from "./world-store.js";
+import { worldPaths } from "./storage.js";
 /** Whether an endpoint takes an event by its `match`: every field of one match (any, when several) equal to the event's
  *  value, or, a list, holding it. */
 function matches(row, match, filled) {
@@ -328,6 +331,7 @@ async function deliverEventType(service, decl, write, data, transport, values, t
     const shared = JSON.stringify(envelope);
     const each = perEndpoint(decl.envelope);
     const sent = [];
+    const recorded = [];
     for (const [i, { row, kind }] of endpoints.entries()) {
         const body = each ? JSON.stringify(fillEnvelope(decl.envelope, filled, row)) : shared;
         const url = String(at(row, kind.url));
@@ -338,22 +342,33 @@ async function deliverEventType(service, decl, write, data, transport, values, t
         const headers = { ...extraHeaders, ...signEventAll(decl.scheme, String(at(row, kind.secret)), body, seconds, url, seq, identity) };
         sent.push({ url, body, headers });
         // kept with the write, by an id of the delivery itself (two made at once never take the same one)
-        if (decl.record !== undefined) {
-            await applyTwinWrite(service, {
-                operation: `${decl.record.slice(1)}.record`, subjectType: decl.record, subjectId: `${decl.record.slice(1)}_v1_${seq}`,
-                fields: { url, body, headers, event_type: type, sent_at: millis }, occurredAt: write.occurredAt, actor: { kind: 'system' },
-            }, write.root);
-        }
+        const record = decl.record ?? '_world_event_delivery';
+        const id = `${record.slice(1)}_v1_${seq}`;
+        await applyTwinWrite(service, {
+            operation: `${record.slice(1)}.record`, subjectType: record, subjectId: id,
+            fields: { url, body, headers, event_type: type, sent_at: millis,
+                delivery_protocol: 1, event_id: String(filled.$id),
+                endpoint_type: kind.storedAs, endpoint_id: String(row.id),
+                delivery_state: 'queued', attempt_count: 0, current_attempt: null,
+                transport_status: null, finished_at: null, accepted_at: null,
+            }, occurredAt: write.occurredAt, actor: { kind: 'system' },
+        }, write.root);
+        recorded.push({ type: record, id });
     }
     // sent after the write's answer, as a vendor sends it: the caller never waits on its receiver, and a receiver that is
     // slow or down fails no request
     // the write's trace is read now, inside its request, and carried on each delivery (W3C trace continuation)
     const trace = deliveryTraceHeaders();
+    // A timer must retain the request's store/root even if another World becomes
+    // active before it runs. Transport completion writes to the same retained state.
+    const store = getActiveWorldStore(), deliveryRoot = worldPaths(service, write.root).root;
     for (const d of sent)
         deliveryObserver?.({ ...d, service });
-    for (const { url, body: payload, headers } of sent)
+    for (const packet of recorded)
         setTimeout(() => {
-            void transport(url, payload, { ...headers, ...trace }).catch(() => { });
+            // Persistence failure leaves a queued/sending claim for explicit recovery;
+            // it must not fail the already-committed vendor write or cause a blind resend.
+            void withWorldStore(store, () => sendRecordedEvent(service, packet.type, packet.id, deliveryRoot, transport, trace)).catch(() => { });
         }, 0);
     return sent;
 }

package/dist/src/graphql-wire.d.ts

@@ -20,12 +20,16 @@ export declare class GraphqlError extends Error {
     readonly type?: string | undefined;
     constructor(message: string, type?: string | undefined);
 }
+type GraphqlLib = typeof import('graphql');
+export type GraphqlLibraryLoader = () => Promise<GraphqlLib>;
 /** A GraphQL endpoint over a schema and a pack's part: answers a request's `{query, variables, operationName}`. The
  *  context each resolver receives is made per request (the handler context). `unmodeled` answers a query selecting a
  *  field nothing models; `mutationRefused`, when given, a mutation the World may not make (a read-only twin). */
 export declare function graphqlEndpoint<C>(options: {
     sdl: string;
     part: GraphqlPart<C>;
+    /** The generated pack fetch's lazy import, resolving the library from the pack that declares it. */
+    loadLibrary?: GraphqlLibraryLoader;
     context: (request: Request) => Promise<C>;
     unmodeled: (field: {
         type: string;
@@ -33,3 +37,4 @@ export declare function graphqlEndpoint<C>(options: {
     }) => Response;
     mutationRefused?: (request: Request) => Response | undefined;
 }): (request: Request) => Promise<Response>;
+export {};

