@volter/world-core 3.0.156 → 3.0.158

package/dist/src/derived-real.js

@@ -1,5 +1,5 @@
 import { parseExactJson, exactInteger, compareExactNumbers } from "./exact-json.js";
-import { aliasesFrom, parentEntries, readParentTreeMap, readTree } from "./log.js";
+import { aliasesFrom, parentEntries, readParentTreeMap, readTree, wholeLog } from "./log.js";
 import { storedType } from "./derived-core.js";
 import { verifyEvent } from "./events.js";
 import { hashFieldValue } from "./hash.js";
@@ -210,13 +210,30 @@ function sentTo(m, path, params) {
 const fixedHeaders = (op) => Object.fromEntries(Object.entries(op.headers ?? {}).filter((e) => typeof e[1] === 'string'));
 /** The body as the operation's encoding sends it. */
 function encode(op, body) {
-    if (body === undefined || op.bodyEncoding === 'none')
+    // a body the request carried where the spec declares none (Tinybird's Events API, NDJSON its client sends as text):
+    // the body as recorded, as the vendor read it
+    if (body === undefined)
         return {};
     if (op.bodyEncoding === 'form') {
+        // a form's nested values in the bracket form a form-encoded API reads (`scope[type]=account`, `items[0][price]=…`),
+        // the form the kernel's own parseBracketForm reads back; never a value's JSON text
         const form = new URLSearchParams();
+        const put = (key, v) => {
+            if (v === undefined || v === null)
+                return;
+            if (Array.isArray(v)) {
+                v.forEach((item, i) => put(`${key}[${i}]`, item));
+                return;
+            }
+            if (typeof v === 'object') {
+                for (const [k, x] of Object.entries(v))
+                    put(`${key}[${k}]`, x);
+                return;
+            }
+            form.append(key, String(v));
+        };
         for (const [k, v] of Object.entries(object(body) ?? {}))
-            if (v !== undefined && v !== null)
-                form.set(k, typeof v === 'object' ? JSON.stringify(v) : String(v));
+            put(k, v);
         return { body: form.toString(), type: 'application/x-www-form-urlencoded' };
     }
     return { body: JSON.stringify(body), type: 'application/json' };
@@ -293,9 +310,14 @@ async function graphqlAnswers(m, surface, input, parsed) {
 /** The account a root is, before a perform sends a path naming the World's ("The account a root is"): the World's
  *  account its own doors made, unadopted, adopts the one account the root's credential lists. Read once per deploy (an
  *  adopted account is not asked again); a list the vendor refuses, or one naming several accounts, adopts none. */
+/** The accounts a root's list already named as the World's own (the World's id is the vendor's), by service and root:
+ *  nothing to adopt, so not asked again. */
+const accountsMatched = new Map();
 async function adoptAccount(units, execute, ctx) {
     if (ctx.service === undefined)
         return;
+    const matched = accountsMatched.get(`${ctx.service}\u0000${ctx.root ?? ''}`) ?? new Set();
+    accountsMatched.set(`${ctx.service}\u0000${ctx.root ?? ''}`, matched);
     for (const u of units) {
         const m = u.manifest;
         const decl = m.account ? m.resources[m.account] : undefined;
@@ -305,13 +327,15 @@ async function adoptAccount(units, execute, ctx) {
         const local = readTree(ctx.service, ctx.root).filter((r) => r.type === type && r.deleted !== true && ctx.resolve(type, String(r.id)) === String(r.id));
         const scope = decl.refresh;
         const op = scope && 'list' in scope ? u.surface.operations.find((o) => o.id === scope.list) : undefined;
-        if (!local.length || !op)
+        if (!local.length || !op || local.every((l) => matched.has(`${type}:${String(l.id)}`)))
             continue;
         const answer = await execute({ method: op.method.toUpperCase(), path: sentTo(m, marked(op, `${op.basePath ?? u.surface.basePath ?? ''}${op.path}`), {}), ...(u.lane ? { lane: u.lane } : {}), headers: fixedHeaders(op) });
         if (answer.status >= 400)
             continue;
         const items = itemsOf(op, parse(answer));
         const id = items.length === 1 ? storedIdOf(decl, items[0]) : undefined;
+        if (id !== undefined && local.some((l) => String(l.id) === id))
+            matched.add(`${type}:${id}`);
         if (id === undefined || local.some((l) => String(l.id) === id))
             continue;
         observeResources(ctx.service, [{ type, id, fields: items[0], adopts: String(local[0].id) }], ctx.root !== undefined ? { root: ctx.root } : {});
@@ -548,8 +572,28 @@ function scopeIdOf(scope, fields) {
     const value = field ? at(fields, field) : undefined;
     return value === undefined || value === null || value === '' ? undefined : String(value);
 }
+/** A refresh larger than one window of the vendor's rate budget paces itself: a call the budget refuses before making
+ *  it (RateBudgetError) waits the time the refusal names, at most two minutes a wait, and is made then. The budget is
+ *  never exceeded and no vendor answer is retried; without it a refresh needing more than one window never finishes
+ *  (Slack's, after a deploy spent the window: every rerun refused again from the start). */
+function paced(execute) {
+    return async (request) => {
+        for (let waits = 0;; waits++) {
+            try {
+                return await execute(request);
+            }
+            catch (error) {
+                const wait = error.name === 'RateBudgetError' ? error.retryAfterMs : undefined;
+                if (wait === undefined || wait > 120_000 || waits >= 60)
+                    throw error;
+                await new Promise((done) => setTimeout(done, wait + 250));
+            }
+        }
+    };
+}
 function refreshOf(units, service) {
-    return async (execute, opts) => {
+    return async (unpaced, opts) => {
+        const execute = paced(unpaced);
         const observed = [];
