@volter/world-core 3.0.156 → 3.0.157

package/dist/src/managed-go-programs.d.ts

@@ -0,0 +1,55 @@
+export interface NativeGoKitReference {
+    package: {
+        name: string;
+        version: string;
+    };
+    target: 'wasm32-wali-go-single-thread';
+    releaseSha256: string;
+    producerSha256: string;
+    sourceSha256: string;
+    selection: {
+        path: string;
+        sha256: string;
+    };
+    recipe: {
+        path: string;
+        sha256: string;
+    };
+    installedRoot: string;
+}
+export interface NativeGoOperation {
+    sourceService: string;
+    role: 'server' | 'prerequisite' | 'health';
+    kit: string;
+    program: {
+        name: string;
+        version: string;
+        manifestId: string;
+        manifestSha256: string;
+        path: string;
+    };
+    /** Resolved arguments require separate comparison with the full source. */
+    args: string[];
+    /** Names of existing World values, never caller secrets in this record. */
+    environmentBindings: Record<string, string>;
+    requires: {
+        service: string;
+        condition: 'service_started' | 'service_healthy' | 'service_completed_successfully';
+    }[];
+}
+export interface NativeGoReference {
+    version: 2;
+    implementation: string;
+    release: string;
+    directory: string;
+    snapshotSha256: string;
+    declarationSha256: string;
+    image: string;
+    kits: Record<string, NativeGoKitReference>;
+    server: NativeGoOperation;
+    prerequisites: NativeGoOperation[];
+    health: NativeGoOperation;
+}
+/** All fields are declared data. The later owned consumer must authenticate
+ * the complete source, kit, original image and admitted installed manifests. */
+export declare function nativeGoReference(value: unknown): NativeGoReference;