package/dist/src/graphql-wire.js

@@ -7,9 +7,9 @@
 // modeled; any other is answered by the manifest's `graphql.unmodeled`, naming the first field nothing models. An error
 // a resolver throws (`GraphqlError`) carries its `type`, as GitHub's GraphQL errors do.
 //
-// The `graphql` protocol library is loaded the first time a GraphQL request comes (installed by the pack's package.json,
-// as node-postgres is for the managed database): the kernel's own dependencies stay B1's, and importing the kernel
-// loads nothing.
+// The generated pack fetch supplies a lazy pack-local loader for the `graphql` protocol library installed by the pack's
+// package.json. Each endpoint caches its library on the first request; callers without a loader keep the kernel-relative
+// lazy import fallback. The kernel's own dependencies stay B1's, and importing the kernel loads nothing.
 /** An error a resolver answers, with the vendor's `type` for it (GitHub's NOT_FOUND, UNPROCESSABLE). */
 export class GraphqlError extends Error {
     type;
@@ -19,8 +19,6 @@ export class GraphqlError extends Error {
         this.name = 'GraphqlError';
     }
 }
-let lib;
-const graphqlLib = () => (lib ??= import('graphql'));
 const snake = (s) => s.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
 /** A list as a Relay connection, paged by `first`/`last` and `after`. */
 function connection(items, args) {
@@ -43,6 +41,8 @@ function connection(items, args) {
  *  context each resolver receives is made per request (the handler context). `unmodeled` answers a query selecting a
  *  field nothing models; `mutationRefused`, when given, a mutation the World may not make (a read-only twin). */
 export function graphqlEndpoint(options) {
+    let lib;
+    const loadLibrary = options.loadLibrary ?? (() => import('graphql'));
     let schema;
     const { resolvers, aliases, stored } = options.part;
     // introspection (`__typename`, `__type`, `__schema` and the `__Type`/`__Field`/… meta types) is the vendor's schema
@@ -50,7 +50,7 @@ export function graphqlEndpoint(options) {
     // before it merges)
     const modeled = (type, field) => field.startsWith('__') || type.startsWith('__') || `${type}.${field}` in resolvers || !!aliases?.[type]?.[field] || !!stored?.[type]?.includes(field) || !!stored?.[type]?.includes(snake(field));
     return async (request) => {
-        const g = await graphqlLib();
+        const g = await (lib ??= loadLibrary());
         schema ??= g.buildSchema(options.sdl, { assumeValidSDL: true });
         const payload = (await request.clone().json().catch(() => ({})));
         let document;

package/dist/src/pack-fetch.d.ts

@@ -5,7 +5,7 @@ import type { ApplicationStandIn } from './events.js';
 import { type SocketEngine } from './sockets.js';
 import type { LiveEngine } from './live/types.js';
 import type { WebSocketUpgrade } from './serve-http.js';
-import { type GraphqlPart } from './graphql-wire.js';
+import { type GraphqlPart, type GraphqlLibraryLoader } from './graphql-wire.js';
 /** What a pack declares and writes, and nothing it assembles itself. */
 export type PackParts = {
     manifest: DerivedManifest;
@@ -39,6 +39,7 @@ export type PackParts = {
      *  state, served at the manifest's `graphql.paths` (graphql-wire.ts). */
     graphql?: GraphqlPart<HandlerContext> & {
         sdl: string;
+        loadLibrary?: GraphqlLibraryLoader;
     };
     /** `semantics/sockets.ts`: each socket's engine, by the id the manifest's `sockets` gives it (sockets.ts). */
     sockets?: Record<string, SocketEngine<HandlerContext>>;

