@volter/world-core 3.0.154 → 3.0.156

package/dist/src/clickhouse/compression.js

@@ -0,0 +1,281 @@
+// CityHashv1.0.2 arithmetic, ported from the vendor-carried Google source.
+// Source: ClickHouse/ClickHouse contrib/cityhash102/src/city.cc, SHA256
+// 4bcc8f0c09e3ef38210a0c568efc0550e4cb426719d8ad74a466f152296d0df7.
+// Copyright (c) 2011 Google, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+const k0 = 0xc3a5c85c97cb3127n, k1 = 0xb492b66fbe98f273n, k2 = 0x9ae16a3b2f90404fn, k3 = 0xc949d7c7509e6557n;
+const u = (value) => BigInt.asUintN(64, value);
+const rotate = (value, shift) => shift === 0 ? u(value) : u((u(value) >> BigInt(shift)) | (u(value) << BigInt(64 - shift)));
+const mix = (value) => u(value) ^ (u(value) >> 47n);
+function hash16(first, second) {
+    const mul = 0x9ddfea08eb382d69n;
+    let a = u((u(first) ^ u(second)) * mul);
+    a ^= a >> 47n;
+    let b = u((u(second) ^ a) * mul);
+    b ^= b >> 47n;
+    return u(b * mul);
+}
+/** The CityHash 1.0.2 checksum used by ClickHouse native compression frames. */
+export function cityHash128(bytes) {
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const fetch = (at) => view.getBigUint64(at, true);
+    const short = (at, length) => {
+        if (length > 8) {
+            const a = fetch(at), b = fetch(at + length - 8);
+            return hash16(a, rotate(u(b + BigInt(length)), length)) ^ b;
+        }
+        if (length >= 4)
+            return hash16(BigInt(length) + (BigInt(view.getUint32(at, true)) << 3n), BigInt(view.getUint32(at + length - 4, true)));
+        if (length) {
+            const a = bytes[at], b = bytes[at + (length >> 1)], c = bytes[at + length - 1];
+            return u(mix(u(BigInt(a + (b << 8)) * k2) ^ u(BigInt(length + (c << 2)) * k3)) * k2);
+        }
+        return k2;
+    };
+    const weak = (at, first, second) => {
+        const w = fetch(at), x = fetch(at + 8), y = fetch(at + 16), z = fetch(at + 24);
+        let a = u(first + w), b = rotate(u(second + a + z), 21);
+        const c = a;
+        a = u(a + x + y);
+        b = u(b + rotate(a, 44));
+        return [u(a + z), u(b + c)];
+    };
+    const murmur = (at, length, seed) => {
+        let [a, b] = seed, c = 0n, d = 0n, left = length - 16;
+        if (left <= 0) {
+            a = u(mix(u(a * k1)) * k1);
+            c = u(b * k1 + short(at, length));
+            d = mix(u(a + (length >= 8 ? fetch(at) : c)));
+        }
+        else {
+            c = hash16(u(fetch(at + length - 8) + k1), a);
+            d = hash16(u(b + BigInt(length)), u(c + fetch(at + length - 16)));
+            a = u(a + d);
+            do {
+                a ^= u(mix(u(fetch(at) * k1)) * k1);
+                a = u(a * k1);
+                b ^= a;
+                c ^= u(mix(u(fetch(at + 8) * k1)) * k1);
+                c = u(c * k1);
+                d ^= c;
+                at += 16;
+                left -= 16;
+            } while (left > 0);
+        }
+        a = hash16(a, c);
+        b = hash16(d, b);
+        return [a ^ b, hash16(b, a)];
+    };
+    const seeded = (at, length, seed) => {
+        if (length < 128)
+            return murmur(at, length, seed);
+        let [x, y] = seed, z = u(BigInt(length) * k1);
+        let v = [u(rotate(y ^ k1, 49) * k1 + fetch(at)), 0n];
+        v[1] = u(rotate(v[0], 42) * k1 + fetch(at + 8));
+        let w = [u(rotate(u(y + z), 35) * k1 + x), u(rotate(u(x + fetch(at + 88)), 53) * k1)];
+        const round = () => {
+            x = u(rotate(u(x + y + v[0] + fetch(at + 16)), 37) * k1);
+            y = u(rotate(u(y + v[1] + fetch(at + 48)), 42) * k1);
+            x ^= w[1];
+            y ^= v[0];
+            z = rotate(z ^ w[0], 33);
+            v = weak(at, u(v[1] * k1), u(x + w[0]));
+            w = weak(at + 32, u(z + w[1]), y);
+            [z, x] = [x, z];
+            at += 64;
+        };
+        do {
+            round();
+            round();
+            length -= 128;
+        } while (length >= 128);
+        y = u(y + rotate(w[0], 37) * k0 + z);
+        x = u(x + rotate(u(v[0] + z), 49) * k0);
+        for (let done = 0; done < length;) {
+            done += 32;
+            y = u(rotate(u(y - x), 42) * k0 + v[1]);
+            w[0] = u(w[0] + fetch(at + length - done + 16));
+            x = u(rotate(x, 49) * k0 + w[0]);
+            w[0] = u(w[0] + v[0]);
+            v = weak(at + length - done, v[0], v[1]);
+        }
+        x = hash16(x, v[0]);
+        y = hash16(y, w[0]);
+        return [u(hash16(u(x + v[1]), w[1]) + y), hash16(u(x + w[1]), u(y + v[1]))];
+    };
+    const length = bytes.length;
+    if (length >= 16)
+        return seeded(16, length - 16, [fetch(0) ^ k3, fetch(8)]);
+    if (length >= 8)
+        return seeded(0, 0, [fetch(0) ^ u(BigInt(length) * k0), fetch(length - 8) ^ k1]);
+    return seeded(0, length, [k0, k1]);
+}
+// ClickHouse src/Compression/CompressionInfo.h:7,14 (SHA25614b39ae2…): both limits are1GiB.
+export const MAX_COMPRESSED_BLOCK_SIZE = 0x40000000;
+export const MAX_DECOMPRESSED_BLOCK_SIZE = 0x40000000;
+/** LZ4 block sequences. Validate all lengths before allocating the output buffer. */
+export function decodeLz4Block(input, size) {
+    if (!Number.isSafeInteger(size) || size < 0 || size > MAX_DECOMPRESSED_BLOCK_SIZE || input.length > MAX_COMPRESSED_BLOCK_SIZE)
+        throw new RangeError('Invalid LZ4 block size');
+    // lz4_Block_format.md:114–126 requires a final literal sequence, five final literals
+    // (except a short all-literal block), and the last match at least12 bytes before its end.
+    // This is the format specification's strictness; ClickHouse's decoder is not retained
+    // here and may accept malformed end sequences that this decoder rejects.
+    const walk = (output) => {
+        let source = 0, target = 0, sequences = 0, finalLiterals = -1, lastMatchStart = -1;
+        const length = (initial) => {
+            let result = initial;
+            if (initial === 15) {
+                let value;
+                do {
+                    if (source >= input.length)