package/dist/src/managed-go-programs.js

@@ -0,0 +1,133 @@
+/** Tagged managed Go operation metadata. This structural reader grants no
+ * source/image correspondence, filesystem custody, catalog admission or exec. */
+import { posix } from 'node:path';
+const fail = (field) => { throw new Error('Native Go operation metadata is invalid: ' + field); };
+function object(value, fields, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return fail(label);
+    const row = value;
+    if (Object.keys(row).length !== fields.length || fields.some(key => !Object.hasOwn(row, key)))
+        return fail(label);
+    return row;
+}
+function text(value, label) {
+    if (typeof value !== 'string' || !value || value.includes('\0'))
+        return fail(label);
+    return value;
+}
+function digest(value, label) {
+    const out = text(value, label);
+    if (!/^[a-f0-9]{64}$/u.test(out))
+        return fail(label);
+    return out;
+}
+function relativePath(value, label) {
+    const out = text(value, label);
+    if (out.startsWith('/') || out.includes('\\') || posix.normalize(out) !== out
+        || out.split('/').some(part => !part || part === '.' || part === '..'))
+        return fail(label);
+    return out;
+}
+function installedPath(value, label) {
+    const out = text(value, label);
+    if (!out.startsWith('/opt/programs/') || out.includes('\\') || posix.normalize(out) !== out
+        || out.split('/').slice(1).some(part => !part || part === '.' || part === '..'))
+        return fail(label);
+    return out;
+}
+function pin(value, label) {
+    const row = object(value, ['path', 'sha256'], label);
+    return { path: relativePath(row.path, label + '.path'), sha256: digest(row.sha256, label + '.sha256') };
+}
+function kit(value, label) {
+    const row = object(value, ['package', 'target', 'releaseSha256', 'producerSha256', 'sourceSha256', 'selection', 'recipe', 'installedRoot'], label);
+    const pack = object(row.package, ['name', 'version'], label + '.package');
+    if (row.target !== 'wasm32-wali-go-single-thread')
+        return fail(label + '.target');
+    return { package: { name: text(pack.name, label + '.package.name'), version: text(pack.version, label + '.package.version') },
+        target: row.target, releaseSha256: digest(row.releaseSha256, label + '.releaseSha256'),
+        producerSha256: digest(row.producerSha256, label + '.producerSha256'), sourceSha256: digest(row.sourceSha256, label + '.sourceSha256'),
+        selection: pin(row.selection, label + '.selection'), recipe: pin(row.recipe, label + '.recipe'),
+        installedRoot: installedPath(row.installedRoot, label + '.installedRoot') };
+}
+function operation(value, role, kits, label) {
+    const row = object(value, ['sourceService', 'role', 'kit', 'program', 'args', 'environmentBindings', 'requires'], label);
+    const selected = text(row.kit, label + '.kit');
+    if (row.role !== role || !Object.hasOwn(kits, selected))
+        return fail(label + '.role/kit');
+    const provider = kits[selected];
+    const command = object(row.program, ['name', 'version', 'manifestId', 'manifestSha256', 'path'], label + '.program');
+    const path = installedPath(command.path, label + '.program.path'), version = text(command.version, label + '.program.version');
+    if (version !== provider.package.version || !path.startsWith(provider.installedRoot + '/'))
+        return fail(label + '.program placement/version');
+    if (!Array.isArray(row.args))
+        return fail(label + '.args');
+    const args = [];
+    for (const arg of row.args) {
+        if (typeof arg !== 'string' || arg.includes('\0'))
+            return fail(label + '.args.' + args.length);
+        args.push(arg);
+    }
+    if (!row.environmentBindings || typeof row.environmentBindings !== 'object' || Array.isArray(row.environmentBindings))
+        return fail(label + '.environmentBindings');
+    const bindings = Object.create(null);
+    for (const [name, value] of Object.entries(row.environmentBindings)) {
+        const source = text(value, label + '.environmentBindings.' + name);
+        if (![name, source].every(item => /^[A-Za-z_][A-Za-z0-9_]*$/u.test(item)))
+            return fail(label + '.environmentBindings name');
+        bindings[name] = source;
+    }
+    if (!Array.isArray(row.requires))
+        return fail(label + '.requires');
+    const dependencies = [];
+    for (const value of row.requires) {
+        const edge = object(value, ['service', 'condition'], label + '.requires');
+        if (edge.condition !== 'service_started' && edge.condition !== 'service_healthy' && edge.condition !== 'service_completed_successfully')
+            return fail(label + '.requires.condition');
+        const service = text(edge.service, label + '.requires.service');
+        if (dependencies.some(prior => prior.service === service))
+            return fail(label + '.requires duplicate service');
+        dependencies.push({ service, condition: edge.condition });
+    }
+    return { sourceService: text(row.sourceService, label + '.sourceService'), role, kit: selected,
+        program: { name: text(command.name, label + '.program.name'), version, manifestId: text(command.manifestId, label + '.program.manifestId'),
+            manifestSha256: digest(command.manifestSha256, label + '.program.manifestSha256'), path },
+        args, environmentBindings: bindings, requires: dependencies };
+}
+/** All fields are declared data. The later owned consumer must authenticate
+ * the complete source, kit, original image and admitted installed manifests. */
+export function nativeGoReference(value) {
+    const row = object(value, ['version', 'implementation', 'release', 'directory', 'snapshotSha256', 'declarationSha256', 'image', 'kits', 'server', 'prerequisites', 'health'], 'reference');
+    if (row.version !== 2)
+        return fail('version');
+    const image = text(row.image, 'image');
+    if (!/^[^\s@]+@sha256:[a-f0-9]{64}$/u.test(image))
+        return fail('image');
+    if (!row.kits || typeof row.kits !== 'object' || Array.isArray(row.kits) || !Object.keys(row.kits).length)
+        return fail('kits');
+    const kits = Object.create(null);
+    for (const [name, value] of Object.entries(row.kits))
+        kits[text(name, 'kit name')] = kit(value, 'kits.' + name);
+    const server = operation(row.server, 'server', kits, 'server'), health = operation(row.health, 'health', kits, 'health');
+    const implementation = text(row.implementation, 'implementation'), release = text(row.release, 'release');
+    if (kits[server.kit].package.name !== implementation || kits[server.kit].package.version !== release
+        || health.sourceService !== server.sourceService)
+        return fail('server/health implementation');
+    if (!Array.isArray(row.prerequisites))
+        return fail('prerequisites');
+    const prerequisites = [];
+    for (const value of row.prerequisites)
+        prerequisites.push(operation(value, 'prerequisite', kits, 'prerequisites.' + prerequisites.length));
+    if (new Set(prerequisites.map(item => item.sourceService)).size !== prerequisites.length
+        || prerequisites.some(item => item.sourceService === server.sourceService))
+        return fail('prerequisite service');
+    const usedKits = new Set([server.kit, health.kit, ...prerequisites.map(item => item.kit)]);
+    if (Object.keys(kits).some(name => !usedKits.has(name)))
+        return fail('unconsumed kit');
+    for (const item of prerequisites)
+        if (!server.requires.some(edge => edge.service === item.sourceService && edge.condition === 'service_completed_successfully'))
+            return fail('server prerequisite completion edge');
+    return { version: 2, implementation, release, directory: relativePath(row.directory, 'directory'),
+        snapshotSha256: digest(row.snapshotSha256, 'snapshotSha256'), declarationSha256: digest(row.declarationSha256, 'declarationSha256'),
+        image, kits, server, prerequisites, health };
+}

