@volter/world-core 3.0.155 → 3.0.157

package/dist/src/derived-real.js

@@ -1,5 +1,5 @@
 import { parseExactJson, exactInteger, compareExactNumbers } from "./exact-json.js";
-import { aliasesFrom, parentEntries, readParentTreeMap, readTree } from "./log.js";
+import { aliasesFrom, parentEntries, readParentTreeMap, readTree, wholeLog } from "./log.js";
 import { storedType } from "./derived-core.js";
 import { verifyEvent } from "./events.js";
 import { hashFieldValue } from "./hash.js";
@@ -210,13 +210,30 @@ function sentTo(m, path, params) {
 const fixedHeaders = (op) => Object.fromEntries(Object.entries(op.headers ?? {}).filter((e) => typeof e[1] === 'string'));
 /** The body as the operation's encoding sends it. */
 function encode(op, body) {
-    if (body === undefined || op.bodyEncoding === 'none')
+    // a body the request carried where the spec declares none (Tinybird's Events API, NDJSON its client sends as text):
+    // the body as recorded, as the vendor read it
+    if (body === undefined)
         return {};
     if (op.bodyEncoding === 'form') {
+        // a form's nested values in the bracket form a form-encoded API reads (`scope[type]=account`, `items[0][price]=…`),
+        // the form the kernel's own parseBracketForm reads back; never a value's JSON text
         const form = new URLSearchParams();
+        const put = (key, v) => {
+            if (v === undefined || v === null)
+                return;
+            if (Array.isArray(v)) {
+                v.forEach((item, i) => put(`${key}[${i}]`, item));
+                return;
+            }
+            if (typeof v === 'object') {
+                for (const [k, x] of Object.entries(v))
+                    put(`${key}[${k}]`, x);
+                return;
+            }
+            form.append(key, String(v));
+        };
         for (const [k, v] of Object.entries(object(body) ?? {}))
-            if (v !== undefined && v !== null)
-                form.set(k, typeof v === 'object' ? JSON.stringify(v) : String(v));
+            put(k, v);
         return { body: form.toString(), type: 'application/x-www-form-urlencoded' };
     }
     return { body: JSON.stringify(body), type: 'application/json' };
@@ -293,9 +310,14 @@ async function graphqlAnswers(m, surface, input, parsed) {
 /** The account a root is, before a perform sends a path naming the World's ("The account a root is"): the World's
  *  account its own doors made, unadopted, adopts the one account the root's credential lists. Read once per deploy (an
  *  adopted account is not asked again); a list the vendor refuses, or one naming several accounts, adopts none. */
+/** The accounts a root's list already named as the World's own (the World's id is the vendor's), by service and root:
+ *  nothing to adopt, so not asked again. */
+const accountsMatched = new Map();
 async function adoptAccount(units, execute, ctx) {
     if (ctx.service === undefined)
         return;
+    const matched = accountsMatched.get(`${ctx.service}\u0000${ctx.root ?? ''}`) ?? new Set();
+    accountsMatched.set(`${ctx.service}\u0000${ctx.root ?? ''}`, matched);
     for (const u of units) {
         const m = u.manifest;
         const decl = m.account ? m.resources[m.account] : undefined;
@@ -305,13 +327,15 @@ async function adoptAccount(units, execute, ctx) {
         const local = readTree(ctx.service, ctx.root).filter((r) => r.type === type && r.deleted !== true && ctx.resolve(type, String(r.id)) === String(r.id));
         const scope = decl.refresh;
         const op = scope && 'list' in scope ? u.surface.operations.find((o) => o.id === scope.list) : undefined;
-        if (!local.length || !op)
+        if (!local.length || !op || local.every((l) => matched.has(`${type}:${String(l.id)}`)))
             continue;
         const answer = await execute({ method: op.method.toUpperCase(), path: sentTo(m, marked(op, `${op.basePath ?? u.surface.basePath ?? ''}${op.path}`), {}), ...(u.lane ? { lane: u.lane } : {}), headers: fixedHeaders(op) });
         if (answer.status >= 400)
             continue;
         const items = itemsOf(op, parse(answer));
         const id = items.length === 1 ? storedIdOf(decl, items[0]) : undefined;
+        if (id !== undefined && local.some((l) => String(l.id) === id))
+            matched.add(`${type}:${id}`);
         if (id === undefined || local.some((l) => String(l.id) === id))
             continue;
         observeResources(ctx.service, [{ type, id, fields: items[0], adopts: String(local[0].id) }], ctx.root !== undefined ? { root: ctx.root } : {});
@@ -548,8 +572,28 @@ function scopeIdOf(scope, fields) {
     const value = field ? at(fields, field) : undefined;
     return value === undefined || value === null || value === '' ? undefined : String(value);
 }
+/** A refresh larger than one window of the vendor's rate budget paces itself: a call the budget refuses before making
+ *  it (RateBudgetError) waits the time the refusal names, at most two minutes a wait, and is made then. The budget is
+ *  never exceeded and no vendor answer is retried; without it a refresh needing more than one window never finishes
+ *  (Slack's, after a deploy spent the window: every rerun refused again from the start). */
+function paced(execute) {
+    return async (request) => {
+        for (let waits = 0;; waits++) {
+            try {
+                return await execute(request);
+            }
+            catch (error) {
+                const wait = error.name === 'RateBudgetError' ? error.retryAfterMs : undefined;
+                if (wait === undefined || wait > 120_000 || waits >= 60)
+                    throw error;
+                await new Promise((done) => setTimeout(done, wait + 250));
+            }
+        }
+    };
+}
 function refreshOf(units, service) {
-    return async (execute, opts) => {
+    return async (unpaced, opts) => {
+        const execute = paced(unpaced);
         const observed = [];