         const complete = [];
         // what the root's credential may not read (a token scoped to some of the account): left as the World holds it, said
@@ -557,6 +601,19 @@ function refreshOf(units, service) {
         let answered = 0;
         for (const { manifest: m, surface, lane } of units) {
             const onLane = lane ? { lane } : {};
+            const tenantBinding = {};
+            if (m.refreshIdentity) {
+                const identity = surface.operations.find(operation => operation.id === m.refreshIdentity.operation);
+                if (!m.tenant || !identity || identity.method !== 'get' || identity.path.includes('{'))
+                    throw new Error(`${m.vendor}: refresh identity needs a parameterless GET and declared tenant field`);
+                const answer = await execute({ method: 'GET', path: `${identity.basePath ?? surface.basePath ?? ''}${identity.path}`, ...onLane, headers: fixedHeaders(identity) });
+                if (answer.status >= 400 || refusedIn(m, parse(answer)))
+                    throw new Error(`${m.vendor}: root account identity refused; nothing folded`);
+                const tenant = at(parse(answer), m.refreshIdentity.field);
+                if (typeof tenant !== 'string' || !tenant)
+                    throw new Error(`${m.vendor}: root account identity is absent; nothing folded`);
+                tenantBinding[m.tenant.field] = tenant;
+            }
             // parents before children, however deep
             const scoped = Object.entries(m.resources).filter(([, d]) => d.refresh && !('none' in d.refresh));
             const depth = (r, seen = new Set()) => { const p = m.resources[r]?.parent?.resource; return p && !seen.has(p) ? 1 + depth(p, seen.add(r)) : 0; };
@@ -565,6 +622,8 @@ function refreshOf(units, service) {
                 const scope = decl.refresh;
                 if ('none' in scope)
                     continue;
+                if (m.refreshIdentity && (!('list' in scope) || 'graphql' in scope))
+                    throw new Error(`${m.vendor}: account-bound refresh requires REST list scopes`);
                 if ('graphql' in scope && scope.graphql) {
                     await refreshGraphql(m, resource, decl, scope, execute, opts.scope, observed, complete);
                     answered += 1;
@@ -582,6 +641,17 @@ function refreshOf(units, service) {
                 if ('get' in scope && scope.known) {
                     const aliases = aliasesFrom(parentEntries(service, opts.root));
                     const held = [...readParentTreeMap(service, opts.root)].filter(([, r]) => r.type === type && r.fields.deleted !== true);
+                    // and each a door made (a person's act on the vendor's site: a group they add the bot to), which the vendor holds
+                    // as the World does though no deploy landed it
+                    const rooted = new Set(held.map(([k]) => k));
+                    const doorMade = new Set(wholeLog(service, opts.root).filter((e) => e.subject.type === type && e.input?.door !== undefined).map((e) => String(e.subject.id)));
+                    for (const r of readTree(service, opts.root)) {
+                        const key = `${type}:${String(r.id)}`;
+                        if (r.type !== type || r.deleted === true || !doorMade.has(String(r.id)) || held.some(([k]) => k === key))
+                            continue;
+                        const { type: _t, id, ...fields } = r;
+                        held.push([key, { type, id: String(id), fields }]);
+                    }
                     const read = [];
                     // a 403 leaves the type as the World holds it, never complete
                     let refused = false;
@@ -606,6 +676,9 @@ function refreshOf(units, service) {
                         const target = marked(op, path);
                         const sent = asked.length ? `${target}${target.includes('?') ? '&' : '?'}${new URLSearchParams(asked)}` : target;
                         const answer = await execute({ method: op.method.toUpperCase(), path: sentTo(m, sent, subject), ...onLane, headers: fixedHeaders(op) });
+                        // a door's subject the vendor does not show the root (another bot's private chat) stays as the World holds it
+                        if (!rooted.has(key) && answer.status >= 400 && answer.status !== 429)
+                            continue;
                         if (answer.status === 401)
                             throw new Error(`401: the vendor refused the root's credential (${op.method.toUpperCase()} ${path}); nothing folded`);
                         if (answer.status === 403) {
@@ -617,7 +690,8 @@ function refreshOf(units, service) {
                             throw new Error(`429: rate limited${answer.headers['retry-after'] ? `, retry after ${answer.headers['retry-after']}s` : ''}`);
                         read.push(String(subject.id));
                         answered += 1;
-                        if (answer.status === 404)
+                        // the vendor's answer for a subject it no longer has: a 404, or the scope's `gone` (Telegram's 400 `chat not found`)
+                        if (answer.status === 404 || (scope.gone && answer.status === scope.gone.status && refusalWords(m, parse(answer)).includes(scope.gone.says)))
                             continue;
                         if (answer.status >= 400 || refusedIn(m, parse(answer)))
                             throw new Error(`${m.vendor}: ${resource} refresh ${op.id} (${op.method.toUpperCase()} ${op.path}): ${answer.status}: ${refusalWords(m, parse(answer))}`);
@@ -674,9 +748,12 @@ function refreshOf(units, service) {
                                 : decl.parent?.params?.length && under ? Object.fromEntries(Object.entries(under.params).filter(([n]) => !op.path.includes(`{${n}}`) && (op.query ?? []).some((x) => x.name === n))) : {};