package/dist/src/mongodb/stream.d.ts

@@ -7,6 +7,29 @@ export type MongoCodec = {
     serialize(document: MongoDocument): Uint8Array;
     deserialize(bytes: Uint8Array): MongoDocument;
 };
+/** What a pack's stream reads of the `bson` library its generated fetch's `loadBson` resolves from the pack: the codec,
+ *  extended JSON, and the number kinds a reply names. The kernel declares the shape and imports nothing of it. */
+export type BsonLibrary = {
+    serialize(document: MongoDocument): Uint8Array;
+    deserialize(bytes: Uint8Array, options?: {
+        promoteValues?: boolean;
+        promoteLongs?: boolean;
+        bsonRegExp?: boolean;
+    }): MongoDocument;
+    EJSON: {
+        serialize(value: unknown, options?: {
+            relaxed?: boolean;
+        }): MongoDocument;
+        deserialize(value: unknown, options?: {
+            relaxed?: boolean;
+        }): MongoDocument;
+    };
+    Double: new (value: number) => unknown;
+    Int32: new (value: number) => unknown;
+    Long: {
+        fromNumber(value: number): unknown;
+    };
+};
 /** What the sender's message said beside its command: whether it will take more than one reply to it (OP_MSG's exhaustAllowed). */
 export type MongoAsked = {
     exhaustAllowed: boolean;

package/dist/src/pack-fetch.d.ts

@@ -1,4 +1,4 @@
-import { type DerivedManifest, type Handler, type HandlerContext, type VendorManifest } from './derived-core.js';
+import { type DerivedManifest, type Handler, type HandlerContext, type ScreenDecl, type VendorManifest } from './derived-core.js';
 import { type DerivedFetch, type DerivedSurface, type BoardFrame } from './derived.js';
 import { type PackScenarioAdapter } from './scenario.js';
 import type { ApplicationStandIn } from './events.js';
@@ -86,5 +86,10 @@ export type PackFetchOptions = {
     /** the application a walk stands in for (a life's `application` answers): this fetch's `ctx.ask` is answered by it */
     application?: ApplicationStandIn;
 };
+/** Where a workspace asked `?show=<type>:<id>` opens the record (architecture, "Workspace"): the built workspace page
+ *  that shows that type, its parameter the id; else the one that lists the type; else the workspace's home (its root
+ *  page). Every other parameter a page's path names is the asking page's, and a page that cannot be filled is passed
+ *  over. Undefined when nothing is asked; the path (with no `show`) otherwise. */
+export declare function shownRecord(url: URL, workspaces: ReadonlyArray<ScreenDecl>, params: Record<string, string>): string | undefined;
 export declare function createPackFetch(parts: PackParts, options?: PackFetchOptions): DerivedFetch;
 export declare function createVendorFetch(manifest: VendorManifest, lanes: Record<string, LanePart>): DerivedFetch;