         const complete = [];
         // what the root's credential may not read (a token scoped to some of the account): left as the World holds it, said
@@ -557,6 +601,19 @@ function refreshOf(units, service) {
         let answered = 0;
         for (const { manifest: m, surface, lane } of units) {
             const onLane = lane ? { lane } : {};
+            const tenantBinding = {};
+            if (m.refreshIdentity) {
+                const identity = surface.operations.find(operation => operation.id === m.refreshIdentity.operation);
+                if (!m.tenant || !identity || identity.method !== 'get' || identity.path.includes('{'))
+                    throw new Error(`${m.vendor}: refresh identity needs a parameterless GET and declared tenant field`);
+                const answer = await execute({ method: 'GET', path: `${identity.basePath ?? surface.basePath ?? ''}${identity.path}`, ...onLane, headers: fixedHeaders(identity) });
+                if (answer.status >= 400 || refusedIn(m, parse(answer)))
+                    throw new Error(`${m.vendor}: root account identity refused; nothing folded`);
+                const tenant = at(parse(answer), m.refreshIdentity.field);
+                if (typeof tenant !== 'string' || !tenant)
+                    throw new Error(`${m.vendor}: root account identity is absent; nothing folded`);
+                tenantBinding[m.tenant.field] = tenant;
+            }
             // parents before children, however deep
             const scoped = Object.entries(m.resources).filter(([, d]) => d.refresh && !('none' in d.refresh));
             const depth = (r, seen = new Set()) => { const p = m.resources[r]?.parent?.resource; return p && !seen.has(p) ? 1 + depth(p, seen.add(r)) : 0; };
@@ -565,6 +622,8 @@ function refreshOf(units, service) {
                 const scope = decl.refresh;
                 if ('none' in scope)
                     continue;
+                if (m.refreshIdentity && (!('list' in scope) || 'graphql' in scope))
+                    throw new Error(`${m.vendor}: account-bound refresh requires REST list scopes`);
                 if ('graphql' in scope && scope.graphql) {
                     await refreshGraphql(m, resource, decl, scope, execute, opts.scope, observed, complete);
                     answered += 1;
@@ -582,6 +641,17 @@ function refreshOf(units, service) {
                 if ('get' in scope && scope.known) {
                     const aliases = aliasesFrom(parentEntries(service, opts.root));
                     const held = [...readParentTreeMap(service, opts.root)].filter(([, r]) => r.type === type && r.fields.deleted !== true);
+                    // and each a door made (a person's act on the vendor's site: a group they add the bot to), which the vendor holds
+                    // as the World does though no deploy landed it
+                    const rooted = new Set(held.map(([k]) => k));
+                    const doorMade = new Set(wholeLog(service, opts.root).filter((e) => e.subject.type === type && e.input?.door !== undefined).map((e) => String(e.subject.id)));
+                    for (const r of readTree(service, opts.root)) {
+                        const key = `${type}:${String(r.id)}`;
+                        if (r.type !== type || r.deleted === true || !doorMade.has(String(r.id)) || held.some(([k]) => k === key))
+                            continue;
+                        const { type: _t, id, ...fields } = r;
+                        held.push([key, { type, id: String(id), fields }]);
+                    }
                     const read = [];
                     // a 403 leaves the type as the World holds it, never complete
                     let refused = false;
@@ -606,6 +676,9 @@ function refreshOf(units, service) {
                         const target = marked(op, path);
                         const sent = asked.length ? `${target}${target.includes('?') ? '&' : '?'}${new URLSearchParams(asked)}` : target;
                         const answer = await execute({ method: op.method.toUpperCase(), path: sentTo(m, sent, subject), ...onLane, headers: fixedHeaders(op) });
+                        // a door's subject the vendor does not show the root (another bot's private chat) stays as the World holds it
+                        if (!rooted.has(key) && answer.status >= 400 && answer.status !== 429)
+                            continue;
                         if (answer.status === 401)
                             throw new Error(`401: the vendor refused the root's credential (${op.method.toUpperCase()} ${path}); nothing folded`);
                         if (answer.status === 403) {
@@ -617,7 +690,8 @@ function refreshOf(units, service) {
                             throw new Error(`429: rate limited${answer.headers['retry-after'] ? `, retry after ${answer.headers['retry-after']}s` : ''}`);
                         read.push(String(subject.id));
                         answered += 1;
-                        if (answer.status === 404)
+                        // the vendor's answer for a subject it no longer has: a 404, or the scope's `gone` (Telegram's 400 `chat not found`)
+                        if (answer.status === 404 || (scope.gone && answer.status === scope.gone.status && refusalWords(m, parse(answer)).includes(scope.gone.says)))
                             continue;
                         if (answer.status >= 400 || refusedIn(m, parse(answer)))
                             throw new Error(`${m.vendor}: ${resource} refresh ${op.id} (${op.method.toUpperCase()} ${op.path}): ${answer.status}: ${refusalWords(m, parse(answer))}`);
@@ -674,9 +748,12 @@ function refreshOf(units, service) {
                                 : decl.parent?.params?.length && under ? Object.fromEntries(Object.entries(under.params).filter(([n]) => !op.path.includes(`{${n}}`) && (op.query ?? []).some((x) => x.name === n))) : {};