package/dist/src/pack-fetch.js

@@ -160,7 +160,7 @@ export function createPackFetch(parts, options = {}) {
     // the GraphQL wire over the same state, at the paths the manifest names (graphql-wire.ts)
     const gql = m.graphql && parts.graphql ? m.graphql : undefined;
     const graphql = gql && parts.graphql ? graphqlEndpoint({
-        sdl: parts.graphql.sdl, part: parts.graphql,
+        sdl: parts.graphql.sdl, part: parts.graphql, loadLibrary: parts.graphql.loadLibrary,
         context: async (request) => contextFor(m, { request: request.clone(), operation: { id: 'graphql', method: 'POST', path: gql.paths[0], class: 'action' }, params: {} }, scope),
         unmodeled: ({ type, field }) => Response.json({ errors: [{ ...(gql.unmodeled.type ? { type: gql.unmodeled.type } : {}), message: gql.unmodeled.message.replace('{field}', field).replace('{type}', type) }] }, { status: gql.unmodeled.status ?? 200 }),
         mutationRefused: (request) => ((options.readOnly ?? false) || isReadOnlyRequest(request) ? vendorError(m, m.readOnly) : undefined),

package/generated/pack-facts.json

@@ -270,6 +270,9 @@
         {
           "host": "api.clerk.com"
         },
+        {
+          "host": "dashboard.clerk.com"
+        },
         {
           "suffix": ".clerk.accounts.dev"
         },
@@ -1309,8 +1312,7 @@
           "host": "api.linear.app"
         },
         {
-          "host": "linear.app",
-          "pathPattern": "^/oauth/"
+          "host": "linear.app"
         }
       ],
       "archetype": "crud",
@@ -1330,7 +1332,7 @@
         "comment",
         "issue_label"
       ],
-      "endpointEnvNone": "Linear uses api.linear.app/graphql and linear.app/oauth/authorize; the World claims the documented hosts",
+      "endpointEnvNone": "Linear uses api.linear.app/graphql and linear.app for its workspace and OAuth authorize page; the World claims those hosts",
       "credentialDoor": {
         "path": "/_twin/local-credentials",
         "body": {},
@@ -2023,6 +2025,10 @@
         },
         {
           "host": "inbound-cdn.resend.com"
+        },
+        {
+          "host": "resend.com",
+          "pathPattern": "^/emails(?:/|$)"
         }
       ],
       "archetype": "crud",
@@ -2179,6 +2185,9 @@
         ]
       },
       "hosts": [
+        {
+          "host": "app.slack.com"
+        },
         {
           "host": "slack.com"
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "3.0.153",
+  "version": "3.0.155",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",

package/src/client-bundle.ts

@@ -1,7 +1,8 @@
 // A page's browser client from its `client/<name>.tsx` entry (the console's, the platform's), runtime-neutral (the
-// serve seam's helpers, docs/contributing/architecture.md#the-serve-seam): under Bun a `Bun.build` at serve time; under Node the PREBUILT `<name>.bundle.js` beside the entry, written at pack time
-// by scripts/publish/build.mjs into dist/client/. Built once per process and kept; a failed build
-// is retried on the next call. Nothing here runs at module scope.
+// serve seam's helpers, docs/contributing/architecture.md#the-serve-seam): serve an adjacent `<name>.bundle.js`
+// under either runtime, written at pack time by scripts/publish/build.mjs into dist/client/. Without one, Bun
+// builds the source at serve time and Node refuses it. Kept once per process; a failed attempt is retried on
+// the next call. Nothing here runs at module scope.
 import { existsSync, readFileSync } from 'node:fs';
 
 /** A file URL's path on this machine, without `node:url` (the modules that call it ride into browser
@@ -23,17 +24,15 @@ const PROCESS_SHIM = 'globalThis.process=globalThis.process||{env:{NODE_ENV:"pro
 export function bundleClient(entry: string): Promise<string> {
   let pending = bundles.get(entry);
   if (!pending) {
-    const bun = (globalThis as { Bun?: Partial<BunBuild> }).Bun;
-    pending = (bun && typeof bun.build === 'function'
-      ? (bun as BunBuild).build({ entrypoints: [entry], target: 'browser', minify: true }).then(async (result) => {
-          if (!result.success) throw new Error(result.logs.map((l) => l.message).join('\n') || `client build failed: ${entry}`);
-          return PROCESS_SHIM + await result.outputs[0]!.text();
-        })
-      : Promise.resolve().then(() => {
-          const prebuilt = entry.replace(/\.tsx?$/, '.bundle.js');
-          if (!existsSync(prebuilt)) throw new Error(`client bundle missing at ${prebuilt} — the package's \`build\` writes it (scripts/publish/build.mjs); Node serves the prebuilt client`);
-          return PROCESS_SHIM + readFileSync(prebuilt, 'utf8');
-        }))
+    pending = Promise.resolve().then(async () => {
+      const prebuilt = entry.replace(/\.tsx?$/, '.bundle.js');
+      if (existsSync(prebuilt)) return PROCESS_SHIM + readFileSync(prebuilt, 'utf8');
+      const bun = (globalThis as { Bun?: Partial<BunBuild> }).Bun;
+      if (!bun || typeof bun.build !== 'function') throw new Error(`client bundle missing at ${prebuilt} — the package's \`build\` writes it (scripts/publish/build.mjs); Node serves the prebuilt client`);
+      const result = await (bun as BunBuild).build({ entrypoints: [entry], target: 'browser', minify: true });
+      if (!result.success) throw new Error(result.logs.map((l) => l.message).join('\n') || `client build failed: ${entry}`);
+      return PROCESS_SHIM + await result.outputs[0]!.text();
+    })
       .catch((error) => { bundles.delete(entry); throw error; });
     bundles.set(entry, pending);
   }