package/dist/src/pack-fetch.js

@@ -23,7 +23,7 @@ import { withCors } from "./cors.js";
 import { contentAddressOf } from "./content-route.js";
 import { getPack } from "./packRegistry.js";
 import { hostRules } from '../host-routing.cjs';
-import { socketUpgrade } from "./sockets.js";
+import { expireSocketWaits, socketUpgrade } from "./sockets.js";
 import { liveIngest } from "./live/ingest.js";
 import { readResourceBlob, removeResourceBlob, writeResourceBlob } from "./resource-blob.js";
 import { resourcesOfType } from "./derived-core.js";
@@ -71,6 +71,32 @@ function hostMatcher(pattern) {
 }
 /** The host a request is for: the vendor host the World's injector names, else its own. */
 const hostOf = (request) => readHostPort(request.headers.get('x-volter-twin-original-host') ?? request.headers.get('host') ?? new URL(request.url).host)?.host ?? '';
+/** Where a workspace asked `?show=<type>:<id>` opens the record (architecture, "Workspace"): the built workspace page
+ *  that shows that type, its parameter the id; else the one that lists the type; else the workspace's home (its root
+ *  page). Every other parameter a page's path names is the asking page's, and a page that cannot be filled is passed
+ *  over. Undefined when nothing is asked; the path (with no `show`) otherwise. */
+export function shownRecord(url, workspaces, params) {
+    const asked = /^([^:]+):(.+)$/.exec(url.searchParams.get('show') ?? '');
+    if (!asked)
+        return undefined;
+    const [, type, id] = asked;
+    const fill = (path, extra) => {
+        let unfilled = false;
+        const filled = path.replace(/\{([^}]+)\}|<([^>]+)>/g, (_, a, b) => {
+            const v = { ...params, ...extra }[(a ?? b)];
+            if (v === undefined || v === '') {
+                unfilled = true;
+                return '';
+            }
+            return encodeURIComponent(v);
+        });
+        return unfilled ? undefined : filled;
+    };
+    const shows = workspaces.filter((s) => s.shows?.type === type).map((s) => fill(s.path, { [s.shows.param]: id })).find((p) => p !== undefined);
+    const lists = workspaces.filter((s) => s.lists?.includes(type)).map((s) => fill(s.path, {})).find((p) => p !== undefined);
+    const home = workspaces.find((s) => s.path.replace(/\/+$/, '') === '') ? '/' : undefined;
+    return shows ?? lists ?? home ?? url.pathname;
+}
 /** The answer for a path no operation, door or screen serves, and for an operation nothing models: the manifest's
  *  `gap`, its `{method}` and `{path}` filled, else the manifest's not-found refusal. */
 function gapAnswer(m, request, otherMethod = false) {
@@ -125,6 +151,16 @@ async function encoded(m, request, res) {
 /** A pack's HTTP surface, as the kernel serves it from the pack's parts. */
 /** A door's path as it is served and listed: under `/_twin/`, whether the manifest writes the prefix or not. */
 const doorPath = (path) => (path.startsWith('/_twin/') ? path : `/_twin${path.startsWith('/') ? '' : '/'}${path}`);
+/** A request with its path's repeated slashes merged, as a front that merges them routes it (the manifest's
+ *  `mergeSlashes`); one with none is itself. */
+function slashesMerged(request) {
+    const url = new URL(request.url);
+    const merged = url.pathname.replace(/\/{2,}/g, '/');
+    if (merged === url.pathname)
+        return request;
+    url.pathname = merged;
+    return new Request(url, request);
+}
 export function createPackFetch(parts, options = {}) {
     const m = parts.manifest;
     const scope = {
@@ -258,7 +294,7 @@ export function createPackFetch(parts, options = {}) {
         }
     };
     // a context the kernel opens for what no surface operation names: a door, a screen, the clock, the board
-    const open = (request, id, method, path, params) => contextFor(m, { request, operation: { id, method, path, class: method === 'GET' ? 'retrieve' : 'action' }, params }, scope);
+    const open = (request, id, method, path, params, streamed) => contextFor(m, { request, operation: { id, method, path, class: method === 'GET' ? 'retrieve' : 'action' }, params, ...(streamed ? { streamed } : {}) }, scope);
     const advanceClock = async (request) => {
         if (parts.clock)
             await runAsVendorMove(async () => parts.clock(await open(new Request(request.url, m.tenant ? { headers: request.headers } : {}), 'clock', 'POST', '/_twin/clock', {})));
@@ -370,7 +406,7 @@ export function createPackFetch(parts, options = {}) {
             return refusedReadOnly();
         if (parts.clock)
             await runAsVendorMove(async () => parts.clock(await open(new Request(asked.url, m.tenant ? { headers: asked.headers } : {}), 'clock', 'POST', '/_twin/clock', {})));
-        return hit.s.answer(await open(asked, hit.s.decl.id, method, hit.s.decl.path, { ...(hit.s.host(host)?.params ?? {}), ...hit.hit.params }));
+        return hit.s.answer(await open(asked, hit.s.decl.id, method, hit.s.decl.path, { ...(hit.s.host(host)?.params ?? {}), ...hit.hit.params }, true));
     };
     /** A request as the kernel reads it: the headers only the kernel names taken off, its body decoded (undefined when it
      *  does not decode as its Content-Encoding says). */
@@ -393,7 +429,8 @@ export function createPackFetch(parts, options = {}) {
         const readable = await prepared(arrived);
         return readable instanceof Response ? readable : readable ? atContentHost(readable) : undecodable(arrived);
     };
-    const fetch = async (arrived) => {
+    const fetch = async (received) => {
+        const arrived = m.mergeSlashes ? slashesMerged(received) : received;
         redisServiceTimes.lap('1 request made by the stream');
         // the discovery door is the pack's own, whichever lane would take its path
         const asked = new URL(arrived.url).pathname.replace(/\/+$/, '') || '/';
@@ -469,6 +506,9 @@ export function createPackFetch(parts, options = {}) {
         // the vendor's own moves, not the caller's: its context carries none of the request's headers (a Stripe-Account
         // header would make a payout time makes the caller's), but a tenant's, when the vendor keeps tenants apart
         await advanceClock(request);
+        // a reply a session awaits that the World's clock has run out (sockets.ts)
+        if (m.sockets?.length)
+            expireSocketWaits(m.service, options.root);
         if (path.startsWith('/_twin/')) {
             // the World's machine pool, enrolled by the kernel for a vendor that runs images (machines.ts)
             if (m.machines && path === '/_twin/machine-pool' && request.method === 'POST') {
@@ -526,9 +566,12 @@ export function createPackFetch(parts, options = {}) {
             ?? (apiPath ? undefined : hits.find((x) => x.onHost) ?? (addressed ? undefined : hits.find((x) => !rooted(x))
                 ?? (placed ? hits.find((x) => x.s.decl.kind === 'workspace') : undefined)));
         if (byPath) {
+            const asked = byPath.s.decl.kind === 'workspace' && request.method === 'GET' ? shownRecord(url, screens.filter((x) => x.decl.kind === 'workspace').map((x) => x.decl), { ...(byPath.onHost?.params ?? {}), ...byPath.hit.params }) : undefined;
+            if (asked !== undefined && asked !== path)
+                return new Response(null, { status: 302, headers: { location: `${(request.headers.get(TWIN_PREFIX_HEADER) ?? '').replace(/\/+$/, '')}${asked}` } });
             if (readOnly && request.method !== 'GET' && request.method !== 'HEAD')
                 return refusedReadOnly();
-            return byPath.s.answer(await open(request, byPath.s.decl.id, request.method, byPath.s.decl.path, { ...(byPath.onHost?.params ?? {}), ...byPath.hit.params }));
+            return byPath.s.answer(await open(request, byPath.s.decl.id, request.method, byPath.s.decl.path, { ...(byPath.onHost?.params ?? {}), ...byPath.hit.params }, true));
         }
         for (const route of m.machineRoutes ?? []) {
             const host = request.headers.get('x-volter-twin-original-host') ?? new URL(request.url).hostname;
@@ -619,7 +662,7 @@ export function createPackFetch(parts, options = {}) {
     for (const d of m.sockets ?? [])
         if (!parts.sockets?.[d.id])
             throw new Error(`${m.vendor}: the manifest declares the socket ${d.id}, and semantics/sockets.ts exports no ${d.id}`);
-    const ownUpgrade = m.sockets?.length ? socketUpgrade(m.service, options.root, m.sockets, parts.sockets, (request, d) => open(request, `socket:${d.id}`, 'GET', d.path, {}), hostOf, (request) => new URL(routed(request).url).pathname, 
+    const ownUpgrade = m.sockets?.length ? socketUpgrade(m.service, options.root, m.sockets, parts.sockets, (request, d, params) => open(request, `socket:${d.id}`, 'GET', d.path, params), hostOf, (request) => new URL(routed(request).url).pathname, 
     // a turn a session speaks (a voice agent's reply) is the World's scenario's, as a turn over HTTP is
     async (asked) => engineOf()?.serve(asked)) : undefined;
     const upgrade = laneUpgrades(parts.lanes ?? {}, ownUpgrade);