+                        throw new RangeError('Truncated LZ4 length');
+                    value = input[source++];
+                    result += value;
+                } while (value === 255);
+            }
+            return result;
+        };
+        while (source < input.length) {
+            sequences++;
+            const token = input[source++], literals = length(token >> 4);
+            if (literals > input.length - source || literals > size - target)
+                throw new RangeError('Invalid LZ4 literal range');
+            output?.set(input.subarray(source, source + literals), target);
+            source += literals;
+            target += literals;
+            if (source === input.length) {
+                finalLiterals = literals;
+                break;
+            }
+            if (source + 2 > input.length)
+                throw new RangeError('Truncated LZ4 offset');
+            const offset = input[source++] | (input[source++] << 8);
+            if (!offset || offset > target)
+                throw new RangeError('Invalid LZ4 offset');
+            const match = length(token & 15) + 4;
+            if (match > size - target)
+                throw new RangeError('Invalid LZ4 match range');
+            lastMatchStart = target;
+            if (output)
+                for (let i = 0; i < match; i++) {
+                    output[target] = output[target - offset];
+                    target++;
+                }
+            else
+                target += match;
+        }
+        if (finalLiterals < 0 || (size >= 5 && finalLiterals < 5) || (size < 5 && sequences !== 1) || (lastMatchStart >= 0 && size - lastMatchStart < 12))
+            throw new RangeError('Invalid LZ4 end sequence');
+        if (target !== size)
+            throw new RangeError('LZ4 decoded size differs');
+    };
+    walk();
+    const output = new Uint8Array(size);
+    walk(output);
+    return output;
+}
+/** A valid literal-only LZ4 block. */
+export function encodeLz4Literals(input) {
+    if (input.length > MAX_DECOMPRESSED_BLOCK_SIZE)
+        throw new RangeError('LZ4 block is too large');
+    const extension = input.length >= 15 ? Math.floor((input.length - 15) / 255) + 1 : 0;
+    const output = new Uint8Array(1 + extension + input.length);
+    let at = 0;
+    output[at++] = Math.min(input.length, 15) << 4;
+    if (extension) {
+        let left = input.length - 15;
+        while (left >= 255) {
+            output[at++] = 255;
+            left -= 255;
+        }
+        output[at++] = left;
+    }
+    output.set(input, at);
+    return output;
+}
+export class ClickHouseCompressionError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ClickHouseCompressionError';
+    }
+}
+/** ClickHouse compressed frame, including its sixteen-byte checksum.
+ * ICompressionCodec.cpp:62–69,102–116 (SHA2562cfbdbd7…) writes the9-byte header.
+ * CompressedReadBufferBase.cpp:193–194,255–256 (SHA2566f5af3a8…) reads low/high
+ * little-endian checksum words and verifies the complete header+payload before decompressing.
+ */
+export function encodeFrame(input, method = 0x82) {
+    if (!input.length || input.length > MAX_DECOMPRESSED_BLOCK_SIZE)
+        throw new ClickHouseCompressionError(39, 'Invalid decompressed block size');
+    if (method !== 0x82 && method !== 0x02)
+        throw new ClickHouseCompressionError(89, 'Unknown compression method');
+    const bodyLength = method === 0x82 ? 1 + (input.length >= 15 ? Math.floor((input.length - 15) / 255) + 1 : 0) + input.length : input.length;
+    if (bodyLength + 9 > MAX_COMPRESSED_BLOCK_SIZE)
+        throw new ClickHouseCompressionError(39, 'Compressed block is too large');
+    const body = method === 0x82 ? encodeLz4Literals(input) : input;
+    const output = new Uint8Array(25 + body.length), view = new DataView(output.buffer);
+    output[16] = method;
+    view.setUint32(17, 9 + body.length, true);
+    view.setUint32(21, input.length, true);
+    output.set(body, 25);
+    const [low, high] = cityHash128(output.subarray(16));
+    view.setBigUint64(0, low, true);
+    view.setBigUint64(8, high, true);
+    return output;
+}
+/** Decode one frame; undefined means the input has not yet supplied the whole frame.
+ * Sizes are validated from the header before waiting for its body, and the checksum
+ * precedes decompression. bytesRead allows the caller to retain subsequent frames.
+ */
+export function decodeFrame(input) {
+    if (input.length < 25)
+        return undefined;
+    const view = new DataView(input.buffer, input.byteOffset, input.byteLength), method = input[16];
+    // CompressedReadBufferBase.cpp:134–138 selects/refuses the codec before header sizes.
+    if (method !== 0x82 && method !== 0x02)
+        throw new ClickHouseCompressionError(89, 'Unknown compression method');
+    const compressed = view.getUint32(17, true), size = view.getUint32(21, true);
+    if (compressed > MAX_COMPRESSED_BLOCK_SIZE || size > MAX_DECOMPRESSED_BLOCK_SIZE)
+        throw new ClickHouseCompressionError(39, 'Compressed block size exceeds the vendor limit');
+    if (compressed < 9 || !size)
+        throw new ClickHouseCompressionError(246, 'Corrupt compressed block header');
+    const bytesRead = 16 + compressed;
+    if (input.length < bytesRead)
+        return undefined;
+    const frame = input.subarray(16, bytesRead), [low, high] = cityHash128(frame);
+    if (low !== view.getBigUint64(0, true) || high !== view.getBigUint64(8, true))
+        throw new ClickHouseCompressionError(40, 'Checksum does not match');
+    const body = frame.subarray(9);
+    if (method === 0x02) {
+        if (body.length !== size)
+            throw new ClickHouseCompressionError(246, 'Uncompressed block size differs');
+        // Own the returned bytes, as the LZ4 branch does.
+        return { data: body.slice(), bytesRead };
+    }
+    try {
+        return { data: decodeLz4Block(body, size), bytesRead };
+    }
+    catch (error) {
+        throw new ClickHouseCompressionError(246, error instanceof Error ? error.message : 'Invalid LZ4 block');
+    }
+}