                             // a list asked by POST carries its parent in its body too, unless the operation reads it from its query
                             const parentInQuery = !rpc || (op.query ?? []).some((x) => x.name === decl.parent?.param);
-                            const q = new URLSearchParams(rpc ? (parentInQuery ? byQuery : {}) : { ...page, ...byQuery });
+                            // a parameter the operation declares in its query, and not its body, goes in the query of a list asked by POST
+                            // too (TikTok's video list: `fields` in the query, its cursor in the body)
+                            const inQuery = (n) => (op.query ?? []).some((x) => x.name === n) && !(op.body ?? []).some((b) => b.name === n);
+                            const q = new URLSearchParams(rpc ? { ...Object.fromEntries(Object.entries(page).filter(([k]) => inQuery(k))), ...(parentInQuery ? byQuery : {}) } : { ...page, ...byQuery });
                             // Fixed parameters and cursors take the operation's body types, not their manifest string encoding.
-                            const typedPage = Object.fromEntries(Object.entries(page).map(([k, v]) => {
+                            const typedPage = Object.fromEntries(Object.entries(page).filter(([k]) => !rpc || !inQuery(k)).map(([k, v]) => {
                                 const type = (op.body ?? []).find((b) => b.name === k)?.type;
                                 const value = type === 'integer' ? exactInteger(v) : type === 'number' ? Number(v)
                                     : type === 'boolean' && (v === 'true' || v === 'false') ? v === 'true' : v;
@@ -739,9 +816,12 @@ function refreshOf(units, service) {
                                     const detail = surface.operations.find((o) => o.id === scope.detail);
                                     if (!detail)
                                         throw new Error(`${m.vendor}: ${resource}'s refresh detail names ${scope.detail}, no operation of the surface`);
-                                    const id = mapId ?? storedIdOf(decl, item);
+                                    const id = mapId ?? storedIdOf(decl, { ...under?.params, ...item });
+                                    // the item's own id names it in the detail's path where its stored id is a composite key (a Cloudflare
+                                    // script stored `<account>/<name>` is read at `/scripts/{script_name}` by its name)
+                                    const own = item[decl.idAs ?? 'id'];
                                     const path = `${detail.basePath ?? surface.basePath ?? ''}${detail.path}`.replace(/\{([^}]+)\}/g, (_, n) => {
-                                        const value = under?.params[n] ?? item[n] ?? id;
+                                        const value = under?.params[n] ?? item[n] ?? (decl.key && (typeof own === 'string' || typeof own === 'number') ? own : id);
                                         if (value === undefined)
                                             throw new Error(`${m.vendor}: ${resource}'s refresh detail has no value for ${n}`);
                                         return encodeURIComponent(String(value));
@@ -766,8 +846,10 @@ function refreshOf(units, service) {
                                 // twin_local_ports) is the answering World's, never the vendor's, and is not folded in
                                 const local = m.worldFields?.[resource] ?? {};
                                 const vendorShape = Object.fromEntries(Object.entries(full).filter(([k]) => !(k in local)));
-                                const fields = { ...vendorShape, ...kept, ...(decl.parent && parent !== undefined ? { [decl.parent.field]: parent } : {}) };
-                                const id = mapId ?? scopeIdOf(scope, fields) ?? storedIdOf(decl, fields);
+                                const fields = { ...vendorShape, ...(!decl.shared ? tenantBinding : {}), ...kept, ...(decl.parent && parent !== undefined ? { [decl.parent.field]: parent } : {}) };
+                                // a key part the item does not carry is the path parameter its parent was listed under (Cloudflare's secret,
+                                // `{account_id}/{script_name}::{name}`, listed as its name and type alone)
+                                const id = mapId ?? scopeIdOf(scope, fields) ?? storedIdOf(decl, { ...under?.params, ...fields });
                                 if (id === undefined)
                                     continue;
                                 observed.push({ type, id, fields: fields });
@@ -856,7 +938,7 @@ function refreshOf(units, service) {
                 // scoped to one resource (`RootConfig.scope`, GitHub's `repos/o/r`) lists only what is under it, so a type with no
                 // parent is never the account's whole list there
                 if (whole && !decl.parent && !opts.scope)
-                    complete.push(type);
+                    complete.push(m.refreshIdentity && m.tenant && !decl.shared ? { type, field: m.tenant.field, within: [String(tenantBinding[m.tenant.field])] } : type);
                 else if (whole && parents.length && decl.parent)
                     complete.push({ type, field: decl.parent.field, within: parents.map((p) => p.value) });
             }
@@ -971,7 +1053,7 @@ async function refreshGraphql(m, resource, decl, scope, execute, rootScope, obse
             const items = listed(value).map(object).filter((x) => x !== undefined);
             for (const item of items) {
                 const fields = { ...item, ...(decl.parent && under ? { [decl.parent.field]: under.value } : {}) };
-                const id = storedIdOf(decl, fields);
+                const id = storedIdOf(decl, { ...under?.params, ...fields });
                 if (id !== undefined)
                     observed.push({ type, id, fields: fields });
             }