                             // a list asked by POST carries its parent in its body too, unless the operation reads it from its query
                             const parentInQuery = !rpc || (op.query ?? []).some((x) => x.name === decl.parent?.param);
-                            const q = new URLSearchParams(rpc ? (parentInQuery ? byQuery : {}) : { ...page, ...byQuery });
+                            // a parameter the operation declares in its query, and not its body, goes in the query of a list asked by POST
+                            // too (TikTok's video list: `fields` in the query, its cursor in the body)
+                            const inQuery = (n) => (op.query ?? []).some((x) => x.name === n) && !(op.body ?? []).some((b) => b.name === n);
+                            const q = new URLSearchParams(rpc ? { ...Object.fromEntries(Object.entries(page).filter(([k]) => inQuery(k))), ...(parentInQuery ? byQuery : {}) } : { ...page, ...byQuery });
                             // Fixed parameters and cursors take the operation's body types, not their manifest string encoding.
-                            const typedPage = Object.fromEntries(Object.entries(page).map(([k, v]) => {
+                            const typedPage = Object.fromEntries(Object.entries(page).filter(([k]) => !rpc || !inQuery(k)).map(([k, v]) => {
                                 const type = (op.body ?? []).find((b) => b.name === k)?.type;
                                 const value = type === 'integer' ? exactInteger(v) : type === 'number' ? Number(v)
                                     : type === 'boolean' && (v === 'true' || v === 'false') ? v === 'true' : v;
@@ -739,9 +816,12 @@ function refreshOf(units, service) {
                                     const detail = surface.operations.find((o) => o.id === scope.detail);
                                     if (!detail)
                                         throw new Error(`${m.vendor}: ${resource}'s refresh detail names ${scope.detail}, no operation of the surface`);
-                                    const id = mapId ?? storedIdOf(decl, item);
+                                    const id = mapId ?? storedIdOf(decl, { ...under?.params, ...item });
+                                    // the item's own id names it in the detail's path where its stored id is a composite key (a Cloudflare
+                                    // script stored `<account>/<name>` is read at `/scripts/{script_name}` by its name)
+                                    const own = item[decl.idAs ?? 'id'];
                                     const path = `${detail.basePath ?? surface.basePath ?? ''}${detail.path}`.replace(/\{([^}]+)\}/g, (_, n) => {
-                                        const value = under?.params[n] ?? item[n] ?? id;
+                                        const value = under?.params[n] ?? item[n] ?? (decl.key && (typeof own === 'string' || typeof own === 'number') ? own : id);
                                         if (value === undefined)
                                             throw new Error(`${m.vendor}: ${resource}'s refresh detail has no value for ${n}`);
                                         return encodeURIComponent(String(value));
@@ -766,8 +846,10 @@ function refreshOf(units, service) {
                                 // twin_local_ports) is the answering World's, never the vendor's, and is not folded in
                                 const local = m.worldFields?.[resource] ?? {};
                                 const vendorShape = Object.fromEntries(Object.entries(full).filter(([k]) => !(k in local)));
-                                const fields = { ...vendorShape, ...kept, ...(decl.parent && parent !== undefined ? { [decl.parent.field]: parent } : {}) };
-                                const id = mapId ?? scopeIdOf(scope, fields) ?? storedIdOf(decl, fields);
+                                const fields = { ...vendorShape, ...(!decl.shared ? tenantBinding : {}), ...kept, ...(decl.parent && parent !== undefined ? { [decl.parent.field]: parent } : {}) };
+                                // a key part the item does not carry is the path parameter its parent was listed under (Cloudflare's secret,
+                                // `{account_id}/{script_name}::{name}`, listed as its name and type alone)
+                                const id = mapId ?? scopeIdOf(scope, fields) ?? storedIdOf(decl, { ...under?.params, ...fields });
                                 if (id === undefined)
                                     continue;
                                 observed.push({ type, id, fields: fields });
@@ -856,7 +938,7 @@ function refreshOf(units, service) {
                 // scoped to one resource (`RootConfig.scope`, GitHub's `repos/o/r`) lists only what is under it, so a type with no
                 // parent is never the account's whole list there
                 if (whole && !decl.parent && !opts.scope)
-                    complete.push(type);
+                    complete.push(m.refreshIdentity && m.tenant && !decl.shared ? { type, field: m.tenant.field, within: [String(tenantBinding[m.tenant.field])] } : type);
                 else if (whole && parents.length && decl.parent)
                     complete.push({ type, field: decl.parent.field, within: parents.map((p) => p.value) });
             }
@@ -971,7 +1053,7 @@ async function refreshGraphql(m, resource, decl, scope, execute, rootScope, obse
             const items = listed(value).map(object).filter((x) => x !== undefined);
             for (const item of items) {
                 const fields = { ...item, ...(decl.parent && under ? { [decl.parent.field]: under.value } : {}) };
-                const id = storedIdOf(decl, fields);
+                const id = storedIdOf(decl, { ...under?.params, ...fields });
                 if (id !== undefined)
                     observed.push({ type, id, fields: fields });
             }