package/dist/src/clickhouse/index.d.ts

@@ -1,3 +1,4 @@
 export * from './values.js';
 export * from './types.js';
 export * from './sql.js';
+export * from './compression.js';

package/dist/src/clickhouse/index.js

@@ -4,3 +4,4 @@
 export * from "./values.js";
 export * from "./types.js";
 export * from "./sql.js";
+export * from "./compression.js";

package/dist/src/client-bundle.js

@@ -1,7 +1,8 @@
 // A page's browser client from its `client/<name>.tsx` entry (the console's, the platform's), runtime-neutral (the
-// serve seam's helpers, docs/contributing/architecture.md#the-serve-seam): under Bun a `Bun.build` at serve time; under Node the PREBUILT `<name>.bundle.js` beside the entry, written at pack time
-// by scripts/publish/build.mjs into dist/client/. Built once per process and kept; a failed build
-// is retried on the next call. Nothing here runs at module scope.
+// serve seam's helpers, docs/contributing/architecture.md#the-serve-seam): serve an adjacent `<name>.bundle.js`
+// under either runtime, written at pack time by scripts/publish/build.mjs into dist/client/. Without one, Bun
+// builds the source at serve time and Node refuses it. Kept once per process; a failed attempt is retried on
+// the next call. Nothing here runs at module scope.
 import { existsSync, readFileSync } from 'node:fs';
 /** A file URL's path on this machine, without `node:url` (the modules that call it ride into browser
  *  bundles): percent-escapes decoded, and without the slash `URL.pathname` puts before a Windows drive
@@ -18,19 +19,18 @@ const PROCESS_SHIM = 'globalThis.process=globalThis.process||{env:{NODE_ENV:"pro
 export function bundleClient(entry) {
     let pending = bundles.get(entry);
     if (!pending) {
-        const bun = globalThis.Bun;
-        pending = (bun && typeof bun.build === 'function'
-            ? bun.build({ entrypoints: [entry], target: 'browser', minify: true }).then(async (result) => {
-                if (!result.success)
-                    throw new Error(result.logs.map((l) => l.message).join('\n') || `client build failed: ${entry}`);
-                return PROCESS_SHIM + await result.outputs[0].text();
-            })
-            : Promise.resolve().then(() => {
-                const prebuilt = entry.replace(/\.tsx?$/, '.bundle.js');
-                if (!existsSync(prebuilt))
-                    throw new Error(`client bundle missing at ${prebuilt} — the package's \`build\` writes it (scripts/publish/build.mjs); Node serves the prebuilt client`);
+        pending = Promise.resolve().then(async () => {
+            const prebuilt = entry.replace(/\.tsx?$/, '.bundle.js');
+            if (existsSync(prebuilt))
                 return PROCESS_SHIM + readFileSync(prebuilt, 'utf8');
-            }))
+            const bun = globalThis.Bun;
+            if (!bun || typeof bun.build !== 'function')
+                throw new Error(`client bundle missing at ${prebuilt} — the package's \`build\` writes it (scripts/publish/build.mjs); Node serves the prebuilt client`);
+            const result = await bun.build({ entrypoints: [entry], target: 'browser', minify: true });
+            if (!result.success)
+                throw new Error(result.logs.map((l) => l.message).join('\n') || `client build failed: ${entry}`);
+            return PROCESS_SHIM + await result.outputs[0].text();
+        })
             .catch((error) => { bundles.delete(entry); throw error; });
         bundles.set(entry, pending);
     }