package/dist/src/derived.d.ts

@@ -19,6 +19,8 @@ export type DerivedOperation = {
     emptySuccess?: boolean;
     /** a form-encoded operation's number and boolean fields, by bracket path (`items.[].quantity`, `metadata.*`) */
     scalars?: Readonly<Record<string, string | undefined>>;
+    /** a form-encoded operation's string fields that take only listed values, by the same bracket path */
+    enums?: Readonly<Record<string, ReadonlyArray<string>>>;
     /** what the success answer is: a resource, a list of them, and the envelope key holding it */
     answers?: {
         resource: string;
@@ -66,6 +68,9 @@ export type DerivedCall = {
     request: Request;
     operation: DerivedOperation;
     params: Record<string, string>;
+    /** a World screen's call, which no perform sends again: a body in a media type the core does not read (anything
+     *  but JSON, a form, multipart or text) is the handler's alone, left unread and unrecorded, so an upload streams */
+    streamed?: true;
 };
 export declare function bodyTextOf(request: Request): Promise<string>;
 /** The body's text, as JSON, or undefined when it is not JSON; the parse is kept for the first taker. */

package/dist/src/executor.d.ts

@@ -120,6 +120,10 @@ export type TwinAuthStrategy =
         answer: string;
         credential: string;
     };
+    /** The answer's field giving the token's lifetime in seconds (a dotted path; OAuth's `expires_in`): a token held past
+     *  it is exchanged again before the next call. For a vendor that answers an expired token with no `retryOn` status
+     *  (TikTok's API for Business answers HTTP 200 with a code), and so a long-lived process never sends a dead token. */
+    expiresIn?: string;
 };
 /** Throws with the precise refusal; returns the parsed URL when the origin is usable. */
 export declare function validateRemoteOrigin(origin: string, opts?: {
@@ -132,10 +136,13 @@ export declare function validateRemoteOrigin(origin: string, opts?: {
  *  refused, as before. */
 /** Where a credential is kept (the head's and refresh's root: head.ts rootCustody): `key` names the credential stably
  *  across rotations and anew when another is sealed in its place (the token cache is keyed by it, not by the secret's value), `open` reads it as sealed now, `seal` keeps a rotated one. */
+/** `unsealed`: where a rotation the seal failed to keep is recorded durably (the field and the cause, never a value), since
+ *  the root cannot renew once the process holding the new secret ends; a later successful seal clears it. */
 export type CredentialCustody = {
     key: string;
     open: () => Promise<CredentialPayload>;
     seal: (credential: CredentialPayload) => Promise<void> | void;
+    unsealed?: (field: string, cause: string) => void;
 };
 /** `vendor`: the vendor whose rate budget every call is charged to (D8): the call is priced and reserved before it is
  *  made, refused when the budget is spent, and settled with the vendor's answer (its back-off honoured). */