package/dist/src/derived.d.ts

@@ -19,6 +19,8 @@ export type DerivedOperation = {
     emptySuccess?: boolean;
     /** a form-encoded operation's number and boolean fields, by bracket path (`items.[].quantity`, `metadata.*`) */
     scalars?: Readonly<Record<string, string | undefined>>;
+    /** a form-encoded operation's string fields that take only listed values, by the same bracket path */
+    enums?: Readonly<Record<string, ReadonlyArray<string>>>;
     /** what the success answer is: a resource, a list of them, and the envelope key holding it */
     answers?: {
         resource: string;
@@ -66,6 +68,9 @@ export type DerivedCall = {
     request: Request;
     operation: DerivedOperation;
     params: Record<string, string>;
+    /** a World screen's call, which no perform sends again: a body in a media type the core does not read (anything
+     *  but JSON, a form, multipart or text) is the handler's alone, left unread and unrecorded, so an upload streams */
+    streamed?: true;
 };
 export declare function bodyTextOf(request: Request): Promise<string>;
 /** The body's text, as JSON, or undefined when it is not JSON; the parse is kept for the first taker. */

package/dist/src/derived.js

@@ -1,5 +1,6 @@
 import { parseExactJson } from "./exact-json.js";
 import { runWithRequestTrace } from "./trace-context.js";
+import { redisServiceTimes } from "./redis/service-times.js";
 /**
  * A request's body as text, read once per request: the dispatch reads it and tags the request with it, and every clone
  * made from a tagged request carries the tag, so the malformed-JSON guard, the idempotency signature, the handler's
@@ -169,8 +170,10 @@ export function createDerivedFetch(options) {
         for (const observer of dispatchObservers ?? [])
             observer({ surface: options.surface, operation: matched.operation, owner: handlers[matched.operation.id] ? 'handler' : options.core?.owns(matched.operation) ? 'core' : 'gap' });
         // the body read once, as text, for everything the dispatch does with it (bodyTextOf)
+        redisServiceTimes.lap('6a around entered, guards and scenario passed, operation matched again');
         if (request.method !== 'GET' && request.method !== 'HEAD' && request.body && !(request.headers.get('content-type') ?? '').includes('multipart'))
             tagBody(request, await request.clone().text());
+        redisServiceTimes.lap('6b the dispatch read the body as text');
         // the path prefix's named groups (pack-fetch.ts, `pathPrefix`) are the call's parameters too
         const prefixed = request.headers.get(PREFIX_PARAMS_HEADER);
         const call = { request, operation: matched.operation, params: prefixed ? { ...parseExactJson(prefixed), ...matched.params } : matched.params };

package/dist/src/executor.d.ts

@@ -120,6 +120,10 @@ export type TwinAuthStrategy =
         answer: string;
         credential: string;
     };
+    /** The answer's field giving the token's lifetime in seconds (a dotted path; OAuth's `expires_in`): a token held past
+     *  it is exchanged again before the next call. For a vendor that answers an expired token with no `retryOn` status
+     *  (TikTok's API for Business answers HTTP 200 with a code), and so a long-lived process never sends a dead token. */
+    expiresIn?: string;
 };
 /** Throws with the precise refusal; returns the parsed URL when the origin is usable. */
 export declare function validateRemoteOrigin(origin: string, opts?: {
@@ -132,10 +136,13 @@ export declare function validateRemoteOrigin(origin: string, opts?: {
  *  refused, as before. */
 /** Where a credential is kept (the head's and refresh's root: head.ts rootCustody): `key` names the credential stably
  *  across rotations and anew when another is sealed in its place (the token cache is keyed by it, not by the secret's value), `open` reads it as sealed now, `seal` keeps a rotated one. */
+/** `unsealed`: where a rotation the seal failed to keep is recorded durably (the field and the cause, never a value), since
+ *  the root cannot renew once the process holding the new secret ends; a later successful seal clears it. */
 export type CredentialCustody = {
     key: string;
     open: () => Promise<CredentialPayload>;
     seal: (credential: CredentialPayload) => Promise<void> | void;
+    unsealed?: (field: string, cause: string) => void;
 };
 /** `vendor`: the vendor whose rate budget every call is charged to (D8): the call is priced and reserved before it is
  *  made, refused when the budget is spent, and settled with the vendor's answer (its back-off honoured). */