package/dist/src/pack-paths.d.ts

@@ -8,7 +8,8 @@ export declare function installedVendorPacks(from: string, options?: {
 }): Map<string, string>;
 /** Node's nearest installed package, including linked packages and hoisted workspace dependencies. */
 export declare function installedPackageDir(from: string, name: string): string | undefined;
-/** A pack repository itself, or the P3 repository beside a platform checkout. Applications do not acquire a
+/** A pack repository itself, or a platform checkout's P3 repository: the one `VOLTER_PACKS` names (a worktree's own
+ *  pinned packs, as the repository's scripts read it), else the one beside it. Applications do not acquire a
  *  sibling checkout merely because one happens to be beside them. */
 export declare function packRepository(from: string): string | undefined;
 /** Resolve one vendor's package directory for host-side reads (assets, infrastructure launchers). */

package/dist/src/pack-paths.js

@@ -121,7 +121,8 @@ export function installedPackageDir(from, name) {
         dir = up;
     }
 }
-/** A pack repository itself, or the P3 repository beside a platform checkout. Applications do not acquire a
+/** A pack repository itself, or a platform checkout's P3 repository: the one `VOLTER_PACKS` names (a worktree's own
+ *  pinned packs, as the repository's scripts read it), else the one beside it. Applications do not acquire a
  *  sibling checkout merely because one happens to be beside them. */
 export function packRepository(from) {
     let dir = resolve(from);
@@ -129,6 +130,10 @@ export function packRepository(from) {
         if (packageName(dir) === 'twin-packs-p3')
             return dir;
         if (packageName(join(dir, 'packages', 'world-core')) === '@volter/world-core') {
+            const env = globalThis.process?.env?.VOLTER_PACKS;
+            const named = env ? resolve(env) : undefined;
+            if (named && packageName(named) === 'twin-packs-p3')
+                return named;
             const sibling = join(dirname(dir), 'twin-packs-p3');
             if (packageName(sibling) === 'twin-packs-p3')
                 return sibling;