package/dist/src/executor.js

@@ -365,6 +365,7 @@ function exchangeExecute(origin, sealed, auth, vendorHosts, custody) {
         return held;
     };
     const key = custody ? `${origin.href}\n${custody.key}` : `${origin.href}\n${JSON.stringify(sealed)}`;
+    let expiresAt;
     const exchange = async () => {
         // a rotating secret is read as kept NOW (another executor or process may have rotated it since this one was
         // built), or as this process holds it when its seal failed and the file still holds the spent value. Two
@@ -409,6 +410,11 @@ function exchangeExecute(origin, sealed, auth, vendorHosts, custody) {
             const code = parsed && typeof parsed === 'object' ? parsed.error : undefined;
             throw new Error(`remote execute: the token exchange answered no \`${auth.token}\`${typeof code === 'string' && code !== '' ? ` (${code.slice(0, 120)})` : ''}`);
         }
+        if (auth.expiresIn) {
+            const seconds = Number(auth.expiresIn.split('.').reduce((at, k) => (at && typeof at === 'object' ? at[k] : undefined), parsed));
+            // a minute short of the stated lifetime, so a call in flight never carries a token that dies on the way
+            expiresAt = Number.isFinite(seconds) && seconds > 0 ? Date.now() + Math.max(0, seconds - 60) * 1000 : undefined;
+        }
         if (auth.rotate) {
             const next = auth.rotate.answer.split('.').reduce((at, k) => (at && typeof at === 'object' ? at[k] : undefined), parsed);
             if (typeof next === 'string' && next !== '' && next !== credential[auth.rotate.credential]) {
@@ -423,6 +429,10 @@ function exchangeExecute(origin, sealed, auth, vendorHosts, custody) {
                     }
                     catch (error) {
                         unsealedRotations.set(key, { replaced, credential });
+                        try {
+                            custody.unsealed?.(auth.rotate.credential, error instanceof Error ? error.message : String(error));
+                        }
+                        catch { /* the stderr line below still says it */ }
                         console.error(`remote execute: the vendor rotated \`${auth.rotate.credential}\` and sealing the new one failed (${error instanceof Error ? error.message : String(error)}); this process holds it until a seal succeeds`);
                     }
                 }
@@ -432,12 +442,16 @@ function exchangeExecute(origin, sealed, auth, vendorHosts, custody) {
     };
     const current = () => {
         let held = exchangedTokens.get(key);
+        if (held?.expiresAt !== undefined && Date.now() >= held.expiresAt) {
+            exchangedTokens.delete(key);
+            held = undefined;
+        }
         if (!held) {
             const token = exchange();
             held = { token };
             exchangedTokens.set(key, held);
             const entry = held;
-            token.catch(() => { if (exchangedTokens.get(key) === entry)
+            token.then(() => { entry.expiresAt = expiresAt; }, () => { if (exchangedTokens.get(key) === entry)
                 exchangedTokens.delete(key); });
         }
         return held;

package/dist/src/git/lfs.d.ts

@@ -4,9 +4,17 @@ export type LfsObject = {
     size: number | string;
 };
 /** Where a pack keeps its objects: by oid. */
+/** Where a server keeps its LFS objects: an object's size when it holds one (the batch API answers from it, never
+ *  loading the object), and the store an upload's verified bytes go to. */
 export type LfsStore = {
-    get(oid: string): Promise<Uint8Array | null>;
+    size(oid: string): Promise<number | null>;
     put(oid: string, bytes: Uint8Array): Promise<void>;
+    /** an upload's body written as it arrives and kept only when `accept` holds for its size and SHA-256 (`ctx.blobs.putStream`):
+     *  a store with it never holds an object whole */
+    putStream?(oid: string, chunks: AsyncIterable<Uint8Array>, accept: (written: {
+        size: number;
+        sha256: string;
+    }) => boolean): Promise<boolean>;
 };
 /** A pointer file's object (`version https://git-lfs.github.com/spec/v1`, `oid sha256:<hex>`, `size <n>`), or null
  *  for any other file. */
@@ -24,5 +32,7 @@ export declare function lfsBatch(body: unknown, opts: {
     header?: Record<string, string>;
 }): Promise<Response>;
 /** A basic transfer's upload (`PUT` of the object's bytes): kept when they hash to the oid and have the declared size
- *  (the size is the request's Content-Length when the caller has no other), else refused and nothing kept. */
-export declare function lfsUpload(bytes: Uint8Array, o: LfsObject, store: LfsStore): Promise<Response>;
+ *  (the size is the request's Content-Length when the caller has no other), else refused and nothing kept. A body
+ *  stream goes to the store's `putStream` as it arrives, read no further than the declared size; bytes, or a store
+ *  without one, are checked whole. */
+export declare function lfsUpload(body: Uint8Array | ReadableStream<Uint8Array> | null, o: LfsObject, store: LfsStore): Promise<Response>;