package/dist/src/executor.js

@@ -365,6 +365,7 @@ function exchangeExecute(origin, sealed, auth, vendorHosts, custody) {
         return held;
     };
     const key = custody ? `${origin.href}\n${custody.key}` : `${origin.href}\n${JSON.stringify(sealed)}`;
+    let expiresAt;
     const exchange = async () => {
         // a rotating secret is read as kept NOW (another executor or process may have rotated it since this one was
         // built), or as this process holds it when its seal failed and the file still holds the spent value. Two
@@ -409,6 +410,11 @@ function exchangeExecute(origin, sealed, auth, vendorHosts, custody) {
             const code = parsed && typeof parsed === 'object' ? parsed.error : undefined;
             throw new Error(`remote execute: the token exchange answered no \`${auth.token}\`${typeof code === 'string' && code !== '' ? ` (${code.slice(0, 120)})` : ''}`);
         }
+        if (auth.expiresIn) {
+            const seconds = Number(auth.expiresIn.split('.').reduce((at, k) => (at && typeof at === 'object' ? at[k] : undefined), parsed));
+            // a minute short of the stated lifetime, so a call in flight never carries a token that dies on the way
+            expiresAt = Number.isFinite(seconds) && seconds > 0 ? Date.now() + Math.max(0, seconds - 60) * 1000 : undefined;
+        }
         if (auth.rotate) {
             const next = auth.rotate.answer.split('.').reduce((at, k) => (at && typeof at === 'object' ? at[k] : undefined), parsed);
             if (typeof next === 'string' && next !== '' && next !== credential[auth.rotate.credential]) {
@@ -423,6 +429,10 @@ function exchangeExecute(origin, sealed, auth, vendorHosts, custody) {
                     }
                     catch (error) {
                         unsealedRotations.set(key, { replaced, credential });
+                        try {
+                            custody.unsealed?.(auth.rotate.credential, error instanceof Error ? error.message : String(error));
+                        }
+                        catch { /* the stderr line below still says it */ }
                         console.error(`remote execute: the vendor rotated \`${auth.rotate.credential}\` and sealing the new one failed (${error instanceof Error ? error.message : String(error)}); this process holds it until a seal succeeds`);
                     }
                 }
@@ -432,12 +442,16 @@ function exchangeExecute(origin, sealed, auth, vendorHosts, custody) {
     };
     const current = () => {
         let held = exchangedTokens.get(key);
+        if (held?.expiresAt !== undefined && Date.now() >= held.expiresAt) {
+            exchangedTokens.delete(key);
+            held = undefined;
+        }
         if (!held) {
             const token = exchange();
             held = { token };
             exchangedTokens.set(key, held);
             const entry = held;
-            token.catch(() => { if (exchangedTokens.get(key) === entry)
+            token.then(() => { entry.expiresAt = expiresAt; }, () => { if (exchangedTokens.get(key) === entry)
                 exchangedTokens.delete(key); });
         }
         return held;

package/dist/src/fork.js

@@ -56,7 +56,7 @@ export function forkTwin(opts) {
         };
         getActiveWorldStore().write(forkMetaPath(service, toRoot), `${JSON.stringify(meta, null, 2)}\n`);
         return meta;
-    });
+    }, { operation: 'pointer publication' });
 }
 export function readForkMeta(service, root) {
     const path = forkMetaPath(service, root);

package/dist/src/git/lfs.d.ts

@@ -4,9 +4,17 @@ export type LfsObject = {
     size: number | string;
 };
 /** Where a pack keeps its objects: by oid. */
+/** Where a server keeps its LFS objects: an object's size when it holds one (the batch API answers from it, never
+ *  loading the object), and the store an upload's verified bytes go to. */
 export type LfsStore = {
-    get(oid: string): Promise<Uint8Array | null>;
+    size(oid: string): Promise<number | null>;
     put(oid: string, bytes: Uint8Array): Promise<void>;
+    /** an upload's body written as it arrives and kept only when `accept` holds for its size and SHA-256 (`ctx.blobs.putStream`):
+     *  a store with it never holds an object whole */
+    putStream?(oid: string, chunks: AsyncIterable<Uint8Array>, accept: (written: {
+        size: number;
+        sha256: string;
+    }) => boolean): Promise<boolean>;
 };
 /** A pointer file's object (`version https://git-lfs.github.com/spec/v1`, `oid sha256:<hex>`, `size <n>`), or null
  *  for any other file. */
@@ -24,5 +32,7 @@ export declare function lfsBatch(body: unknown, opts: {
     header?: Record<string, string>;
 }): Promise<Response>;
 /** A basic transfer's upload (`PUT` of the object's bytes): kept when they hash to the oid and have the declared size
- *  (the size is the request's Content-Length when the caller has no other), else refused and nothing kept. */
-export declare function lfsUpload(bytes: Uint8Array, o: LfsObject, store: LfsStore): Promise<Response>;
+ *  (the size is the request's Content-Length when the caller has no other), else refused and nothing kept. A body
+ *  stream goes to the store's `putStream` as it arrives, read no further than the declared size; bytes, or a store
+ *  without one, are checked whole. */
+export declare function lfsUpload(body: Uint8Array | ReadableStream<Uint8Array> | null, o: LfsObject, store: LfsStore): Promise<Response>;