package/src/event-delivery.ts

@@ -0,0 +1,76 @@
+// FIRST DECLARED-EVENT OUTCOMES (architecture, "What an author writes, and how").
+// A queued packet is not evidence its receiver answered. Keep the first attempt
+// under the shared action lock; this is not the originating-write outbox or a
+// substitute for a vendor's declared retry/redelivery policy.
+import { applyTwinWriteAtomic } from './serve.ts';
+import { worldNow } from './world-clock.ts';
+import type { EventDelivery, EventTransport } from './events.ts';
+
+const ATTEMPT = '_world_event_delivery_attempt';
+type Claimed = EventDelivery & { attemptId: string };
+
+/** Dispatch one newly recorded packet once. Legacy rows, existing attempts and
+ * interrupted sending claims never turn into an unrequested second send. */
+export async function sendRecordedEvent(
+  service: string,
+  deliveryType: string,
+  deliveryId: string,
+  root: string | undefined,
+  transport: EventTransport,
+  trace: Record<string, string>,
+): Promise<void> {
+  const { value: claim } = await applyTwinWriteAtomic<Claimed | undefined>(service, (resources) => {
+    const row = resources.find((r) => r.type === deliveryType && r.id === deliveryId);
+    if (!row || row.deleted === true || row.delivery_protocol !== 1 || row.delivery_state !== 'queued'
+      || row.attempt_count !== 0 || row.current_attempt !== null) return { kind: 'skip', value: undefined };
+    const attemptId = `${deliveryType}:${deliveryId}:1`;
+    if (resources.some((r) => r.type === ATTEMPT && r.id === attemptId)) return { kind: 'skip', value: undefined };
+    if (typeof row.url !== 'string' || typeof row.body !== 'string'
+      || !row.headers || typeof row.headers !== 'object' || Array.isArray(row.headers)
+      || Object.values(row.headers).some((v) => typeof v !== 'string')) {
+      throw new Error('A retained declared-event packet is incomplete; it cannot be dispatched.');
+    }
+    const occurredAt = worldNow();
+    return { kind: 'write', value: {
+      attemptId, url: row.url, body: row.body, headers: { ...row.headers } as Record<string, string>,
+    }, write: {
+      operation: 'world_event_delivery.claim', subjectType: deliveryType, subjectId: deliveryId,
+      fields: { delivery_state: 'sending', attempt_count: 1, current_attempt: attemptId },
+      projection: { creates: [{ type: ATTEMPT, id: attemptId, fields: {
+        delivery_type: deliveryType, delivery_id: deliveryId, attempt: 1,
+        state: 'sending', started_at: Date.parse(occurredAt), finished_at: null, transport_status: null,
+      } }] },
+      occurredAt, actor: { kind: 'system' as const },
+    } };
+  }, root);
+  if (!claim) return;
+
+  let status: number | null = null;
+  try {
+    const answer = await transport(claim.url, claim.body, { ...claim.headers, ...trace });
+    if (typeof answer === 'number' && Number.isInteger(answer) && answer >= 100 && answer <= 599) status = answer;
+  } catch {
+    // A thrown request can have reached the receiver. Preserve uncertainty and
+    // never copy exception strings, response bodies or credentials into history.
+  }
+  const state = status === null ? 'unknown' : status >= 200 && status < 300 ? 'succeeded' : 'failed';
+  const occurredAt = worldNow(), finishedAt = Date.parse(occurredAt);
+  await applyTwinWriteAtomic(service, (resources) => {
+    const attempt = resources.find((r) => r.type === ATTEMPT && r.id === claim.attemptId);
+    if (!attempt || attempt.deleted === true || attempt.state !== 'sending'
+      || attempt.delivery_type !== deliveryType || attempt.delivery_id !== deliveryId) return { kind: 'skip', value: undefined };
+    const row = resources.find((r) => r.type === deliveryType && r.id === deliveryId);
+    const current = row && row.deleted !== true && row.delivery_protocol === 1
+      && row.delivery_state === 'sending' && row.current_attempt === claim.attemptId;
+    return { kind: 'write', value: undefined, write: {
+      operation: 'world_event_delivery.finish', subjectType: ATTEMPT, subjectId: claim.attemptId,
+      fields: { state, finished_at: finishedAt, transport_status: status },
+      ...(current && row ? { projection: { updates: [{ type: deliveryType, id: deliveryId, fields: {
+        delivery_state: state, finished_at: finishedAt, transport_status: status,
+        // A future manual attempt must not erase earlier positive acceptance.
+        accepted_at: state === 'succeeded' ? row.accepted_at ?? finishedAt : row.accepted_at ?? null,
+      } }] } } : {}),
+      occurredAt, actor: { kind: 'system' as const },
+    } };
+  }, root);
+}