package/dist/src/derived-core.d.ts

@@ -992,6 +992,17 @@ export type SemanticsContext = {
     /** Decide an update from the current live stored row under the action lock; undefined leaves it unchanged. */
     change(resource: string, id: string, decide: (row: Record<string, unknown>) => Record<string, unknown> | undefined, operation: string): Promise<Record<string, unknown> | undefined>;
     write(resource: string, id: string, fields: Record<string, unknown>, operation: string): Promise<Record<string, unknown>>;
+    /**
+     * One command's writes as one group (S2 R17; docs/contributing/architecture.md, "A command's writes as one group").
+     * Inside `fn`, `write` stages its write and answers the row as it will stand; `row` and `rowsRaw` read the tree with
+     * the staged writes folded over it, as it will be once they land. When `fn` returns or throws, every staged write
+     * lands, in order, as one append; then its value is answered or its error thrown. Every other way to write, or to
+     * wait on a write, lands the staged writes first; any other read of the tree (`get`, `rows`, `tree`, `history`, ...)
+     * while writes are staged is refused, never answered without them. Each write keeps its own action, id, ordinal,
+     * moment and recorded request. Where the pack has write hooks, events, sockets or counts, a state observer is on,
+     * a head performs, or ids are aliased, `fn` simply runs, each write landing as it is made.
+     */
+    batch<T>(fn: () => Promise<T>): Promise<T>;
     /** Add numeric deltas to an existing bookkeeping row under the kernel's atomic write seam. */
     accumulate(resource: string, id: string, deltas: Record<string, number>, operation: string): Promise<void>;
     /** `write`, with what a live vendor answered when the head performed it */
@@ -1141,7 +1152,7 @@ export type HandlerContext = Omit<SemanticsContext, 'now' | 'core' | 'atomically
 };
 /** What a write hook reads: the writing call's context without its ways to write, so a hook that renders an event
  *  cannot write again (and run itself again). */
-export type WriteHookContext = Omit<HandlerContext, 'write' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'at' | 'over'>;
+export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'at' | 'over'>;
 /** A derived pack's handler: one operation, by its operationId, over the contract's context. */
 export type Handler = (ctx: HandlerContext) => Promise<Response>;
 /** The context the kernel opens for a call (a handler's, a door's, a screen's). Kernel-internal: packs are given it. */