package/dist/src/git/lfs.js

@@ -46,22 +46,54 @@ export async function lfsBatch(body, opts) {
             objects.push({ ...o, error: { code: 422, message: 'Invalid object' } });
             continue;
         }
-        const held = await opts.store.get(o.oid);
+        const held = await opts.store.size(o.oid);
         if (operation === 'upload') {
-            objects.push(held ? { ...o, authenticated: true } : { ...o, authenticated: true, actions: { upload: { href: opts.href('upload', o), ...(opts.header ? { header: opts.header } : {}), expires_in: 3600 } } });
+            objects.push(held !== null ? { ...o, authenticated: true } : { ...o, authenticated: true, actions: { upload: { href: opts.href('upload', o), ...(opts.header ? { header: opts.header } : {}), expires_in: 3600 } } });
         }
         else {
             // source: https://github.com/git-lfs/git-lfs/blob/main/docs/api/batch.md "The object does not exist on the server."
-            objects.push(held ? { oid: o.oid, size: held.length, authenticated: true, actions: { download: { href: opts.href('download', o), ...(opts.header ? { header: opts.header } : {}), expires_in: 3600 } } } : { ...o, error: { code: 404, message: 'Object does not exist' } });
+            objects.push(held !== null ? { oid: o.oid, size: held, authenticated: true, actions: { download: { href: opts.href('download', o), ...(opts.header ? { header: opts.header } : {}), expires_in: 3600 } } } : { ...o, error: { code: 404, message: 'Object does not exist' } });
         }
     }
     return lfsJson(200, { transfer: 'basic', objects, hash_algo: 'sha256' });
 }
 /** A basic transfer's upload (`PUT` of the object's bytes): kept when they hash to the oid and have the declared size
- *  (the size is the request's Content-Length when the caller has no other), else refused and nothing kept. */
-export async function lfsUpload(bytes, o, store) {
-    if (bytes.length !== o.size || (await lfsOid(bytes)) !== o.oid)
-        return lfsJson(422, { message: `the object's bytes do not match ${o.oid} (${o.size} bytes)` });
-    await store.put(o.oid, bytes);
-    return new Response(null, { status: 200 });
+ *  (the size is the request's Content-Length when the caller has no other), else refused and nothing kept. A body
+ *  stream goes to the store's `putStream` as it arrives, read no further than the declared size; bytes, or a store
+ *  without one, are checked whole. */
+export async function lfsUpload(body, o, store) {
+    const refused = () => lfsJson(422, { message: `the object's bytes do not match ${o.oid} (${o.size} bytes)` });
+    if (body instanceof Uint8Array || body === null || !store.putStream) {
+        const bytes = body instanceof Uint8Array ? body : new Uint8Array(body === null ? new ArrayBuffer(0) : await new Response(body).arrayBuffer());
+        if (bytes.length !== o.size || (await lfsOid(bytes)) !== o.oid)
+            return refused();
+        await store.put(o.oid, bytes);
+        return new Response(null, { status: 200 });
+    }
+    const declared = Number(o.size);
+    let over = false;
+    async function* upTo(stream) {
+        const reader = stream.getReader();
+        let read = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    return;
+                read += value.byteLength;
+                // a body longer than declared is refused without reading the rest of it
+                if (read > declared) {
+                    over = true;
+                    await reader.cancel();
+                    return;
+                }
+                yield value;
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+    const kept = await store.putStream(o.oid, upTo(body), (w) => !over && w.size === declared && w.sha256 === o.oid);
+    return kept ? new Response(null, { status: 200 }) : refused();
 }