package/src/events.ts

@@ -10,6 +10,9 @@ import { createHash, createHmac } from 'node:crypto';
 import { applyTwinWrite, applyTwinWriteAtomic, twinResources } from './serve.ts';
 import { equalSecrets as same, ksuidFrom } from './signing.ts';
 import { deliveryTraceHeaders } from './trace-context.ts';
+import { sendRecordedEvent } from './event-delivery.ts';
+import { getActiveWorldStore, withWorldStore } from './world-store.ts';
+import { worldPaths } from './storage.ts';
 
 /** How the vendor signs a delivery. */
 export type EventScheme =
@@ -99,7 +102,8 @@ export type EventsDecl = {
   envelope: unknown;
   /** Where the World's endpoints are kept: one kind, or several (GitHub's repository and organization hooks). */
   endpoints: EndpointsDecl | ReadonlyArray<EndpointsDecl>;
-  /** The bookkeeping type each delivery is kept as (`_webhook_message`): what a World reads to see what was sent. */
+  /** The bookkeeping type each delivery is kept as (`_webhook_message`), otherwise `_world_event_delivery`.
+   *  Queuing and the first transport attempt/outcome are separate retained facts. */
   record?: string;
 };
 
@@ -117,7 +121,7 @@ export type EventWrite = { operation: string; storedType: string; body: Record<s
  *  (a Slack message renders as `message` and as `app_mention`). */
 export type EventRender<C> = (ctx: C, write: EventWrite, type: string) => Record<string, unknown>;
 
-/** A delivery made: where it went and exactly what was sent. */
+/** A rendered delivery packet. Its transport attempt and acceptance are separate retained facts. */
 export type EventDelivery = { url: string; body: string; headers: Record<string, string> };
 
 /** The transport a delivery is made over; the World's by default, a test's own when given. */
@@ -302,8 +306,8 @@ const worldTransport: EventTransport = async (url, body, headers) => {
   try { return ((await appFetch(url, { method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body })) as { status: number }).status; } catch { return 0; }
 };
 