package/dist/src/derived-core.js

@@ -5,8 +5,9 @@ import { parseExactJson, compareExactNumbers, exactInteger, isExactIntegerValue
 // how lists page, how errors read, which fields are state and how they move). From those two this
 // serves CRUD generically and applies declared transitions, over the kernel's tree and write path.
 // Nothing here knows a vendor: every vendor difference is a manifest value.
-import { applyTwinWrite, applyTwinWriteAtomic, twinResources } from "./serve.js";
-import { copyResource, ownFields, parentStamp, subjectHistory, treeChangesSince, treeStamp } from "./log.js";
+import { applyTwinWrite, applyTwinWriteAtomic, applyTwinWrites, twinResources } from "./serve.js";
+import { copyResource, foldLocalWrite, heldSubject, ownFields, parentStamp, subjectHistory, treeChangesSince, treeResources, treeStamp } from "./log.js";
+import { performsAtHeadNow } from "./head.js";
 import { getActiveWorldStore } from "./world-store.js";
 import { getActiveBlobStore } from "./blob-store.js";
 import { worldPaths } from "./storage.js";
@@ -23,6 +24,7 @@ import { handlerCrypto, hmac, ksuidFrom, lettersFrom, sha256, uuidFrom } from ".
 import { hashFieldValue } from "./hash.js";
 import { readResourceBlob, removeResourceBlob, writeResourceBlob } from "./resource-blob.js";
 import { managedDatabase, unboundDatabase } from "./managed-database.js";
+import { redisServiceTimes } from "./redis/service-times.js";
 import { execRedisRun } from "./redis/engine.js";
 import { sendMail } from "./smtp.js";
 import { ownField, parseBracketForm } from "./form.js";
@@ -263,14 +265,16 @@ export function resourcesOfType(service, type, root) {
         }
         held.stamp = delta.stamp;
     }
-    else if (!held || held.stamp !== treeStamp(service, root)) {
-        // the stamp is read before the fold, so a write between them can only leave a newer fold under an older stamp
+    else {
+        // the stamp is read once, before the fold, so a write between them can only leave a newer fold under an older stamp
         const stamp = treeStamp(service, root);
-        const byType = new Map();
-        for (const r of twinResources(service, root))
-            (byType.get(r.type) ?? byType.set(r.type, new Map()).get(r.type)).set(`${r.type}:${r.id}`, r);
-        held = { stamp, byType };
-        indexes.set(key, held);
+        if (!held || held.stamp !== stamp) {
+            const byType = new Map();
+            for (const r of twinResources(service, root))
+                (byType.get(r.type) ?? byType.set(r.type, new Map()).get(r.type)).set(`${r.type}:${r.id}`, r);
+            held = { stamp, byType };
+            indexes.set(key, held);
+        }
     }
     return [...(held.byType.get(type)?.values() ?? [])].map(copyResource);
 }
@@ -1336,7 +1340,7 @@ export async function contextFor(m, call, scope) {
         rawResources.set(row, name ?? resource);
         return row;
     };
-    return {
+    const context = {
         call,
         params,
         id: Object.values(call.params).at(-1),
@@ -1563,12 +1567,142 @@ export async function contextFor(m, call, scope) {
         over: (other) => contextFor(other, { ...asAsked, request: asAsked.request.clone() }, { ...scope, clock: () => at }),
         core: async () => { const out = await serveCore(m, { ...call, request: pristine.clone() }, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
         own: (row) => ownFields(row),
+        batch: (fn) => fn(),
+    };
+    if (batchable(m, root))
+        bindBatch(m, call, context, params, root, at, rawRow);
+    return context;
+}
+/**
+ * Whether a call's writes may be grouped (`ctx.batch`) with nothing about them changing: every effect a write has
+ * besides its action and the tree (write hooks, events, sockets, a parent's counts, a state observer, a head that
+ * performs it, an alias a read resolves through) is one the grouped path would move, so where any is present the
+ * writes land one at a time, as they always have.
+ */
+function batchable(m, root) {
+    return !m.onWrite && !m.events && !m.sockets?.length && !transitionObserver
+        && !Object.values(m.resources).some((decl) => decl.counts && Object.keys(decl.counts).length > 0)
+        && !performsAtHeadNow(m.service, root) && subjectAliases(m.service, root).size === 0;
+}
+/** The members of a context that read the tree other than `row`/`rowsRaw`: refused while writes are staged. */
+const BATCH_REFUSED_READS = ['get', 'rows', 'tree', 'history', 'find', 'list', 'expand', 'mint', 'conflict', 'ownerRow', 'render'];
+/** The members that write, or wait on writes, or answer as another context: each lands the staged writes first. */
+const BATCH_LANDING_MEMBERS = ['create', 'createUnique', 'change', 'accumulate', 'writeDetailed', 'record', 'atomically', 'remove', 'issue', 'at', 'over', 'core', 'awaitWrite', 'awaitCondition',
+    // a World's seed and signing keys are written when first asked (worldSeed, worldSigningKey, as a vendor's move)
+    'secret', 'signingKey'];
+/** `ctx.batch` over a context whose writes may be grouped (see `batchable`). */
+function bindBatch(m, call, context, params, root, at, rawRow) {
+    let staged;
+    // each staged subject as it will stand, by `type:id`, in the order first written
+    const subjects = new Map();
+    const land = async () => {
+        if (!staged?.length)
+            return;
+        const writes = staged;
+        staged = [];
+        subjects.clear();
+        await writeGroup(m, call, writes, params, root, at);
+    };
+    const ctx = context;