package/dist/src/grpc-wire.js

@@ -7,6 +7,7 @@ import { parseExactJson } from "./exact-json.js";
 // and what they answer is the pack's. Importing it does nothing.
 import { acceptH2Connection } from "./h2.js";
 import { nodeBuiltin, WORLD_BOOT_PATH } from "./serve-http.js";
+import { worldBootAnswer } from "./world-boot.js";
 import { decodeMessage, encodeMessage } from "./protobuf.js";
 /** gRPC's status codes (https://grpc.github.io/grpc/core/md_doc_statuscodes.html). */
 export const GrpcStatus = {
@@ -162,7 +163,7 @@ export function grpcOverFetch(fetch) {
 export async function serveGrpc(options) {
     const net = nodeBuiltin('node:net');
     const worldBoot = globalThis.process?.env?.VOLTER_WORLD_BOOT_ID;
-    const fetch = worldBoot ? (request) => (new URL(request.url).pathname === WORLD_BOOT_PATH ? Promise.resolve(Response.json({ boot: worldBoot })) : options.fetch(request)) : options.fetch;
+    const fetch = worldBoot ? (request) => (new URL(request.url).pathname === WORLD_BOOT_PATH ? Promise.resolve(worldBootAnswer(worldBoot)) : options.fetch(request)) : options.fetch;
     const handler = grpcStreamHandler(options.schema, grpcOverFetch(fetch));
     const server = net.createServer((socket) => { acceptH2Connection(socket, handler, fetch); });
     await new Promise((resolve, reject) => { server.once('error', reject); server.listen(options.port ?? 0, '127.0.0.1', () => resolve()); });

package/dist/src/h2.js

@@ -10,6 +10,43 @@ const MAX_CONCURRENT_STREAMS = 1000;
 /** a request body larger than this resets its stream: a memory bound, not Temporal's message limit (the
  *  SDKs' gRPC default is 4 MiB; this server does not enforce that one) */
 const MAX_REQUEST_BYTES = 64 * 1024 * 1024;
+/** A chunked body (RFC 9112 §7.1) from `from`: its bytes once the last chunk and the trailer section have arrived,
+ *  'incomplete' before, 'bad' for a malformed size line or one past MAX_REQUEST_BYTES. Extensions and trailers are
+ *  read past and not kept. */
+function chunkedBody(buffer, from) {
+    const parts = [];
+    let at = from, total = 0;
+    for (;;) {
+        const line = buffer.indexOf('\r\n', at);
+        if (line < 0)
+            return buffer.length - at > 4096 ? 'bad' : 'incomplete';
+        const size = /^([0-9A-Fa-f]{1,8})[ \t]*(?:;.*)?$/su.exec(buffer.subarray(at, line).toString('latin1'));
+        if (!size)
+            return 'bad';
+        const length = parseInt(size[1], 16);
+        at = line + 2;
+        if (length === 0)
+            break;
+        total += length;
+        if (total > MAX_REQUEST_BYTES)
+            return 'bad';
+        if (buffer.length < at + length + 2)
+            return 'incomplete';
+        if (buffer[at + length] !== 0x0d || buffer[at + length + 1] !== 0x0a)
+            return 'bad';
+        parts.push(buffer.subarray(at, at + length));
+        at += length + 2;
+    }
+    // The trailer section: field lines up to an empty line.
+    for (;;) {
+        const line = buffer.indexOf('\r\n', at);
+        if (line < 0)
+            return buffer.length - at > 64 * 1024 ? 'bad' : 'incomplete';
+        if (line === at)
+            return Buffer.concat(parts);
+        at = line + 2;
+    }
+}
 /** a header block (HEADERS + CONTINUATION) larger than this closes the connection */
 const MAX_HEADER_BLOCK = 256 * 1024;
 // ---- HPACK ------------------------------------------------------------------------------------
@@ -248,18 +285,34 @@ class H2Connection {
             this.respondHttp1(new Response('bad header', { status: 400 }));
             return;
         }
-        if (headers.get('transfer-encoding')) {
-            this.respondHttp1(new Response('chunked request bodies are not accepted', { status: 411 }));
-            return;
+        // A request with a Transfer-Encoding has a body framed by it, and its Content-Length is not read (RFC 9112 §6.3):
+        // undici sends a streamed body (a World's fetch forwarding a request's own body, duplex 'half') chunked.
+        const coding = headers.get('transfer-encoding');
+        let body;
+        if (coding !== null) {
+            if (coding.split(',').map((each) => each.trim().toLowerCase()).at(-1) !== 'chunked') {
+                this.respondHttp1(new Response('a transfer coding other than chunked is not read', { status: 400 }));
+                return;
+            }
+            const read = chunkedBody(this.buffer, end + 4);
+            if (read === 'bad') {
+                this.respondHttp1(new Response('bad chunked body', { status: 400 }));
+                return;
+            }
+            if (read === 'incomplete')
+                return;
+            body = read;
         }
-        const length = Number(headers.get('content-length') ?? 0);
-        if (!Number.isFinite(length) || length < 0 || length > MAX_REQUEST_BYTES) {
-            this.respondHttp1(new Response('bad content-length', { status: 400 }));
-            return;
+        else {
+            const length = Number(headers.get('content-length') ?? 0);
+            if (!Number.isFinite(length) || length < 0 || length > MAX_REQUEST_BYTES) {
+                this.respondHttp1(new Response('bad content-length', { status: 400 }));
+                return;
+            }
+            if (this.buffer.length < end + 4 + length)
+                return;
+            body = this.buffer.subarray(end + 4, end + 4 + length);
         }
-        if (this.buffer.length < end + 4 + length)
-            return;
-        const body = this.buffer.subarray(end + 4, end + 4 + length);
         this.buffer = Buffer.alloc(0);
         this.socket.removeAllListeners('data');
         let request;