package/dist/src/resource-blob.d.ts

@@ -1,7 +1,11 @@
+import { type BlobWritten } from './blob-store.js';
 /** Read a resource payload at this branch, then its retained ancestors. */
 export declare function readResourceBlob(service: string, key: string, root?: string): Promise<Uint8Array | null>;
 /** Write a resource payload on this branch (a stored object's bytes), where a read finds it first. */
 export declare function writeResourceBlob(service: string, key: string, bytes: Uint8Array, root?: string): Promise<void>;
+/** Write a resource payload on this branch from a body as it arrives (a model's weights, an upload's bytes), kept only
+ *  when `accept` holds for its size and SHA-256 (the blob seam's `writeBlobStream`). True when kept. */
+export declare function writeResourceBlobStream(service: string, key: string, body: ReadableStream<Uint8Array> | AsyncIterable<Uint8Array>, accept: (written: BlobWritten) => boolean, root?: string): Promise<boolean>;
 /** Remove this branch's copy of a resource payload; an ancestor's stays its own (the row that named it is what a
  *  deletion ends). */
 export declare function removeResourceBlob(service: string, key: string, root?: string): Promise<void>;

package/dist/src/resource-blob.js

@@ -1,5 +1,5 @@
 import { isAbsolute, join, relative } from 'node:path';
-import { getActiveBlobStore, readBlobRange } from "./blob-store.js";
+import { getActiveBlobStore, readBlobRange, streamChunks, writeBlobStream } from "./blob-store.js";
 import { readBranchMeta } from "./log.js";
 import { worldPaths } from "./storage.js";
 /** Read a resource payload at this branch, then its retained ancestors. */
@@ -17,6 +17,13 @@ export async function writeResourceBlob(service, key, bytes, root) {
     assertResourceKey(key);
     await getActiveBlobStore().put(resourceBlobFile(worldPaths(service, root).resources, key), bytes);
 }
+/** Write a resource payload on this branch from a body as it arrives (a model's weights, an upload's bytes), kept only
+ *  when `accept` holds for its size and SHA-256 (the blob seam's `writeBlobStream`). True when kept. */
+export async function writeResourceBlobStream(service, key, body, accept, root) {
+    assertResourceKey(key);
+    const chunks = body instanceof ReadableStream ? streamChunks(body) : body;
+    return writeBlobStream(resourceBlobFile(worldPaths(service, root).resources, key), chunks, accept);
+}
 /** Remove this branch's copy of a resource payload; an ancestor's stays its own (the row that named it is what a
  *  deletion ends). */
 export async function removeResourceBlob(service, key, root) {

package/dist/src/runtime.d.ts

@@ -36,8 +36,8 @@ export type { WorldStore, WorldStat, HydrationSource, HydrationSink } from './wo
 export type { CheckLoader } from './head.js';
 export { SqlWorldStore } from './world-store-sql.js';
 export type { SqlExec } from './world-store-sql.js';
-export { FsBlobStore, MemoryBlobStore, blobDigest, getActiveBlobStore, setActiveBlobStore, withBlobStore, readBlobRange, } from './blob-store.js';
-export type { BlobStore } from './blob-store.js';
+export { FsBlobStore, MemoryBlobStore, blobDigest, getActiveBlobStore, setActiveBlobStore, withBlobStore, readBlobRange, streamChunks, writeBlobStream, } from './blob-store.js';
+export type { BlobStore, BlobWritten } from './blob-store.js';
 export { applyTwinWrite, applyTwinWrites, applyTwinWriteAtomic, createTwinServer, CALLER_HEADER, callerForHeader, callerFromHeader, journalTwinRequest, readTwinRequestJournalFrom, type TwinRequestJournalCursor, twinRequestJournalFailures, twinRequestCredentials, readTwinRequestJournal, recordedInput, resolveTwinRead, twinRequestJournalEnabled, twinRequestJournalPath, twinResources, } from './serve.js';
 export type { AtomicTwinWriteDecision, TwinRequestJournalEntry, TwinResource, TwinWriteInput, TwinWriteResult, } from './serve.js';
 export { createTwinProxy } from './proxy.js';
@@ -79,7 +79,7 @@ export { corsHeaders, withCors, type CorsDecl } from './cors.js';
 export { setInProcessTwins, vendorFetch, VendorUnreachableError, type InProcessTwin } from './vendor-call.js';
 export { closeManagedDatabases, databaseSession, EngineDatabaseError, EngineUnavailableError, managedDatabase, quoteIdent, useDatabaseDriver, type DatabaseDriver, type DatabaseSession } from './managed-database.js';
 export type { Batch as EngineBatch, ManagedDatabase, Statement as EngineStatement, StatementResult as EngineStatementResult } from './managed-database.js';
-export { readResourceBlob, readResourceBlobRange, removeResourceBlob, resourceBlobFile, resourceBlobKey, resourceBlobSize, resourceChain, writeResourceBlob } from './resource-blob.js';
+export { readResourceBlob, readResourceBlobRange, removeResourceBlob, resourceBlobFile, resourceBlobKey, resourceBlobSize, resourceChain, writeResourceBlob, writeResourceBlobStream } from './resource-blob.js';
 export { assertStateRemovable, checkParent, stateGeneration, withAncestryLock, withHistoryLock, withHistoryLocks, withStateLock, withStateRemoval } from './ancestry.js';
 export { captureHistory, captureParentHistory, historyChanges, historyAtInstant, historyDigest, historyEntries, historyLength, historyPrefix, inheritedHistory, originHead, publishOriginHistory, readHistoryView } from './history.js';
 export type { HistoryView, HistoryLayout, HistoryReference, HistoryOrigin } from './history.js';