package/dist/src/git/lfs.js

@@ -46,22 +46,54 @@ export async function lfsBatch(body, opts) {
             objects.push({ ...o, error: { code: 422, message: 'Invalid object' } });
             continue;
         }
-        const held = await opts.store.get(o.oid);
+        const held = await opts.store.size(o.oid);
         if (operation === 'upload') {
-            objects.push(held ? { ...o, authenticated: true } : { ...o, authenticated: true, actions: { upload: { href: opts.href('upload', o), ...(opts.header ? { header: opts.header } : {}), expires_in: 3600 } } });
+            objects.push(held !== null ? { ...o, authenticated: true } : { ...o, authenticated: true, actions: { upload: { href: opts.href('upload', o), ...(opts.header ? { header: opts.header } : {}), expires_in: 3600 } } });
         }
         else {
             // source: https://github.com/git-lfs/git-lfs/blob/main/docs/api/batch.md "The object does not exist on the server."
-            objects.push(held ? { oid: o.oid, size: held.length, authenticated: true, actions: { download: { href: opts.href('download', o), ...(opts.header ? { header: opts.header } : {}), expires_in: 3600 } } } : { ...o, error: { code: 404, message: 'Object does not exist' } });
+            objects.push(held !== null ? { oid: o.oid, size: held, authenticated: true, actions: { download: { href: opts.href('download', o), ...(opts.header ? { header: opts.header } : {}), expires_in: 3600 } } } : { ...o, error: { code: 404, message: 'Object does not exist' } });
         }
     }
     return lfsJson(200, { transfer: 'basic', objects, hash_algo: 'sha256' });
 }
 /** A basic transfer's upload (`PUT` of the object's bytes): kept when they hash to the oid and have the declared size
- *  (the size is the request's Content-Length when the caller has no other), else refused and nothing kept. */
-export async function lfsUpload(bytes, o, store) {
-    if (bytes.length !== o.size || (await lfsOid(bytes)) !== o.oid)
-        return lfsJson(422, { message: `the object's bytes do not match ${o.oid} (${o.size} bytes)` });
-    await store.put(o.oid, bytes);
-    return new Response(null, { status: 200 });
+ *  (the size is the request's Content-Length when the caller has no other), else refused and nothing kept. A body
+ *  stream goes to the store's `putStream` as it arrives, read no further than the declared size; bytes, or a store
+ *  without one, are checked whole. */
+export async function lfsUpload(body, o, store) {
+    const refused = () => lfsJson(422, { message: `the object's bytes do not match ${o.oid} (${o.size} bytes)` });
+    if (body instanceof Uint8Array || body === null || !store.putStream) {
+        const bytes = body instanceof Uint8Array ? body : new Uint8Array(body === null ? new ArrayBuffer(0) : await new Response(body).arrayBuffer());
+        if (bytes.length !== o.size || (await lfsOid(bytes)) !== o.oid)
+            return refused();
+        await store.put(o.oid, bytes);
+        return new Response(null, { status: 200 });
+    }
+    const declared = Number(o.size);
+    let over = false;
+    async function* upTo(stream) {
+        const reader = stream.getReader();
+        let read = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    return;
+                read += value.byteLength;
+                // a body longer than declared is refused without reading the rest of it
+                if (read > declared) {
+                    over = true;
+                    await reader.cancel();
+                    return;
+                }
+                yield value;
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+    const kept = await store.putStream(o.oid, upTo(body), (w) => !over && w.size === declared && w.sha256 === o.oid);
+    return kept ? new Response(null, { status: 200 }) : refused();
 }

package/dist/src/head.d.ts

@@ -72,6 +72,8 @@ export declare function openRootCredential(root: BoundRoot, vendor?: string): Pr
  *  fingerprint, and a new one per grant would start the ledger over), and rotatedAt says when. `source` is the record
  *  the rotation began from: if another credential was set meanwhile, the rotation is dropped, never written over it. */
 export declare function resealRootCredential(root: BoundRoot, payload: CredentialPayload, vendor?: string, source?: string | null): Promise<void>;
+/** Beside a root's credential, the record of a rotation its seal failed to keep (`rootCustody`'s `unsealed`). */
+export declare function unsealedMarkerOf(root: BoundRoot): string;
 /** The root's custody for an exchange that rotates: the credential as sealed now, and the seal of a rotated one, which
  *  lands only over the record that was opened. */
 export declare function rootCustody(root: BoundRoot, vendor?: string): CredentialCustody;

package/dist/src/head.js

@@ -136,7 +136,10 @@ export async function resealRootCredential(root, payload, vendor = vendorOf(root
     if (store.read(root.credential) !== held)
         throw new Error(`the ${vendor} credential was set again while it rotated: the rotation is dropped`);
     store.write(root.credential, `${JSON.stringify({ ...sealed, ...(before ? { fingerprint: before.fingerprint } : {}), rotatedAt: now }, null, 2)}\n`, { secret: true });
+    store.remove(unsealedMarkerOf(root));
 }
+/** Beside a root's credential, the record of a rotation its seal failed to keep (`rootCustody`'s `unsealed`). */
+export function unsealedMarkerOf(root) { return root.credential.replace(/\.json$/, '.unsealed.json'); }
 /** The root's custody for an exchange that rotates: the credential as sealed now, and the seal of a rotated one, which
  *  lands only over the record that was opened. */
 export function rootCustody(root, vendor = vendorOf(root)) {
@@ -155,6 +158,9 @@ export function rootCustody(root, vendor = vendorOf(root)) {
             return opened.payload;
         },
         seal: (credential) => resealRootCredential(root, credential, vendor, source),
+        // the vendor already spent the sealed secret: until a seal lands, the root renews only inside the process holding the
+        // new one, so the World keeps a record a person or `doctor` can read after that process ends
+        unsealed: (field, cause) => store.write(unsealedMarkerOf(root), `${JSON.stringify({ vendor, field, at: new Date().toISOString(), cause: cause.slice(0, 300) }, null, 2)}\n`),
     };
 }
 /** The vendor a root belongs to: its credential is sealed under the vendor's name. */