-/** Who watches what the World sends (a walk reading each delivery as its receiver would): told of every delivery as it
- *  is made, before its transport. Set and restored by the walk, as its World store is; unset, nothing watches. */
+/** Who watches signed packets before dispatch (a walk reading each as its receiver would). This is not evidence of
+ *  transport or acceptance. Set and restored by the walk, as its World store is; unset, nothing watches. */
 export type DeliveryObserver = (delivery: EventDelivery & { service: string }) => void;
 let deliveryObserver: DeliveryObserver | undefined;
 export function setDeliveryObserver(observer: DeliveryObserver | undefined): DeliveryObserver | undefined {
@@ -430,6 +434,7 @@ async function deliverEventType(
   const shared = JSON.stringify(envelope);
   const each = perEndpoint(decl.envelope);
   const sent: EventDelivery[] = [];
+  const recorded: Array<{ type: string; id: string }> = [];
   for (const [i, { row, kind }] of endpoints.entries()) {
     const body = each ? JSON.stringify(fillEnvelope(decl.envelope, filled, row)) : shared;
     const url = String(at(row, kind.url));
@@ -440,20 +445,31 @@ async function deliverEventType(
     const headers = { ...extraHeaders, ...signEventAll(decl.scheme, String(at(row, kind.secret)), body, seconds, url, seq, identity) };
     sent.push({ url, body, headers });
     // kept with the write, by an id of the delivery itself (two made at once never take the same one)
-    if (decl.record !== undefined) {
-      await applyTwinWrite(service, {
-        operation: `${decl.record.slice(1)}.record`, subjectType: decl.record, subjectId: `${decl.record.slice(1)}_v1_${seq}`,
-        fields: { url, body, headers, event_type: type, sent_at: millis }, occurredAt: write.occurredAt, actor: { kind: 'system' },
-      }, write.root);
-    }
+    const record = decl.record ?? '_world_event_delivery';
+    const id = `${record.slice(1)}_v1_${seq}`;
+    await applyTwinWrite(service, {
+      operation: `${record.slice(1)}.record`, subjectType: record, subjectId: id,
+      fields: { url, body, headers, event_type: type, sent_at: millis,
+        delivery_protocol: 1, event_id: String(filled.$id),
+        endpoint_type: kind.storedAs, endpoint_id: String(row.id),
+        delivery_state: 'queued', attempt_count: 0, current_attempt: null,
+        transport_status: null, finished_at: null, accepted_at: null,
+      }, occurredAt: write.occurredAt, actor: { kind: 'system' },
+    }, write.root);
+    recorded.push({ type: record, id });
   }
   // sent after the write's answer, as a vendor sends it: the caller never waits on its receiver, and a receiver that is
   // slow or down fails no request
   // the write's trace is read now, inside its request, and carried on each delivery (W3C trace continuation)
   const trace = deliveryTraceHeaders();
+  // A timer must retain the request's store/root even if another World becomes
+  // active before it runs. Transport completion writes to the same retained state.
+  const store = getActiveWorldStore(), deliveryRoot = worldPaths(service, write.root).root;
   for (const d of sent) deliveryObserver?.({ ...d, service });
-  for (const { url, body: payload, headers } of sent) setTimeout(() => {
-    void transport(url, payload, { ...headers, ...trace }).catch(() => {});
+  for (const packet of recorded) setTimeout(() => {
+    // Persistence failure leaves a queued/sending claim for explicit recovery;
+    // it must not fail the already-committed vendor write or cause a blind resend.
+    void withWorldStore(store, () => sendRecordedEvent(service, packet.type, packet.id, deliveryRoot, transport, trace)).catch(() => {});
   }, 0);
   return sent;
 }

package/src/graphql-wire.ts

@@ -7,9 +7,9 @@
 // modeled; any other is answered by the manifest's `graphql.unmodeled`, naming the first field nothing models. An error
 // a resolver throws (`GraphqlError`) carries its `type`, as GitHub's GraphQL errors do.
 //
-// The `graphql` protocol library is loaded the first time a GraphQL request comes (installed by the pack's package.json,
-// as node-postgres is for the managed database): the kernel's own dependencies stay B1's, and importing the kernel
-// loads nothing.
+// The generated pack fetch supplies a lazy pack-local loader for the `graphql` protocol library installed by the pack's
+// package.json. Each endpoint caches its library on the first request; callers without a loader keep the kernel-relative
+// lazy import fallback. The kernel's own dependencies stay B1's, and importing the kernel loads nothing.
 
 /** A resolver of one field, `Type.field`: its parent object, its arguments, and the request's handler context. */
 export type GraphqlResolver<C = unknown> = (source: Record<string, unknown>, args: Record<string, unknown>, ctx: C) => unknown;
@@ -32,8 +32,7 @@ export class GraphqlError extends Error {
 }
 
 type GraphqlLib = typeof import('graphql');
-let lib: Promise<GraphqlLib> | undefined;
-const graphqlLib = (): Promise<GraphqlLib> => (lib ??= import('graphql') as Promise<GraphqlLib>);
+export type GraphqlLibraryLoader = () => Promise<GraphqlLib>;
 
 const snake = (s: string): string => s.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
 