package/dist/src/head.d.ts

@@ -72,6 +72,8 @@ export declare function openRootCredential(root: BoundRoot, vendor?: string): Pr
  *  fingerprint, and a new one per grant would start the ledger over), and rotatedAt says when. `source` is the record
  *  the rotation began from: if another credential was set meanwhile, the rotation is dropped, never written over it. */
 export declare function resealRootCredential(root: BoundRoot, payload: CredentialPayload, vendor?: string, source?: string | null): Promise<void>;
+/** Beside a root's credential, the record of a rotation its seal failed to keep (`rootCustody`'s `unsealed`). */
+export declare function unsealedMarkerOf(root: BoundRoot): string;
 /** The root's custody for an exchange that rotates: the credential as sealed now, and the seal of a rotated one, which
  *  lands only over the record that was opened. */
 export declare function rootCustody(root: BoundRoot, vendor?: string): CredentialCustody;
@@ -174,6 +176,9 @@ export declare function performEntries(opts: {
  * `auto` is performed now. Returns the vendor's id when it minted one, so the answer carries it.
  * Raises `RefusedWriteError` / `VendorWriteError` for the pack to answer in the vendor's shape.
  */
+/** Whether `performAtHead` would perform an entry now (a twin whose root says `auto`, outside a pack fetch's deferred
+ *  group): a caller appending several writes at once appends them one at a time then, each performed before the next. */
+export declare function performsAtHeadNow(service: string, root?: string): boolean;
 export declare function performAtHead(service: string, action: Pick<TwinAction, 'id'>, root?: string): Promise<{
     performed: boolean;
     externalId?: string;

package/dist/src/head.js

@@ -136,7 +136,10 @@ export async function resealRootCredential(root, payload, vendor = vendorOf(root
     if (store.read(root.credential) !== held)
         throw new Error(`the ${vendor} credential was set again while it rotated: the rotation is dropped`);
     store.write(root.credential, `${JSON.stringify({ ...sealed, ...(before ? { fingerprint: before.fingerprint } : {}), rotatedAt: now }, null, 2)}\n`, { secret: true });
+    store.remove(unsealedMarkerOf(root));
 }
+/** Beside a root's credential, the record of a rotation its seal failed to keep (`rootCustody`'s `unsealed`). */
+export function unsealedMarkerOf(root) { return root.credential.replace(/\.json$/, '.unsealed.json'); }
 /** The root's custody for an exchange that rotates: the credential as sealed now, and the seal of a rotated one, which
  *  lands only over the record that was opened. */
 export function rootCustody(root, vendor = vendorOf(root)) {
@@ -155,6 +158,9 @@ export function rootCustody(root, vendor = vendorOf(root)) {
             return opened.payload;
         },
         seal: (credential) => resealRootCredential(root, credential, vendor, source),
+        // the vendor already spent the sealed secret: until a seal lands, the root renews only inside the process holding the
+        // new one, so the World keeps a record a person or `doctor` can read after that process ends
+        unsealed: (field, cause) => store.write(unsealedMarkerOf(root), `${JSON.stringify({ vendor, field, at: new Date().toISOString(), cause: cause.slice(0, 300) }, null, 2)}\n`),
     };
 }
 /** The vendor a root belongs to: its credential is sealed under the vendor's name. */
@@ -464,6 +470,15 @@ async function performNow(opts) {
  * `auto` is performed now. Returns the vendor's id when it minted one, so the answer carries it.
  * Raises `RefusedWriteError` / `VendorWriteError` for the pack to answer in the vendor's shape.
  */
+/** Whether `performAtHead` would perform an entry now (a twin whose root says `auto`, outside a pack fetch's deferred
+ *  group): a caller appending several writes at once appends them one at a time then, each performed before the next. */
+export function performsAtHeadNow(service, root) {
+    const request = currentCorrelationId();
+    if (request !== undefined && deferred.has(request))
+        return false;
+    const head = headOf(service, root);
+    return head.kind === 'real' && head.deploy === 'auto';
+}
 export async function performAtHead(service, action, root) {
     // a pack fetch performs its request's entries as one group after the handler (performRequestGroup)
     const request = currentCorrelationId();

package/dist/src/history.d.ts

@@ -51,7 +51,7 @@ export declare function saveHistoryView(directory: string, view: HistoryView): s
  *  (and the view document itself) and each named directory's ancestry record (its generation). A read cache keyed by this sees an
  *  ancestor's retained history truncated, replaced or its directory re-created, which the full read
  *  refuses (`historyEntries`), instead of serving a tree folded from the history it replaced. */
-export declare function inheritedHistoryKey(service: string, root?: string): string;
+export declare function inheritedHistoryKey(service: string, root?: string, meta?: string | null): string;
 export declare function inheritedHistory(service: string, root?: string): HistoryView | undefined;
 /** Capture under the directory's history lock, as appends and complete observation batches are made. */
 export declare function captureHistory(service: string, root?: string): {