package/dist/src/index.d.ts

@@ -80,3 +80,4 @@ export { browserSessionToken, startBrowserSession, endBrowserSession } from './b
 export { readHostPort } from './host-port.js';
 export { assertBrowserName, browserOrigin, validateBrowserState, validateBrowserStorageState, validateBrowserContext, browserAcceptLanguage, cookieMatchesHost, type BrowserCookie, type BrowserState, type BrowserStorageState, type BrowserContext, type BrowserIndexedDB } from './browser-state.js';
 export * as managedOriginalInputs from './managed-original-inputs.js';
+export * as managedGoPrograms from './managed-go-programs.js';

package/dist/src/index.js

@@ -72,3 +72,4 @@ export { browserSessionToken, startBrowserSession, endBrowserSession } from "./b
 export { readHostPort } from "./host-port.js";
 export { assertBrowserName, browserOrigin, validateBrowserState, validateBrowserStorageState, validateBrowserContext, browserAcceptLanguage, cookieMatchesHost } from "./browser-state.js";
 export * as managedOriginalInputs from "./managed-original-inputs.js";
+export * as managedGoPrograms from "./managed-go-programs.js";

package/dist/src/live/ingest.js

@@ -25,7 +25,6 @@ export function liveIngest(options) {
         let priorInit;
         let started = false;
         let metadata;
-        let refusedCodec;
         const recording = () => {
             const row = store.rows(LIVE).find((r) => r.id === stream);
             return recordingOf(row, segmentsOf(store, stream));
@@ -116,7 +115,12 @@ export function liveIngest(options) {
                         app: ask.app, key: ask.key, state: 'publishing', startedAt: typeof prior?.startedAt === 'string' ? prior.startedAt : now, endedAt: null,
                         publishes: Number(prior?.publishes ?? 0) + 1, window: ruling.window ?? 6, segmentSeconds: ruling.segmentSeconds ?? 2, ...(ruling.retain !== undefined ? { retain: ruling.retain } : {}),
                     }, 'live.publish'));
+                    // Every admitted publish has its own encoder and hook state. Continuation comes from the recording above,
+                    // including on a connection reused after FCUnpublish, never from the prior publish's in-memory state.
+                    initIndex = -1;
                     priorInit = last?.init;
+                    started = false;
+                    metadata = undefined;
                     segmenter = new Segmenter({ targetMs: Math.max(0.5, ruling.segmentSeconds ?? 2) * 1000, offsetMs, firstSequence: last ? last.seq + 1 : 0 });
                     stream = named;
                     admitted = ruling;
@@ -137,12 +141,8 @@ export function liveIngest(options) {
                 if (!segmenter)
                     return;
                 const tag = readVideoTag(payload);
-                if (tag.kind === 'unsupported') {
-                    if (refusedCodec !== tag.codec)
-                        log(`${stream}: ${tag.codec} video is not recorded (H.264 is)`);
-                    refusedCodec = tag.codec;
-                    return;
-                }
+                if (tag.kind === 'unsupported')
+                    throw new RtmpRefusal('NetStream.Failed', `${tag.codec} video is not supported; publish H.264.`);
                 const s = segmenter;
                 if (tag.kind === 'config')
                     await keepAll(s.videoConfig(tag.config));
@@ -153,12 +153,8 @@ export function liveIngest(options) {
                 if (!segmenter)
                     return;
                 const tag = readAudioTag(payload);
-                if (tag.kind === 'unsupported') {
-                    if (refusedCodec !== tag.codec)
-                        log(`${stream}: ${tag.codec} audio is not recorded (AAC is)`);
-                    refusedCodec = tag.codec;
-                    return;
-                }
+                if (tag.kind === 'unsupported')
+                    throw new RtmpRefusal('NetStream.Failed', `${tag.codec} audio is not supported; publish AAC.`);
                 const s = segmenter;
                 if (tag.kind === 'config')
                     await keepAll(s.audioConfig(tag.config));