@@ -59,10 +58,14 @@ function connection(items: unknown[], args: Record<string, unknown>): Record<str
 export function graphqlEndpoint<C>(options: {
   sdl: string;
   part: GraphqlPart<C>;
+  /** The generated pack fetch's lazy import, resolving the library from the pack that declares it. */
+  loadLibrary?: GraphqlLibraryLoader;
   context: (request: Request) => Promise<C>;
   unmodeled: (field: { type: string; field: string }) => Response;
   mutationRefused?: (request: Request) => Response | undefined;
 }): (request: Request) => Promise<Response> {
+  let lib: Promise<GraphqlLib> | undefined;
+  const loadLibrary = options.loadLibrary ?? (() => import('graphql'));
   let schema: import('graphql').GraphQLSchema | undefined;
   const { resolvers, aliases, stored } = options.part;
   // introspection (`__typename`, `__type`, `__schema` and the `__Type`/`__Field`/… meta types) is the vendor's schema
@@ -71,7 +74,7 @@ export function graphqlEndpoint<C>(options: {
   const modeled = (type: string, field: string): boolean =>
     field.startsWith('__') || type.startsWith('__') || `${type}.${field}` in resolvers || !!aliases?.[type]?.[field] || !!stored?.[type]?.includes(field) || !!stored?.[type]?.includes(snake(field));
   return async (request) => {
-    const g = await graphqlLib();
+    const g = await (lib ??= loadLibrary());
     schema ??= g.buildSchema(options.sdl, { assumeValidSDL: true });
     const payload = (await request.clone().json().catch(() => ({}))) as { query?: string; variables?: Record<string, unknown>; operationName?: string };
     let document: import('graphql').DocumentNode;

package/src/pack-fetch.ts

@@ -35,7 +35,7 @@ import { worldNow } from './world-clock.ts';
 import type { WebSocketUpgrade, WebSocketPeer } from './serve-http.ts';
 import { MACHINE_POOL, POOL_KINDS, resetFakePool } from './machines.ts';
 import { applyTwinWrite } from './serve.ts';
-import { graphqlEndpoint, type GraphqlPart } from './graphql-wire.ts';
+import { graphqlEndpoint, type GraphqlPart, type GraphqlLibraryLoader } from './graphql-wire.ts';
 import { gzipSync } from 'node:zlib';
 import { decompress } from './bytes.ts';
 import { decodedBodyLimit, oversizedBody, RequestBodyTooLargeError } from './request-body.ts';
@@ -71,7 +71,7 @@ export type PackParts = {
   lanes?: Record<string, LanePart>;
   /** `semantics/graphql.ts` with the vendor's schema (`generated/graphql-sdl.gen.json`): the GraphQL wire over the same
    *  state, served at the manifest's `graphql.paths` (graphql-wire.ts). */
-  graphql?: GraphqlPart<HandlerContext> & { sdl: string };
+  graphql?: GraphqlPart<HandlerContext> & { sdl: string; loadLibrary?: GraphqlLibraryLoader };
   /** `semantics/sockets.ts`: each socket's engine, by the id the manifest's `sockets` gives it (sockets.ts). */
   sockets?: Record<string, SocketEngine<HandlerContext>>;
   /** `semantics/board.ts`: the vendor's frames on the World's board, read from its state (`GET /twin/board`). */
@@ -229,7 +229,7 @@ export function createPackFetch(parts: PackParts, options: PackFetchOptions = {}
   // the GraphQL wire over the same state, at the paths the manifest names (graphql-wire.ts)
   const gql = m.graphql && parts.graphql ? m.graphql : undefined;
   const graphql = gql && parts.graphql ? graphqlEndpoint<HandlerContext>({
-    sdl: parts.graphql.sdl, part: parts.graphql,
+    sdl: parts.graphql.sdl, part: parts.graphql, loadLibrary: parts.graphql.loadLibrary,
     context: async (request) => contextFor(m, { request: request.clone(), operation: { id: 'graphql', method: 'POST', path: gql.paths[0]!, class: 'action' } as DerivedOperation, params: {} }, scope) as Promise<HandlerContext>,
     unmodeled: ({ type, field }) => Response.json({ errors: [{ ...(gql.unmodeled.type ? { type: gql.unmodeled.type } : {}), message: gql.unmodeled.message.replace('{field}', field).replace('{type}', type) }] }, { status: gql.unmodeled.status ?? 200 }),
     mutationRefused: (request) => ((options.readOnly ?? false) || isReadOnlyRequest(request) ? vendorError(m, m.readOnly) : undefined),