+    for (const name of BATCH_LANDING_MEMBERS) {
+        const plain = ctx[name];
+        if (typeof plain !== 'function')
+            continue;
+        ctx[name] = async (...args) => { await land(); return plain(...args); };
+    }
+    for (const name of BATCH_REFUSED_READS) {
+        const plain = ctx[name];
+        if (typeof plain !== 'function')
+            continue;
+        ctx[name] = (...args) => {
+            if (staged?.length)
+                throw new Error(`ctx.${name} reads the tree while ctx.batch holds staged writes: only row and rowsRaw see them`);
+            return plain(...args);
+        };
+    }
+    const plainWrite = context.write, plainRow = context.row, plainRowsRaw = context.rowsRaw;
+    context.write = async (resource, id, fields, operation) => {
+        // a vendor's own move (ctx.asVendor) is the clock's write, recorded as the system's: it lands alone, in its place
+        if (!staged || inVendorMove()) {
+            await land();
+            return plainWrite(resource, id, fields, operation);
+        }
+        const type = storedType(m, resource), key = `${type}:${id}`;
+        // the one subject, as the memoized tree holds it (readTreeMap would copy the whole tree on every staged write)
+        const subject = foldLocalWrite(subjects.get(key) ?? heldSubject(m.service, type, id, root), type, id, fields, at);
+        subjects.set(key, subject);
+        staged.push({ resource, id, fields, operation });
+        return view(m, resource, treeResources(new Map([[key, subject]]))[0]);
+    };
+    // the stored rows of a resource's type with the staged subjects folded over them, filtered as `stored` filters
+    const overlaid = (resource, opts) => {
+        if (!staged?.length)
+            return undefined;
+        const type = storedType(m, resource), prefix = `${type}:`;
+        const mine = [...subjects].filter(([key]) => key.startsWith(prefix));
+        if (!mine.length)
+            return undefined;
+        const replaced = new Map(mine.map(([key, subject]) => [key, treeResources(new Map([[key, subject]]))[0]]));
+        const base = resourcesOfType(m.service, type, root);
+        // a subject the tree holds stays where it stands; one new to it goes to the end, in the order first written
+        const rows = base.map((row) => replaced.get(`${prefix}${row.id}`) ?? row);
+        const held = new Set(base.map((row) => `${prefix}${row.id}`));
+        for (const [key, row] of replaced)
+            if (!held.has(key))
+                rows.push(row);
+        const when = Object.entries(m.resources[resource]?.readableWhen ?? {});
+        return rows.filter((r) => (opts?.withDeleted || r.deleted !== true) && when.every(([k, v]) => r[k] === v));
+    };
+    context.row = (resource, id, opts) => {
+        const rows = overlaid(resource, opts);
+        if (!rows)
+            return plainRow(resource, id, opts);
+        const row = rows.find((r) => r.id === id);
+        return row ? rawRow(resource, row) : undefined;
     };
+    context.rowsRaw = (resource, opts) => {
+        const rows = overlaid(resource, opts);
+        return rows ? rows.map((row) => rawRow(resource, row)) : plainRowsRaw(resource, opts);
+    };
+    context.batch = async (fn) => {
+        // a batch inside a batch is the outer one's
+        if (staged !== undefined)
+            return fn();
+        staged = [];
+        try {
+            return await fn();
+        }
+        finally {
+            // every write `write` answered lands, whether fn returned or threw: an ordered insert's prefix stays written
+            try {
+                await land();
+            }
+            finally {
+                staged = undefined;
+                subjects.clear();
+            }
+        }
+    };
+}
+/**
+ * A command's staged writes landed as one group: each recorded with the request as `writeDetailed` records it (one
+ * recordedInput, the same for every write of the call), the call's moment and actor, in order, under one lock and one
+ * append (serve.ts applyTwinWrites); then a held read on each written type is told, as each write tells it.
+ */
+async function writeGroup(m, call, writes, params, root, occurredAt) {
+    const input = recordedInput(m, call, params);
+    const files = input.operationId ? await keptFiles(m, call, root) : undefined;
+    const recorded = files ? { ...input, files } : input;
+    const actor = { kind: 'agent', ...(m.identity ? { id: m.identity(call.request.headers.get('authorization'), root) } : {}) };
+    await applyTwinWrites(m.service, writes.map((write) => ({ operation: write.operation, subjectType: storedType(m, write.resource),
+        subjectId: write.id, fields: write.fields, input: recorded, occurredAt, actor })), root);
+    for (const type of new Set(writes.map((write) => storedType(m, write.resource))))
+        heldReadsWrite(m.service, root, type);
 }
 /** A pack's semantics handlers as the dispatch's handlers. */
 export function bindSemantics(m, handlers, scope = {}) {
     prepareViewOmissions(m);
-    return Object.fromEntries(Object.entries(handlers).map(([id, h]) => [id, async (call) => h(await contextFor(m, call, scope))]));
+    return Object.fromEntries(Object.entries(handlers).map(([id, h]) => [id, async (call) => { const ctx = await contextFor(m, call, scope); redisServiceTimes.lap('6c the handler\'s own context opened'); return h(ctx); }]));
 }
 /** The derived core as the dispatch's core: it owns every operation on a resource the manifest declares. */
 export function coreFor(m, scope = {}) {