package/dist/src/live/rtmp.js

@@ -98,6 +98,9 @@ export function rtmpSession(sink, publisher, log = () => { }) {
         chunks.clear();
         current = undefined;
         held = 0;
+        // A refused/ended transport owns the publish's cleanup too. An admission already awaiting the dialect settles
+        // first; messages queued behind the refusal cannot admit a new publish on the closed connection.
+        chain = chain.then(() => stop()).catch((error) => log(`the publish's end failed: ${String(error?.message ?? error)}`));
         try {
             sink.end();
         }
@@ -165,6 +168,7 @@ export function rtmpSession(sink, publisher, log = () => { }) {
                     close();
                     return;
                 }
+                ended = false;
                 publishing = true;
                 publishStream = stream;
                 // user control StreamBegin (event 0) for the publish's stream, then its start
@@ -281,7 +285,7 @@ export function rtmpSession(sink, publisher, log = () => { }) {
             overrun(`more than ${MAX_QUEUED} bytes of messages wait to be recorded`);
             return;
         }
-        chain = chain.then(() => (phase === 'closed' && message.type !== 20 ? undefined : onMessage(message))).catch((error) => {
+        chain = chain.then(() => (phase === 'closed' ? undefined : onMessage(message))).catch((error) => {
             log(`a message failed: ${String(error?.message ?? error)}`);
             close();
         }).finally(() => { queued -= payload.length; });
@@ -447,10 +451,8 @@ export function rtmpSession(sink, publisher, log = () => { }) {
         // message's bytes are not in it: only more bytes finish it, and what it may hold is bounded (MAX_HELD)
         backlog: () => queued + pending.length,
         close() {
-            clearTimeout(deadline);
-            // the connection ended: a publish still open ends with it, after every message already read
-            chain = chain.then(() => stop()).catch((error) => log(`the publish's end failed: ${String(error?.message ?? error)}`));
-            phase = 'closed';
+            // Peer close and server refusal share one end, after any admission or write already under way settles.
+            close();
         },
     };
 }

package/dist/src/live/segmenter.js

@@ -39,14 +39,20 @@ export class Segmenter {
         this.avc = config;
         this.freshInit = true;
         this.keyed = false;
+        this.unkeyedSince = undefined;
         return out;
     }
     audioConfig(config) {
         if (this.aac && same(this.aac.asc, config.asc))
             return [];
-        const out = this.aac ? this.flush() : [];
+        const out = this.flush();
         this.aac = config;
         this.freshInit = true;
+        // A configuration boundary has no running video segment. Its first frame must be a new keyframe, and the
+        // audio sample clock belongs to the new configuration (which may have a different sample rate).
+        this.keyed = false;
+        this.unkeyedSince = undefined;
+        this.audioNext = undefined;
         return out;
     }
     /** A video frame at its decode time: the segment it closes, if it closes one. */

package/dist/src/machines.js

@@ -14,6 +14,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 // is reached only when a compute pool is asked to act. The light pool delegates to the host's Substrate adapter.
 import { refuseReadOnlyWrite } from "./request-scope.js";
 import { nodeBuiltin } from "./serve-http.js";
+import { refuseRequiredMachineTransport } from '../required-credential-transport.cjs';
 /** A declared compute capability gap, distinct from a failed admitted guest. */
 export function isMachineCapabilityGap(error) {
     return typeof error === 'object' && error !== null && 'code' in error && error.code === 'WORLD_MACHINE_CAPABILITY_GAP';
@@ -60,6 +61,7 @@ function dockerPool(world) {
     });
     return {
         kind: 'docker',
+        async admitRun() { refuseRequiredMachineTransport(process.env, 'Docker machine application transport'); },
         async status(name) {
             const state = JSON.parse(await docker(['inspect', '--format', '{{json .State}}', containerName(world, name)]));
             return state.Running ? { state: 'started' } : { state: 'exited', exitCode: state.ExitCode, ...(state.Error ? { reason: state.Error } : {}) };
@@ -67,6 +69,7 @@ function dockerPool(world) {
         async ports() { throw new Error('port discovery requires the light guest backing'); },
         async files() { throw new Error('file access requires the light guest backing'); },
         async run(spec) {
+            refuseRequiredMachineTransport(process.env, 'Docker machine application transport');
             const name = containerName(world, spec.name);
             await docker(['rm', '-f', name]).catch(() => undefined);
             const env = Object.entries(spec.env ?? {}).flatMap(([k, v]) => ['-e', `${k}=${v}`]);
@@ -80,6 +83,7 @@ function dockerPool(world) {
             return { ports: published };
         },
         async exec(name, spec) {
+            refuseRequiredMachineTransport(process.env, 'Docker machine exec transport');
             const { spawn } = nodeBuiltin('node:child_process');
             const env = Object.entries(spec.env ?? {}).flatMap(([k, v]) => ['-e', `${k}=${v}`]);
             // the shell names its own pid first, then becomes the process: its pid is the process's
@@ -165,7 +169,7 @@ function dockerPool(world) {
             return fetch(`http://127.0.0.1:${host}${source.pathname}${source.search}`, { method: request.method, headers, body, redirect: 'manual', signal: request.signal });
         },
         async pause(name) { await docker(['pause', containerName(world, name)]); },
-        async resume(name) { await docker(['unpause', containerName(world, name)]); },
+        async resume(name) { refuseRequiredMachineTransport(process.env, 'Docker machine resume transport'); await docker(['unpause', containerName(world, name)]); },
         async stop(name) { await docker(['stop', containerName(world, name)]).catch(() => undefined); },
         async remove(name) { await docker(['rm', '-f', containerName(world, name)]).catch(() => undefined); },
     };