package/dist/src/runtime.js

@@ -54,7 +54,7 @@ export { FsWorldStore, MemoryWorldStore, getActiveWorldStore, setActiveWorldStor
 export { SqlWorldStore } from "./world-store-sql.js";
 // The blob seam (runtime contract R11): byte storage behind byte-carrying handlers, so a
 // serverless namespace puts bytes in object storage while local worlds keep today's layout.
-export { FsBlobStore, MemoryBlobStore, blobDigest, getActiveBlobStore, setActiveBlobStore, withBlobStore, readBlobRange, } from "./blob-store.js";
+export { FsBlobStore, MemoryBlobStore, blobDigest, getActiveBlobStore, setActiveBlobStore, withBlobStore, readBlobRange, streamChunks, writeBlobStream, } from "./blob-store.js";
 export { applyTwinWrite, applyTwinWrites, applyTwinWriteAtomic, createTwinServer, CALLER_HEADER, callerForHeader, callerFromHeader, journalTwinRequest, readTwinRequestJournalFrom, twinRequestJournalFailures, twinRequestCredentials, readTwinRequestJournal, recordedInput, resolveTwinRead, twinRequestJournalEnabled, twinRequestJournalPath, twinResources, } from "./serve.js";
 export { createTwinProxy } from "./proxy.js";
 export { forkTwin, isFork, readForkMeta, } from "./fork.js";
@@ -100,7 +100,7 @@ export { multipartBoundary, multipartParts, multipartEnvelope, inferMultipartBou
 export { corsHeaders, withCors } from "./cors.js";
 export { setInProcessTwins, vendorFetch, VendorUnreachableError } from "./vendor-call.js";
 export { closeManagedDatabases, databaseSession, EngineDatabaseError, EngineUnavailableError, managedDatabase, quoteIdent, useDatabaseDriver } from "./managed-database.js";
-export { readResourceBlob, readResourceBlobRange, removeResourceBlob, resourceBlobFile, resourceBlobKey, resourceBlobSize, resourceChain, writeResourceBlob } from "./resource-blob.js";
+export { readResourceBlob, readResourceBlobRange, removeResourceBlob, resourceBlobFile, resourceBlobKey, resourceBlobSize, resourceChain, writeResourceBlob, writeResourceBlobStream } from "./resource-blob.js";
 export { assertStateRemovable, checkParent, stateGeneration, withAncestryLock, withHistoryLock, withHistoryLocks, withStateLock, withStateRemoval } from "./ancestry.js";
 export { captureHistory, captureParentHistory, historyChanges, historyAtInstant, historyDigest, historyEntries, historyLength, historyPrefix, inheritedHistory, originHead, publishOriginHistory, readHistoryView } from "./history.js";
 export { foldHistory } from "./log.js";