package/dist/src/derived.js

@@ -1,5 +1,6 @@
 import { parseExactJson } from "./exact-json.js";
 import { runWithRequestTrace } from "./trace-context.js";
+import { redisServiceTimes } from "./redis/service-times.js";
 /**
  * A request's body as text, read once per request: the dispatch reads it and tags the request with it, and every clone
  * made from a tagged request carries the tag, so the malformed-JSON guard, the idempotency signature, the handler's
@@ -169,8 +170,10 @@ export function createDerivedFetch(options) {
         for (const observer of dispatchObservers ?? [])
             observer({ surface: options.surface, operation: matched.operation, owner: handlers[matched.operation.id] ? 'handler' : options.core?.owns(matched.operation) ? 'core' : 'gap' });
         // the body read once, as text, for everything the dispatch does with it (bodyTextOf)
+        redisServiceTimes.lap('6a around entered, guards and scenario passed, operation matched again');
         if (request.method !== 'GET' && request.method !== 'HEAD' && request.body && !(request.headers.get('content-type') ?? '').includes('multipart'))
             tagBody(request, await request.clone().text());
+        redisServiceTimes.lap('6b the dispatch read the body as text');
         // the path prefix's named groups (pack-fetch.ts, `pathPrefix`) are the call's parameters too
         const prefixed = request.headers.get(PREFIX_PARAMS_HEADER);
         const call = { request, operation: matched.operation, params: prefixed ? { ...parseExactJson(prefixed), ...matched.params } : matched.params };