package/dist/src/serve-http.js

@@ -60,6 +60,37 @@ export async function serveHttp(options) {
         // the global `Bun.serve` — the request journal's wrap of it (serve.ts) applies to packs and to
         // this seam alike, so the seam never decorates twice on Bun
         const upgrade = options.upgrade;
+        // the sockets open now, by the seam's own count: Bun keeps a socket its server closed (a refused key's 1008, from
+        // `open` or later) in `pendingWebSockets` after its close handler ran, and `stop()`'s promise then never settles
+        // (measured on Bun 1.3.11, macOS arm64, alone: a Bun.serve whose open() calls ws.close(1008) leaves
+        // pendingWebSockets at 1 with its close handler called once, and an awaited stop(true) had not settled after 3 s;
+        // unawaited, the listener closed and the process used 4 ms of CPU over the next 2 s; a client-initiated close
+        // stops in 0 ms). Conform's life hung on it after OpenAI's keyless Realtime step.
+        // and the requests whose handlers have not answered: a stop that drops connections (closeActive) aborts each one's
+        // signal, and Bun's stop still waits for the handler to settle, which a handler that never answers never does
+        // (measured on Bun 1.3.11, macOS arm64, alone: a Bun.serve whose fetch never resolves, its request's signal aborted
+        // by stop(true), pendingRequests 1, the stop unsettled after 3 s). Conform's client check hung on a pack served with
+        // a scenario that answered nothing. Node's path below reports such a handler as cleanup and resolves; so does this one.
+        const live = new Set();
+        const inflight = new Set();
+        const served = options.fetch;
+        const tracked = (request, ...rest) => {
+            inflight.add(request);
+            let answer;
+            try {
+                answer = served(request, ...rest);
+            }
+            catch (error) {
+                inflight.delete(request);
+                throw error;
+            }
+            if (!(answer instanceof Promise)) {
+                inflight.delete(request);
+                return answer;
+            }
+            return answer.finally(() => { inflight.delete(request); });
+        };
+        options = { ...options, fetch: tracked };
         const server = bun.serve({ ...options, hostname, port: options.port ?? 0,
             ...(upgrade ? {
                 fetch: (request, server) => {
@@ -70,14 +101,33 @@ export async function serveHttp(options) {
                     return options.fetch(request);
                 },
                 websocket: {
-                    open: (peer) => upgrade.open(peer, peer.data.request),
+                    open: (peer) => { live.add(peer); return upgrade.open(peer, peer.data.request); },
                     message: (peer, data) => upgrade.message(peer, data),
-                    close: upgrade.close,
+                    close: (peer, ...rest) => { live.delete(peer); return upgrade.close(peer, ...rest); },
                 },
             } : {}),
         });
         const port = server.port ?? 0;
-        return keepHandler({ hostname, port, url: server.url instanceof URL ? server.url : new URL(`http://${urlHost}:${port}/`), stop: async (closeActive = true) => { await server.stop(closeActive); } }, options.fetch);
+        return keepHandler({ hostname, port, url: server.url instanceof URL ? server.url : new URL(`http://${urlHost}:${port}/`), stop: async (closeActive = true) => {
+                const stopping = Promise.resolve(server.stop(closeActive));
+                // stop closes the sockets still open (closeActive), each a close Bun may then keep counting, and drops the
+                // connections of handlers still running: once every socket the seam opened has closed and every handler left is
+                // one whose request was dropped, Bun's stop would never settle on them (above), and the seam has stopped
+                let settled = false;
+                stopping.then(() => { settled = true; }, () => { settled = true; });
+                while (!settled) {
+                    const orphaned = [...inflight].every((request) => request.signal.aborted);
+                    const counted = (server.pendingWebSockets ?? 0) > 0;
+                    if (live.size === 0 && orphaned && (counted || (closeActive && inflight.size > 0))) {
+                        stopping.catch(() => { });
+                        if (inflight.size)
+                            console.error(`serveHttp: forced stop left pending handler cleanup: ${inflight.size} request(s)`);
+                        return;
+                    }
+                    await new Promise((resolve) => setTimeout(resolve, 10));
+                }
+                await stopping;
+            } }, options.fetch);
     }
     return keepHandler(await serveOnNode({ ...options, hostname, urlHost, fetch: decorate ? decorate(options) : options.fetch }), options.fetch);
 }

package/dist/src/sockets.d.ts

@@ -44,8 +44,11 @@ export type SocketEngine<C> = {
 };
 /** The open sessions of one socket of the vendor in a World (a handler reaches them as `ctx.sockets(id)`). */
 export declare function openSessions(service: string, root: string | undefined, socket: string): SocketSession[];
+/** What a session awaits that the World's clock has run out (a life's `wait` past a relay's timeout), rejected as the
+ *  machine's clock would reject it; called as the vendor serves a request ("A request answered by a session"). */
+export declare function expireSocketWaits(service: string, root: string | undefined): void;
 /** Offer a write to every open session of the vendor, each in its turn after what it is already doing. Queued, never
  *  awaited: the write may be one a session's own frame made, which that session finishes before it is told. */
 export declare function socketWrite(service: string, root: string | undefined, write: EventWrite): void;
 /** The upgrade the serve seam takes: a request to a declared socket's path (and host) opens a session of its engine. */
-export declare function socketUpgrade<C>(service: string, root: string | undefined, decls: ReadonlyArray<SocketDecl>, engines: Record<string, SocketEngine<C>>, context: (request: Request, decl: SocketDecl) => Promise<C>, hostOf: (request: Request) => string, pathOf?: (request: Request) => string, decide?: (asked: unknown) => Promise<ScenarioServed | undefined>): WebSocketUpgrade;
+export declare function socketUpgrade<C>(service: string, root: string | undefined, decls: ReadonlyArray<SocketDecl>, engines: Record<string, SocketEngine<C>>, context: (request: Request, decl: SocketDecl, params: Record<string, string>) => Promise<C>, hostOf: (request: Request) => string, pathOf?: (request: Request) => string, decide?: (asked: unknown) => Promise<ScenarioServed | undefined>): WebSocketUpgrade;