package/dist/src/fork.js

@@ -56,7 +56,7 @@ export function forkTwin(opts) {
         };
         getActiveWorldStore().write(forkMetaPath(service, toRoot), `${JSON.stringify(meta, null, 2)}\n`);
         return meta;
-    });
+    }, { operation: 'pointer publication' });
 }
 export function readForkMeta(service, root) {
     const path = forkMetaPath(service, root);

package/dist/src/graphql-wire.d.ts

@@ -20,12 +20,16 @@ export declare class GraphqlError extends Error {
     readonly type?: string | undefined;
     constructor(message: string, type?: string | undefined);
 }
+type GraphqlLib = typeof import('graphql');
+export type GraphqlLibraryLoader = () => Promise<GraphqlLib>;
 /** A GraphQL endpoint over a schema and a pack's part: answers a request's `{query, variables, operationName}`. The
  *  context each resolver receives is made per request (the handler context). `unmodeled` answers a query selecting a
  *  field nothing models; `mutationRefused`, when given, a mutation the World may not make (a read-only twin). */
 export declare function graphqlEndpoint<C>(options: {
     sdl: string;
     part: GraphqlPart<C>;
+    /** The generated pack fetch's lazy import, resolving the library from the pack that declares it. */
+    loadLibrary?: GraphqlLibraryLoader;
     context: (request: Request) => Promise<C>;
     unmodeled: (field: {
         type: string;
@@ -33,3 +37,4 @@ export declare function graphqlEndpoint<C>(options: {
     }) => Response;
     mutationRefused?: (request: Request) => Response | undefined;
 }): (request: Request) => Promise<Response>;
+export {};

package/dist/src/graphql-wire.js

@@ -7,9 +7,9 @@
 // modeled; any other is answered by the manifest's `graphql.unmodeled`, naming the first field nothing models. An error
 // a resolver throws (`GraphqlError`) carries its `type`, as GitHub's GraphQL errors do.
 //
-// The `graphql` protocol library is loaded the first time a GraphQL request comes (installed by the pack's package.json,
-// as node-postgres is for the managed database): the kernel's own dependencies stay B1's, and importing the kernel
-// loads nothing.
+// The generated pack fetch supplies a lazy pack-local loader for the `graphql` protocol library installed by the pack's
+// package.json. Each endpoint caches its library on the first request; callers without a loader keep the kernel-relative
+// lazy import fallback. The kernel's own dependencies stay B1's, and importing the kernel loads nothing.
 /** An error a resolver answers, with the vendor's `type` for it (GitHub's NOT_FOUND, UNPROCESSABLE). */
 export class GraphqlError extends Error {
     type;
@@ -19,8 +19,6 @@ export class GraphqlError extends Error {
         this.name = 'GraphqlError';
     }
 }
-let lib;
-const graphqlLib = () => (lib ??= import('graphql'));
 const snake = (s) => s.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
 /** A list as a Relay connection, paged by `first`/`last` and `after`. */
 function connection(items, args) {
@@ -43,6 +41,8 @@ function connection(items, args) {
  *  context each resolver receives is made per request (the handler context). `unmodeled` answers a query selecting a
  *  field nothing models; `mutationRefused`, when given, a mutation the World may not make (a read-only twin). */
 export function graphqlEndpoint(options) {
+    let lib;
+    const loadLibrary = options.loadLibrary ?? (() => import('graphql'));
     let schema;
     const { resolvers, aliases, stored } = options.part;
     // introspection (`__typename`, `__type`, `__schema` and the `__Type`/`__Field`/… meta types) is the vendor's schema
@@ -50,7 +50,7 @@ export function graphqlEndpoint(options) {
     // before it merges)
     const modeled = (type, field) => field.startsWith('__') || type.startsWith('__') || `${type}.${field}` in resolvers || !!aliases?.[type]?.[field] || !!stored?.[type]?.includes(field) || !!stored?.[type]?.includes(snake(field));
     return async (request) => {
-        const g = await graphqlLib();
+        const g = await (lib ??= loadLibrary());
         schema ??= g.buildSchema(options.sdl, { assumeValidSDL: true });
         const payload = (await request.clone().json().catch(() => ({})));
         let document;